- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] Fix CVE-2024-46826
by Gu Bowen 11 Oct '24

11 Oct '24

Fix CVE-2024-46826 Alexey Dobriyan (1): ELF: fix kernel.randomize_va_space double read Gu Bowen (1): ELF: Fix mixed declarations and code of "snapshot_randomize_va_space" fs/binfmt_elf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 20512/23827] drivers/md/md.o: warning: objtool: md_seq_show()+0x1087: unreachable instruction
by kernel test robot 11 Oct '24

11 Oct '24

Hi Logan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: a89f484219c9ea217d26908f16037d1ab55d4f17 [20512/23827] md: Ensure resync is reported after it starts config: x86_64-randconfig-001-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111657.HXras3Wj-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111657.HXras3Wj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111657.HXras3Wj-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/md/md.c:49: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/md.c:320:6: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 320 | int cpu; | ^ drivers/md/md.c:2231:24: warning: variable 'bi_rdev' set but not used [-Wunused-but-set-variable] 2231 | struct blk_integrity *bi_rdev; | ^ 3 warnings generated. >> drivers/md/md.o: warning: objtool: md_seq_show()+0x1087: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1 0/2] bugfix for cgroup steal task
by Cheng Yu 11 Oct '24

11 Oct '24

bugfix for cgroup steal task Cheng Yu (2): sched/fair: Fix the condition in overload_clear sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug kernel/sched/debug.c | 10 +++++----- kernel/sched/fair.c | 7 +++---- 2 files changed, 8 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 V1 1/2] sched/fair: Fix the condition in overload_clear
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQWPQ ----------------------------------------- In the overload_clear function, there is a bug when setting the overload_cpus, that is, when the steal_task feature is globally enabled and rq->cfs.h_nr_running is less than 2, the need_clear should be set to true. Fixes: 433c0b725642 ("sched/fair: Count the number of tasks marked as steal_task on cfs_rq") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 38841d1d640a..a518d636f07f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -4492,11 +4492,10 @@ static void overload_clear(struct rq *rq) if (!steal_enabled()) return; - if (!group_steal_used() && rq->cfs.h_nr_running >= 2) - return; + if (rq->cfs.h_nr_running < 2) + need_clear = true; - if (group_steal_used() && - (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) + if (group_steal_used() && rq->cfs.steal_h_nr_running < 1) need_clear = true; if (!need_clear) -- 2.25.1

2 1

[openeuler:OLK-6.6 777/14350] arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B
by kernel test robot 11 Oct '24

11 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: db5bb24abc8dd120fd81b7ce21819e96578d011e [777/14350] LoongArch: Old BPI compatibility config: loongarch-randconfig-r062-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111529.bqXXUCAv-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111529.bqXXUCAv-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B vim +439 arch/loongarch/kernel/legacy_boot.c 423 424 static struct fwnode_handle * __init parse_isa_base(u64 *cpu_addr) 425 { 426 struct device_node *np; 427 const __be32 *ranges = NULL; 428 int len; 429 struct device_node *node; 430 431 for_each_node_by_name(np, "isa") { 432 node = of_node_get(np); 433 434 if (!node) 435 break; 436 437 ranges = of_get_property(node, "ranges", &len); 438 > 439 if (!ranges || (ranges && len > 0)) 440 break; 441 } 442 if (ranges) { 443 ranges += 2; 444 *cpu_addr = of_translate_address(np, ranges); 445 return &np->fwnode; 446 } 447 448 return NULL; 449 } 450 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1 2/2] sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQWPQ ----------------------------------------- It would be more practical to put the statistics of h_nr_running and steal_h_nr_running in the per-cpu column. Fixes: 1f9456c873b7 ("sched/debug: Add h_nr_running/steal_h_nr_running in sched_debug") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/debug.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index ff2d6dc59c14..4275398bc713 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -594,11 +594,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq) SEQ_printf(m, " .%-30s: %d\n", "nr_spread_over", cfs_rq->nr_spread_over); SEQ_printf(m, " .%-30s: %d\n", "nr_running", cfs_rq->nr_running); -#ifdef CONFIG_SCHED_STEAL - SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", cfs_rq->h_nr_running); - SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", - cfs_rq->steal_h_nr_running); -#endif SEQ_printf(m, " .%-30s: %ld\n", "load", cfs_rq->load.weight); #ifdef CONFIG_SMP SEQ_printf(m, " .%-30s: %lu\n", "load_avg", @@ -714,6 +709,11 @@ do { \ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", #x, SPLIT_NS(rq->x)) P(nr_running); +#ifdef CONFIG_SCHED_STEAL + SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", rq->cfs.h_nr_running); + SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", + rq->cfs.steal_h_nr_running); +#endif P(nr_switches); P(nr_uninterruptible); PN(next_balance); -- 2.25.1

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f7c1291d7c3f15bc448cd93e29fa539386fe85fe
by kernel test robot 11 Oct '24

11 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f7c1291d7c3f15bc448cd93e29fa539386fe85fe !12080 btrfs: clean up our handling of refs == 0 in snapshot delete Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410101809.HFdpybos-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410111205.LRqw3beL-lkp@intel.com drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module' ld.lld: error: undefined symbol: arch_elf_adjust_prot Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-004-20241010 | `-- ld.lld:error:undefined-symbol:arch_elf_adjust_prot |-- loongarch-allmodconfig | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-001-20241011 | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-002-20241011 | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-r062-20241011 | `-- arch-loongarch-kernel-legacy_boot.c:WARNING-A-A-B-is-equivalent-to-A-B |-- x86_64-allyesconfig | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-buildonly-randconfig-003-20241011 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-tdm-dev.c:error:incomplete-definition-of-type-struct-module | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-func | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-kselftests | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst `-- x86_64-rhel-8.3-rust |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst elapsed time: 1257m configs tested: 32 configs skipped: 133 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241011 gcc-14.1.0 arm64 randconfig-002-20241011 clang-20 arm64 randconfig-003-20241011 clang-20 arm64 randconfig-004-20241011 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20241011 gcc-14.1.0 loongarch randconfig-002-20241011 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241011 gcc-12 x86_64 buildonly-randconfig-002-20241011 gcc-12 x86_64 buildonly-randconfig-003-20241011 clang-18 x86_64 buildonly-randconfig-004-20241011 clang-18 x86_64 buildonly-randconfig-005-20241011 gcc-12 x86_64 buildonly-randconfig-006-20241011 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20241011 clang-18 x86_64 randconfig-002-20241011 gcc-11 x86_64 randconfig-003-20241011 gcc-12 x86_64 randconfig-004-20241011 gcc-12 x86_64 randconfig-005-20241011 clang-18 x86_64 randconfig-006-20241011 clang-18 x86_64 randconfig-011-20241011 gcc-12 x86_64 randconfig-012-20241011 clang-18 x86_64 randconfig-013-20241011 gcc-11 x86_64 randconfig-014-20241011 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-46858
by Wang Liang 11 Oct '24

11 Oct '24

Davide Caratti (1): mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer Edward Adam Davis (1): mptcp: pm: Fix uaf in __timer_delete_sync Geliang Tang (1): mptcp: export lookup_anno_list_by_saddr net/mptcp/options.c | 2 +- net/mptcp/pm_netlink.c | 27 ++++++++++++++++----------- net/mptcp/protocol.h | 5 ++++- 3 files changed, 21 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] net: dpaa: Pad packets to ETH_ZLEN
by Wang Liang 11 Oct '24

11 Oct '24

From: Sean Anderson <sean.anderson(a)linux.dev> mainline inclusion from mainline-v6.11 commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9O1 CVE: CVE-2024-46854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running $ ping -s 11 destination Fixes: 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240910143144.1439910-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c index cb7c028b1bf5..638dd56bbc5e 100644 --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c @@ -2147,12 +2147,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); - bool nonlinear = skb_is_nonlinear(skb); struct rtnl_link_stats64 *percpu_stats; struct dpaa_percpu_priv *percpu_priv; struct netdev_queue *txq; struct dpaa_priv *priv; struct qm_fd fd; + bool nonlinear; int offset = 0; int err = 0; @@ -2162,6 +2162,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) qm_fd_clear_fd(&fd); + /* Packet data is always read as 32-bit words, so zero out any part of + * the skb which might be sent if we have to pad the packet + */ + if (__skb_put_padto(skb, ETH_ZLEN, false)) + goto enomem; + + nonlinear = skb_is_nonlinear(skb); if (!nonlinear) { /* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: nft_socket: fix sk refcount leaks
by Wang Liang 11 Oct '24

11 Oct '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.11 commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9K2 CVE: CVE-2024-46855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must put 'sk' reference before returning. Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_socket.c [conflicts due to not mergered e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nft_socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c index f6d517185d9c..151cd2fc0765 100644 --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -88,13 +88,13 @@ static void nft_socket_eval(const struct nft_expr *expr, *dest = sk->sk_mark; } else { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } break; case NFT_SOCKET_WILDCARD: if (!sk_fullsock(sk)) { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } nft_socket_wildcard(pkt, regs, sk, dest); break; @@ -103,6 +103,7 @@ static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } +out_put_sk: if (sk != skb->sk) sock_gen_put(sk); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] CVE-2024-46858
by Wang Liang 11 Oct '24

11 Oct '24

Davide Caratti (1): mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer Edward Adam Davis (1): mptcp: pm: Fix uaf in __timer_delete_sync Geliang Tang (1): mptcp: export lookup_anno_list_by_saddr net/mptcp/options.c | 2 +- net/mptcp/pm_netlink.c | 27 ++++++++++++++++----------- net/mptcp/protocol.h | 5 ++++- 3 files changed, 21 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] net: dpaa: Pad packets to ETH_ZLEN
by Wang Liang 11 Oct '24

11 Oct '24

From: Sean Anderson <sean.anderson(a)linux.dev> mainline inclusion from mainline-v6.11 commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9O1 CVE: CVE-2024-46854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running $ ping -s 11 destination Fixes: 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240910143144.1439910-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c index cb7c028b1bf5..638dd56bbc5e 100644 --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c @@ -2147,12 +2147,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); - bool nonlinear = skb_is_nonlinear(skb); struct rtnl_link_stats64 *percpu_stats; struct dpaa_percpu_priv *percpu_priv; struct netdev_queue *txq; struct dpaa_priv *priv; struct qm_fd fd; + bool nonlinear; int offset = 0; int err = 0; @@ -2162,6 +2162,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) qm_fd_clear_fd(&fd); + /* Packet data is always read as 32-bit words, so zero out any part of + * the skb which might be sent if we have to pad the packet + */ + if (__skb_put_padto(skb, ETH_ZLEN, false)) + goto enomem; + + nonlinear = skb_is_nonlinear(skb); if (!nonlinear) { /* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nft_socket: fix sk refcount leaks
by Wang Liang 11 Oct '24

11 Oct '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.11 commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9K2 CVE: CVE-2024-46855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must put 'sk' reference before returning. Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_socket.c [conflicts due to not mergered e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nft_socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c index 826e5f8c78f3..07e73e50b713 100644 --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -88,13 +88,13 @@ static void nft_socket_eval(const struct nft_expr *expr, *dest = sk->sk_mark; } else { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } break; case NFT_SOCKET_WILDCARD: if (!sk_fullsock(sk)) { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } nft_socket_wildcard(pkt, regs, sk, dest); break; @@ -103,6 +103,7 @@ static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } +out_put_sk: if (sk != skb->sk) sock_gen_put(sk); } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 9b2f1457c730cd7915663ac5d9ccb849f2657714
by kernel test robot 11 Oct '24

11 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 9b2f1457c730cd7915663ac5d9ccb849f2657714 !12071 btrfs: clean up our handling of refs == 0 in snapshot delete Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20241011 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-002-20241011 | `-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay |-- arm64-randconfig-003-20241011 | `-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) |-- arm64-randconfig-004-20241011 | |-- include-linux-uaccess.h:warning:bind-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kmask-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:p-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:params-may-be-used-uninitialized |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int |-- x86_64-buildonly-randconfig-002-20241011 | |-- arch-x86-kernel-cpu-mce-therm_throt.o:warning:objtool:missing-symbol-for-section-.irqentry.text | `-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241011 | |-- fs-sysfs-symlink.o:warning:objtool:missing-symbol-for-section-.text | |-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-ax25-ax25_dev.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-buildonly-randconfig-005-20241011 | `-- fs-pstore-inode.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-001-20241011 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-002-20241011 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-003-20241011 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-012-20241011 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-014-20241011 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-015-20241011 `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity elapsed time: 1226m configs tested: 30 configs skipped: 138 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20241011 gcc-14.1.0 arm64 randconfig-002-20241011 gcc-14.1.0 arm64 randconfig-003-20241011 gcc-14.1.0 arm64 randconfig-004-20241011 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241011 gcc-12 x86_64 buildonly-randconfig-002-20241011 gcc-12 x86_64 buildonly-randconfig-003-20241011 clang-18 x86_64 buildonly-randconfig-004-20241011 clang-18 x86_64 buildonly-randconfig-005-20241011 gcc-12 x86_64 buildonly-randconfig-006-20241011 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20241011 clang-18 x86_64 randconfig-002-20241011 gcc-11 x86_64 randconfig-003-20241011 gcc-12 x86_64 randconfig-004-20241011 gcc-12 x86_64 randconfig-005-20241011 clang-18 x86_64 randconfig-006-20241011 clang-18 x86_64 randconfig-011-20241011 gcc-12 x86_64 randconfig-012-20241011 clang-18 x86_64 randconfig-013-20241011 gcc-11 x86_64 randconfig-014-20241011 clang-18 x86_64 randconfig-015-20241011 gcc-12 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/6] Backport some patches of hns RoCE from mainline
by Chengchang Tang 11 Oct '24

11 Oct '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Backport some patches of hns RoCE from Linux mainline to olk-5.10 Chengchang Tang (2): RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled Junxian Huang (1): RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler Xinghai Cen (3): Revert "RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler" Revert "RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS" Revert "RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled" -- 2.33.0

2 7

[openeuler:OLK-6.6 13318/14350] drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module'
by kernel test robot 11 Oct '24

11 Oct '24

Hi chench00, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: a1dd4972da4e66d9a9d1a89b3dfd8f742c20193b [13318/14350] crypto: tdm: Add Hygon TDM driver config: x86_64-buildonly-randconfig-003-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111205.LRqw3beL-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111205.LRqw3beL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111205.LRqw3beL-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/tdm-dev.c:94:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 94 | int ret = 0; | ^ >> drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:707:53: note: expanded from macro 'memcpy' 707 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^ include/linux/fortify-string.h:650:41: note: expanded from macro '__fortify_memcpy_chk' 650 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:708:35: note: expanded from macro 'memcpy' 708 | __struct_size(p), __struct_size(q), \ | ^ include/linux/fortify-string.h:110:56: note: expanded from macro '__struct_size' 110 | #define __struct_size(p) __builtin_dynamic_object_size(p, 0) | ^ include/linux/fortify-string.h:652:27: note: expanded from macro '__fortify_memcpy_chk' 652 | const size_t __q_size = (q_size); \ | ^~~~~~ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:709:35: note: expanded from macro 'memcpy' 709 | __member_size(p), __member_size(q), \ | ^ include/linux/fortify-string.h:111:56: note: expanded from macro '__member_size' 111 | #define __member_size(p) __builtin_dynamic_object_size(p, 1) | ^ include/linux/fortify-string.h:654:33: note: expanded from macro '__fortify_memcpy_chk' 654 | const size_t __q_size_field = (q_size_field); \ | ^~~~~~~~~~~~ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:707:50: note: expanded from macro 'memcpy' 707 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^ include/linux/fortify-string.h:662:23: note: expanded from macro '__fortify_memcpy_chk' 662 | __underlying_##op(p, q, __fortify_size); \ | ^ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:606:20: warning: variable 'head' set but not used [-Wunused-but-set-variable] 606 | struct list_head *head = NULL; | ^ 2 warnings and 4 errors generated. vim +340 drivers/crypto/ccp/hygon/tdm-dev.c 323 324 if (!hash) { 325 ret = -DYN_NULL_POINTER; 326 pr_err("Null pointer\n"); 327 goto end; 328 } 329 330 ctx_msg.flag = flag; 331 ctx_msg.pid = current->pid; 332 memcpy(ctx_msg.comm, current->comm, sizeof(current->comm)); 333 334 return_address = CALLER_ADDR1; 335 if (return_address) { 336 #if IS_BUILTIN(CONFIG_CRYPTO_DEV_CCP_DD) 337 p_module = __module_address(return_address); 338 // caller is module 339 if (p_module) > 340 memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); 341 // caller is build-in 342 else 343 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 344 #elif IS_ENABLED(CONFIG_KALLSYMS) 345 symbol_len = sprint_symbol((char *)symbol_buf, return_address); 346 if (!symbol_len) { 347 ret = -DYN_ERR_API; 348 pr_err("sprint_symbol failed\n"); 349 goto end; 350 } 351 symbol_begin = strchr((char *)symbol_buf, '['); 352 if (!symbol_begin) { 353 ret = -DYN_NULL_POINTER; 354 pr_err("module name is not exist\n"); 355 goto end; 356 } 357 symbol_end = strchr((char *)symbol_buf, ']'); 358 if (!symbol_end) { 359 ret = -DYN_NULL_POINTER; 360 pr_err("module name is not exist\n"); 361 goto end; 362 } 363 symbol_begin++; 364 if (symbol_end - symbol_begin) 365 memcpy(ctx_msg.module_name, symbol_begin, symbol_end - symbol_begin); 366 else 367 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 368 #else 369 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 370 #endif 371 } else 372 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 373 374 ret = calc_task_context_hash(ctx_msg, hash); 375 if (ret) { 376 pr_err("calc_task_context_hash failed\n"); 377 goto end; 378 } 379 380 end: 381 return ret; 382 } 383 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] USB: usbtmc: prevent kernel-usb-infoleak
by Yipeng Zou 11 Oct '24

11 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7U CVE: CVE-2024-47671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 49f59d53b4b2..cf285d43d0c1 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -724,7 +724,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL; -- 2.34.1

2 1

[PATCH OLK-6.6] USB: usbtmc: prevent kernel-usb-infoleak
by Yipeng Zou 11 Oct '24

11 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7U CVE: CVE-2024-47671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 311007b1d904..c2e666e82857 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -754,7 +754,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL; -- 2.34.1

2 1

[PATCH OLK-5.10] USB: usbtmc: prevent kernel-usb-infoleak
by Yipeng Zou 11 Oct '24

11 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7U CVE: CVE-2024-47671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 76ff182427bc..78adc112a77b 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -724,7 +724,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Have tracing_max_latency inc the trace array ref count
by Chen Zhongjin 11 Oct '24

11 Oct '24

From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.6-rc2 commit 7d660c9b2bc95107f90a9f4c4759be85309a6550 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IATD5H Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The tracing_max_latency file points to the trace_array max_latency field. For an instance, if the file is opened and the instance is deleted, reading or writing to the file will cause a use after free. Up the ref count of the trace_array when tracing_max_latency is opened. Link: https://lkml.kernel.org/r/20230907024803.666889383@goodmis.org Link: https://lore.kernel.org/all/1cb3aee2-19af-c472-e265-05176fe9bd84@huawei.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Zheng Yejian <zhengyejian1(a)huawei.com> Fixes: 8530dec63e7b4 ("tracing: Add tracing_check_open_get_tr()") Tested-by: Linux Kernel Functional Testing <lkft(a)linaro.org> Tested-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [adjust context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/trace/trace.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 3c776919305a..a470950b8ed6 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -1718,7 +1718,7 @@ static void trace_create_maxlat_file(struct trace_array *tr, init_irq_work(&tr->fsnotify_irqwork, latency_fsnotify_workfn_irq); tr->d_max_latency = trace_create_file("tracing_max_latency", TRACE_MODE_WRITE, - d_tracer, &tr->max_latency, + d_tracer, tr, &tracing_max_lat_fops); } @@ -1752,7 +1752,7 @@ void latency_fsnotify(struct trace_array *tr) #define trace_create_maxlat_file(tr, d_tracer) \ trace_create_file("tracing_max_latency", TRACE_MODE_WRITE, \ - d_tracer, &tr->max_latency, &tracing_max_lat_fops) + d_tracer, tr, &tracing_max_lat_fops) #else #define trace_create_maxlat_file(tr, d_tracer) do { } while (0) @@ -6227,14 +6227,18 @@ static ssize_t tracing_max_lat_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos) { - return tracing_nsecs_read(filp->private_data, ubuf, cnt, ppos); + struct trace_array *tr = filp->private_data; + + return tracing_nsecs_read(&tr->max_latency, ubuf, cnt, ppos); } static ssize_t tracing_max_lat_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos) { - return tracing_nsecs_write(filp->private_data, ubuf, cnt, ppos); + struct trace_array *tr = filp->private_data; + + return tracing_nsecs_write(&tr->max_latency, ubuf, cnt, ppos); } #endif @@ -7264,10 +7268,11 @@ static const struct file_operations tracing_thresh_fops = { #if defined(CONFIG_TRACER_MAX_TRACE) || defined(CONFIG_HWLAT_TRACER) static const struct file_operations tracing_max_lat_fops = { - .open = tracing_open_generic, + .open = tracing_open_generic_tr, .read = tracing_max_lat_read, .write = tracing_max_lat_write, .llseek = generic_file_llseek, + .release = tracing_release_generic_tr, }; #endif -- 2.25.1

2 1

[PATCH OLK-6.6] arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
by Heyuan Wang 11 Oct '24

11 Oct '24

From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> mainline inclusion from mainline-v6.11-rc1 commit 2488444274c70038eb6b686cba5f1ce48ebb9cdd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OA CVE: CVE-2024-46822 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In a review discussion of the changes to support vCPU hotplug where a check was added on the GICC being enabled if was online, it was noted that there is need to map back to the cpu and use that to index into a cpumask. As such, a valid ID is needed. If an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible for the entry in cpu_madt_gicc[cpu] == NULL. This function would then cause a NULL pointer dereference. Whilst a path to trigger this has not been established, harden this caller against the possibility. Reviewed-by: Gavin Shan <gshan(a)redhat.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Link: https://lore.kernel.org/r/20240529133446.28446-13-Jonathan.Cameron@huawei.c… Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: wangheyuan <wangheyuan2(a)h-partners.com> --- arch/arm64/include/asm/acpi.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h index bc9a6656fc0c..a407f9cd549e 100644 --- a/arch/arm64/include/asm/acpi.h +++ b/arch/arm64/include/asm/acpi.h @@ -124,7 +124,8 @@ static inline int get_cpu_for_acpi_id(u32 uid) int cpu; for (cpu = 0; cpu < nr_cpu_ids; cpu++) - if (uid == get_acpi_id_for_cpu(cpu)) + if (acpi_cpu_get_madt_gicc(cpu) && + uid == get_acpi_id_for_cpu(cpu)) return cpu; return -EINVAL; -- 2.25.1

2 1

[PATCH OLK-5.10 00/19] blk-throttle: support prioritized processing of metadata
by Yu Kuai 10 Oct '24

10 Oct '24

Jens Axboe (1): block: move blk-throtl fast path inline Jinke Han (1): blk-throttle: Fix io statistics for cgroup v1 Kemeng Shi (2): blk-throttle: Fix that bps of child could exceed bps limited in parent blk-throttle: correct calculation of wait time in tg_may_dispatch Laibin Qiu (1): blk-throttle: Set BIO_THROTTLED when bio has been throttled Ming Lei (4): block: throttle split bio in case of iops limit block: don't try to throttle split bio if iops limit isn't set block: revert 4f1e9630afe6 ("blk-throtl: optimize IOPS throttle for large IO scenarios") block: avoid use-after-free on throttle data Yu Kuai (10): Revert "blk-throttle: fix io hung due to configuration updates" Revert "blk-throttle: Set BIO_THROTTLED when bio has been throttled" blk-throttle: fix that io throttle can only work for single bio blk-throttle: fix io hung due to configuration updates blk-throttle: remove THROTL_TG_HAS_IOPS_LIMIT blk-throttle: improve bypassing bios checkings blk-throttle: print signed value 'carryover_bytes/ios' for user blk-throttle: fix wrong comparation while 'carryover_ios/bytes' is negative blk-throttle: consider 'carryover_ios/bytes' in throtl_trim_slice() blk-throttle: support prioritized processing of metadata block/bio.c | 2 - block/blk-cgroup.c | 7 +- block/blk-core.c | 1 + block/blk-merge.c | 6 +- block/blk-sysfs.c | 1 + block/blk-throttle.c | 519 +++++++++++++------------------------- block/blk-throttle.h | 214 ++++++++++++++++ block/blk.h | 16 -- include/linux/bio.h | 2 +- include/linux/blk_types.h | 2 +- 10 files changed, 396 insertions(+), 374 deletions(-) create mode 100644 block/blk-throttle.h -- 2.39.2

