- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 7438/23724] drivers/net/phy/ax88796b.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 21 Sep '24

21 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3bbb0f885bf0f93bee0bb99c623877588ae005ee commit: 56e625aa545a24e8d3fa44b5fbcdedd88e443dcc [7438/23724] net: phy: rename Asix Electronics PHY driver config: x86_64-buildonly-randconfig-002-20240911 (https://download.01.org/0day-ci/archive/20240921/202409211917.FUngwi3h-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409211917.FUngwi3h-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409211917.FUngwi3h-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/phy/ax88796b.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 369b68f40ab0c9bf0a8e087ed7ced93dcad3cd6c
by kernel test robot 21 Sep '24

21 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 369b68f40ab0c9bf0a8e087ed7ced93dcad3cd6c !11560 mm/ksm: fix possible UAF of stable_node Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- x86_64-buildonly-randconfig-002-20240911 | `-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-kexec `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration elapsed time: 1450m configs tested: 8 configs skipped: 40 tested configs: arm64 allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-kselftests gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 6891/30000] arch/arm64/kernel/ipi_nmi.c:40:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'?
by kernel test robot 21 Sep '24

21 Sep '24

Hi Li, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9728eb343bf95f638ebe53d7bf78063c87131b7d commit: f86d165bfe5f6248743774bb07af0bd7cff12443 [6891/30000] arm64: Add non nmi ipi backtrace support config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20240921/202409211722.HQb4h8VT-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409211722.HQb4h8VT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409211722.HQb4h8VT-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kernel/ipi_nmi.c: In function 'ipi_cpu_backtrace': arch/arm64/kernel/ipi_nmi.c:38:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] 38 | printk_safe_enter(); | ^~~~~~~~~~~~~~~~~ | printk_nmi_enter >> arch/arm64/kernel/ipi_nmi.c:40:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] 40 | printk_safe_exit(); | ^~~~~~~~~~~~~~~~ | printk_nmi_exit cc1: some warnings being treated as errors vim +40 arch/arm64/kernel/ipi_nmi.c 35 36 static void ipi_cpu_backtrace(void *info) 37 { > 38 printk_safe_enter(); 39 nmi_cpu_backtrace(get_irq_regs()); > 40 printk_safe_exit(); 41 } 42 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v2] mm/migration: do not folio copy in MIGRATE_SYNC_NO_COPY mode
by Tong Tiangen 21 Sep '24

21 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IASFAM -------------------------------- During page migration, if MIGRATE_SYNC_NO_COPY mode is used, the page content should not be migrated. This patch fix it. Fixes: 374fe8ea8082 ("fs: hugetlbfs: support poisoned recover from hugetlbfs_migrate_folio()") Fixes: 1d263184ba06 ("mm: migrate: support poisoned recover from migrate folio") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- fs/hugetlbfs/inode.c | 4 ++++ include/linux/migrate.h | 8 ++++++++ mm/migrate.c | 45 ++++++++++++++++++++++++++++------------- 3 files changed, 43 insertions(+), 14 deletions(-) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 8386d78eabe5..7f95b0fece82 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1146,6 +1146,10 @@ static int hugetlbfs_migrate_folio(struct address_space *mapping, { int rc; + rc = folio_migrate_mc_copy(mapping, dst, src, mode); + if (rc != MIGRATEPAGE_SUCCESS) + return rc; + rc = migrate_huge_page_move_mapping(mapping, dst, src); if (rc != MIGRATEPAGE_SUCCESS) return rc; diff --git a/include/linux/migrate.h b/include/linux/migrate.h index 517f70b70620..68083e8432e8 100644 --- a/include/linux/migrate.h +++ b/include/linux/migrate.h @@ -79,6 +79,8 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio); void folio_migrate_copy(struct folio *newfolio, struct folio *folio); int folio_migrate_mapping(struct address_space *mapping, struct folio *newfolio, struct folio *folio, int extra_count); +int folio_migrate_mc_copy(struct address_space *mapping, struct folio *dst, + struct folio *src, enum migrate_mode mode); #else @@ -98,6 +100,12 @@ static inline int migrate_huge_page_move_mapping(struct address_space *mapping, { return -ENOSYS; } +static inline int folio_migrate_mc_copy(struct address_space *mapping, + struct folio *dst, struct folio *src, + enum migrate_mode mode) +{ + return -ENOSYS; +} #endif /* CONFIG_MIGRATION */ diff --git a/mm/migrate.c b/mm/migrate.c index efcca5330568..577c559b56fd 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -552,16 +552,10 @@ int migrate_huge_page_move_mapping(struct address_space *mapping, struct folio *dst, struct folio *src) { XA_STATE(xas, &mapping->i_pages, folio_index(src)); - int rc, expected_count = folio_expected_refs(mapping, src); - - if (folio_ref_count(src) != expected_count) - return -EAGAIN; - - rc = folio_mc_copy(dst, src); - if (unlikely(rc)) - return rc; + int expected_count; xas_lock_irq(&xas); + expected_count = folio_expected_refs(mapping, src); if (!folio_ref_freeze(src, expected_count)) { xas_unlock_irq(&xas); return -EAGAIN; @@ -681,6 +675,33 @@ void folio_migrate_copy(struct folio *newfolio, struct folio *folio) } EXPORT_SYMBOL(folio_migrate_copy); + +static int __folio_migrate_mc_copy(struct folio *dst, struct folio *src, + enum migrate_mode mode, int expected_count) +{ + int rc; + + /* Check whether src does not have extra refs before we do more work */ + if (folio_ref_count(src) != expected_count) + return -EAGAIN; + + if (mode != MIGRATE_SYNC_NO_COPY) { + rc = folio_mc_copy(dst, src); + if (unlikely(rc)) + return rc; + } + + return MIGRATEPAGE_SUCCESS; +} + +int folio_migrate_mc_copy(struct address_space *mapping, struct folio *dst, + struct folio *src, enum migrate_mode mode) +{ + int expected_count = folio_expected_refs(mapping, src); + + return __folio_migrate_mc_copy(dst, src, mode, expected_count); +} + /************************************************************ * Migration functions ***********************************************************/ @@ -691,12 +712,8 @@ static int __migrate_folio(struct address_space *mapping, struct folio *dst, { int rc, expected_count = folio_expected_refs(mapping, src); - /* Check whether src does not have extra refs before we do more work */ - if (folio_ref_count(src) != expected_count) - return -EAGAIN; - - rc = folio_mc_copy(dst, src); - if (unlikely(rc)) + rc = __folio_migrate_mc_copy(dst, src, mode, expected_count); + if (rc != MIGRATEPAGE_SUCCESS) return rc; rc = __folio_migrate_mapping(mapping, dst, src, expected_count); -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 9728eb343bf95f638ebe53d7bf78063c87131b7d
by kernel test robot 21 Sep '24

21 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 9728eb343bf95f638ebe53d7bf78063c87131b7d !11588 drm/amd/display: Skip finding free audio for unknown engine_id Error/Warning (recently discovered and may have been fixed): drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_rearm_jfc' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap' [-Wmissing-prototypes] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-004-20240912 | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_rearm_jfc | `-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_mmap |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-kexec | |-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-161-20240921 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-rhel-8.3 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-func | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-kselftests | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 1458m configs tested: 7 configs skipped: 40 tested configs: arm64 allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 7193/23724] net/9p/client.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 21 Sep '24

21 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 369b68f40ab0c9bf0a8e087ed7ced93dcad3cd6c commit: a6fb923f7803f40a567445dfe1ff3a539c8adc1f [7193/23724] 9p: Use a slab for allocating requests config: x86_64-buildonly-randconfig-002-20240911 (https://download.01.org/0day-ci/archive/20240921/202409211531.7WSQbHuU-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409211531.7WSQbHuU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409211531.7WSQbHuU-lkp@intel.com/ All warnings (new ones prefixed by >>): net/9p/client.c:376: warning: Function parameter or member 'c' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'req' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'status' not described in 'p9_client_cb' net/9p/client.c:523: warning: Function parameter or member 'uidata' not described in 'p9_check_zc_errors' net/9p/client.c:774: warning: Function parameter or member 'in_hdrlen' not described in 'p9_client_zc_rpc' net/9p/client.c:774: warning: Excess function parameter 'hdrlen' description in 'p9_client_zc_rpc' >> net/9p/client.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] arm64/mpam: Add early_param for MPAM detecting
by Zeng Heng 21 Sep '24