2 20

[openeuler:OLK-6.6 691/14344] ld.lld: error: undefined symbol: arch_elf_adjust_prot
by kernel test robot 10 Oct '24

10 Oct '24

Hi Yury, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: 7de3ab4c3dd938fae3626a6344830b018eb7ba4f [691/14344] arm64: introduce binfmt_elf32.c config: arm64-randconfig-004-20241010 (https://download.01.org/0day-ci/archive/20241010/202410101809.HFdpybos-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 70e0a7e7e6a8541bcc46908c592eed561850e416) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410101809.HFdpybos-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410101809.HFdpybos-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: arch_elf_adjust_prot >>> referenced by binfmt_elf.c:583 (arch/arm64/kernel/../../../fs/binfmt_elf.c:583) >>> arch/arm64/kernel/binfmt_elf32.o:(load_elf_binary) in archive vmlinux.a >>> referenced by binfmt_elf.c:583 (arch/arm64/kernel/../../../fs/binfmt_elf.c:583) >>> arch/arm64/kernel/binfmt_elf32.o:(load_elf_interp) in archive vmlinux.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] drm/i915/gt: Cleanup partial engine discovery failures
by Yu Liao 10 Oct '24

10 Oct '24

From: Chris Wilson <chris.p.wilson(a)intel.com> mainline inclusion from mainline-v6.2-rc1 commit 78a033433a5ae4fee85511ee075bc9a48312c79e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIK8 CVE: CVE-2022-48893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If we abort driver initialisation in the middle of gt/engine discovery, some engines will be fully setup and some not. Those incompletely setup engines only have 'engine->release == NULL' and so will leak any of the common objects allocated. v2: - Drop the destroy_pinned_context() helper for now. It's not really worth it with just a single callsite at the moment. (Janusz) Signed-off-by: Chris Wilson <chris.p.wilson(a)intel.com> Cc: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Matt Roper <matthew.d.roper(a)intel.com> Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220915232654.3283095-2-matt… Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index c940ac3aae2f..5bec331c0813 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -905,8 +905,13 @@ int intel_engines_init(struct intel_gt *gt) return err; err = setup(engine); - if (err) + if (err) { + intel_engine_cleanup_common(engine); return err; + } + + /* The backend should now be responsible for cleanup */ + GEM_BUG_ON(engine->release == NULL); err = engine_init_common(engine); if (err) -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/i915/gt: Cleanup partial engine discovery failures
by Yu Liao 10 Oct '24

10 Oct '24

From: Chris Wilson <chris.p.wilson(a)intel.com> mainline inclusion from mainline-v6.2-rc1 commit 78a033433a5ae4fee85511ee075bc9a48312c79e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIK8 CVE: CVE-2022-48893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If we abort driver initialisation in the middle of gt/engine discovery, some engines will be fully setup and some not. Those incompletely setup engines only have 'engine->release == NULL' and so will leak any of the common objects allocated. v2: - Drop the destroy_pinned_context() helper for now. It's not really worth it with just a single callsite at the moment. (Janusz) Signed-off-by: Chris Wilson <chris.p.wilson(a)intel.com> Cc: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Matt Roper <matthew.d.roper(a)intel.com> Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220915232654.3283095-2-matt… Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index c940ac3aae2f..5bec331c0813 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -905,8 +905,13 @@ int intel_engines_init(struct intel_gt *gt) return err; err = setup(engine); - if (err) + if (err) { + intel_engine_cleanup_common(engine); return err; + } + + /* The backend should now be responsible for cleanup */ + GEM_BUG_ON(engine->release == NULL); err = engine_init_common(engine); if (err) -- 2.33.0

2 1

[PATCH OLK-6.6] userfaultfd: don't BUG_ON() if khugepaged yanks our page table
by Liu Shixin 10 Oct '24

10 Oct '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.51 commit 4a594acc12d5954cdc71d4450a386748bf3d136a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9P2 CVE: CVE-2024-46838 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4828d207dc5161dc7ddf9a4f6dcfd80c7dd7d20a upstream. Since khugepaged was changed to allow retracting page tables in file mappings without holding the mmap lock, these BUG_ON()s are wrong - get rid of them. We could also remove the preceding "if (unlikely(...))" block, but then we could reach pte_offset_map_lock() with transhuge pages not just for file mappings but also for anonymous mappings - which would probably be fine but I think is not necessarily expected. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-2-5efa61078a41@goog… Fixes: 1d65b771bc08 ("mm/khugepaged: retract_page_tables() without mmap or vma lock") Signed-off-by: Jann Horn <jannh(a)google.com> Reviewed-by: Qi Zheng <zhengqi.arch(a)bytedance.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Pavel Emelyanov <xemul(a)virtuozzo.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/userfaultfd.c [ Context conflict with userswap feature. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/userfaultfd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index b7562e6847b2..2c71a269a52c 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -724,9 +724,10 @@ static __always_inline ssize_t mfill_atomic(struct mm_struct *dst_mm, err = -EFAULT; break; } - - BUG_ON(pmd_none(*dst_pmd)); - BUG_ON(pmd_trans_huge(*dst_pmd)); + /* + * For shmem mappings, khugepaged is allowed to remove page + * tables under us; pte_offset_map_lock() will deal with that. + */ #ifdef CONFIG_USERSWAP if (static_branch_unlikely(&userswap_enabled) && -- 2.34.1

2 1

[openeuler:OLK-6.6 6858/14336] drivers/char/ipmi/ipmi_bt_sm.c:194:11: error: call to undeclared function 'acpi_evaluate_integer'; ISO C99 and later do not support implicit function declarations
by kernel test robot 10 Oct '24

10 Oct '24

Hi Devyn, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5cfda5c5e5fbd3cbd5845d1ba3ebb1ccd52c05a9 commit: 6449ff7a5a2b148bc0a60efb3f0d723aaeceaae6 [6858/14336] ipmi: Errata workaround to prevent SMS message processing timeout config: arm64-randconfig-002-20241010 (https://download.01.org/0day-ci/archive/20241010/202410101323.VsBPpYrP-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 70e0a7e7e6a8541bcc46908c592eed561850e416) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410101323.VsBPpYrP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410101323.VsBPpYrP-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/char/ipmi/ipmi_bt_sm.c:194:11: error: call to undeclared function 'acpi_evaluate_integer'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 194 | status = acpi_evaluate_integer(handle, "SATN", NULL, &tmp); | ^ drivers/char/ipmi/ipmi_bt_sm.c:194:11: note: did you mean 'acpi_evaluate_object'? include/acpi/acpixf.h:550:8: note: 'acpi_evaluate_object' declared here 550 | acpi_evaluate_object(acpi_handle object, | ^ include/acpi/platform/aclinux.h:93:21: note: expanded from macro 'ACPI_EXTERNAL_RETURN_STATUS' 93 | static ACPI_INLINE prototype {return(AE_NOT_CONFIGURED);} | ^ 1 error generated. vim +/acpi_evaluate_integer +194 drivers/char/ipmi/ipmi_bt_sm.c 177 178 #ifdef CONFIG_HISILICON_ERRATUM_162102203 179 /* 180 * To confirm whether the SMS_ATN flag needs to be stored and get 181 * quirk through the method reported by the BIOS. Because in special 182 * cases SMS_ATN flag bits may be lost before being processed. 183 */ 184 static bool get_sms_atn_quirk(struct si_sm_io *io) 185 { 186 acpi_handle handle; 187 acpi_status status; 188 unsigned long long tmp; 189 190 handle = ACPI_HANDLE(io->dev); 191 if (!handle) 192 return false; 193 > 194 status = acpi_evaluate_integer(handle, "SATN", NULL, &tmp); 195 if (ACPI_FAILURE(status)) 196 return false; 197 else if (tmp != 1) 198 return false; 199 200 return true; 201 } 202 #endif 203 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] swiotlb: fix swiotlb_bounce() to do partial sync's correctly
by Kaixiong Yu 10 Oct '24

10 Oct '24

Merge mainline commit e8068f2d756d("swiotlb: fix swiotlb_bounce() to do partial sync's correctly") and af133562d5a("swiotlb: extend buffer pre-padding to alloc_align_mask if necessary") Michael Kelley (1): swiotlb: fix swiotlb_bounce() to do partial sync's correctly Petr Tesarik (1): swiotlb: extend buffer pre-padding to alloc_align_mask if necessary kernel/dma/swiotlb.c | 87 +++++++++++++++++++++++++++++--------------- 1 file changed, 58 insertions(+), 29 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] btrfs: clean up our handling of refs == 0 in snapshot delete
by Baokun Li 10 Oct '24

10 Oct '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v6.6.51 commit 7d1df13bf078ffebfedd361d714ff6cee1ff01b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NE CVE: CVE-2024-46840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b8ccef048354074a548f108e51d0557d6adfd3a3 ] In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walk_down_proc we also BUG_ON(refs == 0), which could happen if we have extent tree corruption. Change that to return -EUCLEAN. In do_walk_down() we catch this case and handle it correctly, however we return -EIO, which -EUCLEAN is a more appropriate error code. Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert that to proper error handling. Also adjust the error message so we can actually do something with the information. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent-tree.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index c88907111d80..ebd07c3801af 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5086,7 +5086,15 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans, /* We don't care about errors in readahead. */ if (ret < 0) continue; - BUG_ON(refs == 0); + + /* + * This could be racey, it's conceivable that we raced and end + * up with a bogus refs count, if that's the case just skip, if + * we are actually corrupt we will notice when we look up + * everything again with our locks. + */ + if (refs == 0) + continue; if (wc->stage == DROP_REFERENCE) { if (refs == 1) @@ -5152,7 +5160,11 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, &wc->flags[level]); if (ret) return ret; - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } } if (wc->stage == DROP_REFERENCE) { @@ -5286,8 +5298,9 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, goto out_unlock; if (unlikely(wc->refs[level - 1] == 0)) { - btrfs_err(fs_info, "Missing references."); - ret = -EIO; + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + bytenr); + ret = -EUCLEAN; goto out_unlock; } *lookup_info = 0; @@ -5487,7 +5500,12 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, path->locks[level] = 0; return ret; } - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_tree_unlock_rw(eb, path->locks[level]); + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } if (wc->refs[level] == 1) { btrfs_tree_unlock_rw(eb, path->locks[level]); path->locks[level] = 0; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: clean up our handling of refs == 0 in snapshot delete
by Baokun Li 10 Oct '24

10 Oct '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.226 commit c60676b81fab456b672796830f6d8057058f029c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NE CVE: CVE-2024-46840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b8ccef048354074a548f108e51d0557d6adfd3a3 ] In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walk_down_proc we also BUG_ON(refs == 0), which could happen if we have extent tree corruption. Change that to return -EUCLEAN. In do_walk_down() we catch this case and handle it correctly, however we return -EIO, which -EUCLEAN is a more appropriate error code. Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert that to proper error handling. Also adjust the error message so we can actually do something with the information. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent-tree.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 62956c24b4b5..8212c2440158 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4796,7 +4796,15 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans, /* We don't care about errors in readahead. */ if (ret < 0) continue; - BUG_ON(refs == 0); + + /* + * This could be racey, it's conceivable that we raced and end + * up with a bogus refs count, if that's the case just skip, if + * we are actually corrupt we will notice when we look up + * everything again with our locks. + */ + if (refs == 0) + continue; if (wc->stage == DROP_REFERENCE) { if (refs == 1) @@ -4862,7 +4870,11 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, &wc->flags[level]); if (ret) return ret; - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } } if (wc->stage == DROP_REFERENCE) { @@ -4995,8 +5007,9 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, goto out_unlock; if (unlikely(wc->refs[level - 1] == 0)) { - btrfs_err(fs_info, "Missing references."); - ret = -EIO; + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + bytenr); + ret = -EUCLEAN; goto out_unlock; } *lookup_info = 0; @@ -5198,7 +5211,12 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, path->locks[level] = 0; return ret; } - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_tree_unlock_rw(eb, path->locks[level]); + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } if (wc->refs[level] == 1) { btrfs_tree_unlock_rw(eb, path->locks[level]); path->locks[level] = 0; -- 2.31.1

2 1

[PATCH OLK-5.10] btrfs: clean up our handling of refs == 0 in snapshot delete
by Baokun Li 10 Oct '24

10 Oct '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.226 commit c60676b81fab456b672796830f6d8057058f029c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NE CVE: CVE-2024-46840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b8ccef048354074a548f108e51d0557d6adfd3a3 ] In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walk_down_proc we also BUG_ON(refs == 0), which could happen if we have extent tree corruption. Change that to return -EUCLEAN. In do_walk_down() we catch this case and handle it correctly, however we return -EIO, which -EUCLEAN is a more appropriate error code. Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert that to proper error handling. Also adjust the error message so we can actually do something with the information. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent-tree.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 854c7fa0fc06..12d2923da2b4 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4808,7 +4808,15 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans, /* We don't care about errors in readahead. */ if (ret < 0) continue; - BUG_ON(refs == 0); + + /* + * This could be racey, it's conceivable that we raced and end + * up with a bogus refs count, if that's the case just skip, if + * we are actually corrupt we will notice when we look up + * everything again with our locks. + */ + if (refs == 0) + continue; if (wc->stage == DROP_REFERENCE) { if (refs == 1) @@ -4874,7 +4882,11 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, &wc->flags[level]); if (ret) return ret; - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } } if (wc->stage == DROP_REFERENCE) { @@ -5007,8 +5019,9 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, goto out_unlock; if (unlikely(wc->refs[level - 1] == 0)) { - btrfs_err(fs_info, "Missing references."); - ret = -EIO; + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + bytenr); + ret = -EUCLEAN; goto out_unlock; } *lookup_info = 0; @@ -5210,7 +5223,12 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, path->locks[level] = 0; return ret; } - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_tree_unlock_rw(eb, path->locks[level]); + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } if (wc->refs[level] == 1) { btrfs_tree_unlock_rw(eb, path->locks[level]); path->locks[level] = 0; -- 2.31.1

2 1

[openeuler:OLK-5.10 23034/30000] kernel/sched/topology.c:1749:2: error: implicit declaration of function 'register_sysctl_init'
by kernel test robot 10 Oct '24

10 Oct '24

Hi Tim, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c9c7afae6802fd2282529d80c0f808360f7b654a commit: f4128ae8e6ff03b4c805707fe75d0345797f7f53 [23034/30000] sched: Add cluster scheduler level for x86 config: x86_64-buildonly-randconfig-002-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100921.MexAROBI-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100921.MexAROBI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100921.MexAROBI-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/topology.c:5: kernel/sched/sched.h:1838:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1838 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/topology.c:718:6: warning: variable 'numa_distance' set but not used [-Wunused-but-set-variable] 718 | int numa_distance = 0; | ^ >> kernel/sched/topology.c:1749:2: error: implicit declaration of function 'register_sysctl_init' [-Werror,-Wimplicit-function-declaration] 1749 | register_sysctl_init("kernel", sched_cluster_sysctls); | ^ 2 warnings and 1 error generated. vim +/register_sysctl_init +1749 kernel/sched/topology.c 8ce3e706b314091 Tim Chen 2021-12-03 1746 8ce3e706b314091 Tim Chen 2021-12-03 1747 static int __init sched_cluster_sysctl_init(void) 8ce3e706b314091 Tim Chen 2021-12-03 1748 { 8ce3e706b314091 Tim Chen 2021-12-03 @1749 register_sysctl_init("kernel", sched_cluster_sysctls); 8ce3e706b314091 Tim Chen 2021-12-03 1750 return 0; 8ce3e706b314091 Tim Chen 2021-12-03 1751 } 8ce3e706b314091 Tim Chen 2021-12-03 1752 late_initcall(sched_cluster_sysctl_init); 9e68cc2bf535a2f Tim Chen 2021-12-03 1753 :::::: The code at line 1749 was first introduced by commit :::::: 8ce3e706b31409147f035c037055caa68e450ce5 scheduler: Add runtime knob sysctl_sched_cluster :::::: TO: Tim Chen <tim.c.chen(a)linux.intel.com> :::::: CC: Jie Liu <liujie375(a)h-partners.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 4855/30000] fs/ntfs3/frecord.o: warning: objtool: .text.unlikely: unexpected end of section
by kernel test robot 10 Oct '24

10 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c9c7afae6802fd2282529d80c0f808360f7b654a commit: c213d417e466b7a7d9e02939bb67fcf5d82a3f2f [4855/30000] fs/ntfs3: Add NTFS3 in fs/Kconfig and fs/Makefile config: x86_64-buildonly-randconfig-004-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100857.PsMQ97VM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100857.PsMQ97VM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100857.PsMQ97VM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ntfs3/frecord.o: warning: objtool: .text.unlikely: unexpected end of section -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 18857/30000] security/integrity/ima/ima.h:381:16: warning: declaration of 'struct ima_digest' will not be visible outside of this function
by kernel test robot 10 Oct '24

10 Oct '24

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c9c7afae6802fd2282529d80c0f808360f7b654a commit: e94df9b790f7ed9025c9321f16a77044f66b14a5 [18857/30000] ima: Add macros to isolate the IMA digest list config: x86_64-randconfig-003-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100850.oF7Ohlzy-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100850.oF7Ohlzy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100850.oF7Ohlzy-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from security/integrity/ima/ima_template.c:13: >> security/integrity/ima/ima.h:381:16: warning: declaration of 'struct ima_digest' will not be visible outside of this function [-Wvisibility] 381 | struct ima_digest *found_digest) | ^ 1 warning generated. -- In file included from security/integrity/ima/ima_asymmetric_keys.c:13: >> security/integrity/ima/ima.h:381:16: warning: declaration of 'struct ima_digest' will not be visible outside of this function [-Wvisibility] 381 | struct ima_digest *found_digest) | ^ security/integrity/ima/ima_asymmetric_keys.c:27:6: warning: no previous prototype for function 'ima_post_key_create_or_update' [-Wmissing-prototypes] 27 | void ima_post_key_create_or_update(struct key *keyring, struct key *key, | ^ security/integrity/ima/ima_asymmetric_keys.c:27:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 27 | void ima_post_key_create_or_update(struct key *keyring, struct key *key, | ^ | static 2 warnings generated. -- In file included from security/integrity/ima/ima_main.c:30: >> security/integrity/ima/ima.h:381:16: warning: declaration of 'struct ima_digest' will not be visible outside of this function [-Wvisibility] 381 | struct ima_digest *found_digest) | ^ security/integrity/ima/ima_main.c:440:29: error: too few arguments to function call, expected 8, have 7 433 | rc = ima_appraise_measurement(func, iint, file, | ~~~~~~~~~~~~~~~~~~~~~~~~ 434 | pathname, xattr_value, 435 | #ifdef CONFIG_IMA_DIGEST_LIST 436 | xattr_len, modsig, 437 | ima_digest_allow(found_digest, 438 | IMA_APPRAISE)); 439 | #else 440 | xattr_len, modsig); | ^ security/integrity/ima/ima.h:373:19: note: 'ima_appraise_measurement' declared here 373 | static inline int ima_appraise_measurement(enum ima_hooks func, | ^ ~~~~~~~~~~~~~~~~~~~~ 374 | struct integrity_iint_cache *iint, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 375 | struct file *file, | ~~~~~~~~~~~~~~~~~~ 376 | const unsigned char *filename, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 377 | struct evm_ima_xattr_data *xattr_value, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 378 | int xattr_len, | ~~~~~~~~~~~~~~ 379 | #ifndef CONFIG_IMA_DIGEST_LIST | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 380 | const struct modsig *modsig, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 381 | struct ima_digest *found_digest) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning and 1 error generated. vim +381 security/integrity/ima/ima.h 273df864cf7466 Nayna Jain 2019-10-30 372 4ad87a3d7444de Mimi Zohar 2016-01-14 373 static inline int ima_appraise_measurement(enum ima_hooks func, d79d72e02485c0 Mimi Zohar 2012-12-03 374 struct integrity_iint_cache *iint, 2fe5d6def1672a Mimi Zohar 2012-02-13 375 struct file *file, d3634d0f426bde Dmitry Kasatkin 2013-04-25 376 const unsigned char *filename, d3634d0f426bde Dmitry Kasatkin 2013-04-25 377 struct evm_ima_xattr_data *xattr_value, 39b07096364a42 Thiago Jung Bauermann 2019-06-27 378 int xattr_len, e94df9b790f7ed Zhou Shuiqing 2023-09-06 379 #ifndef CONFIG_IMA_DIGEST_LIST a44c2ae6cac55b Roberto Sassu 2021-03-03 380 const struct modsig *modsig, a44c2ae6cac55b Roberto Sassu 2021-03-03 @381 struct ima_digest *found_digest) e94df9b790f7ed Zhou Shuiqing 2023-09-06 382 #else e94df9b790f7ed Zhou Shuiqing 2023-09-06 383 const struct modsig *modsig) e94df9b790f7ed Zhou Shuiqing 2023-09-06 384 #endif 2fe5d6def1672a Mimi Zohar 2012-02-13 385 { 2fe5d6def1672a Mimi Zohar 2012-02-13 386 return INTEGRITY_UNKNOWN; 2fe5d6def1672a Mimi Zohar 2012-02-13 387 } 2fe5d6def1672a Mimi Zohar 2012-02-13 388 :::::: The code at line 381 was first introduced by commit :::::: a44c2ae6cac55bdcc0d33f62600233ea0f3f6688 ima: Add support for appraisal with digest lists :::::: TO: Roberto Sassu <roberto.sassu(a)huawei.com> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION bd281fec9a629fc56d2e07e32f8e719201dfc38f
by kernel test robot 10 Oct '24

10 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: bd281fec9a629fc56d2e07e32f8e719201dfc38f !12069 platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20241010 | `-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) |-- arm64-randconfig-002-20241010 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_disable_msi | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_enable_msi | `-- mm-pin_mem.c:error:lvalue-required-as-unary-operand |-- arm64-randconfig-003-20241010 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- mm-mem_reliable.c:warning:zero-defined-but-not-used |-- arm64-randconfig-004-20241010 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int |-- x86_64-buildonly-randconfig-001-20241010 | `-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount |-- x86_64-buildonly-randconfig-002-20241010 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20241010 | |-- drivers-char-hw_random-zhaoxin-rng.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-char-ipmi-ipmi_si_intf.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hwtracing-intel_th-msu-sink.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20241010 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20241010 `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity elapsed time: 828m configs tested: 18 configs skipped: 138 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241010 gcc-14.1.0 arm64 randconfig-002-20241010 gcc-14.1.0 arm64 randconfig-003-20241010 gcc-14.1.0 arm64 randconfig-004-20241010 gcc-14.1.0 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241010 gcc-12 x86_64 buildonly-randconfig-002-20241010 clang-18 x86_64 buildonly-randconfig-003-20241010 clang-18 x86_64 buildonly-randconfig-004-20241010 gcc-12 x86_64 buildonly-randconfig-005-20241010 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21254/23825] drivers/gpu/drm/phytium/phytium_pci.c:237:23: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'?
by kernel test robot 10 Oct '24