21 Sep '24

Zeng Heng (2): Revert "arm64: head.S: Initialise MPAM EL2 registers and disable traps" arm64/mpam: Add early_param for MPAM detecting arch/arm64/include/asm/cpufeature.h | 9 +++++++ arch/arm64/include/asm/el2_setup.h | 16 ------------ arch/arm64/kernel/cpufeature.c | 13 +++++++--- arch/arm64/kernel/cpuinfo.c | 1 + arch/arm64/kernel/mpam.c | 38 ++++++++++++++++++++++++++--- 5 files changed, 53 insertions(+), 24 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] arm64/mpam: Add early_param for MPAM detecting
by Zeng Heng 21 Sep '24

21 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9OXPO -------------------------------- If BIOS firmware doesn't enable MPAM function under EL3 environment, while the hardware has the MPAM ability, that would cause illegal instruction fault when access MPAM registers. Fixes: 21771eaaf93a ("arm64: cpufeature: discover CPU support for MPAM") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/cpufeature.h | 9 +++++++ arch/arm64/kernel/cpufeature.c | 13 +++++++--- arch/arm64/kernel/cpuinfo.c | 1 + arch/arm64/kernel/mpam.c | 38 ++++++++++++++++++++++++++--- 4 files changed, 53 insertions(+), 8 deletions(-) diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index 2af4c7ad7dc5..f8ec4b20fa69 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -858,6 +858,15 @@ static inline bool cpus_support_mpam(void) cpus_have_final_cap(ARM64_MPAM); } +#ifdef CONFIG_ARM64_MPAM +bool mpam_detect_is_enabled(void); +#else +static inline bool mpam_detect_is_enabled(void) +{ + return false; +} +#endif + int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt); bool try_emulate_mrs(struct pt_regs *regs, u32 isn); diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index f94bc6eb83e0..f4f3ad670391 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1078,8 +1078,9 @@ void __init init_cpu_features(struct cpuinfo_arm64 *info) vec_init_vq_map(ARM64_VEC_SME); } - if (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || - id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1)) + if (mpam_detect_is_enabled() && + (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || + id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1))) init_cpu_ftr_reg(SYS_MPAMIDR_EL1, info->reg_mpamidr); if (id_aa64pfr1_mte(info->reg_id_aa64pfr1)) @@ -1341,8 +1342,9 @@ void update_cpu_features(int cpu, vec_update_vq_map(ARM64_VEC_SME); } - if (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || - id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1)) { + if (mpam_detect_is_enabled() && + (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || + id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1))) { taint |= check_update_ftr_reg(SYS_MPAMIDR_EL1, cpu, info->reg_mpamidr, boot->reg_mpamidr); } @@ -2317,6 +2319,9 @@ test_has_mpam(const struct arm64_cpu_capabilities *entry, int scope) !id_aa64pfr1_mpamfrac(pfr1)) return false; + if (!mpam_detect_is_enabled()) + return false; + /* Check firmware actually enabled MPAM on this cpu. */ return (read_sysreg_s(SYS_MPAM1_EL1) & MPAM_SYSREG_EN); } diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c index 5ad8d8697d56..7466b6066d87 100644 --- a/arch/arm64/kernel/cpuinfo.c +++ b/arch/arm64/kernel/cpuinfo.c @@ -461,6 +461,7 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info) __cpuinfo_store_cpu_32bit(&info->aarch32); if (IS_ENABLED(CONFIG_ARM64_MPAM) && + mpam_detect_is_enabled() && (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1))) info->reg_mpamidr = read_cpuid(MPAMIDR_EL1); diff --git a/arch/arm64/kernel/mpam.c b/arch/arm64/kernel/mpam.c index 8fd9dbdc2b01..87411609407e 100644 --- a/arch/arm64/kernel/mpam.c +++ b/arch/arm64/kernel/mpam.c @@ -13,15 +13,45 @@ DEFINE_STATIC_KEY_FALSE(mpam_enabled); DEFINE_PER_CPU(u64, arm64_mpam_default); DEFINE_PER_CPU(u64, arm64_mpam_current); +static const struct midr_range mpam_disable_list[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + { /* sentinel */ } +}; + +static bool __read_mostly mpam_detect_enabled; +static int __init mpam_setup(char *str) +{ + if (!is_midr_in_range_list(read_cpuid_id(), mpam_disable_list)) + mpam_detect_enabled = true; + + if (!strcmp(str, "acpi")) + mpam_detect_enabled = true; + + return 0; +} +early_param("mpam", mpam_setup); + +bool mpam_detect_is_enabled(void) +{ + return mpam_detect_enabled; +} + static int __init arm64_mpam_register_cpus(void) { + u16 partid_max; + u64 mpamidr; + u8 pmg_max; + if (is_kdump_kernel()) return 0; - u64 mpamidr = read_sanitised_ftr_reg(SYS_MPAMIDR_EL1); - u16 partid_max = FIELD_GET(MPAMIDR_PARTID_MAX, mpamidr); - u8 pmg_max = FIELD_GET(MPAMIDR_PMG_MAX, mpamidr); + if (!mpam_detect_is_enabled()) + return 0; + + mpamidr = read_sanitised_ftr_reg(SYS_MPAMIDR_EL1); + partid_max = FIELD_GET(MPAMIDR_PARTID_MAX, mpamidr); + pmg_max = FIELD_GET(MPAMIDR_PMG_MAX, mpamidr); return mpam_register_requestor(partid_max, pmg_max); } -arch_initcall(arm64_mpam_register_cpus) +arch_initcall(arm64_mpam_register_cpus); -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] fix CVE-2024-46714
by Lin Yujun 20 Sep '24

20 Sep '24

Alex Hung (1): drm/amd/display: Skip wbscl_set_scaler_filter if filter is null drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] drm/amd/display: Check denominator pbn_div before used
by Xia Fukun 20 Sep '24

20 Sep '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.11-rc7 commit 116a678f3a9abc24f5c9d2525b7393d18d9eb58e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXX CVE: CVE-2024-46773 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHAT & HOW] A denominator cannot be 0, and is checked before used. This fixes 1 DIVIDE_BY_ZERO issue reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 94059aef762b..2c7ba6e4fd1b 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -6934,7 +6934,7 @@ static int dm_update_mst_vcpi_slots_for_dsc(struct drm_atomic_state *state, } } - if (j == dc_state->stream_count) + if (j == dc_state->stream_count || pbn_div == 0) continue; slot_num = DIV_ROUND_UP(pbn, pbn_div); -- 2.34.1

2 1

[PATCH OLK-6.6] mm/migration: do not folio copy in MIGRATE_SYNC_NO_COPY mode
by Tong Tiangen 20 Sep '24

20 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IASFAM -------------------------------- During page migration, if MIGRATE_SYNC_NO_COPY mode is used, the page content should not be migrated. This patch fix it. Fixes: 374fe8ea8082 ("fs: hugetlbfs: support poisoned recover from hugetlbfs_migrate_folio()") Fixes: 1d263184ba06 ("mm: migrate: support poisoned recover from migrate folio") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- fs/hugetlbfs/inode.c | 10 ++++++++++ include/linux/migrate.h | 7 +++++-- mm/migrate.c | 20 ++++++++------------ 3 files changed, 23 insertions(+), 14 deletions(-) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 8386d78eabe5..d4fcfc03fac9 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1145,6 +1145,16 @@ static int hugetlbfs_migrate_folio(struct address_space *mapping, enum migrate_mode mode) { int rc; + int expected_count = folio_expected_refs(mapping, src); + + if (folio_ref_count(src) != expected_count) + return -EAGAIN; + + if (mode != MIGRATE_SYNC_NO_COPY) { + rc = folio_mc_copy(dst, src); + if (unlikely(rc)) + return rc; + } rc = migrate_huge_page_move_mapping(mapping, dst, src); if (rc != MIGRATEPAGE_SUCCESS) diff --git a/include/linux/migrate.h b/include/linux/migrate.h index 517f70b70620..832d711d381d 100644 --- a/include/linux/migrate.h +++ b/include/linux/migrate.h @@ -79,7 +79,7 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio); void folio_migrate_copy(struct folio *newfolio, struct folio *folio); int folio_migrate_mapping(struct address_space *mapping, struct folio *newfolio, struct folio *folio, int extra_count); - +int folio_expected_refs(struct address_space *mapping, struct folio *folio); #else static inline void putback_movable_pages(struct list_head *l) {} @@ -98,7 +98,10 @@ static inline int migrate_huge_page_move_mapping(struct address_space *mapping, { return -ENOSYS; } - +static inline int folio_expected_refs(struct address_space *mapping, struct folio *folio) +{ + return 0; +} #endif /* CONFIG_MIGRATION */ #ifdef CONFIG_COMPACTION diff --git a/mm/migrate.c b/mm/migrate.c index efcca5330568..50cf85d65cf3 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -376,7 +376,7 @@ void pmd_migration_entry_wait(struct mm_struct *mm, pmd_t *pmd) } #endif -static int folio_expected_refs(struct address_space *mapping, +int folio_expected_refs(struct address_space *mapping, struct folio *folio) { int refs = 1; @@ -552,16 +552,10 @@ int migrate_huge_page_move_mapping(struct address_space *mapping, struct folio *dst, struct folio *src) { XA_STATE(xas, &mapping->i_pages, folio_index(src)); - int rc, expected_count = folio_expected_refs(mapping, src); - - if (folio_ref_count(src) != expected_count) - return -EAGAIN; - - rc = folio_mc_copy(dst, src); - if (unlikely(rc)) - return rc; + int expected_count; xas_lock_irq(&xas); + expected_count = folio_expected_refs(mapping, src); if (!folio_ref_freeze(src, expected_count)) { xas_unlock_irq(&xas); return -EAGAIN; @@ -695,9 +689,11 @@ static int __migrate_folio(struct address_space *mapping, struct folio *dst, if (folio_ref_count(src) != expected_count) return -EAGAIN; - rc = folio_mc_copy(dst, src); - if (unlikely(rc)) - return rc; + if (mode != MIGRATE_SYNC_NO_COPY) { + rc = folio_mc_copy(dst, src); + if (unlikely(rc)) + return rc; + } rc = __folio_migrate_mapping(mapping, dst, src, expected_count); if (rc != MIGRATEPAGE_SUCCESS) -- 2.25.1

2 1

[PATCH OLK-5.10] media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
by Zheng Yejian 20 Sep '24

20 Sep '24

From: Sean Young <sean(a)mess.org> stable inclusion from stable-v5.10.224 commit 2de18b5cc38e83428316d6d6d05a702208fb299b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAS2LK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c84bde4f37ba27d50e4c70ecacd33fe4a57030d upstream. This reverts commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c. This breaks the TeVii s480 dual DVB-S2 S660. The device has a bulk in endpoint but no corresponding out endpoint, so the device does not pass the "has both receive and send bulk endpoint" test. Seemingly this device does not use dvb_usb_generic_rw() so I have tried removing the generic_bulk_ctrl_endpoint entry, but this resulted in different problems. As we have no explanation yet, revert. $ dmesg | grep -i -e dvb -e dw21 -e usb\ 4 [ 0.999122] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 1.023123] usb 4-1: new high-speed USB device number 2 using ehci-pci [ 1.130247] usb 1-1: New USB device found, idVendor=9022, idProduct=d482, +bcdDevice= 0.01 [ 1.130257] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1.152323] usb 4-1: New USB device found, idVendor=9022, idProduct=d481, +bcdDevice= 0.01 [ 1.152329] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 6.701033] dvb-usb: found a 'TeVii S480.2 USB' in cold state, will try to +load a firmware [ 6.701178] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.701179] dw2102: start downloading DW210X firmware [ 6.703715] dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in cold +state, will try to load a firmware [ 6.703974] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 6.756432] usb 1-1: USB disconnect, device number 2 [ 6.862119] dvb-usb: found a 'TeVii S480.2 USB' in warm state. [ 6.862194] dvb-usb: TeVii S480.2 USB error while loading driver (-22) [ 6.862209] dvb-usb: found a 'TeVii S480.1 USB' in cold state, will try to +load a firmware [ 6.862244] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.862245] dw2102: start downloading DW210X firmware [ 6.914811] usb 4-1: USB disconnect, device number 2 [ 7.014131] dvb-usb: found a 'TeVii S480.1 USB' in warm state. [ 7.014487] dvb-usb: TeVii S480.1 USB error while loading driver (-22) [ 7.014538] usbcore: registered new interface driver dw2102 Closes: https://lore.kernel.org/stable/20240801165146.38991f60@mir/ Fixes: 2052138b7da5 ("media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()") Reported-by: Stefan Lippers-Hollmann <s.l-h(a)gmx.de> Cc: stable(a)vger.kernel.org Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++--------------------- 1 file changed, 4 insertions(+), 31 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index 6cf6d08cc4ec..58eea8ab5477 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -23,40 +23,11 @@ static int dvb_usb_force_pid_filter_usage; module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); -static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) -{ - if (endpoint) { - int ret; - - ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); - if (ret) - return ret; - ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); - if (ret) - return ret; - } - return 0; -} - -static void dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint) -{ - if (endpoint) { - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); - } -} - static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) { struct dvb_usb_adapter *adap; int ret, n, o; - ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); - if (ret) - return ret; - ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); - if (ret) - return ret; for (n = 0; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d; @@ -132,8 +103,10 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) * when reloading the driver w/o replugging the device * sometimes a timeout occurs, this helps */ - dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint); - dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response); + if (d->props.generic_bulk_ctrl_endpoint != 0) { + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); + } return 0; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
by Zheng Yejian 20 Sep '24

20 Sep '24

From: Sean Young <sean(a)mess.org> stable inclusion from stable-v5.10.224 commit 2de18b5cc38e83428316d6d6d05a702208fb299b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAS2LK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c84bde4f37ba27d50e4c70ecacd33fe4a57030d upstream. This reverts commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c. This breaks the TeVii s480 dual DVB-S2 S660. The device has a bulk in endpoint but no corresponding out endpoint, so the device does not pass the "has both receive and send bulk endpoint" test. Seemingly this device does not use dvb_usb_generic_rw() so I have tried removing the generic_bulk_ctrl_endpoint entry, but this resulted in different problems. As we have no explanation yet, revert. $ dmesg | grep -i -e dvb -e dw21 -e usb\ 4 [ 0.999122] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 1.023123] usb 4-1: new high-speed USB device number 2 using ehci-pci [ 1.130247] usb 1-1: New USB device found, idVendor=9022, idProduct=d482, +bcdDevice= 0.01 [ 1.130257] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1.152323] usb 4-1: New USB device found, idVendor=9022, idProduct=d481, +bcdDevice= 0.01 [ 1.152329] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 6.701033] dvb-usb: found a 'TeVii S480.2 USB' in cold state, will try to +load a firmware [ 6.701178] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.701179] dw2102: start downloading DW210X firmware [ 6.703715] dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in cold +state, will try to load a firmware [ 6.703974] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 6.756432] usb 1-1: USB disconnect, device number 2 [ 6.862119] dvb-usb: found a 'TeVii S480.2 USB' in warm state. [ 6.862194] dvb-usb: TeVii S480.2 USB error while loading driver (-22) [ 6.862209] dvb-usb: found a 'TeVii S480.1 USB' in cold state, will try to +load a firmware [ 6.862244] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.862245] dw2102: start downloading DW210X firmware [ 6.914811] usb 4-1: USB disconnect, device number 2 [ 7.014131] dvb-usb: found a 'TeVii S480.1 USB' in warm state. [ 7.014487] dvb-usb: TeVii S480.1 USB error while loading driver (-22) [ 7.014538] usbcore: registered new interface driver dw2102 Closes: https://lore.kernel.org/stable/20240801165146.38991f60@mir/ Fixes: 2052138b7da5 ("media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()") Reported-by: Stefan Lippers-Hollmann <s.l-h(a)gmx.de> Cc: stable(a)vger.kernel.org Conflicts: drivers/media/usb/dvb-usb/dvb-usb-init.c [Resolve conflicts due to changes in comments] Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++--------------------- 1 file changed, 4 insertions(+), 31 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index 04af78316efd..39ac22486bcd 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -26,40 +26,11 @@ static int dvb_usb_force_pid_filter_usage; module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); -static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) -{ - if (endpoint) { - int ret; - - ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); - if (ret) - return ret; - ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); - if (ret) - return ret; - } - return 0; -} - -static void dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint) -{ - if (endpoint) { - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); - } -} - static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) { struct dvb_usb_adapter *adap; int ret, n, o; - ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); - if (ret) - return ret; - ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); - if (ret) - return ret; for (n = 0; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d; @@ -129,8 +100,10 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) * when reloading the driver w/o replugging the device * sometimes a timeout occures, this helps */ - dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint); - dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response); + if (d->props.generic_bulk_ctrl_endpoint != 0) { + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); + } return 0; } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 18192/23720] mm/memory.c:1546:10: error: implicit declaration of function 'hugetlb_insert_hugepage_pte_by_pa'
by kernel test robot 20 Sep '24