10 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bd281fec9a629fc56d2e07e32f8e719201dfc38f commit: cad0702e5286d3cc80afe545de027858b855dd5a [21254/23825] DRM: Phytium display DRM driver config: arm64-randconfig-002-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100635.fEGuT7Zt-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100635.fEGuT7Zt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100635.fEGuT7Zt-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/gpu/drm/phytium/phytium_pci.c:23:6: warning: no previous prototype for 'phytium_pci_vram_hw_init' [-Wmissing-prototypes] 23 | void phytium_pci_vram_hw_init(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:30:5: warning: no previous prototype for 'phytium_pci_vram_init' [-Wmissing-prototypes] 30 | int phytium_pci_vram_init(struct pci_dev *pdev, struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:68:6: warning: no previous prototype for 'phytium_pci_vram_fini' [-Wmissing-prototypes] 68 | void phytium_pci_vram_fini(struct pci_dev *pdev, struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:89:5: warning: no previous prototype for 'phytium_pci_dma_init' [-Wmissing-prototypes] 89 | int phytium_pci_dma_init(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c: In function 'phytium_pci_dma_init': drivers/gpu/drm/phytium/phytium_pci.c:99:34: error: 'PCI_VENDOR_ID_PHYTIUM' undeclared (first use in this function); did you mean 'PCI_VENDOR_ID_PHILIPS'? 99 | gpu_dev = pci_get_device(PCI_VENDOR_ID_PHYTIUM, 0xdc20, NULL); | ^~~~~~~~~~~~~~~~~~~~~ | PCI_VENDOR_ID_PHILIPS drivers/gpu/drm/phytium/phytium_pci.c:99:34: note: each undeclared identifier is reported only once for each function it appears in drivers/gpu/drm/phytium/phytium_pci.c: At top level: drivers/gpu/drm/phytium/phytium_pci.c:137:6: warning: no previous prototype for 'phytium_pci_dma_fini' [-Wmissing-prototypes] 137 | void phytium_pci_dma_fini(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c: In function 'phytium_pci_probe': >> drivers/gpu/drm/phytium/phytium_pci.c:237:23: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Werror=implicit-function-declaration] 237 | ret = pci_enable_msi(pdev); | ^~~~~~~~~~~~~~ | pci_enable_sriov >> drivers/gpu/drm/phytium/phytium_pci.c:272:17: error: implicit declaration of function 'pci_disable_msi'; did you mean 'pci_disable_sriov'? [-Werror=implicit-function-declaration] 272 | pci_disable_msi(pdev); | ^~~~~~~~~~~~~~~ | pci_disable_sriov In file included from drivers/gpu/drm/phytium/phytium_pci.c:7: drivers/gpu/drm/phytium/phytium_pci.c: At top level: include/linux/pci.h:888:19: error: 'PCI_VENDOR_ID_PHYTIUM' undeclared here (not in a function); did you mean 'PCI_VENDOR_ID_PHILIPS'? 888 | .vendor = PCI_VENDOR_ID_##vend, .device = (dev), \ | ^~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_pci.c:375:11: note: in expansion of macro 'PCI_VDEVICE' 375 | { PCI_VDEVICE(PHYTIUM, 0xdc22), (kernel_ulong_t)&x100_info }, | ^~~~~~~~~~~ cc1: some warnings being treated as errors vim +237 drivers/gpu/drm/phytium/phytium_pci.c 88 89 int phytium_pci_dma_init(struct phytium_display_private *priv) 90 { 91 struct pci_dev *dma_dev, *gpu_dev; 92 struct drm_device *drm_dev = priv->dev; 93 dma_cap_mask_t mask; 94 struct phytium_dma_slave s; 95 int ret = 0; 96 u16 cmd; 97 98 /* check x100 gpu enable */ > 99 gpu_dev = pci_get_device(PCI_VENDOR_ID_PHYTIUM, 0xdc20, NULL); 100 if (!gpu_dev) { 101 DRM_INFO("failed to get gpu_dev\n"); 102 ret = -ENODEV; 103 goto failed; 104 } 105 106 pci_read_config_word(gpu_dev, PCI_COMMAND, &cmd); 107 if (!(cmd & PCI_COMMAND_MASTER)) { 108 DRM_INFO("gpu_dev master is disabled\n"); 109 ret = -ENODEV; 110 goto failed; 111 } 112 113 dma_dev = pci_get_device(PCI_VENDOR_ID_PHYTIUM, 0xdc3c, NULL); 114 if (!dma_dev) { 115 DRM_INFO("failed to get dma_dev\n"); 116 ret = -ENODEV; 117 goto failed; 118 } 119 120 dma_cap_zero(mask); 121 dma_cap_set(DMA_SLAVE, mask); 122 123 s.dma_dev = &dma_dev->dev; 124 s.chan_id = 2; 125 priv->dma_chan = dma_request_channel(mask, phytium_pci_dma_chan_filter, &s); 126 if (!priv->dma_chan) { 127 DRM_DEV_ERROR(drm_dev->dev, "failed to request dma chan\n"); 128 ret = -EBUSY; 129 goto failed; 130 } 131 priv->dma_inited = 1; 132 133 failed: 134 return ret; 135 } 136 > 137 void phytium_pci_dma_fini(struct phytium_display_private *priv) 138 { 139 if (priv->dma_inited) 140 dma_release_channel(priv->dma_chan); 141 priv->dma_inited = 0; 142 priv->dma_chan = NULL; 143 } 144 145 static struct phytium_display_private* 146 phytium_pci_private_init(struct pci_dev *pdev, const struct pci_device_id *ent) 147 { 148 struct drm_device *dev = pci_get_drvdata(pdev); 149 struct phytium_display_private *priv = NULL; 150 struct phytium_pci_private *pci_priv = NULL; 151 struct phytium_device_info *phytium_info = (struct phytium_device_info *)ent->driver_data; 152 int i = 0; 153 resource_size_t io_addr, io_size; 154 155 pci_priv = devm_kzalloc(&pdev->dev, sizeof(*pci_priv), GFP_KERNEL); 156 if (!pci_priv) { 157 DRM_ERROR("no memory to allocate for drm_display_private\n"); 158 goto failed_malloc_priv; 159 } 160 161 memset(pci_priv, 0, sizeof(*pci_priv)); 162 priv = &pci_priv->base; 163 phytium_display_private_init(priv, dev); 164 165 memcpy(&(priv->info), phytium_info, sizeof(struct phytium_device_info)); 166 DRM_DEBUG_KMS("priv->info.num_pipes :%d\n", priv->info.num_pipes); 167 priv->info.pipe_mask = ((pdev->subsystem_device >> PIPE_MASK_SHIFT) & PIPE_MASK_MASK); 168 priv->info.edp_mask = ((pdev->subsystem_device >> EDP_MASK_SHIFT) & EDP_MASK_MASK); 169 priv->info.num_pipes = 0; 170 for_each_pipe_masked(priv, i) 171 priv->info.num_pipes++; 172 if (priv->info.num_pipes == 0) { 173 DRM_ERROR("num_pipes is zero, so exit init\n"); 174 goto failed_init_numpipe; 175 } 176 177 io_addr = pci_resource_start(pdev, 0); 178 io_size = pci_resource_len(pdev, 0); 179 priv->regs = ioremap(io_addr, io_size); 180 if (priv->regs == NULL) { 181 DRM_ERROR("pci bar0 ioremap fail, addr:0x%llx, size:0x%llx\n", io_addr, io_size); 182 goto failed_ioremap; 183 } 184 185 priv->irq = pdev->irq; 186 if (IS_X100(priv)) { 187 pci_priv->dc_hw_vram_init = x100_dc_hw_vram_init; 188 priv->dc_hw_clear_msi_irq = x100_dc_hw_clear_msi_irq; 189 priv->dc_hw_fb_format_check = x100_dc_hw_fb_format_check; 190 } else if (IS_E2000(priv)) { 191 pci_priv->dc_hw_vram_init = e2000_dc_hw_vram_init; 192 priv->dc_hw_clear_msi_irq = NULL; 193 priv->dc_hw_fb_format_check = e2000_dc_hw_fb_format_check; 194 } 195 196 return priv; 197 198 failed_ioremap: 199 failed_init_numpipe: 200 devm_kfree(&pdev->dev, pci_priv); 201 failed_malloc_priv: 202 return NULL; 203 } 204 205 static void 206 phytium_pci_private_fini(struct pci_dev *pdev, struct phytium_display_private *priv) 207 { 208 struct phytium_pci_private *pci_priv = to_pci_priv(priv); 209 210 if (priv->regs) 211 iounmap(priv->regs); 212 213 devm_kfree(&pdev->dev, pci_priv); 214 } 215 216 static int phytium_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 217 { 218 struct phytium_display_private *priv = NULL; 219 struct drm_device *dev = NULL; 220 int ret = 0; 221 222 dev = drm_dev_alloc(&phytium_display_drm_driver, &pdev->dev); 223 if (IS_ERR(dev)) { 224 DRM_ERROR("failed to allocate drm_device\n"); 225 return PTR_ERR(dev); 226 } 227 dev->pdev = pdev; 228 pci_set_drvdata(pdev, dev); 229 pci_set_master(pdev); 230 ret = pci_enable_device(pdev); 231 if (ret) { 232 DRM_ERROR("pci enbale device fail\n"); 233 goto failed_enable_device; 234 } 235 236 if (dc_msi_enable) { > 237 ret = pci_enable_msi(pdev); 238 if (ret) 239 DRM_ERROR("pci enbale msi fail\n"); 240 } 241 242 dma_set_mask(&pdev->dev, DMA_BIT_MASK(40)); 243 244 priv = phytium_pci_private_init(pdev, ent); 245 if (priv) 246 dev->dev_private = priv; 247 else 248 goto failed_pci_private_init; 249 250 ret = phytium_pci_vram_init(pdev, priv); 251 if (ret) { 252 DRM_ERROR("failed to init pci vram\n"); 253 goto failed_pci_vram_init; 254 } 255 256 ret = drm_dev_register(dev, 0); 257 if (ret) { 258 DRM_ERROR("failed to register drm dev\n"); 259 goto failed_register_drm; 260 } 261 262 phytium_dp_hpd_irq_setup(dev, true); 263 264 return 0; 265 266 failed_register_drm: 267 phytium_pci_vram_fini(pdev, priv); 268 failed_pci_vram_init: 269 phytium_pci_private_fini(pdev, priv); 270 failed_pci_private_init: 271 if (pdev->msi_enabled) > 272 pci_disable_msi(pdev); 273 pci_disable_device(pdev); 274 failed_enable_device: 275 pci_set_drvdata(pdev, NULL); 276 drm_dev_put(dev); 277 278 return -1; 279 } 280 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3405/14324] drivers/gpu/drm/phytium/phytium_pci.c:236:9: error: call to undeclared function 'pci_enable_msi'; ISO C99 and later do not support implicit function declarations
by kernel test robot 10 Oct '24

10 Oct '24

Hi Li, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5d76abff5e121f2d916bcbc121f558c82e5dc221 commit: 792b82446538ed840a6e23b89673ce21564702bd [3405/14324] Fix gic support for Phytium S2500 config: arm64-randconfig-002-20241010 (https://download.01.org/0day-ci/archive/20241010/202410100523.x3WsGWyG-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 70e0a7e7e6a8541bcc46908c592eed561850e416) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241010/202410100523.x3WsGWyG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410100523.x3WsGWyG-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/gpu/drm/phytium/phytium_pci.c:7: In file included from include/linux/pci.h:2106: In file included from arch/arm64/include/asm/pci.h:7: In file included from include/linux/dma-mapping.h:11: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ drivers/gpu/drm/phytium/phytium_pci.c:23:6: warning: no previous prototype for function 'phytium_pci_vram_hw_init' [-Wmissing-prototypes] 23 | void phytium_pci_vram_hw_init(struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:23:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 23 | void phytium_pci_vram_hw_init(struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:30:5: warning: no previous prototype for function 'phytium_pci_vram_init' [-Wmissing-prototypes] 30 | int phytium_pci_vram_init(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:30:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 30 | int phytium_pci_vram_init(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:68:6: warning: no previous prototype for function 'phytium_pci_vram_fini' [-Wmissing-prototypes] 68 | void phytium_pci_vram_fini(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:68:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 68 | void phytium_pci_vram_fini(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:89:5: warning: no previous prototype for function 'phytium_pci_dma_init' [-Wmissing-prototypes] 89 | int phytium_pci_dma_init(struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:89:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 89 | int phytium_pci_dma_init(struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:137:6: warning: no previous prototype for function 'phytium_pci_dma_fini' [-Wmissing-prototypes] 137 | void phytium_pci_dma_fini(struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:137:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 137 | void phytium_pci_dma_fini(struct phytium_display_private *priv) | ^ | static >> drivers/gpu/drm/phytium/phytium_pci.c:236:9: error: call to undeclared function 'pci_enable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 236 | ret = pci_enable_msi(pdev); | ^ >> drivers/gpu/drm/phytium/phytium_pci.c:271:3: error: call to undeclared function 'pci_disable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 271 | pci_disable_msi(pdev); | ^ drivers/gpu/drm/phytium/phytium_pci.c:271:3: note: did you mean 'pci_disable_sriov'? include/linux/pci.h:2437:20: note: 'pci_disable_sriov' declared here 2437 | static inline void pci_disable_sriov(struct pci_dev *dev) { } | ^ drivers/gpu/drm/phytium/phytium_pci.c:291:3: error: call to undeclared function 'pci_disable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 291 | pci_disable_msi(pdev); | ^ 6 warnings and 3 errors generated. vim +/pci_enable_msi +236 drivers/gpu/drm/phytium/phytium_pci.c b80df10f845813 lishuo 2024-01-31 215 b80df10f845813 lishuo 2024-01-31 216 static int phytium_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) b80df10f845813 lishuo 2024-01-31 217 { b80df10f845813 lishuo 2024-01-31 218 struct phytium_display_private *priv = NULL; b80df10f845813 lishuo 2024-01-31 219 struct drm_device *dev = NULL; b80df10f845813 lishuo 2024-01-31 220 int ret = 0; b80df10f845813 lishuo 2024-01-31 221 b80df10f845813 lishuo 2024-01-31 222 dev = drm_dev_alloc(&phytium_display_drm_driver, &pdev->dev); b80df10f845813 lishuo 2024-01-31 223 if (IS_ERR(dev)) { b80df10f845813 lishuo 2024-01-31 224 DRM_ERROR("failed to allocate drm_device\n"); b80df10f845813 lishuo 2024-01-31 225 return PTR_ERR(dev); b80df10f845813 lishuo 2024-01-31 226 } b80df10f845813 lishuo 2024-01-31 227 pci_set_drvdata(pdev, dev); b80df10f845813 lishuo 2024-01-31 228 pci_set_master(pdev); b80df10f845813 lishuo 2024-01-31 229 ret = pci_enable_device(pdev); b80df10f845813 lishuo 2024-01-31 230 if (ret) { b80df10f845813 lishuo 2024-01-31 231 DRM_ERROR("pci enable device fail\n"); b80df10f845813 lishuo 2024-01-31 232 goto failed_enable_device; b80df10f845813 lishuo 2024-01-31 233 } b80df10f845813 lishuo 2024-01-31 234 b80df10f845813 lishuo 2024-01-31 235 if (dc_msi_enable) { b80df10f845813 lishuo 2024-01-31 @236 ret = pci_enable_msi(pdev); b80df10f845813 lishuo 2024-01-31 237 if (ret) b80df10f845813 lishuo 2024-01-31 238 DRM_ERROR("pci enable msi fail\n"); b80df10f845813 lishuo 2024-01-31 239 } b80df10f845813 lishuo 2024-01-31 240 b80df10f845813 lishuo 2024-01-31 241 dma_set_mask(&pdev->dev, DMA_BIT_MASK(40)); b80df10f845813 lishuo 2024-01-31 242 b80df10f845813 lishuo 2024-01-31 243 priv = phytium_pci_private_init(pdev, ent); b80df10f845813 lishuo 2024-01-31 244 if (priv) b80df10f845813 lishuo 2024-01-31 245 dev->dev_private = priv; b80df10f845813 lishuo 2024-01-31 246 else b80df10f845813 lishuo 2024-01-31 247 goto failed_pci_private_init; b80df10f845813 lishuo 2024-01-31 248 b80df10f845813 lishuo 2024-01-31 249 ret = phytium_pci_vram_init(pdev, priv); b80df10f845813 lishuo 2024-01-31 250 if (ret) { b80df10f845813 lishuo 2024-01-31 251 DRM_ERROR("failed to init pci vram\n"); b80df10f845813 lishuo 2024-01-31 252 goto failed_pci_vram_init; b80df10f845813 lishuo 2024-01-31 253 } b80df10f845813 lishuo 2024-01-31 254 b80df10f845813 lishuo 2024-01-31 255 ret = drm_dev_register(dev, 0); b80df10f845813 lishuo 2024-01-31 256 if (ret) { b80df10f845813 lishuo 2024-01-31 257 DRM_ERROR("failed to register drm dev\n"); b80df10f845813 lishuo 2024-01-31 258 goto failed_register_drm; b80df10f845813 lishuo 2024-01-31 259 } b80df10f845813 lishuo 2024-01-31 260 b80df10f845813 lishuo 2024-01-31 261 phytium_dp_hpd_irq_setup(dev, true); b80df10f845813 lishuo 2024-01-31 262 b80df10f845813 lishuo 2024-01-31 263 return 0; b80df10f845813 lishuo 2024-01-31 264 b80df10f845813 lishuo 2024-01-31 265 failed_register_drm: b80df10f845813 lishuo 2024-01-31 266 phytium_pci_vram_fini(pdev, priv); b80df10f845813 lishuo 2024-01-31 267 failed_pci_vram_init: b80df10f845813 lishuo 2024-01-31 268 phytium_pci_private_fini(pdev, priv); b80df10f845813 lishuo 2024-01-31 269 failed_pci_private_init: b80df10f845813 lishuo 2024-01-31 270 if (pdev->msi_enabled) b80df10f845813 lishuo 2024-01-31 @271 pci_disable_msi(pdev); b80df10f845813 lishuo 2024-01-31 272 pci_disable_device(pdev); b80df10f845813 lishuo 2024-01-31 273 failed_enable_device: b80df10f845813 lishuo 2024-01-31 274 pci_set_drvdata(pdev, NULL); b80df10f845813 lishuo 2024-01-31 275 drm_dev_put(dev); b80df10f845813 lishuo 2024-01-31 276 b80df10f845813 lishuo 2024-01-31 277 return -1; b80df10f845813 lishuo 2024-01-31 278 } b80df10f845813 lishuo 2024-01-31 279 :::::: The code at line 236 was first introduced by commit :::::: b80df10f845813bb4fc2002b5386ecdfa8be5f6c DRM: Phytium display DRM driver :::::: TO: lishuo <lishuo(a)phytium.com.cn> :::::: CC: lishuo <lishuo(a)phytium.com.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION c9c7afae6802fd2282529d80c0f808360f7b654a
by kernel test robot 10 Oct '24

10 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c9c7afae6802fd2282529d80c0f808360f7b654a !12050 um: line: always fill *error_out in setup_one_line() Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/loongson/lsdc_plane.o: warning: objtool: lsdc_plane_init() falls through to next function lsdc_plane_reset() drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.o: warning: objtool: pvrdma_create_qp() falls through to next function pvrdma_destroy_qp() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-defconfig | `-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:warning:implicit-conversion-from-enum-hclge_ext_opcode_type-to-enum-hclge_opcode_type |-- arm64-randconfig-002-20241010 | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20241010 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-sched_setsteal | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-tg_change_steal | |-- ld.lld:error:duplicate-symbol:debug | |-- ld.lld:error:duplicate-symbol:lld_dev_hold | `-- ld.lld:error:duplicate-symbol:lld_dev_put |-- x86_64-buildonly-randconfig-001-20241010 | `-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init |-- x86_64-buildonly-randconfig-002-20241010 | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20241009 | `-- drivers-gpu-drm-loongson-lsdc_plane.o:warning:objtool:lsdc_plane_init-falls-through-to-next-function-lsdc_plane_reset() |-- x86_64-buildonly-randconfig-006-20241010 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-kexec | `-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction |-- x86_64-randconfig-016-20241009 | `-- drivers-fpga-dfl.o:warning:objtool:dfl_fpga_cdev_config_ports_pf:unreachable-instruction |-- x86_64-randconfig-075-20241009 | `-- drivers-infiniband-hw-vmw_pvrdma-pvrdma_qp.o:warning:objtool:pvrdma_create_qp-falls-through-to-next-function-pvrdma_destroy_qp() |-- x86_64-rhel-8.3 | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target |-- x86_64-rhel-8.3-func | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target `-- x86_64-rhel-8.3-kselftests `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target elapsed time: 805m configs tested: 19 configs skipped: 138 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20241010 clang-20 arm64 randconfig-002-20241010 clang-20 arm64 randconfig-003-20241010 clang-20 arm64 randconfig-004-20241010 clang-20 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241010 gcc-12 x86_64 buildonly-randconfig-002-20241010 clang-18 x86_64 buildonly-randconfig-003-20241010 clang-18 x86_64 buildonly-randconfig-004-20241010 gcc-12 x86_64 buildonly-randconfig-006-20241010 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 5d76abff5e121f2d916bcbc121f558c82e5dc221
by kernel test robot 10 Oct '24

10 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 5d76abff5e121f2d916bcbc121f558c82e5dc221 !12063 cpufreq: intel_pstate: Revise global turbo disable check Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-001-20241010 | |-- mm-share_pool.c:error:call-to-undeclared-function-huge_ptep_get-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- mm-share_pool.c:error:initializing-pte_t-with-an-expression-of-incompatible-type-int |-- arm64-randconfig-002-20241010 | |-- drivers-char-ipmi-ipmi_bt_sm.c:error:call-to-undeclared-function-acpi_evaluate_integer-ISO-C99-and-later-do-not-support-implicit-function-declarations | |-- drivers-ptp-ptp_hisi.c:warning:unused-variable-hisi_ptp_acpi_match | `-- kernel-cgroup-cgroup.c:error:use-of-undeclared-identifier-cgroup_psi_stat_show |-- loongarch-allmodconfig | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- x86_64-allyesconfig | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-buildonly-randconfig-001-20241010 | `-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node |-- x86_64-buildonly-randconfig-002-20241010 | `-- include-linux-psp-hygon.h:error:conflicting-types-for-vpsp_try_do_cmd |-- x86_64-rhel-8.3 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-func | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-kselftests | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst `-- x86_64-rhel-8.3-rust |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst elapsed time: 778m configs tested: 16 configs skipped: 101 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241010 clang-20 arm64 randconfig-002-20241010 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241010 gcc-12 x86_64 buildonly-randconfig-002-20241010 clang-18 x86_64 buildonly-randconfig-003-20241010 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ELF: fix kernel.randomize_va_space double read
by Gu Bowen 09 Oct '24

09 Oct '24

From: Alexey Dobriyan <adobriyan(a)gmail.com> stable inclusion from stable-v6.6.51 commit 53f17409abf61f66b6f05aff795e938e5ba811d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NT CVE: CVE-2024-46826 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a97388a807b6ab5538aa8f8537b2463c6988bd2 ] ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences. Issue exactly one load for consistent value across one exec. Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> Link: https://lore.kernel.org/r/3329905c-7eb8-400a-8f0a-d87cff979b5b@p183 Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- fs/binfmt_elf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 7b3d2d491407..fb2c8d14327a 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -1008,7 +1008,8 @@ static int load_elf_binary(struct linux_binprm *bprm) if (elf_read_implies_exec(*elf_ex, executable_stack)) current->personality |= READ_IMPLIES_EXEC; - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) + const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space); + if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space) current->flags |= PF_RANDOMIZE; setup_new_exec(bprm); @@ -1300,7 +1301,7 @@ static int load_elf_binary(struct linux_binprm *bprm) mm->end_data = end_data; mm->start_stack = bprm->p; - if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) { + if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) { /* * For architectures with ELF randomization, when executing * a loader directly (i.e. no interpreter listed in ELF -- 2.25.1

2 1

[PATCH OLK-6.6] drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ
by liwei 09 Oct '24

09 Oct '24

From: Marek Vasut <marex(a)denx.de> mainline inclusion from mainline-v6.11-rc1 commit 162e48cb1d84c2c966b649b8ac5c9d4f75f6d44f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUAT8 CVE: CVE-2024-46810 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Make sure the connector is fully initialized before signalling any HPD events via drm_kms_helper_hotplug_event(), otherwise this may lead to NULL pointer dereference. Signed-off-by: Marek Vasut <marex(a)denx.de> Reviewed-by: Robert Foss <rfoss(a)kernel.org> Signed-off-by: Robert Foss <rfoss(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240531203333.277476-1-marex… Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/gpu/drm/bridge/tc358767.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c index d941c3a0e611..7fd4a5fe03ed 100644 --- a/drivers/gpu/drm/bridge/tc358767.c +++ b/drivers/gpu/drm/bridge/tc358767.c @@ -2034,7 +2034,7 @@ static irqreturn_t tc_irq_handler(int irq, void *arg) dev_err(tc->dev, "syserr %x\n", stat); } - if (tc->hpd_pin >= 0 && tc->bridge.dev) { + if (tc->hpd_pin >= 0 && tc->bridge.dev && tc->aux.drm_dev) { /* * H is triggered when the GPIO goes high. * -- 2.25.1

2 1

[PATCH OLK-5.10] blk-mq: fix lockdep hardirq warning in __blk_mq_tag_idle()
by Yu Kuai 09 Oct '24

09 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAVONP CVE: NA -------------------------------- commit c6f9c0e2d53d ("blk-mq: allow hardware queue to get more tag while sharing a tag set") started to call blk_mq_tag_idle() from hardirq context. And later commit 1b6433f06bda ("blk-mq: fix potential io hang by wrong 'wake_batch'") add spin_unlock_irq() in blk_mq_tag_idle(), which may enable interrupt in hardirq context, and may trigger AA deadlock. Fixes: 1b6433f06bda ("blk-mq: fix potential io hang by wrong 'wake_batch'") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- block/blk-mq-tag.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index 73c046bc3d90..dd4f9bdcb8c2 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -85,6 +85,7 @@ void __blk_mq_tag_idle(struct blk_mq_hw_ctx *hctx) { struct blk_mq_tags *tags = hctx->tags; unsigned int users; + unsigned long flags; if (blk_mq_is_sbitmap_shared(hctx->flags)) { struct request_queue *q = hctx->queue; @@ -97,10 +98,10 @@ void __blk_mq_tag_idle(struct blk_mq_hw_ctx *hctx) return; } - spin_lock_irq(&tags->lock); + spin_lock_irqsave(&tags->lock, flags); users = atomic_dec_return(&tags->active_queues); blk_mq_update_wake_batch(tags, users); - spin_unlock_irq(&tags->lock); + spin_unlock_irqrestore(&tags->lock, flags); blk_mq_tag_wakeup_all(tags, false); } -- 2.39.2

2 1

[PATCH OLK-6.6] drm/amd/display: Check index for aux_rd_interval before using
by Qi Xi 09 Oct '24

09 Oct '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit 9ba2ea6337b4f159aecb177555a6a81da92d302e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV7O CVE: CVE-2024-46728 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- aux_rd_interval has size of 7 and should be checked. This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- .../gpu/drm/amd/display/dc/link/protocols/link_dp_training.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c index 16a62e018712..9d1adfc09fb2 100644 --- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c +++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c @@ -914,10 +914,10 @@ static enum dc_status configure_lttpr_mode_non_transparent( /* Driver does not need to train the first hop. Skip DPCD read and clear * AUX_RD_INTERVAL for DPTX-to-DPIA hop. */ - if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA) + if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA && repeater_cnt > 0 && repeater_cnt < MAX_REPEATER_CNT) link->dpcd_caps.lttpr_caps.aux_rd_interval[--repeater_cnt] = 0; - for (repeater_id = repeater_cnt; repeater_id > 0; repeater_id--) { + for (repeater_id = repeater_cnt; repeater_id > 0 && repeater_id < MAX_REPEATER_CNT; repeater_id--) { aux_interval_address = DP_TRAINING_AUX_RD_INTERVAL_PHY_REPEATER1 + ((DP_REPEATER_CONFIGURATION_AND_STATUS_SIZE) * (repeater_id - 1)); core_link_read_dpcd( -- 2.25.1

2 1

[PATCH OLK-5.10] kprobes: Fix deadlock issue with kmemleak
by Zheng Yejian 09 Oct '24

09 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K8D1 ----------------------------------------- There is following deadlock issue: CPU0 CPU1 ==== ==== kretprobe_trampoline kmem_cache_alloc trampoline_handler kmemleak_alloc __kretprobe_trampoline_handler create_object kretprobe_hash_lock <-- hold kmemleak lock <-- hold kretprobe table lock __link_object recycle_rp_inst stack_trace_save kfree_rcu kvfree_call_rcu ... kmemleak_ignore unwind_next_frame kretprobe_find_ret_addr <-- wait for kmemleak lock kretprobe_hash_lock <-- wait for kretprobe table lock One task on CPU0 hold kretprobe_hash_lock and wait for kmemleak_lock, however, kmemleak_lock was held by other task on CPU1 and that task is waiting for kretprobe_hash_lock, then deadlock happended. To fix it, move kfree_rcu() out of kretprobe table lock area. Fixes: 88fef946364b ("kprobes: Add kretprobe_find_ret_addr() for searching return address") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/kprobes.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index dacb71214fa1..5d64d97975ba 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1223,7 +1223,7 @@ void kprobes_inc_nmissed_count(struct kprobe *p) } NOKPROBE_SYMBOL(kprobes_inc_nmissed_count); -static void recycle_rp_inst(struct kretprobe_instance *ri) +static void recycle_rp_inst(struct kretprobe_instance *ri, struct hlist_head *head) { struct kretprobe *rp = ri->rp; @@ -1235,7 +1235,7 @@ static void recycle_rp_inst(struct kretprobe_instance *ri) hlist_add_head(&ri->hlist, &rp->free_instances); raw_spin_unlock(&rp->lock); } else - kfree_rcu(ri, rcu); + hlist_add_head(&ri->hlist, head); } NOKPROBE_SYMBOL(recycle_rp_inst); @@ -1326,6 +1326,7 @@ void kprobe_flush_task(struct task_struct *tk) struct hlist_head *head; struct hlist_node *tmp; unsigned long hash, flags = 0; + HLIST_HEAD(empty_rp); if (unlikely(!kprobes_initialized)) /* Early boot. kretprobe_table_locks not yet initialized. */ @@ -1338,10 +1339,16 @@ void kprobe_flush_task(struct task_struct *tk) kretprobe_table_lock(hash, &flags); hlist_for_each_entry_safe(ri, tmp, head, hlist) { if (ri->task == tk) - recycle_rp_inst(ri); + recycle_rp_inst(ri, &empty_rp); } kretprobe_table_unlock(hash, &flags); + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + INIT_HLIST_NODE(&ri->hlist); + kfree_rcu(ri, rcu); + } + kprobe_busy_end(); } NOKPROBE_SYMBOL(kprobe_flush_task); @@ -2014,6 +2021,7 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, unsigned long flags; kprobe_opcode_t *correct_ret_addr = NULL; bool skipped = false; + HLIST_HEAD(empty_rp); kretprobe_hash_lock(current, &head, &flags); @@ -2082,7 +2090,7 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, __this_cpu_write(current_kprobe, prev); } - recycle_rp_inst(ri); + recycle_rp_inst(ri, &empty_rp); if (ri == last) break; @@ -2090,6 +2098,12 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs, kretprobe_hash_unlock(current, &flags); + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + INIT_HLIST_NODE(&ri->hlist); + kfree_rcu(ri, rcu); + } + return (unsigned long)correct_ret_addr; } NOKPROBE_SYMBOL(__kretprobe_trampoline_handler) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] btrfs: clean up our handling of refs == 0 in snapshot delete
by Baokun Li 09 Oct '24

09 Oct '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v4.19.322 commit c847b28a799733b04574060ab9d00f215970627d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NE CVE: CVE-2024-46840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b8ccef048354074a548f108e51d0557d6adfd3a3 ] In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walk_down_proc we also BUG_ON(refs == 0), which could happen if we have extent tree corruption. Change that to return -EUCLEAN. In do_walk_down() we catch this case and handle it correctly, however we return -EIO, which -EUCLEAN is a more appropriate error code. Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert that to proper error handling. Also adjust the error message so we can actually do something with the information. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent-tree.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index e579e19ebd4b..8207c202e498 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -8400,7 +8400,15 @@ static noinline void reada_walk_down(struct btrfs_trans_handle *trans, /* We don't care about errors in readahead. */ if (ret < 0) continue; - BUG_ON(refs == 0); + + /* + * This could be racey, it's conceivable that we raced and end + * up with a bogus refs count, if that's the case just skip, if + * we are actually corrupt we will notice when we look up + * everything again with our locks. + */ + if (refs == 0) + continue; if (wc->stage == DROP_REFERENCE) { if (refs == 1) @@ -8467,7 +8475,11 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, BUG_ON(ret == -ENOMEM); if (ret) return ret; - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } } if (wc->stage == DROP_REFERENCE) { @@ -8575,8 +8587,9 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans, goto out_unlock; if (unlikely(wc->refs[level - 1] == 0)) { - btrfs_err(fs_info, "Missing references."); - ret = -EIO; + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + bytenr); + ret = -EUCLEAN; goto out_unlock; } *lookup_info = 0; @@ -8744,7 +8757,12 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, path->locks[level] = 0; return ret; } - BUG_ON(wc->refs[level] == 0); + if (unlikely(wc->refs[level] == 0)) { + btrfs_tree_unlock_rw(eb, path->locks[level]); + btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0", + eb->start); + return -EUCLEAN; + } if (wc->refs[level] == 1) { btrfs_tree_unlock_rw(eb, path->locks[level]); path->locks[level] = 0; -- 2.31.1

2 1

[openeuler:OLK-5.10 11219/30000] vmlinux.o: warning: objtool: do_syscall_64()+0x46: call to memset() leaves .noinstr.text section
by kernel test robot 09 Oct '24

09 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411e7ef551c128efdf5b4e53cc01245ba85b3817 commit: 130620d5878d2348208258965876547a69353f9f [11219/30000] x86/entry: Enable random_kstack_offset support config: x86_64-buildonly-randconfig-006-20241009 (https://download.01.org/0day-ci/archive/20241009/202410091420.7w9TkxwA-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241009/202410091420.7w9TkxwA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410091420.7w9TkxwA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> vmlinux.o: warning: objtool: do_syscall_64()+0x46: call to memset() leaves .noinstr.text section vmlinux.o: warning: objtool: fixup_bad_iret()+0x36: call to memset() leaves .noinstr.text section ld.lld: error: undefined symbol: __tsan_memset >>> referenced by do_mounts.c >>> do_mounts.o:(name_to_dev_t) in archive init/built-in.a >>> referenced by do_mounts.c >>> do_mounts.o:(mount_block_root) in archive init/built-in.a >>> referenced by vsyscall_64.c >>> entry/vsyscall/vsyscall_64.o:(trace_event_raw_event_emulate_vsyscall) in archive arch/x86/built-in.a >>> referenced 14932 more times -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

openEuler Kernel SIG双周例会
by openEuler conference 09 Oct '24

09 Oct '24

您好！ Kernel 邀请您参加 2024-10-11 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填写至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/960499088 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-10-11 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填写至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/960499088. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
by Wupeng Ma 09 Oct '24

09 Oct '24

From: Hans de Goede <hdegoede(a)redhat.com> stable inclusion from stable-v6.6.52 commit 6821a82616f60aa72c5909b3e252ad97fb9f7e2a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUA6B CVE: CVE-2024-46859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4 upstream. The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute. Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load if the SINF array is smaller. For higher SINF indexes hide the sysfs attributes when the SINF array does not contain an entry for that attribute, avoiding show()/store() accessing the array out of bounds and add bounds checking to the probe() and resume() code accessing these. Fixes: e424fb8cc4e6 ("panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add()") Cc: stable(a)vger.kernel.org Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20240909113227.254470-1-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/platform/x86/panasonic-laptop.c [Ma Wupeng: mode SINF_ECO_MODE, SINF_CUR_BRIGHT do not exist until 5.11] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/platform/x86/panasonic-laptop.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c index 8361ad75389a..71e55d90f712 100644 --- a/drivers/platform/x86/panasonic-laptop.c +++ b/drivers/platform/x86/panasonic-laptop.c @@ -429,6 +429,18 @@ static DEVICE_ATTR(lcdtype, S_IRUGO, show_lcdtype, NULL); static DEVICE_ATTR(mute, S_IRUGO, show_mute, NULL); static DEVICE_ATTR(sticky_key, S_IRUGO | S_IWUSR, show_sticky, set_sticky); +static umode_t pcc_sysfs_is_visible(struct kobject *kobj, struct attribute *attr, int idx) +{ + struct device *dev = kobj_to_dev(kobj); + struct acpi_device *acpi = to_acpi_device(dev); + struct pcc_acpi *pcc = acpi_driver_data(acpi); + + if (attr == &dev_attr_mute.attr) + return (pcc->num_sifr > SINF_MUTE) ? attr->mode : 0; + + return attr->mode; +} + static struct attribute *pcc_sysfs_entries[] = { &dev_attr_numbatt.attr, &dev_attr_lcdtype.attr, @@ -438,8 +450,9 @@ static struct attribute *pcc_sysfs_entries[] = { }; static const struct attribute_group pcc_attr_group = { - .name = NULL, /* put in device directory */ - .attrs = pcc_sysfs_entries, + .name = NULL, /* put in device directory */ + .attrs = pcc_sysfs_entries, + .is_visible = pcc_sysfs_is_visible, }; @@ -559,8 +572,12 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) num_sifr = acpi_pcc_get_sqty(device); - if (num_sifr < 0 || num_sifr > 255) { - ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "num_sifr out of range")); + /* + * pcc->sinf is expected to at least have the AC+DC brightness entries. + * Accesses to higher SINF entries are checked against num_sifr. + */ + if (num_sifr <= SINF_DC_CUR_BRIGHT || num_sifr > 255) { + ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "num_sifr %d out of range %d - 255\n", num_sifr, SINF_DC_CUR_BRIGHT + 1)); return -ENODEV; } -- 2.25.1

2 1

[PATCH OLK-6.6] usb: gadget: aspeed_udc: validate endpoint index for ast udc
by Gu Bowen 09 Oct '24

09 Oct '24

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v6.6.51 commit b2a50ffdd1a079869a62198a8d1441355c513c7c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NW CVE: CVE-2024-46836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ee0d382feb44ec0f445e2ad63786cd7f3f6a8199 ] We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis. Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Reviewed-by: Andrew Jeffery <andrew(a)codeconstruct.com.au> Acked-by: Andrew Jeffery <andrew(a)codeconstruct.com.au> Link: https://lore.kernel.org/r/20240625022306.2568122-1-make24@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/usb/gadget/udc/aspeed_udc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/gadget/udc/aspeed_udc.c b/drivers/usb/gadget/udc/aspeed_udc.c index fc2ead0fe621..4868286574a1 100644 --- a/drivers/usb/gadget/udc/aspeed_udc.c +++ b/drivers/usb/gadget/udc/aspeed_udc.c @@ -1009,6 +1009,8 @@ static void ast_udc_getstatus(struct ast_udc_dev *udc) break; case USB_RECIP_ENDPOINT: epnum = crq.wIndex & USB_ENDPOINT_NUMBER_MASK; + if (epnum >= AST_UDC_NUM_ENDPOINTS) + goto stall; status = udc->ep[epnum].stopped; break; default: -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/display: added NULL check at start of dc_validate_stream
by Yu Liao 09 Oct '24

09 Oct '24

From: winstang <winstang(a)amd.com> stable inclusion from stable-v6.6.50 commit 154a50bf4221a6a6ccf88d565b8184da7c40a2dd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9N4 CVE: CVE-2024-46802 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26c56049cc4f1705b498df013949427692a4b0d5 ] [Why] prevent invalid memory access [How] check if dc and stream are NULL Co-authored-by: winstang <winstang(a)amd.com> Reviewed-by: Alvin Lee <alvin.lee2(a)amd.com> Acked-by: Zaeem Mohamed <zaeem.mohamed(a)amd.com> Signed-off-by: winstang <winstang(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index 84923c5400d3..733e445331ea 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -3927,6 +3927,9 @@ void resource_build_bit_depth_reduction_params(struct dc_stream_state *stream, enum dc_status dc_validate_stream(struct dc *dc, struct dc_stream_state *stream) { + if (dc == NULL || stream == NULL) + return DC_ERROR_UNEXPECTED; + struct dc_link *link = stream->link; struct timing_generator *tg = dc->res_pool->timing_generators[0]; enum dc_status res = DC_OK; -- 2.33.0

2 1

[openeuler:OLK-5.10 28633/30000] arch/x86/kernel/paravirt.c:65:2: error: implicit declaration of function '__text_gen_insn'
by kernel test robot 09 Oct '24

09 Oct '24

Hi Peter, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 17befaf8efea2ff937fa7e0d754885a67f67ce71 commit: 822da186955cbcd69b4715b8a307053e6c756f30 [28633/30000] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() config: x86_64-buildonly-randconfig-002-20241009 (https://download.01.org/0day-ci/archive/20241009/202410091222.YZTQ9zgW-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241009/202410091222.YZTQ9zgW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410091222.YZTQ9zgW-lkp@intel.com/ All errors (new ones prefixed by >>): >> arch/x86/kernel/paravirt.c:65:2: error: implicit declaration of function '__text_gen_insn' [-Werror,-Wimplicit-function-declaration] 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^ >> arch/x86/kernel/paravirt.c:65:29: error: use of undeclared identifier 'CALL_INSN_OPCODE' 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^ >> arch/x86/kernel/paravirt.c:66:26: error: use of undeclared identifier 'CALL_INSN_SIZE' 66 | (void *)addr, target, CALL_INSN_SIZE); | ^ arch/x86/kernel/paravirt.c:67:9: error: use of undeclared identifier 'CALL_INSN_SIZE' 67 | return CALL_INSN_SIZE; | ^ arch/x86/kernel/paravirt.c:327:4: warning: cast from 'void (*)(struct mmu_gather *, struct page *)' to 'void (*)(struct mmu_gather *, void *)' converts to incompatible function type [-Wcast-function-type-strict] 327 | (void (*)(struct mmu_gather *, void *))tlb_remove_page, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning and 4 errors generated. vim +/__text_gen_insn +65 arch/x86/kernel/paravirt.c 61 62 static unsigned paravirt_patch_call(void *insn_buff, const void *target, 63 unsigned long addr, unsigned len) 64 { > 65 __text_gen_insn(insn_buff, CALL_INSN_OPCODE, > 66 (void *)addr, target, CALL_INSN_SIZE); 67 return CALL_INSN_SIZE; 68 } 69 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] cpufreq: intel_pstate: Revise global turbo disable check
by Yipeng Zou 09 Oct '24

09 Oct '24

From: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> mainline inclusion from mainline-v6.7-rc1 commit 37b6ddba967c601479bea418a7ac6ff16b6232b7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAVI54 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Setting global turbo flag based on CPU 0 P-state limits is problematic as it limits max P-state request on every CPU on the system just based on its P-state limits. There are two cases in which global.turbo_disabled flag is set: - When the MSR_IA32_MISC_ENABLE_TURBO_DISABLE bit is set to 1 in the MSR MSR_IA32_MISC_ENABLE. This bit can be only changed by the system BIOS before power up. - When the max non turbo P-state is same as max turbo P-state for CPU 0. The second check is not a valid to decide global turbo state based on the CPU 0. CPU 0 max turbo P-state can be same as max non turbo P-state, but for other CPUs this may not be true. There is no guarantee that max P-state limits are same for every CPU. This is possible that during fusing max P-state for a CPU is constrained. Also with the Intel Speed Select performance profile, CPU 0 may not be present in all profiles. In this case the max non turbo and turbo P-state can be set to the lowest possible P-state by the hardware when switched to such profile. Since max non turbo and turbo P-state is same, global.turbo_disabled flag will be set. Once global.turbo_disabled is set, any scaling max and min frequency update for any CPU will result in its max P-state constrained to the max non turbo P-state. Hence remove the check of max non turbo P-state equal to max turbo P-state of CPU 0 to set global turbo disabled flag. Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> [ rjw: Subject edit ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/cpufreq/intel_pstate.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c index 0ee3a04bb102..c563f70d084d 100644 --- a/drivers/cpufreq/intel_pstate.c +++ b/drivers/cpufreq/intel_pstate.c @@ -595,13 +595,9 @@ static void intel_pstate_hybrid_hwp_adjust(struct cpudata *cpu) static inline void update_turbo_state(void) { u64 misc_en; - struct cpudata *cpu; - cpu = all_cpu_data[0]; rdmsrl(MSR_IA32_MISC_ENABLE, misc_en); - global.turbo_disabled = - (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE || - cpu->pstate.max_pstate == cpu->pstate.turbo_pstate); + global.turbo_disabled = misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE; } static int min_perf_pct_min(void) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-46857
by Zhang Changzhong 09 Oct '24

09 Oct '24

Benjamin Poirier (1): net/mlx5: Fix bridge mode operations when there are no VFs Chris Mi (1): net/mlx5: E-switch, Introduce flag to indicate if fdb table is created drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 7 +++++-- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 9 +++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) -- 2.9.5

2 3

[openeuler:OLK-6.6 3892/14286] include/linux/mmzone.h:1788:2: error: #error Allocator MAX_ORDER exceeds SECTION_SIZE
by kernel test robot 09 Oct '24

09 Oct '24

Hi zhangtianyang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fb512ada4da1a8aefba17392d87452a37796a0f2 commit: c93eb12529e21dbb59796132f4fdf75fad4eddaf [3892/14286] LoongArch: Adapted SECTION_SIZE_BITS with page size config: loongarch-randconfig-002-20241009 (https://download.01.org/0day-ci/archive/20241009/202410091038.th2Iv8Hi-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241009/202410091038.th2Iv8Hi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410091038.th2Iv8Hi-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/gfp.h:7, from include/linux/mm.h:7, from arch/loongarch/kernel/asm-offsets.c:9: >> include/linux/mmzone.h:1788:2: error: #error Allocator MAX_ORDER exceeds SECTION_SIZE 1788 | #error Allocator MAX_ORDER exceeds SECTION_SIZE | ^~~~~ arch/loongarch/kernel/asm-offsets.c:18:6: warning: no previous prototype for 'output_ptreg_defines' [-Wmissing-prototypes] 18 | void output_ptreg_defines(void) | ^~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:65:6: warning: no previous prototype for 'output_task_defines' [-Wmissing-prototypes] 65 | void output_task_defines(void) | ^~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:80:6: warning: no previous prototype for 'output_thread_info_defines' [-Wmissing-prototypes] 80 | void output_thread_info_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:96:6: warning: no previous prototype for 'output_thread_defines' [-Wmissing-prototypes] 96 | void output_thread_defines(void) | ^~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:132:6: warning: no previous prototype for 'output_thread_fpu_defines' [-Wmissing-prototypes] 132 | void output_thread_fpu_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:173:6: warning: no previous prototype for 'output_thread_lbt_defines' [-Wmissing-prototypes] 173 | void output_thread_lbt_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:183:6: warning: no previous prototype for 'output_mm_defines' [-Wmissing-prototypes] 183 | void output_mm_defines(void) | ^~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:215:6: warning: no previous prototype for 'output_sc_defines' [-Wmissing-prototypes] 215 | void output_sc_defines(void) | ^~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:223:6: warning: no previous prototype for 'output_signal_defines' [-Wmissing-prototypes] 223 | void output_signal_defines(void) | ^~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:261:6: warning: no previous prototype for 'output_smpboot_defines' [-Wmissing-prototypes] 261 | void output_smpboot_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:294:6: warning: no previous prototype for 'output_kvm_defines' [-Wmissing-prototypes] 294 | void output_kvm_defines(void) | ^~~~~~~~~~~~~~~~~~ make[3]: *** [scripts/Makefile.build:116: arch/loongarch/kernel/asm-offsets.s] Error 1 shuffle=526995723 make[3]: Target 'prepare' not remade because of errors. make[2]: *** [Makefile:1202: prepare0] Error 2 shuffle=526995723 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 shuffle=526995723 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 shuffle=526995723 make: Target 'prepare' not remade because of errors. vim +1788 include/linux/mmzone.h d41dee369bff3b Andy Whitcroft 2005-06-23 1783 835c134ec4dd75 Mel Gorman 2007-10-16 1784 #define SECTION_BLOCKFLAGS_BITS \ d9c2340052278d Mel Gorman 2007-10-16 1785 ((1UL << (PFN_SECTION_SHIFT - pageblock_order)) * NR_PAGEBLOCK_BITS) 835c134ec4dd75 Mel Gorman 2007-10-16 1786 23baf831a32c04 Kirill A. Shutemov 2023-03-15 1787 #if (MAX_ORDER + PAGE_SHIFT) > SECTION_SIZE_BITS d41dee369bff3b Andy Whitcroft 2005-06-23 @1788 #error Allocator MAX_ORDER exceeds SECTION_SIZE d41dee369bff3b Andy Whitcroft 2005-06-23 1789 #endif d41dee369bff3b Andy Whitcroft 2005-06-23 1790 :::::: The code at line 1788 was first introduced by commit :::::: d41dee369bff3b9dcb6328d4d822926c28cc2594 [PATCH] sparsemem memory model :::::: TO: Andy Whitcroft <apw(a)shadowen.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net/mlx5: Fix bridge mode operations when there are no VFs
by Zhang Changzhong 09 Oct '24