20 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bacbf9a9f0df34d979a8029d5a7a7e5dc91460b9 commit: 18f49509eef01d1ee6ed81899298994f2f88dd2a [18192/23720] ascend: share_pool: Use remap_pfn_range to share kva to uva config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20240920/202409201222.m2Vt8TXh-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240920/202409201222.m2Vt8TXh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409201222.m2Vt8TXh-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/memory.c:51: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> mm/memory.c:1546:10: error: implicit declaration of function 'hugetlb_insert_hugepage_pte_by_pa' [-Werror,-Wimplicit-function-declaration] 1546 | return hugetlb_insert_hugepage_pte_by_pa(vma->vm_mm, addr, | ^ mm/memory.c:1546:10: note: did you mean 'hugetlb_insert__hugepage_pte_by_pa'? include/linux/hugetlb.h:658:19: note: 'hugetlb_insert__hugepage_pte_by_pa' declared here 658 | static inline int hugetlb_insert__hugepage_pte_by_pa(struct mm_struct *mm, | ^ 1 warning and 1 error generated. vim +/hugetlb_insert_hugepage_pte_by_pa +1546 mm/memory.c 1504 1505 /** 1506 * vm_insert_page - insert single page into user vma 1507 * @vma: user vma to map to 1508 * @addr: target user address of this page 1509 * @page: source kernel page 1510 * 1511 * This allows drivers to insert individual pages they've allocated 1512 * into a user vma. 1513 * 1514 * The page has to be a nice clean _individual_ kernel allocation. 1515 * If you allocate a compound page, you need to have marked it as 1516 * such (__GFP_COMP), or manually just split the page up yourself 1517 * (see split_page()). 1518 * 1519 * NOTE! Traditionally this was done with "remap_pfn_range()" which 1520 * took an arbitrary page protection parameter. This doesn't allow 1521 * that. Your vma protection will have to be set up correctly, which 1522 * means that if you want a shared writable mapping, you'd better 1523 * ask for a shared writable mapping! 1524 * 1525 * The page does not need to be reserved. 1526 * 1527 * Usually this function is called from f_op->mmap() handler 1528 * under mm->mmap_sem write-lock, so it can change vma->vm_flags. 1529 * Caller must set VM_MIXEDMAP on vma if it wants to call this 1530 * function from other places, for example from page-fault handler. 1531 */ 1532 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, 1533 struct page *page) 1534 { 1535 if (addr < vma->vm_start || addr >= vma->vm_end) 1536 return -EFAULT; 1537 if (!page_count(page)) 1538 return -EINVAL; 1539 if (!(vma->vm_flags & VM_MIXEDMAP)) { 1540 BUG_ON(down_read_trylock(&vma->vm_mm->mmap_sem)); 1541 BUG_ON(vma->vm_flags & VM_PFNMAP); 1542 vma->vm_flags |= VM_MIXEDMAP; 1543 } 1544 1545 if (sp_check_hugepage(page)) > 1546 return hugetlb_insert_hugepage_pte_by_pa(vma->vm_mm, addr, 1547 vma->vm_page_prot, page_to_phys(page)); 1548 else 1549 return insert_page(vma, addr, page, vma->vm_page_prot); 1550 } 1551 EXPORT_SYMBOL(vm_insert_page); 1552 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/11] large folio: Performance and bugfix
by Liu Shixin 20 Sep '24

20 Sep '24

Patch [1-3] are cleanups for shmem. Patch [4,5] fix performance of shmem write. Patch [6-11] fix fault handler's handling of poisoned tail pages. Baolin Wang (3): mm: shmem: simplify the suitable huge orders validation for tmpfs mm: shmem: rename shmem_is_huge() to shmem_huge_global_enabled() mm: shmem: move shmem_huge_global_enabled() into shmem_allowable_huge_orders() Kefeng Wang (1): tmpfs: fault in smaller chunks if large folio allocation not allowed Matthew Wilcox (Oracle) (6): mm: make mapping_evict_folio() the preferred way to evict clean folios mm: convert __do_fault() to use a folio mm: use mapping_evict_folio() in truncate_error_page() mm: convert soft_offline_in_use_page() to use a folio mm: convert isolate_page() to mf_isolate_folio() mm: remove invalidate_inode_page() Rik van Riel (1): mm,tmpfs: consider end of file write in shmem_is_huge include/linux/fs.h | 2 + include/linux/shmem_fs.h | 15 ++--- mm/filemap.c | 7 +- mm/huge_memory.c | 11 +--- mm/internal.h | 2 +- mm/khugepaged.c | 2 +- mm/memory-failure.c | 54 ++++++++-------- mm/memory.c | 20 +++--- mm/shmem.c | 135 +++++++++++++++++++++------------------ mm/truncate.c | 42 +++++------- mm/userfaultfd.c | 2 +- 11 files changed, 145 insertions(+), 147 deletions(-) -- 2.34.1

2 12

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-46714
by Lin Yujun 20 Sep '24

20 Sep '24

Alex Hung (1): drm/amd/display: Skip wbscl_set_scaler_filter if filter is null drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] fix CVE-2024-46714
by Lin Yujun 20 Sep '24

20 Sep '24

Alex Hung (1): drm/amd/display: Skip wbscl_set_scaler_filter if filter is null drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] vsock: fix recursive ->recvmsg calls
by Zhang Changzhong 20 Sep '24

20 Sep '24

From: Cong Wang <cong.wang(a)bytedance.com> stable inclusion from stable-v6.6.48 commit 921f1acf0c3cf6b1260ab57a8a6e8b3d5f3023d5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZC CVE: CVE-2024-44996 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 69139d2919dd4aa9a553c8245e7c63e82613e3fc ] After a vsock socket has been added to a BPF sockmap, its prot->recvmsg has been replaced with vsock_bpf_recvmsg(). Thus the following recursiion could happen: vsock_bpf_recvmsg() -> __vsock_recvmsg() -> vsock_connectible_recvmsg() -> prot->recvmsg() -> vsock_bpf_recvmsg() again We need to fix it by calling the original ->recvmsg() without any BPF sockmap logic in __vsock_recvmsg(). Fixes: 634f1a7110b4 ("vsock: support sockmap") Reported-by: syzbot+bdb4bd87b5e22058e2a4(a)syzkaller.appspotmail.com Tested-by: syzbot+bdb4bd87b5e22058e2a4(a)syzkaller.appspotmail.com Cc: Bobby Eshleman <bobby.eshleman(a)bytedance.com> Cc: Michael S. Tsirkin <mst(a)redhat.com> Cc: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Cong Wang <cong.wang(a)bytedance.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Link: https://patch.msgid.link/20240812022153.86512-1-xiyou.wangcong@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- include/net/af_vsock.h | 4 ++++ net/vmw_vsock/af_vsock.c | 50 +++++++++++++++++++++++++++-------------------- net/vmw_vsock/vsock_bpf.c | 4 ++-- 3 files changed, 35 insertions(+), 23 deletions(-) diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index dc3cb16..f8b09a8 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -227,8 +227,12 @@ struct vsock_tap { int vsock_add_tap(struct vsock_tap *vt); int vsock_remove_tap(struct vsock_tap *vt); void vsock_deliver_tap(struct sk_buff *build_skb(void *opaque), void *opaque); +int __vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + int flags); int vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, int flags); +int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, + size_t len, int flags); int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, int flags); diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 4afb6a5..f5eb737 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1270,25 +1270,28 @@ static int vsock_dgram_connect(struct socket *sock, return err; } +int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, + size_t len, int flags) +{ + struct sock *sk = sock->sk; + struct vsock_sock *vsk = vsock_sk(sk); + + return vsk->transport->dgram_dequeue(vsk, msg, len, flags); +} + int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, int flags) { #ifdef CONFIG_BPF_SYSCALL + struct sock *sk = sock->sk; const struct proto *prot; -#endif - struct vsock_sock *vsk; - struct sock *sk; - sk = sock->sk; - vsk = vsock_sk(sk); - -#ifdef CONFIG_BPF_SYSCALL prot = READ_ONCE(sk->sk_prot); if (prot != &vsock_proto) return prot->recvmsg(sk, msg, len, flags, NULL); #endif - return vsk->transport->dgram_dequeue(vsk, msg, len, flags); + return __vsock_dgram_recvmsg(sock, msg, len, flags); } EXPORT_SYMBOL_GPL(vsock_dgram_recvmsg); @@ -2124,15 +2127,12 @@ static int __vsock_seqpacket_recvmsg(struct sock *sk, struct msghdr *msg, } int -vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - int flags) +__vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + int flags) { struct sock *sk; struct vsock_sock *vsk; const struct vsock_transport *transport; -#ifdef CONFIG_BPF_SYSCALL - const struct proto *prot; -#endif int err; sk = sock->sk; @@ -2183,14 +2183,6 @@ vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, goto out; } -#ifdef CONFIG_BPF_SYSCALL - prot = READ_ONCE(sk->sk_prot); - if (prot != &vsock_proto) { - release_sock(sk); - return prot->recvmsg(sk, msg, len, flags, NULL); - } -#endif - if (sk->sk_type == SOCK_STREAM) err = __vsock_stream_recvmsg(sk, msg, len, flags); else @@ -2200,6 +2192,22 @@ vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, release_sock(sk); return err; } + +int +vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + int flags) +{ +#ifdef CONFIG_BPF_SYSCALL + struct sock *sk = sock->sk; + const struct proto *prot; + + prot = READ_ONCE(sk->sk_prot); + if (prot != &vsock_proto) + return prot->recvmsg(sk, msg, len, flags, NULL); +#endif + + return __vsock_connectible_recvmsg(sock, msg, len, flags); +} EXPORT_SYMBOL_GPL(vsock_connectible_recvmsg); static int vsock_set_rcvlowat(struct sock *sk, int val) diff --git a/net/vmw_vsock/vsock_bpf.c b/net/vmw_vsock/vsock_bpf.c index a3c9754..c42c5cc1 100644 --- a/net/vmw_vsock/vsock_bpf.c +++ b/net/vmw_vsock/vsock_bpf.c @@ -64,9 +64,9 @@ static int __vsock_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int int err; if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) - err = vsock_connectible_recvmsg(sock, msg, len, flags); + err = __vsock_connectible_recvmsg(sock, msg, len, flags); else if (sk->sk_type == SOCK_DGRAM) - err = vsock_dgram_recvmsg(sock, msg, len, flags); + err = __vsock_dgram_recvmsg(sock, msg, len, flags); else err = -EPROTOTYPE; -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] net: hns3: fix a deadlock problem when config TC during resetting
by Zhang Changzhong 20 Sep '24