09 Oct '24

From: Benjamin Poirier <bpoirier(a)nvidia.com> stable inclusion from stable-v6.6.52 commit 65feee671e37f3b6eda0b6af28f204b5bcf7fa50 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OW CVE: CVE-2024-46857 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b1d305abef4640af1b4f1b4774d513cd81b10cfc ] Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa [ 168.967392] BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] [ 168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core] [...] [ 168.976037] Call Trace: [ 168.976188] <TASK> [ 168.978620] _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core] [ 168.979074] mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core] [ 168.979471] rtnl_bridge_setlink+0xe9/0x1f0 [ 168.979714] rtnetlink_rcv_msg+0x159/0x400 [ 168.980451] netlink_rcv_skb+0x54/0x100 [ 168.980675] netlink_unicast+0x241/0x360 [ 168.980918] netlink_sendmsg+0x1f6/0x430 [ 168.981162] ____sys_sendmsg+0x3bb/0x3f0 [ 168.982155] ___sys_sendmsg+0x88/0xd0 [ 168.985036] __sys_sendmsg+0x59/0xa0 [ 168.985477] do_syscall_64+0x79/0x150 [ 168.987273] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 168.987773] RIP: 0033:0x7f8f7950f917 (esw->fdb_table.legacy.vepa_fdb is null) The bridge mode is only relevant when there are multiple functions per port. Therefore, prevent setting and getting this setting when there are no VFs. Note that after this change, there are no settings to change on the PF interface using `bridge link` when there are no VFs, so the interface no longer appears in the `bridge link` output. Fixes: 4b89251de024 ("net/mlx5: Support ndo bridge_setlink and getlink") Signed-off-by: Benjamin Poirier <bpoirier(a)nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu(a)nvidia.com> Signed-off-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c index 255bc8b..8587cd5 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c @@ -319,7 +319,7 @@ int mlx5_eswitch_set_vepa(struct mlx5_eswitch *esw, u8 setting) return -EPERM; mutex_lock(&esw->state_lock); - if (esw->mode != MLX5_ESWITCH_LEGACY) { + if (esw->mode != MLX5_ESWITCH_LEGACY || !mlx5_esw_is_fdb_created(esw)) { err = -EOPNOTSUPP; goto out; } @@ -339,7 +339,7 @@ int mlx5_eswitch_get_vepa(struct mlx5_eswitch *esw, u8 *setting) if (!mlx5_esw_allowed(esw)) return -EPERM; - if (esw->mode != MLX5_ESWITCH_LEGACY) + if (esw->mode != MLX5_ESWITCH_LEGACY || !mlx5_esw_is_fdb_created(esw)) return -EOPNOTSUPP; *setting = esw->fdb_table.legacy.vepa_uplink_rule ? 1 : 0; -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-46857
by Zhang Changzhong 09 Oct '24

09 Oct '24

Benjamin Poirier (1): net/mlx5: Fix bridge mode operations when there are no VFs Chris Mi (1): net/mlx5: E-switch, Introduce flag to indicate if fdb table is created drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 7 +++++-- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 9 +++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) -- 2.9.5

2 3

[PATCH OLK-6.6] mptcp: pm: Fix uaf in __timer_delete_sync
by Wang Liang 09 Oct '24

09 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.52 commit 6452b162549c7f9ef54655d3fb9977b9192e6e5b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9JW CVE: CVE-2024-46858 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b4cd80b0338945a94972ac3ed54f8338d2da2076 upstream. There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb genl_rcv __netif_receive_skb_one_core netlink_rcv_skb NF_HOOK genl_rcv_msg ip_local_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit tcp_v4_do_rcv mptcp_nl_remove_addrs_list tcp_rcv_established mptcp_pm_remove_addrs_and_subflows tcp_data_queue remove_anno_list_by_saddr mptcp_incoming_options mptcp_pm_del_add_timer mptcp_pm_del_add_timer kfree(entry) In remove_anno_list_by_saddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1). Keeping a reference to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer". Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock, do not directly access any members of the entry outside the pm lock, which can avoid similar "entry->x" uaf. Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable(a)vger.kernel.org Reported-and-tested-by: syzbot+f3a31fb909db9b2a5c4d(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f3a31fb909db9b2a5c4d Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://patch.msgid.link/tencent_7142963A37944B4A74EF76CD66EA3C253609@qq.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mptcp/pm_netlink.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index aa56696cdc78..9a696e8ec060 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -336,15 +336,21 @@ mptcp_pm_del_add_timer(struct mptcp_sock *msk, { struct mptcp_pm_add_entry *entry; struct sock *sk = (struct sock *)msk; + struct timer_list *add_timer = NULL; spin_lock_bh(&msk->pm.lock); entry = mptcp_lookup_anno_list_by_saddr(msk, addr); - if (entry && (!check_id || entry->addr.id == addr->id)) + if (entry && (!check_id || entry->addr.id == addr->id)) { entry->retrans_times = ADD_ADDR_RETRANS_MAX; + add_timer = &entry->add_timer; + } + if (!check_id && entry) + list_del(&entry->list); spin_unlock_bh(&msk->pm.lock); - if (entry && (!check_id || entry->addr.id == addr->id)) - sk_stop_timer_sync(sk, &entry->add_timer); + /* no lock, because sk_stop_timer_sync() is calling del_timer_sync() */ + if (add_timer) + sk_stop_timer_sync(sk, add_timer); return entry; } @@ -1405,7 +1411,6 @@ static bool remove_anno_list_by_saddr(struct mptcp_sock *msk, entry = mptcp_pm_del_add_timer(msk, addr, false); if (entry) { - list_del(&entry->list); kfree(entry); return true; } -- 2.34.1

2 1

[PATCH OLK-6.6] net: dpaa: Pad packets to ETH_ZLEN
by Wang Liang 09 Oct '24

09 Oct '24

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v6.6.52 commit 34fcac26216ce17886af3eb392355b459367af1a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9O1 CVE: CVE-2024-46854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 ] When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running $ ping -s 11 destination Fixes: 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240910143144.1439910-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c index dcbc598b11c6..816c71c4a131 100644 --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c @@ -2277,12 +2277,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); - bool nonlinear = skb_is_nonlinear(skb); struct rtnl_link_stats64 *percpu_stats; struct dpaa_percpu_priv *percpu_priv; struct netdev_queue *txq; struct dpaa_priv *priv; struct qm_fd fd; + bool nonlinear; int offset = 0; int err = 0; @@ -2292,6 +2292,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) qm_fd_clear_fd(&fd); + /* Packet data is always read as 32-bit words, so zero out any part of + * the skb which might be sent if we have to pad the packet + */ + if (__skb_put_padto(skb, ETH_ZLEN, false)) + goto enomem; + + nonlinear = skb_is_nonlinear(skb); if (!nonlinear) { /* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: nft_socket: fix sk refcount leaks
by Wang Liang 09 Oct '24

09 Oct '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v6.6.52 commit 83e6fb59040e8964888afcaa5612cc1243736715 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9K2 CVE: CVE-2024-46855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c ] We must put 'sk' reference before returning. Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nft_socket.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c index f30163e2ca62..765ffd6e06bc 100644 --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -110,13 +110,13 @@ static void nft_socket_eval(const struct nft_expr *expr, *dest = READ_ONCE(sk->sk_mark); } else { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } break; case NFT_SOCKET_WILDCARD: if (!sk_fullsock(sk)) { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } nft_socket_wildcard(pkt, regs, sk, dest); break; @@ -124,7 +124,7 @@ static void nft_socket_eval(const struct nft_expr *expr, case NFT_SOCKET_CGROUPV2: if (!nft_sock_get_eval_cgroupv2(dest, sk, pkt, priv->level)) { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } break; #endif @@ -133,6 +133,7 @@ static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } +out_put_sk: if (sk != skb->sk) sock_gen_put(sk); } -- 2.34.1

2 1

[PATCH OLK-5.10] drm/i915/gt: Cleanup partial engine discovery failures
by Yu Liao 09 Oct '24

09 Oct '24

From: Chris Wilson <chris.p.wilson(a)intel.com> mainline inclusion from mainline-v6.2-rc1 commit 78a033433a5ae4fee85511ee075bc9a48312c79e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIK8 CVE: CVE-2022-48893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If we abort driver initialisation in the middle of gt/engine discovery, some engines will be fully setup and some not. Those incompletely setup engines only have 'engine->release == NULL' and so will leak any of the common objects allocated. v2: - Drop the destroy_pinned_context() helper for now. It's not really worth it with just a single callsite at the moment. (Janusz) Signed-off-by: Chris Wilson <chris.p.wilson(a)intel.com> Cc: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Matt Roper <matthew.d.roper(a)intel.com> Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220915232654.3283095-2-matt… Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index c940ac3aae2f..5bec331c0813 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -905,8 +905,13 @@ int intel_engines_init(struct intel_gt *gt) return err; err = setup(engine); - if (err) + if (err) { + intel_engine_cleanup_common(engine); return err; + } + + /* The backend should now be responsible for cleanup */ + GEM_BUG_ON(engine->release == NULL); err = engine_init_common(engine); if (err) -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/i915/gt: Cleanup partial engine discovery failures
by Yu Liao 09 Oct '24

09 Oct '24

From: Chris Wilson <chris.p.wilson(a)intel.com> mainline inclusion from mainline-v6.2-rc1 commit 78a033433a5ae4fee85511ee075bc9a48312c79e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIK8 CVE: CVE-2022-48893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If we abort driver initialisation in the middle of gt/engine discovery, some engines will be fully setup and some not. Those incompletely setup engines only have 'engine->release == NULL' and so will leak any of the common objects allocated. v2: - Drop the destroy_pinned_context() helper for now. It's not really worth it with just a single callsite at the moment. (Janusz) Signed-off-by: Chris Wilson <chris.p.wilson(a)intel.com> Cc: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Matt Roper <matthew.d.roper(a)intel.com> Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220915232654.3283095-2-matt… Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index c940ac3aae2f..5bec331c0813 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -905,8 +905,13 @@ int intel_engines_init(struct intel_gt *gt) return err; err = setup(engine); - if (err) + if (err) { + intel_engine_cleanup_common(engine); return err; + } + + /* The backend should now be responsible for cleanup */ + GEM_BUG_ON(engine->release == NULL); err = engine_init_common(engine); if (err) -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amdgpu: the warning dereferencing obj for nbio_v7_4
by Liu Chuang 09 Oct '24

09 Oct '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v5.10.226 commit 614564a5b28983de53b23a358ebe6c483a2aa21e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OS CVE: CVE-2024-46819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit d190b459b2a4304307c3468ed97477b808381011 ] if ras_manager obj null, don't print NBIO err data Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Suggested-by: Tim Huang <Tim.Huang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c index eadc9526d33f..b81572dc115f 100644 --- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c @@ -313,7 +313,7 @@ static void nbio_v7_4_handle_ras_controller_intr_no_bifring(struct amdgpu_device RAS_CNTLR_INTERRUPT_CLEAR, 1); WREG32_SOC15(NBIO, 0, mmBIF_DOORBELL_INT_CNTL, bif_doorbell_intr_cntl); - if (!ras->disable_ras_err_cnt_harvest) { + if (ras && !ras->disable_ras_err_cnt_harvest && obj) { /* * clear error status after ras_controller_intr * according to hw team and count ue number -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amdgpu: the warning dereferencing obj for nbio_v7_4
by Liu Chuang 09 Oct '24

09 Oct '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v5.10.226 commit 614564a5b28983de53b23a358ebe6c483a2aa21e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OS CVE: CVE-2024-46819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit d190b459b2a4304307c3468ed97477b808381011 ] if ras_manager obj null, don't print NBIO err data Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Suggested-by: Tim Huang <Tim.Huang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c index eadc9526d33f..b81572dc115f 100644 --- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c @@ -313,7 +313,7 @@ static void nbio_v7_4_handle_ras_controller_intr_no_bifring(struct amdgpu_device RAS_CNTLR_INTERRUPT_CLEAR, 1); WREG32_SOC15(NBIO, 0, mmBIF_DOORBELL_INT_CNTL, bif_doorbell_intr_cntl); - if (!ras->disable_ras_err_cnt_harvest) { + if (ras && !ras->disable_ras_err_cnt_harvest && obj) { /* * clear error status after ras_controller_intr * according to hw team and count ue number -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amdgpu: the warning dereferencing obj for nbio_v7_4
by Liu Chuang 09 Oct '24

09 Oct '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit 7d265772e44d403071a2b573eac0db60250b1c21 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAU9OS CVE: CVE-2024-46819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d190b459b2a4304307c3468ed97477b808381011 ] if ras_manager obj null, don't print NBIO err data Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Suggested-by: Tim Huang <Tim.Huang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c index 685abf57ffdd..977b956bf930 100644 --- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c @@ -384,7 +384,7 @@ static void nbio_v7_4_handle_ras_controller_intr_no_bifring(struct amdgpu_device else WREG32_SOC15(NBIO, 0, mmBIF_DOORBELL_INT_CNTL, bif_doorbell_intr_cntl); - if (!ras->disable_ras_err_cnt_harvest) { + if (ras && !ras->disable_ras_err_cnt_harvest && obj) { /* * clear error status after ras_controller_intr * according to hw team and count ue number -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 313516d1ae36cc86a40f2b86642bc1bfec17f74e
by kernel test robot 09 Oct '24

09 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 313516d1ae36cc86a40f2b86642bc1bfec17f74e !11940 【OLK 5.10】RDMA/hns backport some bugfix from mainline linux Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410090839.I1WLy52U-lkp@intel.com arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'x16' in asm Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-defconfig | `-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:warning:implicit-conversion-from-enum-hclge_ext_opcode_type-to-enum-hclge_opcode_type |-- arm64-randconfig-001-20241009 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20241009 | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-sched_setsteal | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-tg_change_steal | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-buildonly-randconfig-001-20241009 | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20241009 | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-kexec | `-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction |-- x86_64-rhel-8.3 | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target |-- x86_64-rhel-8.3-func | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target `-- x86_64-rhel-8.3-kselftests `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target elapsed time: 736m configs tested: 17 configs skipped: 138 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20241009 clang-20 arm64 randconfig-002-20241009 clang-20 arm64 randconfig-003-20241009 gcc-14.1.0 arm64 randconfig-004-20241009 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241009 clang-18 x86_64 buildonly-randconfig-002-20241009 clang-18 x86_64 buildonly-randconfig-003-20241009 gcc-12 x86_64 buildonly-randconfig-004-20241009 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] um: line: always fill *error_out in setup_one_line()
by Tong Tiangen 09 Oct '24

09 Oct '24

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v6.6.51 commit ec5b47a370177d79ae7773858042c107e21f8ecc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NH CVE: CVE-2024-46844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 824ac4a5edd3f7494ab1996826c4f47f8ef0f63d ] The pointer isn't initialized by callers, but I have encountered cases where it's still printed; initialize it in all possible cases in setup_one_line(). Link: https://patch.msgid.link/20240703172235.ad863568b55f.Iaa1eba4db8265d7715ba7… Acked-By: Anton Ivanov <anton.ivanov(a)cambridgegreys.com> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- arch/um/drivers/line.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c index 375200e9aba9..2ba4e0d4e26b 100644 --- a/arch/um/drivers/line.c +++ b/arch/um/drivers/line.c @@ -383,6 +383,7 @@ int setup_one_line(struct line *lines, int n, char *init, parse_chan_pair(NULL, line, n, opts, error_out); err = 0; } + *error_out = "configured as 'none'"; } else { char *new = kstrdup(init, GFP_KERNEL); if (!new) { @@ -406,6 +407,7 @@ int setup_one_line(struct line *lines, int n, char *init, } } if (err) { + *error_out = "failed to parse channel pair"; line->init_str = NULL; line->valid = 0; kfree(new); -- 2.25.1

2 1

[PATCH OLK-5.10] um: line: always fill *error_out in setup_one_line()
by Tong Tiangen 09 Oct '24

09 Oct '24

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v5.10.226 commit c8944d449fda9f58c03bd99649b2df09948fc874 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NH CVE: CVE-2024-46844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 824ac4a5edd3f7494ab1996826c4f47f8ef0f63d ] The pointer isn't initialized by callers, but I have encountered cases where it's still printed; initialize it in all possible cases in setup_one_line(). Link: https://patch.msgid.link/20240703172235.ad863568b55f.Iaa1eba4db8265d7715ba7… Acked-By: Anton Ivanov <anton.ivanov(a)cambridgegreys.com> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- arch/um/drivers/line.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c index 37e96ba0f5fb..d2beb4a497a2 100644 --- a/arch/um/drivers/line.c +++ b/arch/um/drivers/line.c @@ -378,6 +378,7 @@ int setup_one_line(struct line *lines, int n, char *init, parse_chan_pair(NULL, line, n, opts, error_out); err = 0; } + *error_out = "configured as 'none'"; } else { char *new = kstrdup(init, GFP_KERNEL); if (!new) { @@ -401,6 +402,7 @@ int setup_one_line(struct line *lines, int n, char *init, } } if (err) { + *error_out = "failed to parse channel pair"; line->init_str = NULL; line->valid = 0; kfree(new); -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
by Ze Zuo 09 Oct '24

09 Oct '24

From: Hersen Wu <hersenxs.wu(a)amd.com> stable inclusion from stable-v6.6.50 commit 8406158a546441b73f0b216aedacbf9a1e5748fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OG CVE: CVE-2024-46812 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a54f7e866cc73a4cb71b8b24bb568ba35c8969df ] [Why] Coverity reports Memory - illegal accesses. [How] Skip inactive planes. Reviewed-by: Alex Hung <alex.hung(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c index 9a3ded311195..85453bbb4f9b 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c +++ b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c @@ -1099,8 +1099,13 @@ void ModeSupportAndSystemConfiguration(struct display_mode_lib *mode_lib) // Total Available Pipes Support Check for (k = 0; k < mode_lib->vba.NumberOfActivePlanes; ++k) { - total_pipes += mode_lib->vba.DPPPerPlane[k]; pipe_idx = get_pipe_idx(mode_lib, k); + if (pipe_idx == -1) { + ASSERT(0); + continue; // skip inactive planes + } + total_pipes += mode_lib->vba.DPPPerPlane[k]; + if (mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz > 0.0) mode_lib->vba.DPPCLK[k] = mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz; else -- 2.25.1

2 1

[openeuler:OLK-5.10 4507/30000] arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'x16' in asm
by kernel test robot 09 Oct '24

09 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 313516d1ae36cc86a40f2b86642bc1bfec17f74e commit: 11b558f5b0628f4701672b6778c068362ef329a7 [4507/30000] arm64: smccc: Support SMCCC v1.3 SVE register saving hint config: arm64-randconfig-001-20241009 (https://download.01.org/0day-ci/archive/20241009/202410090839.I1WLy52U-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 70e0a7e7e6a8541bcc46908c592eed561850e416) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241009/202410090839.I1WLy52U-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410090839.I1WLy52U-lkp@intel.com/ All errors (new ones prefixed by >>): | ^ include/linux/arm-smccc.h:365:33: note: expanded from macro '__arm_smccc_1_1' 365 | register unsigned long r1 asm("r1"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:441:4: note: expanded from macro 'arm_smccc_1_1_invoke' 441 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:407:32: note: expanded from macro 'arm_smccc_1_1_hvc' 407 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:366:33: note: expanded from macro '__arm_smccc_1_1' 366 | register unsigned long r2 asm("r2"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:441:4: note: expanded from macro 'arm_smccc_1_1_invoke' 441 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:407:32: note: expanded from macro 'arm_smccc_1_1_hvc' 407 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:367:33: note: expanded from macro '__arm_smccc_1_1' 367 | register unsigned long r3 asm("r3"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:441:4: note: expanded from macro 'arm_smccc_1_1_invoke' 441 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:407:32: note: expanded from macro 'arm_smccc_1_1_hvc' 407 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:368:3: note: expanded from macro '__arm_smccc_1_1' 368 | __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \ | ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/arm-smccc.h:349:37: note: expanded from macro '___declare_args' 349 | #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) | ^ <scratch space>:25:1: note: expanded from here 25 | __declare_arg_0 | ^ include/linux/arm-smccc.h:303:34: note: expanded from macro '__declare_arg_0' 303 | register unsigned long arg0 asm("r0") = (u32)a0 | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'x16' in asm include/linux/arm-smccc.h:441:4: note: expanded from macro 'arm_smccc_1_1_invoke' 441 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:407:32: note: expanded from macro 'arm_smccc_1_1_hvc' 407 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:372:9: note: expanded from macro '__arm_smccc_1_1' 372 | __constraints(__count_args(__VA_ARGS__))); \ | ^ include/linux/arm-smccc.h:355:30: note: expanded from macro '__constraints' 355 | #define __constraints(count) ___constraints(count) | ^ include/linux/arm-smccc.h:354:4: note: expanded from macro '___constraints' 354 | : smccc_sve_clobbers "memory" | ^ include/linux/arm-smccc.h:278:28: note: expanded from macro 'smccc_sve_clobbers' 278 | #define smccc_sve_clobbers "x16", "x30", "cc", | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:444:4: note: expanded from macro 'arm_smccc_1_1_invoke' 444 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:391:32: note: expanded from macro 'arm_smccc_1_1_smc' 391 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:364:33: note: expanded from macro '__arm_smccc_1_1' 364 | register unsigned long r0 asm("r0"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:444:4: note: expanded from macro 'arm_smccc_1_1_invoke' 444 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:391:32: note: expanded from macro 'arm_smccc_1_1_smc' 391 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:365:33: note: expanded from macro '__arm_smccc_1_1' 365 | register unsigned long r1 asm("r1"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:444:4: note: expanded from macro 'arm_smccc_1_1_invoke' 444 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:391:32: note: expanded from macro 'arm_smccc_1_1_smc' 391 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:366:33: note: expanded from macro '__arm_smccc_1_1' 366 | register unsigned long r2 asm("r2"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r3' in asm include/linux/arm-smccc.h:444:4: note: expanded from macro 'arm_smccc_1_1_invoke' 444 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:391:32: note: expanded from macro 'arm_smccc_1_1_smc' 391 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:367:33: note: expanded from macro '__arm_smccc_1_1' 367 | register unsigned long r3 asm("r3"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:444:4: note: expanded from macro 'arm_smccc_1_1_invoke' 444 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:391:32: note: expanded from macro 'arm_smccc_1_1_smc' 391 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:368:3: note: expanded from macro '__arm_smccc_1_1' 368 | __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \ | ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/arm-smccc.h:349:37: note: expanded from macro '___declare_args' 349 | #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) | ^ <scratch space>:33:1: note: expanded from here 33 | __declare_arg_0 | ^ include/linux/arm-smccc.h:303:34: note: expanded from macro '__declare_arg_0' 303 | register unsigned long arg0 asm("r0") = (u32)a0 | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'x16' in asm include/linux/arm-smccc.h:444:4: note: expanded from macro 'arm_smccc_1_1_invoke' 444 | arm_smccc_1_1_smc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:391:32: note: expanded from macro 'arm_smccc_1_1_smc' 391 | #define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:372:9: note: expanded from macro '__arm_smccc_1_1' 372 | __constraints(__count_args(__VA_ARGS__))); \ | ^ include/linux/arm-smccc.h:355:30: note: expanded from macro '__constraints' 355 | #define __constraints(count) ___constraints(count) | ^ include/linux/arm-smccc.h:354:4: note: expanded from macro '___constraints' 354 | : smccc_sve_clobbers "memory" | ^ include/linux/arm-smccc.h:278:28: note: expanded from macro 'smccc_sve_clobbers' 278 | #define smccc_sve_clobbers "x16", "x30", "cc", | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'r0' in asm include/linux/arm-smccc.h:447:4: note: expanded from macro 'arm_smccc_1_1_invoke' 447 | __fail_smccc_1_1(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:416:3: note: expanded from macro '__fail_smccc_1_1' 416 | __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \ | ^ include/linux/arm-smccc.h:350:37: note: expanded from macro '__declare_args' 350 | #define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__) | ^ include/linux/arm-smccc.h:349:37: note: expanded from macro '___declare_args' 349 | #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) | ^ <scratch space>:41:1: note: expanded from here 41 | __declare_arg_0 | ^ include/linux/arm-smccc.h:303:34: note: expanded from macro '__declare_arg_0' 303 | register unsigned long arg0 asm("r0") = (u32)a0 | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: >> arch/arm64/include/asm/archrandom.h:20:2: error: unknown register name 'x16' in asm include/linux/arm-smccc.h:447:4: note: expanded from macro 'arm_smccc_1_1_invoke' 447 | __fail_smccc_1_1(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:417:13: note: expanded from macro '__fail_smccc_1_1' 417 | asm ("" : __constraints(__count_args(__VA_ARGS__))); \ | ^ include/linux/arm-smccc.h:355:30: note: expanded from macro '__constraints' 355 | #define __constraints(count) ___constraints(count) | ^ include/linux/arm-smccc.h:354:4: note: expanded from macro '___constraints' 354 | : smccc_sve_clobbers "memory" | ^ include/linux/arm-smccc.h:278:28: note: expanded from macro 'smccc_sve_clobbers' 278 | #define smccc_sve_clobbers "x16", "x30", "cc", | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r0' in asm 66 | arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_RND64, 64, &res); | ^ include/linux/arm-smccc.h:441:4: note: expanded from macro 'arm_smccc_1_1_invoke' 441 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:407:32: note: expanded from macro 'arm_smccc_1_1_hvc' 407 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:364:33: note: expanded from macro '__arm_smccc_1_1' 364 | register unsigned long r0 asm("r0"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r1' in asm include/linux/arm-smccc.h:441:4: note: expanded from macro 'arm_smccc_1_1_invoke' 441 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:407:32: note: expanded from macro 'arm_smccc_1_1_hvc' 407 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:365:33: note: expanded from macro '__arm_smccc_1_1' 365 | register unsigned long r1 asm("r1"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: In file included from arch/arm64/include/asm/processor.h:45: In file included from arch/arm64/include/asm/pointer_auth.h:6: In file included from include/linux/random.h:121: arch/arm64/include/asm/archrandom.h:66:3: error: unknown register name 'r2' in asm include/linux/arm-smccc.h:441:4: note: expanded from macro 'arm_smccc_1_1_invoke' 441 | arm_smccc_1_1_hvc(__VA_ARGS__); \ | ^ include/linux/arm-smccc.h:407:32: note: expanded from macro 'arm_smccc_1_1_hvc' 407 | #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) | ^ include/linux/arm-smccc.h:366:33: note: expanded from macro '__arm_smccc_1_1' 366 | register unsigned long r2 asm("r2"); \ | ^ In file included from arch/arm64/kernel/asm-offsets.c:10: In file included from include/linux/arm_sdei.h:8: In file included from include/acpi/ghes.h:5: In file included from include/acpi/apei.h:9: In file included from include/linux/acpi.h:13: In file included from include/linux/irqdomain.h:35: In file included from include/linux/of.h:17: In file included from include/linux/kobject.h:21: In file included from include/linux/sysfs.h:17: In file included from include/linux/kernfs.h:13: In file included from include/linux/mutex.h:19: vim +/x16 +20 arch/arm64/include/asm/archrandom.h 78d8f4f7a298a5 Andre Przywara 2022-01-17 15 181f11fd395b9e Andre Przywara 2022-01-17 16 static inline bool __init smccc_probe_trng(void) 181f11fd395b9e Andre Przywara 2022-01-17 17 { 78d8f4f7a298a5 Andre Przywara 2022-01-17 18 struct arm_smccc_res res; 78d8f4f7a298a5 Andre Przywara 2022-01-17 19 78d8f4f7a298a5 Andre Przywara 2022-01-17 @20 arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_VERSION, &res); 78d8f4f7a298a5 Andre Przywara 2022-01-17 21 if ((s32)res.a0 < 0) 181f11fd395b9e Andre Przywara 2022-01-17 22 return false; 78d8f4f7a298a5 Andre Przywara 2022-01-17 23 78d8f4f7a298a5 Andre Przywara 2022-01-17 24 return res.a0 >= ARM_SMCCC_TRNG_MIN_VERSION; 181f11fd395b9e Andre Przywara 2022-01-17 25 } 181f11fd395b9e Andre Przywara 2022-01-17 26 :::::: The code at line 20 was first introduced by commit :::::: 78d8f4f7a298a5d259b2163121ea20b9e60e93f7 arm64: Add support for SMCCC TRNG entropy source :::::: TO: Andre Przywara <andre.przywara(a)arm.com> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9756/14286] drivers/irqchip/irq-loongson-eiointc.c:378:58: error: 'NODES_PER_FLATMODE_NODE' undeclared
by kernel test robot 09 Oct '24

09 Oct '24

Hi Hongchen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fb512ada4da1a8aefba17392d87452a37796a0f2 commit: 30affb08c584efdc07b3c68015b5902ea02ec86a [9756/14286] irqchip/loongson-eiointc: fix gsi register error config: loongarch-allnoconfig (https://download.01.org/0day-ci/archive/20241009/202410090854.U809Omnk-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241009/202410090854.U809Omnk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410090854.U809Omnk-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/irqchip/irq-loongson-eiointc.c:357:12: warning: no previous prototype for 'pch_pic_parse_madt' [-Wmissing-prototypes] 357 | int __init pch_pic_parse_madt(union acpi_subtable_headers *header, | ^~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c:370:12: warning: no previous prototype for 'pch_msi_parse_madt' [-Wmissing-prototypes] 370 | int __init pch_msi_parse_madt(union acpi_subtable_headers *header, | ^~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c: In function 'pch_msi_parse_madt': >> drivers/irqchip/irq-loongson-eiointc.c:378:58: error: 'NODES_PER_FLATMODE_NODE' undeclared (first use in this function) 378 | node = eiointc_priv[nr_pics - 1]->node / NODES_PER_FLATMODE_NODE; | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c:378:58: note: each undeclared identifier is reported only once for each function it appears in drivers/irqchip/irq-loongson-eiointc.c: In function 'eiointc_acpi_init': drivers/irqchip/irq-loongson-eiointc.c:481:45: error: 'NODES_PER_FLATMODE_NODE' undeclared (first use in this function) 481 | node = acpi_eiointc->node / NODES_PER_FLATMODE_NODE; | ^~~~~~~~~~~~~~~~~~~~~~~ vim +/NODES_PER_FLATMODE_NODE +378 drivers/irqchip/irq-loongson-eiointc.c 369 370 int __init pch_msi_parse_madt(union acpi_subtable_headers *header, 371 const unsigned long end) 372 { 373 struct irq_domain *parent; 374 struct acpi_madt_msi_pic *pchmsi_entry = (struct acpi_madt_msi_pic *)header; 375 int node; 376 377 if (cpu_has_flatmode) > 378 node = eiointc_priv[nr_pics - 1]->node / NODES_PER_FLATMODE_NODE; 379 else 380 node = eiointc_priv[nr_pics - 1]->node; 381 382 parent = acpi_get_vec_parent(node, msi_group); 383 384 if (parent) 385 return pch_msi_acpi_init(parent, pchmsi_entry); 386 387 return 0; 388 } 389 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] Add generic xdp xsk multi-buffer recv for ipvlan
by Yue Haibing 08 Oct '24

08 Oct '24

2 3

[openeuler:OLK-5.10 6710/30000] arch/arm64/kernel/ipi_nmi.c:40:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'?
by kernel test robot 08 Oct '24

08 Oct '24

Hi Li, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: fe7027c3c730b443c2d88e476ad16b966b144366 commit: f86d165bfe5f6248743774bb07af0bd7cff12443 [6710/30000] arm64: Add non nmi ipi backtrace support config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20241008/202410082021.GasFl3wK-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241008/202410082021.GasFl3wK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410082021.GasFl3wK-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kernel/ipi_nmi.c: In function 'ipi_cpu_backtrace': arch/arm64/kernel/ipi_nmi.c:38:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] 38 | printk_safe_enter(); | ^~~~~~~~~~~~~~~~~ | printk_nmi_enter >> arch/arm64/kernel/ipi_nmi.c:40:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] 40 | printk_safe_exit(); | ^~~~~~~~~~~~~~~~ | printk_nmi_exit cc1: some warnings being treated as errors vim +40 arch/arm64/kernel/ipi_nmi.c 35 36 static void ipi_cpu_backtrace(void *info) 37 { 38 printk_safe_enter(); 39 nmi_cpu_backtrace(get_irq_regs()); > 40 printk_safe_exit(); 41 } 42 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] perf/x86/intel: Limit the period on Haswell
by Li Huafei 08 Oct '24

08 Oct '24

From: Kan Liang <kan.liang(a)linux.intel.com> mainline inclusion from mainline-v6.11-rc7 commit 25dfc9e357af8aed1ca79b318a73f2c59c1f0b2b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR511 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Running the ltp test cve-2015-3290 concurrently reports the following warnings. perfevents: irq loop stuck! WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174 intel_pmu_handle_irq+0x285/0x370 Call Trace: <NMI> ? __warn+0xa4/0x220 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? report_bug+0x3e/0xa0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? irq_work_claim+0x1e/0x40 ? intel_pmu_handle_irq+0x285/0x370 perf_event_nmi_handler+0x3d/0x60 nmi_handle+0x104/0x330 Thanks to Thomas Gleixner's analysis, the issue is caused by the low initial period (1) of the frequency estimation algorithm, which triggers the defects of the HW, specifically erratum HSW11 and HSW143. (For the details, please refer https://lore.kernel.org/lkml/87plq9l5d2.ffs@tglx/) The HSW11 requires a period larger than 100 for the INST_RETIRED.ALL event, but the initial period in the freq mode is 1. The erratum is the same as the BDM11, which has been supported in the kernel. A minimum period of 128 is enforced as well on HSW. HSW143 is regarding that the fixed counter 1 may overcount 32 with the Hyper-Threading is enabled. However, based on the test, the hardware has more issues than it tells. Besides the fixed counter 1, the message 'interrupt took too long' can be observed on any counter which was armed with a period < 32 and two events expired in the same NMI. A minimum period of 32 is enforced for the rest of the events. The recommended workaround code of the HSW143 is not implemented. Because it only addresses the issue for the fixed counter. It brings extra overhead through extra MSR writing. No related overcounting issue has been reported so far. Fixes: 3a632cb229bf ("perf/x86/intel: Add simple Haswell PMU support") Reported-by: Li Huafei <lihuafei1(a)huawei.com> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20240819183004.3132920-1-kan.liang@linux.intel.… Closes: https://lore.kernel.org/lkml/20240729223328.327835-1-lihuafei1@huawei.com/ Conflicts: arch/x86/events/intel/core.c [ Adapted x86_pmu::limit_period signature due to commit 28f0f3c44b5c (“perf/x86: Change x86_pmu::limit_period signature”) not backported. ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- arch/x86/events/intel/core.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index a90ca6e863c5..265352d65a1b 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -4160,6 +4160,25 @@ tfa_get_event_constraints(struct cpu_hw_events *cpuc, int idx, return c; } +static inline bool erratum_hsw11(struct perf_event *event) +{ + return (event->hw.config & INTEL_ARCH_EVENT_MASK) == + X86_CONFIG(.event=0xc0, .umask=0x01); +} + +/* + * The HSW11 requires a period larger than 100 which is the same as the BDM11. + * A minimum period of 128 is enforced as well for the INST_RETIRED.ALL. + * + * The message 'interrupt took too long' can be observed on any counter which + * was armed with a period < 32 and two events expired in the same NMI. + * A minimum period of 32 is enforced for the rest of the events. + */ +static u64 hsw_limit_period(struct perf_event *event, u64 left) +{ + return max(left, erratum_hsw11(event) ? 128ULL : 32ULL); +} + /* * Broadwell: * @@ -4177,8 +4196,7 @@ tfa_get_event_constraints(struct cpu_hw_events *cpuc, int idx, */ static u64 bdw_limit_period(struct perf_event *event, u64 left) { - if ((event->hw.config & INTEL_ARCH_EVENT_MASK) == - X86_CONFIG(.event=0xc0, .umask=0x01)) { + if (erratum_hsw11(event)) { if (left < 128) left = 128; left &= ~0x3fULL; @@ -5626,6 +5644,7 @@ __init int intel_pmu_init(void) x86_pmu.hw_config = hsw_hw_config; x86_pmu.get_event_constraints = hsw_get_event_constraints; + x86_pmu.limit_period = hsw_limit_period; x86_pmu.lbr_double_abort = true; extra_attr = boot_cpu_has(X86_FEATURE_RTM) ? hsw_format_attr : nhm_format_attr; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] s390/dasd: fix error recovery leading to data corruption on ESE devices
by Li Nan 08 Oct '24

08 Oct '24

From: Stefan Haberland <sth(a)linux.ibm.com> stable inclusion from stable-v5.10.225 commit e245a18281c252c8dbc467492e09bb5d4b012118 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOID CVE: CVE-2024-45026 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7db4042336580dfd75cb5faa82c12cd51098c90b upstream. Extent Space Efficient (ESE) or thin provisioned volumes need to be formatted on demand during usual IO processing. The dasd_ese_needs_format function checks for error codes that signal the non existence of a proper track format. The check for incorrect length is to imprecise since other error cases leading to transport of insufficient data also have this flag set. This might lead to data corruption in certain error cases for example during a storage server warmstart. Fix by removing the check for incorrect length and replacing by explicitly checking for invalid track format in transport mode. Also remove the check for file protected since this is not a valid ESE handling case. Cc: stable(a)vger.kernel.org # 5.3+ Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes") Reviewed-by: Jan Hoeppner <hoeppner(a)linux.ibm.com> Signed-off-by: Stefan Haberland <sth(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240812125733.126431-3-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/s390/block/dasd_int.h | 2 +- drivers/s390/block/dasd.c | 36 ++++++++++++------- drivers/s390/block/dasd_3990_erp.c | 10 ++---- drivers/s390/block/dasd_eckd.c | 55 +++++++++++++----------------- 4 files changed, 50 insertions(+), 53 deletions(-) diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h index 5d7d35ca5eb4..052b5d1ba9c1 100644 --- a/drivers/s390/block/dasd_int.h +++ b/drivers/s390/block/dasd_int.h @@ -226,7 +226,7 @@ struct dasd_ccw_req { * The following flags are used to suppress output of certain errors. */ #define DASD_CQR_SUPPRESS_NRF 4 /* Suppress 'No Record Found' error */ -#define DASD_CQR_SUPPRESS_FP 5 /* Suppress 'File Protected' error*/ +#define DASD_CQR_SUPPRESS_IT 5 /* Suppress 'Invalid Track' error*/ #define DASD_CQR_SUPPRESS_IL 6 /* Suppress 'Incorrect Length' error */ #define DASD_CQR_SUPPRESS_CR 7 /* Suppress 'Command Reject' error */ diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c index 81de5c98221a..0b09ed6ac133 100644 --- a/drivers/s390/block/dasd.c +++ b/drivers/s390/block/dasd.c @@ -1665,9 +1665,15 @@ static int dasd_ese_needs_format(struct dasd_block *block, struct irb *irb) if (!sense) return 0; - return !!(sense[1] & SNS1_NO_REC_FOUND) || - !!(sense[1] & SNS1_FILE_PROTECTED) || - scsw_cstat(&irb->scsw) == SCHN_STAT_INCORR_LEN; + if (sense[1] & SNS1_NO_REC_FOUND) + return 1; + + if ((sense[1] & SNS1_INV_TRACK_FORMAT) && + scsw_is_tm(&irb->scsw) && + !(sense[2] & SNS2_ENV_DATA_PRESENT)) + return 1; + + return 0; } static int dasd_ese_oos_cond(u8 *sense) @@ -1688,7 +1694,7 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, struct dasd_device *device; unsigned long now; int nrf_suppressed = 0; - int fp_suppressed = 0; + int it_suppressed = 0; struct request *req; u8 *sense = NULL; int expires; @@ -1743,8 +1749,9 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, */ sense = dasd_get_sense(irb); if (sense) { - fp_suppressed = (sense[1] & SNS1_FILE_PROTECTED) && - test_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags); + it_suppressed = (sense[1] & SNS1_INV_TRACK_FORMAT) && + !(sense[2] & SNS2_ENV_DATA_PRESENT) && + test_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags); nrf_suppressed = (sense[1] & SNS1_NO_REC_FOUND) && test_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags); @@ -1759,7 +1766,7 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, return; } } - if (!(fp_suppressed || nrf_suppressed)) + if (!(it_suppressed || nrf_suppressed)) device->discipline->dump_sense_dbf(device, irb, "int"); if (device->features & DASD_FEATURE_ERPLOG) @@ -2513,14 +2520,17 @@ static int _dasd_sleep_on_queue(struct list_head *ccw_queue, int interruptible) rc = 0; list_for_each_entry_safe(cqr, n, ccw_queue, blocklist) { /* - * In some cases the 'File Protected' or 'Incorrect Length' - * error might be expected and error recovery would be - * unnecessary in these cases. Check if the according suppress - * bit is set. + * In some cases certain errors might be expected and + * error recovery would be unnecessary in these cases. + * Check if the according suppress bit is set. */ sense = dasd_get_sense(&cqr->irb); - if (sense && sense[1] & SNS1_FILE_PROTECTED && - test_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags)) + if (sense && (sense[1] & SNS1_INV_TRACK_FORMAT) && + !(sense[2] & SNS2_ENV_DATA_PRESENT) && + test_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags)) + continue; + if (sense && (sense[1] & SNS1_NO_REC_FOUND) && + test_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags)) continue; if (scsw_cstat(&cqr->irb.scsw) == 0x40 && test_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags)) diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c index c2d4ea74e0d0..845f088ce97b 100644 --- a/drivers/s390/block/dasd_3990_erp.c +++ b/drivers/s390/block/dasd_3990_erp.c @@ -1401,14 +1401,8 @@ dasd_3990_erp_file_prot(struct dasd_ccw_req * erp) struct dasd_device *device = erp->startdev; - /* - * In some cases the 'File Protected' error might be expected and - * log messages shouldn't be written then. - * Check if the according suppress bit is set. - */ - if (!test_bit(DASD_CQR_SUPPRESS_FP, &erp->flags)) - dev_err(&device->cdev->dev, - "Accessing the DASD failed because of a hardware error\n"); + dev_err(&device->cdev->dev, + "Accessing the DASD failed because of a hardware error\n"); return dasd_3990_erp_cleanup(erp, DASD_CQR_FAILED); diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c index c6930c159d2a..fddcb910157c 100644 --- a/drivers/s390/block/dasd_eckd.c +++ b/drivers/s390/block/dasd_eckd.c @@ -2201,6 +2201,7 @@ dasd_eckd_analysis_ccw(struct dasd_device *device) cqr->status = DASD_CQR_FILLED; /* Set flags to suppress output for expected errors */ set_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags); + set_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags); return cqr; } @@ -2482,7 +2483,6 @@ dasd_eckd_build_check_tcw(struct dasd_device *base, struct format_data_t *fdata, cqr->buildclk = get_tod_clock(); cqr->status = DASD_CQR_FILLED; /* Set flags to suppress output for expected errors */ - set_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags); set_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags); return cqr; @@ -4031,8 +4031,6 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_cmd_single( /* Set flags to suppress output for expected errors */ if (dasd_eckd_is_ese(basedev)) { - set_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags); - set_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags); set_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags); } @@ -4534,9 +4532,8 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track( /* Set flags to suppress output for expected errors */ if (dasd_eckd_is_ese(basedev)) { - set_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags); - set_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags); set_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags); + set_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags); } return cqr; @@ -5706,36 +5703,32 @@ static void dasd_eckd_dump_sense(struct dasd_device *device, { u8 *sense = dasd_get_sense(irb); - if (scsw_is_tm(&irb->scsw)) { - /* - * In some cases the 'File Protected' or 'Incorrect Length' - * error might be expected and log messages shouldn't be written - * then. Check if the according suppress bit is set. - */ - if (sense && (sense[1] & SNS1_FILE_PROTECTED) && - test_bit(DASD_CQR_SUPPRESS_FP, &req->flags)) - return; - if (scsw_cstat(&irb->scsw) == 0x40 && - test_bit(DASD_CQR_SUPPRESS_IL, &req->flags)) - return; + /* + * In some cases certain errors might be expected and + * log messages shouldn't be written then. + * Check if the according suppress bit is set. + */ + if (sense && (sense[1] & SNS1_INV_TRACK_FORMAT) && + !(sense[2] & SNS2_ENV_DATA_PRESENT) && + test_bit(DASD_CQR_SUPPRESS_IT, &req->flags)) + return; - dasd_eckd_dump_sense_tcw(device, req, irb); - } else { - /* - * In some cases the 'Command Reject' or 'No Record Found' - * error might be expected and log messages shouldn't be - * written then. Check if the according suppress bit is set. - */ - if (sense && sense[0] & SNS0_CMD_REJECT && - test_bit(DASD_CQR_SUPPRESS_CR, &req->flags)) - return; + if (sense && sense[0] & SNS0_CMD_REJECT && + test_bit(DASD_CQR_SUPPRESS_CR, &req->flags)) + return; - if (sense && sense[1] & SNS1_NO_REC_FOUND && - test_bit(DASD_CQR_SUPPRESS_NRF, &req->flags)) - return; + if (sense && sense[1] & SNS1_NO_REC_FOUND && + test_bit(DASD_CQR_SUPPRESS_NRF, &req->flags)) + return; + if (scsw_cstat(&irb->scsw) == 0x40 && + test_bit(DASD_CQR_SUPPRESS_IL, &req->flags)) + return; + + if (scsw_is_tm(&irb->scsw)) + dasd_eckd_dump_sense_tcw(device, req, irb); + else dasd_eckd_dump_sense_ccw(device, req, irb); - } } static int dasd_eckd_pm_freeze(struct dasd_device *device) -- 2.39.2

2 1

[PATCH OLK-5.10] [Backport] s390/dasd: fix error recovery leading to data corruption on ESE devices
by Li Nan 08 Oct '24