20 Sep '24

From: Jie Wang <wangjie125(a)huawei.com> stable inclusion from stable-v5.10.225 commit fc250eca15bde34c4c8f806b9d88f55bd56a992c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY0Z CVE: CVE-2024-44995 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be5e816d00a506719e9dbb1a9c861c5ced30a109 ] When config TC during the reset process, may cause a deadlock, the flow is as below: pf reset start │ ▼ ...... setup tc │ │ ▼ ▼ DOWN: napi_disable() napi_disable()(skip) │ │ │ ▼ ▼ ...... ...... │ │ ▼ │ napi_enable() │ ▼ UINIT: netif_napi_del() │ ▼ ...... │ ▼ INIT: netif_napi_add() │ ▼ ...... global reset start │ │ ▼ ▼ UP: napi_enable()(skip) ...... │ │ ▼ ▼ ...... napi_disable() In reset process, the driver will DOWN the port and then UINIT, in this case, the setup tc process will UP the port before UINIT, so cause the problem. Adds a DOWN process in UINIT to fix it. Fixes: bb6b94a896d4 ("net: hns3: Add reset interface implementation in client") Signed-off-by: Jie Wang <wangjie125(a)huawei.com> Signed-off-by: Jijie Shao <shaojijie(a)huawei.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index cf79cd6..f5f7b59 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -5798,6 +5798,9 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle) struct net_device *netdev = handle->kinfo.netdev; struct hns3_nic_priv *priv = netdev_priv(netdev); + if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) + hns3_nic_net_stop(netdev); + if (!test_and_clear_bit(HNS3_NIC_STATE_INITED, &priv->state)) { netdev_warn(netdev, "already uninitialized\n"); return 0; -- 2.9.5

2 1

[PATCH OLK-6.6] net: hns3: fix a deadlock problem when config TC during resetting
by Zhang Changzhong 20 Sep '24

20 Sep '24

From: Jie Wang <wangjie125(a)huawei.com> stable inclusion from stable-v6.6.48 commit fa1d4de7265c370e673583ac8d1bd17d21826cd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY0Z CVE: CVE-2024-44995 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be5e816d00a506719e9dbb1a9c861c5ced30a109 ] When config TC during the reset process, may cause a deadlock, the flow is as below: pf reset start │ ▼ ...... setup tc │ │ ▼ ▼ DOWN: napi_disable() napi_disable()(skip) │ │ │ ▼ ▼ ...... ...... │ │ ▼ │ napi_enable() │ ▼ UINIT: netif_napi_del() │ ▼ ...... │ ▼ INIT: netif_napi_add() │ ▼ ...... global reset start │ │ ▼ ▼ UP: napi_enable()(skip) ...... │ │ ▼ ▼ ...... napi_disable() In reset process, the driver will DOWN the port and then UINIT, in this case, the setup tc process will UP the port before UINIT, so cause the problem. Adds a DOWN process in UINIT to fix it. Fixes: bb6b94a896d4 ("net: hns3: Add reset interface implementation in client") Signed-off-by: Jie Wang <wangjie125(a)huawei.com> Signed-off-by: Jijie Shao <shaojijie(a)huawei.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 180787c..ce22b34 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -5998,6 +5998,9 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle) struct net_device *netdev = handle->kinfo.netdev; struct hns3_nic_priv *priv = netdev_priv(netdev); + if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) + hns3_nic_net_stop(netdev); + if (!test_and_clear_bit(HNS3_NIC_STATE_INITED, &priv->state)) { netdev_warn(netdev, "already uninitialized\n"); return 0; -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS 00/13] block: backport debugfs patches
by Yu Kuai 20 Sep '24

20 Sep '24

Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Greg Kroah-Hartman (2): blk-mq: no need to check return value of debugfs_create functions blk-mq: fix up placement of debugfs directory of queue files Jan Kara (1): blktrace: Avoid sparse warnings when assigning q->blk_trace Luis Chamberlain (3): blktrace: break out of blktrace setup on concurrent calls blktrace: annotate required lock on do_blk_trace_setup() block: create the request_queue debugfs_dir on registration Ming Lei (1): blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created Saravanan D (1): blk-mq: Fix spurious debugfs directory creation during initialization Yu Kuai (3): block: shutdown blktrace in blk_release_queue() block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: fix kabi broken in struct request_queue block/blk-core.c | 8 +- block/blk-io-hierarchy/debugfs.c | 6 ++ block/blk-io-hierarchy/stats.c | 8 ++ block/blk-mq-debugfs.c | 158 ++++++++++++------------------- block/blk-mq-debugfs.h | 36 +++---- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 2 + block/blk-sysfs.c | 24 +++-- block/blk.h | 2 - include/linux/blkdev.h | 11 ++- kernel/trace/blktrace.c | 72 +++++++------- 11 files changed, 168 insertions(+), 170 deletions(-) -- 2.39.2

2 14

[PATCH OLK-6.6] drm/amdgpu: fix dereference after null check
by Liu Chuang 20 Sep '24

20 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit 0aad97bf6d0bc7a34a19f266b0b9fb2861efe64c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARVHE CVE: CVE-2024-46720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit b1f7810b05d1950350ac2e06992982974343e441 ] check the pointer hive before use. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index d8c95f5adeb6..a3d755e1470b 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -5235,7 +5235,7 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, * to put adev in the 1st position. */ INIT_LIST_HEAD(&device_list); - if (!amdgpu_sriov_vf(adev) && (adev->gmc.xgmi.num_physical_nodes > 1)) { + if (!amdgpu_sriov_vf(adev) && (adev->gmc.xgmi.num_physical_nodes > 1) && hive) { list_for_each_entry(tmp_adev, &hive->device_list, gmc.xgmi.head) { list_add_tail(&tmp_adev->reset_list, &device_list); if (gpu_reset_for_dev_remove && adev->shutdown) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 20 Sep '24

20 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index 28d671c5e0ca..d173b13ff198 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH OLK-6.6] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 20 Sep '24

20 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index cb8bd8aae15b..0fa785f52707 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH OLK-6.6] mm: set hugepage to false when anon mthp allocation
by Liu Shixin 20 Sep '24

20 Sep '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARA8A -------------------------------- When the hugepage parameter is true in vma_alloc_folio(), it indicates that we only try allocation on preferred node if possible, but it could lead to lots of failures for large folio allocation without commit ddc1a5cbc05d ("mempolicy: alloc_pages_mpol() for NUMA policy without vma"), it has no effect on runtime behavior on mainline, but we're affected, so fix it by setting hugepage to false. Fixes: ba572beac8be ("mm: thp: support allocation of anonymous multi-size THP") Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memory.c b/mm/memory.c index 4eea351aaccd..03fa94ae898a 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -4434,7 +4434,7 @@ static struct folio *alloc_anon_folio(struct vm_fault *vmf) gfp = vma_thp_gfp_mask(vma); while (orders) { addr = ALIGN_DOWN(vmf->address, PAGE_SIZE << order); - folio = vma_alloc_folio(gfp, order, vma, addr, true); + folio = vma_alloc_folio(gfp, order, vma, addr, false); if (folio) { if (mem_cgroup_charge(folio, vma->vm_mm, gfp)) { count_mthp_stat(order, MTHP_STAT_ANON_FAULT_FALLBACK_CHARGE); -- 2.34.1

2 1

[PATCH OLK-5.10] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 20 Sep '24

20 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index 28d671c5e0ca..d173b13ff198 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 20 Sep '24

20 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index ad2e87de7dc5..d58a108a96c0 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -104,7 +104,7 @@ static void cougar_fix_g6_mapping(struct hid_device *hdev) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2024-44991
by Wang Liang 20 Sep '24

20 Sep '24

Eric Dumazet (3): tcp/dccp: bypass empty buckets in inet_twsk_purge() tcp/dccp: do not care about families in inet_twsk_purge() tcp: do not export tcp_twsk_purge() Florian Westphal (1): tcp: prevent concurrent execution of tcp_sk_exit_batch include/net/inet_timewait_sock.h | 2 +- include/net/tcp.h | 2 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 ------ net/ipv4/inet_timewait_sock.c | 16 +++++++++------- net/ipv4/tcp_ipv4.c | 16 +++++++++++++++- net/ipv4/tcp_minisocks.c | 7 +++---- net/ipv6/tcp_ipv6.c | 6 ------ 8 files changed, 30 insertions(+), 27 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10] netfilter: tproxy: bail out if IP has been disabled on the device
by Yongqiang Liu 20 Sep '24

20 Sep '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.219 commit 07eeedafc59c45fe5de43958128542be3784764c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D8P CVE: CVE-2024-36270 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 21a673bddc8fd4873c370caf9ae70ffc6d47e8d3 ] syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [..] RIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62 Call Trace: nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline] nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168 __in_dev_get_rcu() can return NULL, so check for this. Reported-and-tested-by: syzbot+b94a6818504ea90d7661(a)syzkaller.appspotmail.com Fixes: cc6eb4338569 ("tproxy: use the interface primary IP address as a default value for --on-ip") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c index 61cb2341f50f..7c1a0cd9f435 100644 --- a/net/ipv4/netfilter/nf_tproxy_ipv4.c +++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c @@ -58,6 +58,8 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr) laddr = 0; indev = __in_dev_get_rcu(skb->dev); + if (!indev) + return daddr; in_dev_for_each_ifa_rcu(ifa, indev) { if (ifa->ifa_flags & IFA_F_SECONDARY) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: tproxy: bail out if IP has been disabled on the device
by Yongqiang Liu 20 Sep '24

20 Sep '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.219 commit 07eeedafc59c45fe5de43958128542be3784764c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D8P CVE: CVE-2024-36270 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 21a673bddc8fd4873c370caf9ae70ffc6d47e8d3 ] syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [..] RIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62 Call Trace: nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline] nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168 __in_dev_get_rcu() can return NULL, so check for this. Reported-and-tested-by: syzbot+b94a6818504ea90d7661(a)syzkaller.appspotmail.com Fixes: cc6eb4338569 ("tproxy: use the interface primary IP address as a default value for --on-ip") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c index 61cb2341f50f..7c1a0cd9f435 100644 --- a/net/ipv4/netfilter/nf_tproxy_ipv4.c +++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c @@ -58,6 +58,8 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr) laddr = 0; indev = __in_dev_get_rcu(skb->dev); + if (!indev) + return daddr; in_dev_for_each_ifa_rcu(ifa, indev) { if (ifa->ifa_flags & IFA_F_SECONDARY) -- 2.34.1

2 1

[PATCH OLK-6.6] arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register
by yangjinqian 19 Sep '24

19 Sep '24

From: Nianyao Tang <tangnianyao(a)huawei.com> mainline inclusion from mainline-v6.11-rc1 commit e8cde32f111f7f5681a7bad3ec747e9e697569a9 category: other bugzilla: https://gitee.com/openeuler/kernel/issues/IAS9Z8 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=… ------------------------------------------------------------------------------- Enable ECBHB bits in ID_AA64MMFR1 register as per ARM DDI 0487K.a specification. When guest OS read ID_AA64MMFR1_EL1, kvm emulate this reg using ftr_id_aa64mmfr1 and always return ID_AA64MMFR1_EL1.ECBHB=0 to guest. It results in guest syscall jump to tramp ventry, which is not needed in implementation with ID_AA64MMFR1_EL1.ECBHB=1. Let's make the guest syscall process the same as the host. Signed-off-by: Nianyao Tang <tangnianyao(a)huawei.com> Link: https://lore.kernel.org/r/20240611122049.2758600-1-tangnianyao@huawei.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Jinqian Yang <yangjinqian1(a)huawei.com> Signed-off-by: Zhou Wang <wangzhou1(a)hisilicon.com> --- arch/arm64/kernel/cpufeature.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index f94bc6eb83e0..eb700e404aac 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -367,6 +367,7 @@ static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = { }; static const struct arm64_ftr_bits ftr_id_aa64mmfr1[] = { + ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_ECBHB_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_TIDCP1_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_AFP_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_HCX_SHIFT, 4, 0), -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-46723
by Liao Chen 19 Sep '24

19 Sep '24

fix CVE-2024-46723 Tim Huang (1): [Backport] drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-46723
by Liao Chen 19 Sep '24

19 Sep '24

fix CVE-2024-46723 Tim Huang (1): drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] fix CVE-2024-46723
by Liao Chen 19 Sep '24

19 Sep '24

fix CVE-2024-46723 Tim Huang (1): drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] fix CVE-2024-46723
by Liao Chen 19 Sep '24

19 Sep '24

fix CVE-2024-46723 Tim Huang (1): [Backport] drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

3 5

[PATCH OLK-6.6 0/1] CVE-2024-46785
by Yuntao Liu 19 Sep '24

19 Sep '24

CVE-2024-46785 Steven Rostedt (1): eventfs: Use list_del_rcu() for SRCU protected list variable fs/tracefs/event_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] [Backport] smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
by Li Lingfeng 19 Sep '24

19 Sep '24

From: ChenXiaoSong <chenxiaosong(a)kylinos.cn> mainline inclusion from mainline-v6.11-rc5 commit 4e8771a3666c8f216eefd6bd2fd50121c6c437db category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWV6 CVE: CVE-2024-46742 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) and parse_lease_state() return NULL. Fix this by check if 'lease_ctx_info' is NULL. Additionally, remove the redundant parentheses in parse_durable_handle_context(). Signed-off-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/server/oplock.c | 2 +- fs/smb/server/smb2pdu.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c index a8f52c4ebbda..e546ffa57b55 100644 --- a/fs/smb/server/oplock.c +++ b/fs/smb/server/oplock.c @@ -1510,7 +1510,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) * parse_lease_state() - parse lease context containted in file open request * @open_req: buffer containing smb2 file open(create) request * - * Return: oplock state, -ENOENT if create lease context not found + * Return: allocated lease context object on success, otherwise NULL */ struct lease_ctx_info *parse_lease_state(void *open_req) { diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 4d91210e6acf..7f8b55c39e84 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2761,8 +2761,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work, } } - if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || - req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) { + if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || + req_op_level == SMB2_OPLOCK_LEVEL_BATCH) { dh_info->CreateGuid = durable_v2_blob->CreateGuid; dh_info->persistent = @@ -2782,8 +2782,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work, goto out; } - if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || - req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) { + if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || + req_op_level == SMB2_OPLOCK_LEVEL_BATCH) { ksmbd_debug(SMB, "Request for durable open\n"); dh_info->type = dh_idx; } @@ -3414,7 +3414,7 @@ int smb2_open(struct ksmbd_work *work) goto err_out1; } } else { - if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) { + if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) { if (S_ISDIR(file_inode(filp)->i_mode)) { lc->req_state &= ~SMB2_LEASE_WRITE_CACHING_LE; lc->is_dir = true; -- 2.31.1