08 Oct '24

From: Stefan Haberland <sth(a)linux.ibm.com> stable inclusion from stable-v5.10.225 commit e245a18281c252c8dbc467492e09bb5d4b012118 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOID CVE: CVE-2024-45026 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7db4042336580dfd75cb5faa82c12cd51098c90b upstream. Extent Space Efficient (ESE) or thin provisioned volumes need to be formatted on demand during usual IO processing. The dasd_ese_needs_format function checks for error codes that signal the non existence of a proper track format. The check for incorrect length is to imprecise since other error cases leading to transport of insufficient data also have this flag set. This might lead to data corruption in certain error cases for example during a storage server warmstart. Fix by removing the check for incorrect length and replacing by explicitly checking for invalid track format in transport mode. Also remove the check for file protected since this is not a valid ESE handling case. Cc: stable(a)vger.kernel.org # 5.3+ Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes") Reviewed-by: Jan Hoeppner <hoeppner(a)linux.ibm.com> Signed-off-by: Stefan Haberland <sth(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240812125733.126431-3-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/s390/block/dasd_int.h | 2 +- drivers/s390/block/dasd.c | 36 ++++++++++++------- drivers/s390/block/dasd_3990_erp.c | 10 ++---- drivers/s390/block/dasd_eckd.c | 55 +++++++++++++----------------- 4 files changed, 50 insertions(+), 53 deletions(-) diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h index 5d7d35ca5eb4..052b5d1ba9c1 100644 --- a/drivers/s390/block/dasd_int.h +++ b/drivers/s390/block/dasd_int.h @@ -226,7 +226,7 @@ struct dasd_ccw_req { * The following flags are used to suppress output of certain errors. */ #define DASD_CQR_SUPPRESS_NRF 4 /* Suppress 'No Record Found' error */ -#define DASD_CQR_SUPPRESS_FP 5 /* Suppress 'File Protected' error*/ +#define DASD_CQR_SUPPRESS_IT 5 /* Suppress 'Invalid Track' error*/ #define DASD_CQR_SUPPRESS_IL 6 /* Suppress 'Incorrect Length' error */ #define DASD_CQR_SUPPRESS_CR 7 /* Suppress 'Command Reject' error */ diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c index 81de5c98221a..0b09ed6ac133 100644 --- a/drivers/s390/block/dasd.c +++ b/drivers/s390/block/dasd.c @@ -1665,9 +1665,15 @@ static int dasd_ese_needs_format(struct dasd_block *block, struct irb *irb) if (!sense) return 0; - return !!(sense[1] & SNS1_NO_REC_FOUND) || - !!(sense[1] & SNS1_FILE_PROTECTED) || - scsw_cstat(&irb->scsw) == SCHN_STAT_INCORR_LEN; + if (sense[1] & SNS1_NO_REC_FOUND) + return 1; + + if ((sense[1] & SNS1_INV_TRACK_FORMAT) && + scsw_is_tm(&irb->scsw) && + !(sense[2] & SNS2_ENV_DATA_PRESENT)) + return 1; + + return 0; } static int dasd_ese_oos_cond(u8 *sense) @@ -1688,7 +1694,7 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, struct dasd_device *device; unsigned long now; int nrf_suppressed = 0; - int fp_suppressed = 0; + int it_suppressed = 0; struct request *req; u8 *sense = NULL; int expires; @@ -1743,8 +1749,9 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, */ sense = dasd_get_sense(irb); if (sense) { - fp_suppressed = (sense[1] & SNS1_FILE_PROTECTED) && - test_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags); + it_suppressed = (sense[1] & SNS1_INV_TRACK_FORMAT) && + !(sense[2] & SNS2_ENV_DATA_PRESENT) && + test_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags); nrf_suppressed = (sense[1] & SNS1_NO_REC_FOUND) && test_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags); @@ -1759,7 +1766,7 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, return; } } - if (!(fp_suppressed || nrf_suppressed)) + if (!(it_suppressed || nrf_suppressed)) device->discipline->dump_sense_dbf(device, irb, "int"); if (device->features & DASD_FEATURE_ERPLOG) @@ -2513,14 +2520,17 @@ static int _dasd_sleep_on_queue(struct list_head *ccw_queue, int interruptible) rc = 0; list_for_each_entry_safe(cqr, n, ccw_queue, blocklist) { /* - * In some cases the 'File Protected' or 'Incorrect Length' - * error might be expected and error recovery would be - * unnecessary in these cases. Check if the according suppress - * bit is set. + * In some cases certain errors might be expected and + * error recovery would be unnecessary in these cases. + * Check if the according suppress bit is set. */ sense = dasd_get_sense(&cqr->irb); - if (sense && sense[1] & SNS1_FILE_PROTECTED && - test_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags)) + if (sense && (sense[1] & SNS1_INV_TRACK_FORMAT) && + !(sense[2] & SNS2_ENV_DATA_PRESENT) && + test_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags)) + continue; + if (sense && (sense[1] & SNS1_NO_REC_FOUND) && + test_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags)) continue; if (scsw_cstat(&cqr->irb.scsw) == 0x40 && test_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags)) diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c index c2d4ea74e0d0..845f088ce97b 100644 --- a/drivers/s390/block/dasd_3990_erp.c +++ b/drivers/s390/block/dasd_3990_erp.c @@ -1401,14 +1401,8 @@ dasd_3990_erp_file_prot(struct dasd_ccw_req * erp) struct dasd_device *device = erp->startdev; - /* - * In some cases the 'File Protected' error might be expected and - * log messages shouldn't be written then. - * Check if the according suppress bit is set. - */ - if (!test_bit(DASD_CQR_SUPPRESS_FP, &erp->flags)) - dev_err(&device->cdev->dev, - "Accessing the DASD failed because of a hardware error\n"); + dev_err(&device->cdev->dev, + "Accessing the DASD failed because of a hardware error\n"); return dasd_3990_erp_cleanup(erp, DASD_CQR_FAILED); diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c index c6930c159d2a..fddcb910157c 100644 --- a/drivers/s390/block/dasd_eckd.c +++ b/drivers/s390/block/dasd_eckd.c @@ -2201,6 +2201,7 @@ dasd_eckd_analysis_ccw(struct dasd_device *device) cqr->status = DASD_CQR_FILLED; /* Set flags to suppress output for expected errors */ set_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags); + set_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags); return cqr; } @@ -2482,7 +2483,6 @@ dasd_eckd_build_check_tcw(struct dasd_device *base, struct format_data_t *fdata, cqr->buildclk = get_tod_clock(); cqr->status = DASD_CQR_FILLED; /* Set flags to suppress output for expected errors */ - set_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags); set_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags); return cqr; @@ -4031,8 +4031,6 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_cmd_single( /* Set flags to suppress output for expected errors */ if (dasd_eckd_is_ese(basedev)) { - set_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags); - set_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags); set_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags); } @@ -4534,9 +4532,8 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track( /* Set flags to suppress output for expected errors */ if (dasd_eckd_is_ese(basedev)) { - set_bit(DASD_CQR_SUPPRESS_FP, &cqr->flags); - set_bit(DASD_CQR_SUPPRESS_IL, &cqr->flags); set_bit(DASD_CQR_SUPPRESS_NRF, &cqr->flags); + set_bit(DASD_CQR_SUPPRESS_IT, &cqr->flags); } return cqr; @@ -5706,36 +5703,32 @@ static void dasd_eckd_dump_sense(struct dasd_device *device, { u8 *sense = dasd_get_sense(irb); - if (scsw_is_tm(&irb->scsw)) { - /* - * In some cases the 'File Protected' or 'Incorrect Length' - * error might be expected and log messages shouldn't be written - * then. Check if the according suppress bit is set. - */ - if (sense && (sense[1] & SNS1_FILE_PROTECTED) && - test_bit(DASD_CQR_SUPPRESS_FP, &req->flags)) - return; - if (scsw_cstat(&irb->scsw) == 0x40 && - test_bit(DASD_CQR_SUPPRESS_IL, &req->flags)) - return; + /* + * In some cases certain errors might be expected and + * log messages shouldn't be written then. + * Check if the according suppress bit is set. + */ + if (sense && (sense[1] & SNS1_INV_TRACK_FORMAT) && + !(sense[2] & SNS2_ENV_DATA_PRESENT) && + test_bit(DASD_CQR_SUPPRESS_IT, &req->flags)) + return; - dasd_eckd_dump_sense_tcw(device, req, irb); - } else { - /* - * In some cases the 'Command Reject' or 'No Record Found' - * error might be expected and log messages shouldn't be - * written then. Check if the according suppress bit is set. - */ - if (sense && sense[0] & SNS0_CMD_REJECT && - test_bit(DASD_CQR_SUPPRESS_CR, &req->flags)) - return; + if (sense && sense[0] & SNS0_CMD_REJECT && + test_bit(DASD_CQR_SUPPRESS_CR, &req->flags)) + return; - if (sense && sense[1] & SNS1_NO_REC_FOUND && - test_bit(DASD_CQR_SUPPRESS_NRF, &req->flags)) - return; + if (sense && sense[1] & SNS1_NO_REC_FOUND && + test_bit(DASD_CQR_SUPPRESS_NRF, &req->flags)) + return; + if (scsw_cstat(&irb->scsw) == 0x40 && + test_bit(DASD_CQR_SUPPRESS_IL, &req->flags)) + return; + + if (scsw_is_tm(&irb->scsw)) + dasd_eckd_dump_sense_tcw(device, req, irb); + else dasd_eckd_dump_sense_ccw(device, req, irb); - } } static int dasd_eckd_pm_freeze(struct dasd_device *device) -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] s390/sclp: Prevent release of buffer in I/O
by Li Nan 08 Oct '24

08 Oct '24

From: Peter Oberparleiter <oberpar(a)linux.ibm.com> stable inclusion from stable-v5.10.224 commit a3e52a4c22c846858a6875e1c280030a3849e148 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYK CVE: CVE-2024-44969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bf365071ea92b9579d5a272679b74052a5643e35 ] When a task waiting for completion of a Store Data operation is interrupted, an attempt is made to halt this operation. If this attempt fails due to a hardware or firmware problem, there is a chance that the SCLP facility might store data into buffers referenced by the original operation at a later time. Handle this situation by not releasing the referenced data buffers if the halt attempt fails. For current use cases, this might result in a leak of few pages of memory in case of a rare hardware/firmware malfunction. Reviewed-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Peter Oberparleiter <oberpar(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/s390/char/sclp_sd.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/s390/char/sclp_sd.c b/drivers/s390/char/sclp_sd.c index 1e244f78f192..64581433c334 100644 --- a/drivers/s390/char/sclp_sd.c +++ b/drivers/s390/char/sclp_sd.c @@ -319,8 +319,14 @@ static int sclp_sd_store_data(struct sclp_sd_data *result, u8 di) &esize); if (rc) { /* Cancel running request if interrupted */ - if (rc == -ERESTARTSYS) - sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL); + if (rc == -ERESTARTSYS) { + if (sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL)) { + pr_warn("Could not stop Store Data request - leaking at least %zu bytes\n", + (size_t)dsize * PAGE_SIZE); + data = NULL; + asce = 0; + } + } vfree(data); goto out; } -- 2.39.2

2 1

[PATCH OLK-5.10] s390/sclp: Prevent release of buffer in I/O
by Li Nan 08 Oct '24

08 Oct '24

From: Peter Oberparleiter <oberpar(a)linux.ibm.com> stable inclusion from stable-v5.10.224 commit a3e52a4c22c846858a6875e1c280030a3849e148 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYK CVE: CVE-2024-44969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bf365071ea92b9579d5a272679b74052a5643e35 ] When a task waiting for completion of a Store Data operation is interrupted, an attempt is made to halt this operation. If this attempt fails due to a hardware or firmware problem, there is a chance that the SCLP facility might store data into buffers referenced by the original operation at a later time. Handle this situation by not releasing the referenced data buffers if the halt attempt fails. For current use cases, this might result in a leak of few pages of memory in case of a rare hardware/firmware malfunction. Reviewed-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Peter Oberparleiter <oberpar(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/s390/char/sclp_sd.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/s390/char/sclp_sd.c b/drivers/s390/char/sclp_sd.c index 1e244f78f192..64581433c334 100644 --- a/drivers/s390/char/sclp_sd.c +++ b/drivers/s390/char/sclp_sd.c @@ -319,8 +319,14 @@ static int sclp_sd_store_data(struct sclp_sd_data *result, u8 di) &esize); if (rc) { /* Cancel running request if interrupted */ - if (rc == -ERESTARTSYS) - sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL); + if (rc == -ERESTARTSYS) { + if (sclp_sd_sync(page, SD_EQ_HALT, di, 0, 0, NULL, NULL)) { + pr_warn("Could not stop Store Data request - leaking at least %zu bytes\n", + (size_t)dsize * PAGE_SIZE); + data = NULL; + asce = 0; + } + } vfree(data); goto out; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS V1] drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
by Cheng Yu 08 Oct '24

08 Oct '24

From: Hersen Wu <hersenxs.wu(a)amd.com> stable inclusion from stable-v6.10.9 commit 36c39a8dcce210649f2f45f252abaa09fcc1ae87 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9L0 CVE: CVE-2024-46816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cf8b16857db702ceb8d52f9219a4613363e2b1cf ] [Why] Coverity report OVERRUN warning. There are only max_links elements within dc->links. link count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31. [How] Make sure link count less than max_links. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c [This conflict is caused by the lack of definition of the MAX_LINKS variable. Manually adapt the variable value.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 943ff0e45e84..65fb64c8727f 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1608,17 +1608,17 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) dm->display_indexes_num = dm->dc->caps.max_streams; + if (link_cnt > MAX_PIPES * 2) { + DRM_ERROR( + "KMS: Cannot support more than %d display indexes\n", + MAX_PIPES * 2); + goto fail; + } + /* loops over all connectors on the board */ for (i = 0; i < link_cnt; i++) { struct dc_link *link = NULL; - if (i > AMDGPU_DM_MAX_DISPLAY_INDEX) { - DRM_ERROR( - "KMS: Cannot support more than %d display indexes\n", - AMDGPU_DM_MAX_DISPLAY_INDEX); - continue; - } - aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL); if (!aconnector) goto fail; -- 2.25.1

2 1

[PATCH OLK-6.6 V1] drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
by Cheng Yu 08 Oct '24

08 Oct '24

From: Hersen Wu <hersenxs.wu(a)amd.com> stable inclusion from stable-v6.10.9 commit 36c39a8dcce210649f2f45f252abaa09fcc1ae87 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9L0 CVE: CVE-2024-46816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cf8b16857db702ceb8d52f9219a4613363e2b1cf ] [Why] Coverity report OVERRUN warning. There are only max_links elements within dc->links. link count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31. [How] Make sure link count less than max_links. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c [This conflict is caused by the lack of definition of the MAX_LINKS variable. Manually adapt the variable value.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 2c7ba6e4fd1b..dca207a2c4fc 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -4450,17 +4450,17 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) } } + if (link_cnt > MAX_PIPES * 2) { + DRM_ERROR( + "KMS: Cannot support more than %d display indexes\n", + MAX_PIPES * 2); + goto fail; + } + /* loops over all connectors on the board */ for (i = 0; i < link_cnt; i++) { struct dc_link *link = NULL; - if (i > AMDGPU_DM_MAX_DISPLAY_INDEX) { - DRM_ERROR( - "KMS: Cannot support more than %d display indexes\n", - AMDGPU_DM_MAX_DISPLAY_INDEX); - continue; - } - aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL); if (!aconnector) goto fail; -- 2.25.1

2 1

[PATCH OLK-5.10 V1] drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
by Cheng Yu 08 Oct '24

08 Oct '24

From: Hersen Wu <hersenxs.wu(a)amd.com> stable inclusion from stable-v6.10.9 commit 36c39a8dcce210649f2f45f252abaa09fcc1ae87 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9L0 CVE: CVE-2024-46816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cf8b16857db702ceb8d52f9219a4613363e2b1cf ] [Why] Coverity report OVERRUN warning. There are only max_links elements within dc->links. link count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31. [How] Make sure link count less than max_links. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c [This conflict is caused by the lack of definition of the MAX_LINKS variable. Manually adapt the variable value.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index b2053d9265ad..aad99a9ce6a4 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -3397,17 +3397,17 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) goto fail; } + if (link_cnt > MAX_PIPES * 2) { + DRM_ERROR( + "KMS: Cannot support more than %d display indexes\n", + MAX_PIPES * 2); + goto fail; + } + /* loops over all connectors on the board */ for (i = 0; i < link_cnt; i++) { struct dc_link *link = NULL; - if (i > AMDGPU_DM_MAX_DISPLAY_INDEX) { - DRM_ERROR( - "KMS: Cannot support more than %d display indexes\n", - AMDGPU_DM_MAX_DISPLAY_INDEX); - continue; - } - aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL); if (!aconnector) goto fail; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 V1] drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
by Cheng Yu 08 Oct '24

08 Oct '24

From: Hersen Wu <hersenxs.wu(a)amd.com> stable inclusion from stable-v6.10.9 commit 36c39a8dcce210649f2f45f252abaa09fcc1ae87 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9L0 CVE: CVE-2024-46816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cf8b16857db702ceb8d52f9219a4613363e2b1cf ] [Why] Coverity report OVERRUN warning. There are only max_links elements within dc->links. link count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31. [How] Make sure link count less than max_links. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c [This conflict is caused by the lack of definition of the MAX_LINKS variable. Manually adapt the variable value.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 56324bd42fde..07a37407879f 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -3395,17 +3395,17 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) goto fail; } + if (link_cnt > MAX_PIPES * 2) { + DRM_ERROR( + "KMS: Cannot support more than %d display indexes\n", + MAX_PIPES * 2); + goto fail; + } + /* loops over all connectors on the board */ for (i = 0; i < link_cnt; i++) { struct dc_link *link = NULL; - if (i > AMDGPU_DM_MAX_DISPLAY_INDEX) { - DRM_ERROR( - "KMS: Cannot support more than %d display indexes\n", - AMDGPU_DM_MAX_DISPLAY_INDEX); - continue; - } - aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL); if (!aconnector) goto fail; -- 2.25.1

2 1

[PATCH OLK-6.6] KVM: arm64: Add new HiSi CPU type for supporting DVMBM
by Zhou Wang 08 Oct '24

08 Oct '24

virt inclusion category: other bugzilla: https://gitee.com/openeuler/kernel/issues/IAV9YO ----------------------------------------------------------- Add new HiSi CPU type for supporting DVMBM, and expand ACPI hisi oem table id string to 8 bit. Signed-off-by: Zhou Wang <wangzhou1(a)hisilicon.com> Signed-off-by: caijian <caijian11(a)h-partners.com> --- arch/arm64/kvm/hisilicon/hisi_virt.c | 16 ++++++++++------ arch/arm64/kvm/hisilicon/hisi_virt.h | 6 ++++-- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/arch/arm64/kvm/hisilicon/hisi_virt.c b/arch/arm64/kvm/hisilicon/hisi_virt.c index 68809f10e8d7..ea6ab834a46e 100644 --- a/arch/arm64/kvm/hisilicon/hisi_virt.c +++ b/arch/arm64/kvm/hisilicon/hisi_virt.c @@ -18,15 +18,19 @@ static const char * const hisi_cpu_type_str[] = { "Hisi1616", "Hisi1620", "HIP09", + "HIP10", + "HIP10C", "Unknown" }; /* ACPI Hisi oem table id str */ static const char * const oem_str[] = { - "HIP06", /* Hisi 1612 */ - "HIP07", /* Hisi 1616 */ - "HIP08", /* Hisi 1620 */ - "HIP09" /* HIP09 */ + "HIP06 ", /* Hisi 1612 */ + "HIP07 ", /* Hisi 1616 */ + "HIP08 ", /* Hisi 1620 */ + "HIP09 ", /* HIP09 */ + "HIP10 ", /* HIP10 */ + "HIP10C " /* HIP10C */ }; /* @@ -47,7 +51,7 @@ static enum hisi_cpu_type acpi_get_hisi_cpu_type(void) } for (i = 0; i < str_size; ++i) { - if (!strncmp(oem_str[i], table->oem_table_id, 5)) + if (!strncmp(oem_str[i], table->oem_table_id, 8)) return i; } @@ -153,7 +157,7 @@ static void hardware_disable_dvmbm(void *data) bool hisi_dvmbm_supported(void) { - if (cpu_type != HI_IP09) + if (cpu_type != HI_IP10 && cpu_type != HI_IP10C) return false; /* Determine whether DVMBM is supported by the hardware */ diff --git a/arch/arm64/kvm/hisilicon/hisi_virt.h b/arch/arm64/kvm/hisilicon/hisi_virt.h index 31bcb62235a4..e3b006343ead 100644 --- a/arch/arm64/kvm/hisilicon/hisi_virt.h +++ b/arch/arm64/kvm/hisilicon/hisi_virt.h @@ -12,10 +12,12 @@ enum hisi_cpu_type { HI_1616, HI_1620, HI_IP09, + HI_IP10, + HI_IP10C, UNKNOWN_HI_TYPE }; -/* HIP09 */ +/* HIP10 */ #define AIDR_EL1_DVMBM_MASK GENMASK_ULL(13, 12) #define SYS_LSUDVM_CTRL_EL2 sys_reg(3, 4, 15, 7, 4) #define LSUDVM_CTLR_EL2_MASK BIT_ULL(0) @@ -36,7 +38,7 @@ enum hisi_cpu_type { #define TOTEM_B_ID 3 /* - * MPIDR_EL1 layout on HIP09 + * MPIDR_EL1 layout on HIP10 * * Aff3[7:3] - socket ID [0-15] * Aff3[2:0] - die ID [1,3] -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] ksmbd: discard write access to the directory open
by Long Li 08 Oct '24

08 Oct '24

From: Hobin Woo <hobin.woo(a)samsung.com> stable inclusion from stable-v6.6.40 commit 9e84b1ba5c98fb5c9f869c85db1d870354613baa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELQ CVE: CVE-2024-41030 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- may_open() does not allow a directory to be opened with the write access. However, some writing flags set by client result in adding write access on server, making ksmbd incompatible with FUSE file system. Simply, let's discard the write access when opening a directory. list_add corruption. next is NULL. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:26! pc : __list_add_valid+0x88/0xbc lr : __list_add_valid+0x88/0xbc Call trace: __list_add_valid+0x88/0xbc fuse_finish_open+0x11c/0x170 fuse_open_common+0x284/0x5e8 fuse_dir_open+0x14/0x24 do_dentry_open+0x2a4/0x4e0 dentry_open+0x50/0x80 smb2_open+0xbe4/0x15a4 handle_ksmbd_work+0x478/0x5ec process_one_work+0x1b4/0x448 worker_thread+0x25c/0x430 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20 Cc: stable(a)vger.kernel.org Signed-off-by: Yoonho Shin <yoonho.shin(a)samsung.com> Signed-off-by: Hobin Woo <hobin.woo(a)samsung.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..feec18445829 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -2043,15 +2043,22 @@ int smb2_tree_connect(struct ksmbd_work *work) * @access: file access flags * @disposition: file disposition flags * @may_flags: set with MAY_ flags + * @is_dir: is creating open flags for directory * * Return: file open flags */ static int smb2_create_open_flags(bool file_present, __le32 access, __le32 disposition, - int *may_flags) + int *may_flags, + bool is_dir) { int oflags = O_NONBLOCK | O_LARGEFILE; + if (is_dir) { + access &= ~FILE_WRITE_DESIRE_ACCESS_LE; + ksmbd_debug(SMB, "Discard write access to a directory\n"); + } + if (access & FILE_READ_DESIRED_ACCESS_LE && access & FILE_WRITE_DESIRE_ACCESS_LE) { oflags |= O_RDWR; @@ -2891,7 +2898,9 @@ int smb2_open(struct ksmbd_work *work) open_flags = smb2_create_open_flags(file_present, daccess, req->CreateDisposition, - &may_flags); + &may_flags, + req->CreateOptions & FILE_DIRECTORY_FILE_LE || + (file_present && S_ISDIR(d_inode(path.dentry)->i_mode))); if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { if (open_flags & O_CREAT) { -- 2.39.2

2 1

[PATCH OLK-5.10] ksmbd: discard write access to the directory open
by Long Li 08 Oct '24