2 1

[PATCH OLK-5.10] smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
by Li Lingfeng 19 Sep '24

19 Sep '24

From: ChenXiaoSong <chenxiaosong(a)kylinos.cn> mainline inclusion from mainline-v6.11-rc5 commit 4e8771a3666c8f216eefd6bd2fd50121c6c437db category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWV6 CVE: CVE-2024-46742 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) and parse_lease_state() return NULL. Fix this by check if 'lease_ctx_info' is NULL. Additionally, remove the redundant parentheses in parse_durable_handle_context(). Signed-off-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/oplock.c fs/smb/server/smb2pdu.c [Commit c8efcc786146 ("ksmbd: add support for durable handles v1/v2") add parse_durable_handle_context(); Commit 38c8a9a52082 ("smb: move client and server files to common directory fs/smb") move oplock.c and smb2pdu.c from fs/ksmbd/ to fs/smb/server/.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/oplock.c | 2 +- fs/ksmbd/smb2pdu.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/oplock.c b/fs/ksmbd/oplock.c index 6df455a54b70..3324bb226c79 100644 --- a/fs/ksmbd/oplock.c +++ b/fs/ksmbd/oplock.c @@ -1389,7 +1389,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) * parse_lease_state() - parse lease context containted in file open request * @open_req: buffer containing smb2 file open(create) request * - * Return: oplock state, -ENOENT if create lease context not found + * Return: allocated lease context object on success, otherwise NULL */ struct lease_ctx_info *parse_lease_state(void *open_req) { diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..a5f71fd7b1a8 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -3115,7 +3115,7 @@ int smb2_open(struct ksmbd_work *work) goto err_out; } } else { - if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) { + if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) { req_op_level = smb2_map_lease_to_oplock(lc->req_state); ksmbd_debug(SMB, "lease req for(%s) req oplock state 0x%x, lease state 0x%x\n", -- 2.31.1

2 1

[PATCH OLK-6.6 0/1] Fix iBMA bug and change version
by Peng Zhang 19 Sep '24

19 Sep '24

From: Wujiahai <wujiahai(a)huawei.com> 1. The initialization sequence of the edma_host.timer and edma_host is optimized when the iBMA initializes the edma driver. 2. Change the iBMA driver version. Wujiahai (1): BMA: Fix edma driver initialization problem and change the version number. .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../ethernet/huawei/bma/edma_drv/edma_host.c | 80 ++++++++----------- .../huawei/bma/kbox_drv/kbox_include.h | 2 +- .../ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 38 insertions(+), 50 deletions(-) -- 2.27.0

2 2

[PATCH OLK-6.6 v3] KVM:arm64:Add a kvm module param to get current enabled GIC version
by Zhiqiang Ni 19 Sep '24

19 Sep '24

From: Yanan Wang <wangyanan55(a)huawei.com> virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAR5EZ CVE: NA Reference: NA -------------------------------- Using GICv4.1 is not a 100% win in all scenarios, sometimes we need to use different GIC version in different usecases. Given that there is not a straight forward way to check the GIC version that system is using (e.g., kernel messages may be overided with time elapses), let's add a module param in KVM such that userspace can check the GIC version simply by reading /sys/module/kvm/parameters/gic_version. Signed-off-by: Yanan Wang <wangyanan55(a)huawei.com> Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/kvm/vgic/vgic-v3.c | 37 +++++++++++++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic.h | 8 ++++++++ 2 files changed, 45 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-v3.c b/arch/arm64/kvm/vgic/vgic-v3.c index dab599e857b5..227fa1874c3b 100644 --- a/arch/arm64/kvm/vgic/vgic-v3.c +++ b/arch/arm64/kvm/vgic/vgic-v3.c @@ -20,6 +20,37 @@ static bool common_trap; static bool dir_trap; static bool gicv4_enable; +enum gic_version global_gic_version = UNKNOWN_GIC_VERSION; +static const char * const gic_version_str[] = { + "GICv2", + "GICv3", + "GICv4", + "GICv4.1", + "unknown" +}; + +static int get_gic_version(char *buffer, const struct kernel_param *kp); +static const struct kernel_param_ops gic_version_ops = { + .get = get_gic_version, +}; + +static const char *gic_version; +module_param_cb(gic_version, &gic_version_ops, &gic_version, 0444); +MODULE_PARM_DESC(gic_version, "Version of current enabled GIC"); + +static int get_gic_version(char *buffer, const struct kernel_param *kp) +{ + int index = global_gic_version; + + if (index < 0 || index >= ARRAY_SIZE(gic_version_str)) { + kvm_err("Invalid GIC version enum %d\n", index); + return -EINVAL; + } + gic_version = gic_version_str[index]; + + return param_get_charp(buffer, kp); +} + void vgic_v3_set_underflow(struct kvm_vcpu *vcpu) { struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3; @@ -654,6 +685,7 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.nr_lr = (ich_vtr_el2 & 0xf) + 1; kvm_vgic_global_state.can_emulate_gicv2 = false; kvm_vgic_global_state.ich_vtr_el2 = ich_vtr_el2; + global_gic_version = GICV3; /* GICv4 support? */ if (info->has_v4) { @@ -663,6 +695,11 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.has_gicv4_1 ? ".1" : "", gicv4_enable ? "en" : "dis"); + if (kvm_vgic_global_state.has_gicv4_1) + global_gic_version = GICV4_1; + else if (kvm_vgic_global_state.has_gicv4) + global_gic_version = GICV4; + #ifdef CONFIG_VIRT_VTIMER_IRQ_BYPASS kvm_vgic_global_state.has_direct_vtimer = info->has_vtimer && gicv4_enable; if (kvm_vgic_global_state.has_direct_vtimer) diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index 5135c690839e..539909a681d7 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -157,6 +157,14 @@ static inline bool vgic_direct_sgi_or_ppi(struct vgic_irq *irq) #endif } +enum gic_version { + GICV2, + GICV3, + GICV4, + GICV4_1, + UNKNOWN_GIC_VERSION +}; + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] Fix CVE-2024-44991
by Wang Liang 19 Sep '24

19 Sep '24

Eric Dumazet (2): tcp/dccp: bypass empty buckets in inet_twsk_purge() tcp/dccp: do not care about families in inet_twsk_purge() Florian Westphal (1): tcp: prevent concurrent execution of tcp_sk_exit_batch include/net/inet_timewait_sock.h | 2 +- include/net/tcp.h | 2 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 ------ net/ipv4/inet_timewait_sock.c | 16 +++++++++------- net/ipv4/tcp_ipv4.c | 16 +++++++++++++++- net/ipv4/tcp_minisocks.c | 6 +++--- net/ipv6/tcp_ipv6.c | 6 ------ 8 files changed, 30 insertions(+), 26 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 v3] KVM:arm64:Add a kvm parameter to control guest wfi trapping
by Zhiqiang Ni 19 Sep '24