08 Oct '24

From: Hobin Woo <hobin.woo(a)samsung.com> stable inclusion from stable-v6.6.40 commit 9e84b1ba5c98fb5c9f869c85db1d870354613baa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELQ CVE: CVE-2024-41030 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- may_open() does not allow a directory to be opened with the write access. However, some writing flags set by client result in adding write access on server, making ksmbd incompatible with FUSE file system. Simply, let's discard the write access when opening a directory. list_add corruption. next is NULL. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:26! pc : __list_add_valid+0x88/0xbc lr : __list_add_valid+0x88/0xbc Call trace: __list_add_valid+0x88/0xbc fuse_finish_open+0x11c/0x170 fuse_open_common+0x284/0x5e8 fuse_dir_open+0x14/0x24 do_dentry_open+0x2a4/0x4e0 dentry_open+0x50/0x80 smb2_open+0xbe4/0x15a4 handle_ksmbd_work+0x478/0x5ec process_one_work+0x1b4/0x448 worker_thread+0x25c/0x430 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20 Cc: stable(a)vger.kernel.org Signed-off-by: Yoonho Shin <yoonho.shin(a)samsung.com> Signed-off-by: Hobin Woo <hobin.woo(a)samsung.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index c1c71db5660d..20f97b37e7c6 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -2047,15 +2047,22 @@ int smb2_tree_connect(struct ksmbd_work *work) * @access: file access flags * @disposition: file disposition flags * @may_flags: set with MAY_ flags + * @is_dir: is creating open flags for directory * * Return: file open flags */ static int smb2_create_open_flags(bool file_present, __le32 access, __le32 disposition, - int *may_flags) + int *may_flags, + bool is_dir) { int oflags = O_NONBLOCK | O_LARGEFILE; + if (is_dir) { + access &= ~FILE_WRITE_DESIRE_ACCESS_LE; + ksmbd_debug(SMB, "Discard write access to a directory\n"); + } + if (access & FILE_READ_DESIRED_ACCESS_LE && access & FILE_WRITE_DESIRE_ACCESS_LE) { oflags |= O_RDWR; @@ -2895,7 +2902,9 @@ int smb2_open(struct ksmbd_work *work) open_flags = smb2_create_open_flags(file_present, daccess, req->CreateDisposition, - &may_flags); + &may_flags, + req->CreateOptions & FILE_DIRECTORY_FILE_LE || + (file_present && S_ISDIR(d_inode(path.dentry)->i_mode))); if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { if (open_flags & O_CREAT) { -- 2.39.2

2 1

[PATCH OLK-6.6] sysctl: always initialize i_uid/i_gid
by Long Li 08 Oct '24

08 Oct '24

From: Thomas Weißschuh <linux(a)weissschuh.net> stable inclusion from stable-v6.6.44 commit ffde3af4b29bf97d62d82e1d45275587e10a991a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ93 CVE: CVE-2024-42312 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 98ca62ba9e2be5863c7d069f84f7166b45a5b2f4 ] Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when set_ownership() was not implemented. It also missed adjusting net_ctl_set_ownership() to use the same default values in case the computation of a better value failed. Fixes: 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.") Cc: stable(a)vger.kernel.org Signed-off-by: Thomas Weißschuh <linux(a)weissschuh.net> Signed-off-by: Joel Granados <j.granados(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/proc/proc_sysctl.c [Conflicts due not merged 96f1d909cdd7 ("sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/proc/proc_sysctl.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c index 5b5cdc747cef..1d665f1c8f34 100644 --- a/fs/proc/proc_sysctl.c +++ b/fs/proc/proc_sysctl.c @@ -480,12 +480,10 @@ static struct inode *proc_sys_make_inode(struct super_block *sb, make_empty_dir_inode(inode); } + inode->i_uid = GLOBAL_ROOT_UID; + inode->i_gid = GLOBAL_ROOT_GID; if (root->set_ownership) root->set_ownership(head, table, &inode->i_uid, &inode->i_gid); - else { - inode->i_uid = GLOBAL_ROOT_UID; - inode->i_gid = GLOBAL_ROOT_GID; - } return inode; } -- 2.39.2

2 1

[PATCH OLK-5.10] serial: sc16is7xx: fix invalid FIFO access with special register set
by Gu Bowen 08 Oct '24

08 Oct '24

From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> mainline inclusion from mainline-v6.11-rc3 commit 7d3b793faaab1305994ce568b59d61927235f57b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY1A CVE: CVE-2024-44950 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable(a)vger.kernel.org Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> Link: https://lore.kernel.org/r/20240723125302.1305372-3-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/sc16is7xx.c [The conflicts occurs because the commit 3837a0379533 ("serial: sc16is7xx: improve regmap debugfs by using one regmap per port") and commit 4409df5866b7f ("serial: sc16is7xx: change EFR lock to operate on each channels") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/serial/sc16is7xx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index 29f05db0d49b..367692a35398 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -538,6 +538,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) SC16IS7XX_MCR_CLKSEL_BIT, prescaler); + mutex_lock(&s->efr_lock); + /* Open the LCR divisors for configuration */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_CONF_MODE_A); @@ -551,6 +553,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) /* Put LCR back to the normal mode */ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); + mutex_unlock(&s->efr_lock); + return DIV_ROUND_CLOSEST(clk / 16, div); } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] fix CVE-2024-46839
by liwei 08 Oct '24

08 Oct '24

fix CVE-2024-46839 Nicholas Piggin (2): workqueue: wq_watchdog_touch is always called with valid CPU workqueue: Improve scalability of workqueue watchdog touch Wang Qing (1): workqueue/watchdog: Make unbound workqueues aware of touch_softlockup_watchdog() kernel/watchdog.c | 5 +++-- kernel/workqueue.c | 25 ++++++++++++++----------- 2 files changed, 17 insertions(+), 13 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 0/3] fix CVE-2024-46839
by liwei 08 Oct '24

08 Oct '24

fix CVE-2024-46839 Nicholas Piggin (2): workqueue: wq_watchdog_touch is always called with valid CPU workqueue: Improve scalability of workqueue watchdog touch Wang Qing (1): workqueue/watchdog: Make unbound workqueues aware of touch_softlockup_watchdog() kernel/watchdog.c | 5 +++-- kernel/workqueue.c | 25 ++++++++++++++----------- 2 files changed, 17 insertions(+), 13 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/2] fix CVE-2024-46839
by liwei 08 Oct '24

08 Oct '24

fix CVE-2024-46839 Nicholas Piggin (2): workqueue: wq_watchdog_touch is always called with valid CPU workqueue: Improve scalability of workqueue watchdog touch kernel/workqueue.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/3] Fix CVE-2024-44958 for olk-5.10
by Zheng Zucheng 08 Oct '24

08 Oct '24

Yang Yingliang (2): sched/smt: Introduce sched_smt_present_inc/dec() helper sched/smt: Fix unbalance sched_smt_present dec/inc Zheng Zucheng (1): sched: Revert fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/2] Add generic xdp xsk multi-buffer recv for ipvlan
by Yue Haibing 08 Oct '24

08 Oct '24

2 3

[OLK-5.10 0/2] Add generic xdp xsk multi-buffer recv for ipvlan
by Yue Haibing 08 Oct '24

08 Oct '24

1 2

[PATCH openEuler-1.0-LTS] ASoC: meson: axg-card: fix 'use-after-free'
by Zeng Heng 08 Oct '24

08 Oct '24

From: Arseniy Krasnov <avkrasnov(a)salutedevices.com> stable inclusion from stable-v6.6.52 commit e43364f578cdc2f8083abbc0cb743ea55e827c29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9R1 CVE: CVE-2024-46849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4f9a71435953f941969a4f017e2357db62d85a86 upstream. Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()', so move 'pad' pointer initialization after this function when memory is already reallocated. Kasan bug report: ================================================================== BUG: KASAN: slab-use-after-free in axg_card_add_link+0x76c/0x9bc Read of size 8 at addr ffff000000e8b260 by task modprobe/356 CPU: 0 PID: 356 Comm: modprobe Tainted: G O 6.9.12-sdkernel #1 Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x78/0x90 print_report+0xfc/0x5c0 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 axg_card_add_link+0x76c/0x9bc [snd_soc_meson_axg_sound_card] meson_card_probe+0x344/0x3b8 [snd_soc_meson_card_utils] platform_probe+0x8c/0xf4 really_probe+0x110/0x39c __driver_probe_device+0xb8/0x18c driver_probe_device+0x108/0x1d8 __driver_attach+0xd0/0x25c bus_for_each_dev+0xe0/0x154 driver_attach+0x34/0x44 bus_add_driver+0x134/0x294 driver_register+0xa8/0x1e8 __platform_driver_register+0x44/0x54 axg_card_pdrv_init+0x20/0x1000 [snd_soc_meson_axg_sound_card] do_one_initcall+0xdc/0x25c do_init_module+0x10c/0x334 load_module+0x24c4/0x26cc init_module_from_file+0xd4/0x128 __arm64_sys_finit_module+0x1f4/0x41c invoke_syscall+0x60/0x188 el0_svc_common.constprop.0+0x78/0x13c do_el0_svc+0x30/0x40 el0_svc+0x38/0x78 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support") Cc: Stable(a)vger.kernel.org Signed-off-by: Arseniy Krasnov <avkrasnov(a)salutedevices.com> Reviewed-by: Jerome Brunet <jbrunet(a)baylibre.com> Link: https://patch.msgid.link/20240911142425.598631-1-avkrasnov@salutedevices.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- sound/soc/meson/axg-card.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c index 2914ba0d965b..da9a8f946f74 100644 --- a/sound/soc/meson/axg-card.c +++ b/sound/soc/meson/axg-card.c @@ -241,7 +241,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, int *index) { struct axg_card *priv = snd_soc_card_get_drvdata(card); - struct snd_soc_dai_link *pad = &card->dai_link[*index]; + struct snd_soc_dai_link *pad; struct snd_soc_dai_link *lb; int ret; @@ -250,6 +250,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, if (ret) return ret; + pad = &card->dai_link[*index]; lb = &card->dai_link[*index + 1]; lb->name = kasprintf(GFP_KERNEL, "%s-lb", pad->name); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ASoC: meson: axg-card: fix 'use-after-free'
by Zeng Heng 08 Oct '24

08 Oct '24

From: Arseniy Krasnov <avkrasnov(a)salutedevices.com> stable inclusion from stable-v6.6.52 commit e43364f578cdc2f8083abbc0cb743ea55e827c29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9R1 CVE: CVE-2024-46849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4f9a71435953f941969a4f017e2357db62d85a86 upstream. Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()', so move 'pad' pointer initialization after this function when memory is already reallocated. Kasan bug report: ================================================================== BUG: KASAN: slab-use-after-free in axg_card_add_link+0x76c/0x9bc Read of size 8 at addr ffff000000e8b260 by task modprobe/356 CPU: 0 PID: 356 Comm: modprobe Tainted: G O 6.9.12-sdkernel #1 Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x78/0x90 print_report+0xfc/0x5c0 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 axg_card_add_link+0x76c/0x9bc [snd_soc_meson_axg_sound_card] meson_card_probe+0x344/0x3b8 [snd_soc_meson_card_utils] platform_probe+0x8c/0xf4 really_probe+0x110/0x39c __driver_probe_device+0xb8/0x18c driver_probe_device+0x108/0x1d8 __driver_attach+0xd0/0x25c bus_for_each_dev+0xe0/0x154 driver_attach+0x34/0x44 bus_add_driver+0x134/0x294 driver_register+0xa8/0x1e8 __platform_driver_register+0x44/0x54 axg_card_pdrv_init+0x20/0x1000 [snd_soc_meson_axg_sound_card] do_one_initcall+0xdc/0x25c do_init_module+0x10c/0x334 load_module+0x24c4/0x26cc init_module_from_file+0xd4/0x128 __arm64_sys_finit_module+0x1f4/0x41c invoke_syscall+0x60/0x188 el0_svc_common.constprop.0+0x78/0x13c do_el0_svc+0x30/0x40 el0_svc+0x38/0x78 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support") Cc: Stable(a)vger.kernel.org Signed-off-by: Arseniy Krasnov <avkrasnov(a)salutedevices.com> Reviewed-by: Jerome Brunet <jbrunet(a)baylibre.com> Link: https://patch.msgid.link/20240911142425.598631-1-avkrasnov@salutedevices.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- sound/soc/meson/axg-card.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c index 2b77010c2c5c..985dbe1805e3 100644 --- a/sound/soc/meson/axg-card.c +++ b/sound/soc/meson/axg-card.c @@ -104,7 +104,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, int *index) { struct meson_card *priv = snd_soc_card_get_drvdata(card); - struct snd_soc_dai_link *pad = &card->dai_link[*index]; + struct snd_soc_dai_link *pad; struct snd_soc_dai_link *lb; struct snd_soc_dai_link_component *dlc; int ret; @@ -114,6 +114,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, if (ret) return ret; + pad = &card->dai_link[*index]; lb = &card->dai_link[*index + 1]; lb->name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-lb", pad->name); -- 2.25.1

2 1

[PATCH OLK-5.10] ASoC: meson: axg-card: fix 'use-after-free'
by Zeng Heng 08 Oct '24

08 Oct '24

From: Arseniy Krasnov <avkrasnov(a)salutedevices.com> stable inclusion from stable-v6.6.52 commit e43364f578cdc2f8083abbc0cb743ea55e827c29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9R1 CVE: CVE-2024-46849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4f9a71435953f941969a4f017e2357db62d85a86 upstream. Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()', so move 'pad' pointer initialization after this function when memory is already reallocated. Kasan bug report: ================================================================== BUG: KASAN: slab-use-after-free in axg_card_add_link+0x76c/0x9bc Read of size 8 at addr ffff000000e8b260 by task modprobe/356 CPU: 0 PID: 356 Comm: modprobe Tainted: G O 6.9.12-sdkernel #1 Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x78/0x90 print_report+0xfc/0x5c0 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 axg_card_add_link+0x76c/0x9bc [snd_soc_meson_axg_sound_card] meson_card_probe+0x344/0x3b8 [snd_soc_meson_card_utils] platform_probe+0x8c/0xf4 really_probe+0x110/0x39c __driver_probe_device+0xb8/0x18c driver_probe_device+0x108/0x1d8 __driver_attach+0xd0/0x25c bus_for_each_dev+0xe0/0x154 driver_attach+0x34/0x44 bus_add_driver+0x134/0x294 driver_register+0xa8/0x1e8 __platform_driver_register+0x44/0x54 axg_card_pdrv_init+0x20/0x1000 [snd_soc_meson_axg_sound_card] do_one_initcall+0xdc/0x25c do_init_module+0x10c/0x334 load_module+0x24c4/0x26cc init_module_from_file+0xd4/0x128 __arm64_sys_finit_module+0x1f4/0x41c invoke_syscall+0x60/0x188 el0_svc_common.constprop.0+0x78/0x13c do_el0_svc+0x30/0x40 el0_svc+0x38/0x78 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support") Cc: Stable(a)vger.kernel.org Signed-off-by: Arseniy Krasnov <avkrasnov(a)salutedevices.com> Reviewed-by: Jerome Brunet <jbrunet(a)baylibre.com> Link: https://patch.msgid.link/20240911142425.598631-1-avkrasnov@salutedevices.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- sound/soc/meson/axg-card.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c index 2b77010c2c5c..985dbe1805e3 100644 --- a/sound/soc/meson/axg-card.c +++ b/sound/soc/meson/axg-card.c @@ -104,7 +104,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, int *index) { struct meson_card *priv = snd_soc_card_get_drvdata(card); - struct snd_soc_dai_link *pad = &card->dai_link[*index]; + struct snd_soc_dai_link *pad; struct snd_soc_dai_link *lb; struct snd_soc_dai_link_component *dlc; int ret; @@ -114,6 +114,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, if (ret) return ret; + pad = &card->dai_link[*index]; lb = &card->dai_link[*index + 1]; lb->name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-lb", pad->name); -- 2.25.1

2 1

[PATCH OLK-6.6] ASoC: meson: axg-card: fix 'use-after-free'
by Zeng Heng 08 Oct '24

08 Oct '24

From: Arseniy Krasnov <avkrasnov(a)salutedevices.com> stable inclusion from stable-v6.6.52 commit e43364f578cdc2f8083abbc0cb743ea55e827c29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9R1 CVE: CVE-2024-46849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4f9a71435953f941969a4f017e2357db62d85a86 upstream. Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()', so move 'pad' pointer initialization after this function when memory is already reallocated. Kasan bug report: ================================================================== BUG: KASAN: slab-use-after-free in axg_card_add_link+0x76c/0x9bc Read of size 8 at addr ffff000000e8b260 by task modprobe/356 CPU: 0 PID: 356 Comm: modprobe Tainted: G O 6.9.12-sdkernel #1 Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x78/0x90 print_report+0xfc/0x5c0 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 axg_card_add_link+0x76c/0x9bc [snd_soc_meson_axg_sound_card] meson_card_probe+0x344/0x3b8 [snd_soc_meson_card_utils] platform_probe+0x8c/0xf4 really_probe+0x110/0x39c __driver_probe_device+0xb8/0x18c driver_probe_device+0x108/0x1d8 __driver_attach+0xd0/0x25c bus_for_each_dev+0xe0/0x154 driver_attach+0x34/0x44 bus_add_driver+0x134/0x294 driver_register+0xa8/0x1e8 __platform_driver_register+0x44/0x54 axg_card_pdrv_init+0x20/0x1000 [snd_soc_meson_axg_sound_card] do_one_initcall+0xdc/0x25c do_init_module+0x10c/0x334 load_module+0x24c4/0x26cc init_module_from_file+0xd4/0x128 __arm64_sys_finit_module+0x1f4/0x41c invoke_syscall+0x60/0x188 el0_svc_common.constprop.0+0x78/0x13c do_el0_svc+0x30/0x40 el0_svc+0x38/0x78 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 Fixes: 7864a79f37b5 ("ASoC: meson: add axg sound card support") Cc: Stable(a)vger.kernel.org Signed-off-by: Arseniy Krasnov <avkrasnov(a)salutedevices.com> Reviewed-by: Jerome Brunet <jbrunet(a)baylibre.com> Link: https://patch.msgid.link/20240911142425.598631-1-avkrasnov@salutedevices.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- sound/soc/meson/axg-card.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c index b6f5b4572012..44175b1b14a2 100644 --- a/sound/soc/meson/axg-card.c +++ b/sound/soc/meson/axg-card.c @@ -104,7 +104,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, int *index) { struct meson_card *priv = snd_soc_card_get_drvdata(card); - struct snd_soc_dai_link *pad = &card->dai_link[*index]; + struct snd_soc_dai_link *pad; struct snd_soc_dai_link *lb; struct snd_soc_dai_link_component *dlc; int ret; @@ -114,6 +114,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, if (ret) return ret; + pad = &card->dai_link[*index]; lb = &card->dai_link[*index + 1]; lb->name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-lb", pad->name); -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/display: Check gpio_id before used as array index
by Zeng Heng 08 Oct '24

08 Oct '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.6.50 commit 08e7755f754e3d2cef7d3a7da538d33526bd6f7c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MK CVE: CVE-2024-46818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 ] [WHY & HOW] GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore should be checked in advance. This fixes 5 OVERRUN issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c index 3ede6e02c3a7..2f8ca831afa2 100644 --- a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +++ b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c @@ -239,6 +239,9 @@ static bool is_pin_busy( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return false; + return service->busyness[id][en]; } @@ -247,6 +250,9 @@ static void set_pin_busy( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return; + service->busyness[id][en] = true; } @@ -255,6 +261,9 @@ static void set_pin_free( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return; + service->busyness[id][en] = false; } @@ -263,7 +272,7 @@ enum gpio_result dal_gpio_service_lock( enum gpio_id id, uint32_t en) { - if (!service->busyness[id]) { + if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { ASSERT_CRITICAL(false); return GPIO_RESULT_OPEN_FAILED; } @@ -277,7 +286,7 @@ enum gpio_result dal_gpio_service_unlock( enum gpio_id id, uint32_t en) { - if (!service->busyness[id]) { + if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { ASSERT_CRITICAL(false); return GPIO_RESULT_OPEN_FAILED; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check gpio_id before used as array index
by Zeng Heng 08 Oct '24

08 Oct '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.226 commit 40c2e8bc117cab8bca8814735f28a8b121654a84 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MK CVE: CVE-2024-46818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 ] [WHY & HOW] GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore should be checked in advance. This fixes 5 OVERRUN issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c index dae8e489c8cf..a7c92c64490c 100644 --- a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +++ b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c @@ -241,6 +241,9 @@ static bool is_pin_busy( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return false; + return service->busyness[id][en]; } @@ -249,6 +252,9 @@ static void set_pin_busy( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return; + service->busyness[id][en] = true; } @@ -257,6 +263,9 @@ static void set_pin_free( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return; + service->busyness[id][en] = false; } @@ -265,7 +274,7 @@ enum gpio_result dal_gpio_service_lock( enum gpio_id id, uint32_t en) { - if (!service->busyness[id]) { + if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { ASSERT_CRITICAL(false); return GPIO_RESULT_OPEN_FAILED; } @@ -279,7 +288,7 @@ enum gpio_result dal_gpio_service_unlock( enum gpio_id id, uint32_t en) { - if (!service->busyness[id]) { + if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { ASSERT_CRITICAL(false); return GPIO_RESULT_OPEN_FAILED; } -- 2.25.1

2 1

[PATCH OLK-5.10] drm/amd/display: Check gpio_id before used as array index
by Zeng Heng 08 Oct '24

08 Oct '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.226 commit 40c2e8bc117cab8bca8814735f28a8b121654a84 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MK CVE: CVE-2024-46818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 ] [WHY & HOW] GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore should be checked in advance. This fixes 5 OVERRUN issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c index dae8e489c8cf..a7c92c64490c 100644 --- a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +++ b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c @@ -241,6 +241,9 @@ static bool is_pin_busy( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return false; + return service->busyness[id][en]; } @@ -249,6 +252,9 @@ static void set_pin_busy( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return; + service->busyness[id][en] = true; } @@ -257,6 +263,9 @@ static void set_pin_free( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return; + service->busyness[id][en] = false; } @@ -265,7 +274,7 @@ enum gpio_result dal_gpio_service_lock( enum gpio_id id, uint32_t en) { - if (!service->busyness[id]) { + if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { ASSERT_CRITICAL(false); return GPIO_RESULT_OPEN_FAILED; } @@ -279,7 +288,7 @@ enum gpio_result dal_gpio_service_unlock( enum gpio_id id, uint32_t en) { - if (!service->busyness[id]) { + if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { ASSERT_CRITICAL(false); return GPIO_RESULT_OPEN_FAILED; } -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amd/display: Check gpio_id before used as array index
by Zeng Heng 08 Oct '24

08 Oct '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from stable-v6.6.50 commit 08e7755f754e3d2cef7d3a7da538d33526bd6f7c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MK CVE: CVE-2024-46818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 ] [WHY & HOW] GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore should be checked in advance. This fixes 5 OVERRUN issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c index 3ede6e02c3a7..2f8ca831afa2 100644 --- a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +++ b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c @@ -239,6 +239,9 @@ static bool is_pin_busy( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return false; + return service->busyness[id][en]; } @@ -247,6 +250,9 @@ static void set_pin_busy( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return; + service->busyness[id][en] = true; } @@ -255,6 +261,9 @@ static void set_pin_free( enum gpio_id id, uint32_t en) { + if (id == GPIO_ID_UNKNOWN) + return; + service->busyness[id][en] = false; } @@ -263,7 +272,7 @@ enum gpio_result dal_gpio_service_lock( enum gpio_id id, uint32_t en) { - if (!service->busyness[id]) { + if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { ASSERT_CRITICAL(false); return GPIO_RESULT_OPEN_FAILED; } @@ -277,7 +286,7 @@ enum gpio_result dal_gpio_service_unlock( enum gpio_id id, uint32_t en) { - if (!service->busyness[id]) { + if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) { ASSERT_CRITICAL(false); return GPIO_RESULT_OPEN_FAILED; } -- 2.25.1

2 1