19 Sep '24

virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAQV1W CVE: NA Reference: NA -------------------------------- Currently, on GICv4+ system if a vCPU is only runnable process on a pCPU and we are using direct injection of interrupts, the guest WFI trapping will be turn off. So in host view, the vcpu process's CPU util is almost 100%, which may confuse someone. Let's add a kvm parameter to control guest wfi trapping. Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/include/asm/kvm_emulate.h | 3 ++ arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 49 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index 2293caab9..6992d010b 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -119,6 +119,9 @@ static inline void vcpu_clear_wfx_traps(struct kvm_vcpu *vcpu) vcpu->arch.hcr_el2 &= ~HCR_TWI; else vcpu->arch.hcr_el2 |= HCR_TWI; + + if (force_wfi_trap) + vcpu->arch.hcr_el2 |= HCR_TWI; } static inline void vcpu_set_wfx_traps(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098..5ba983f71 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -54,6 +54,7 @@ #define KVM_REQ_SUSPEND KVM_ARCH_REQ(6) #define KVM_REQ_RESYNC_PMU_EL0 KVM_ARCH_REQ(7) #define KVM_REQ_RELOAD_TLBI_DVMBM KVM_ARCH_REQ(8) +#define KVM_REQ_RELOAD_WFI_TRAPS KVM_ARCH_REQ(9) #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ KVM_DIRTY_LOG_INITIALLY_SET) @@ -1244,6 +1245,7 @@ extern unsigned int twedel; void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu); bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu); +extern bool force_wfi_trap; extern bool kvm_ncsnp_support; extern bool kvm_dvmbm_support; diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index fe3add87e..3e0e84ce9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -82,6 +82,48 @@ unsigned int twedel; module_param(twedel, uint, 0644); #endif +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp); + +static const struct kernel_param_ops force_wfi_trap_ops = { + .set = vcpu_req_reload_wfi_traps, + .get = param_get_bool, +}; + +bool force_wfi_trap; +module_param_cb(force_wfi_trap, &force_wfi_trap_ops, &force_wfi_trap, 0644); + +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp) +{ + struct kvm *kvm; + bool oldvalue; + int err; + + oldvalue = force_wfi_trap; + err = param_set_bool(val, kp); + if (err) + return err; + + if (oldvalue == force_wfi_trap) + return err; + + /* + * If set the force_wfi_trap from 1 to 0, no need to kick vcpus here. + * The HCR_TWI flag will be cleared in kvm_arch_vcpu_load(). + */ + if (force_wfi_trap == 0) + return 0; + + /* + * We need to kick vcpus out of guest mode here to reload + * wfx trapping config when re-enter guest mode. + */ + mutex_lock(&kvm_lock); + list_for_each_entry(kvm, &vm_list, vm_list) + kvm_make_all_cpus_request(kvm, KVM_REQ_RELOAD_WFI_TRAPS); + mutex_unlock(&kvm_lock); + return err; +} + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) { return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE; @@ -958,6 +1000,13 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu) if (kvm_check_request(KVM_REQ_RELOAD_TLBI_DVMBM, vcpu)) kvm_hisi_reload_lsudvmbm(vcpu->kvm); + + if (kvm_check_request(KVM_REQ_RELOAD_WFI_TRAPS, vcpu)) { + if (single_task_running()) + vcpu_clear_wfx_traps(vcpu); + else + vcpu_set_wfx_traps(vcpu); + } } return 1; -- 2.43.0

2 1

[PATCH v3 OLK-6.6] KVM:arm64:Add a kvm parameter to control guest wfi trapping
by Zhiqiang Ni 19 Sep '24

19 Sep '24

virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAQV1W CVE: NA Reference: NA -------------------------------- Currently, on GICv4+ system if a vCPU is only runnable process on a pCPU and we are using direct injection of interrupts, the guest WFI trapping will be turn off. So in host view, the vcpu process's CPU util is almost 100%, which may confuse someone. Let's add a kvm parameter to control guest wfi trapping. Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/include/asm/kvm_emulate.h | 3 ++ arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 49 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index 2293caab9..6992d010b 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -119,6 +119,9 @@ static inline void vcpu_clear_wfx_traps(struct kvm_vcpu *vcpu) vcpu->arch.hcr_el2 &= ~HCR_TWI; else vcpu->arch.hcr_el2 |= HCR_TWI; + + if (force_wfi_trap) + vcpu->arch.hcr_el2 |= HCR_TWI; } static inline void vcpu_set_wfx_traps(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098..5ba983f71 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -54,6 +54,7 @@ #define KVM_REQ_SUSPEND KVM_ARCH_REQ(6) #define KVM_REQ_RESYNC_PMU_EL0 KVM_ARCH_REQ(7) #define KVM_REQ_RELOAD_TLBI_DVMBM KVM_ARCH_REQ(8) +#define KVM_REQ_RELOAD_WFI_TRAPS KVM_ARCH_REQ(9) #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ KVM_DIRTY_LOG_INITIALLY_SET) @@ -1244,6 +1245,7 @@ extern unsigned int twedel; void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu); bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu); +extern bool force_wfi_trap; extern bool kvm_ncsnp_support; extern bool kvm_dvmbm_support; diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index fe3add87e..3e0e84ce9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -82,6 +82,48 @@ unsigned int twedel; module_param(twedel, uint, 0644); #endif +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp); + +static const struct kernel_param_ops force_wfi_trap_ops = { + .set = vcpu_req_reload_wfi_traps, + .get = param_get_bool, +}; + +bool force_wfi_trap; +module_param_cb(force_wfi_trap, &force_wfi_trap_ops, &force_wfi_trap, 0644); + +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp) +{ + struct kvm *kvm; + bool oldvalue; + int err; + + oldvalue = force_wfi_trap; + err = param_set_bool(val, kp); + if (err) + return err; + + if (oldvalue == force_wfi_trap) + return err; + + /* + * If set the force_wfi_trap from 1 to 0, no need to kick vcpus here. + * The HCR_TWI flag will be cleared in kvm_arch_vcpu_load(). + */ + if (force_wfi_trap == 0) + return 0; + + /* + * We need to kick vcpus out of guest mode here to reload + * wfx trapping config when re-enter guest mode. + */ + mutex_lock(&kvm_lock); + list_for_each_entry(kvm, &vm_list, vm_list) + kvm_make_all_cpus_request(kvm, KVM_REQ_RELOAD_WFI_TRAPS); + mutex_unlock(&kvm_lock); + return err; +} + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) { return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE; @@ -958,6 +1000,13 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu) if (kvm_check_request(KVM_REQ_RELOAD_TLBI_DVMBM, vcpu)) kvm_hisi_reload_lsudvmbm(vcpu->kvm); + + if (kvm_check_request(KVM_REQ_RELOAD_WFI_TRAPS, vcpu)) { + if (single_task_running()) + vcpu_clear_wfx_traps(vcpu); + else + vcpu_set_wfx_traps(vcpu); + } } return 1; -- 2.43.0

2 1

[PATCH v3 OLK-6.6] KVM:arm64:Add a kvm parameter to control guest wfi trapping
by Zhiqiang Ni 19 Sep '24

19 Sep '24

virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAQV1W CVE: NA Reference: NA -------------------------------- Currently, on GICv4+ system if a vCPU is only runnable process on a pCPU and we are using direct injection of interrupts, the guest WFI trapping will be turn off. So in host view, the vcpu process's CPU util is almost 100%, which may confuse someone. Let's add a kvm parameter to control guest wfi trapping. Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/include/asm/kvm_emulate.h | 3 ++ arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 49 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index 2293caab9..6992d010b 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -119,6 +119,9 @@ static inline void vcpu_clear_wfx_traps(struct kvm_vcpu *vcpu) vcpu->arch.hcr_el2 &= ~HCR_TWI; else vcpu->arch.hcr_el2 |= HCR_TWI; + + if (force_wfi_trap) + vcpu->arch.hcr_el2 |= HCR_TWI; } static inline void vcpu_set_wfx_traps(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098..5ba983f71 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -54,6 +54,7 @@ #define KVM_REQ_SUSPEND KVM_ARCH_REQ(6) #define KVM_REQ_RESYNC_PMU_EL0 KVM_ARCH_REQ(7) #define KVM_REQ_RELOAD_TLBI_DVMBM KVM_ARCH_REQ(8) +#define KVM_REQ_RELOAD_WFI_TRAPS KVM_ARCH_REQ(9) #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ KVM_DIRTY_LOG_INITIALLY_SET) @@ -1244,6 +1245,7 @@ extern unsigned int twedel; void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu); bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu); +extern bool force_wfi_trap; extern bool kvm_ncsnp_support; extern bool kvm_dvmbm_support; diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index fe3add87e..3e0e84ce9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -82,6 +82,48 @@ unsigned int twedel; module_param(twedel, uint, 0644); #endif +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp); + +static const struct kernel_param_ops force_wfi_trap_ops = { + .set = vcpu_req_reload_wfi_traps, + .get = param_get_bool, +}; + +bool force_wfi_trap; +module_param_cb(force_wfi_trap, &force_wfi_trap_ops, &force_wfi_trap, 0644); + +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp) +{ + struct kvm *kvm; + bool oldvalue; + int err; + + oldvalue = force_wfi_trap; + err = param_set_bool(val, kp); + if (err) + return err; + + if (oldvalue == force_wfi_trap) + return err; + + /* + * If set the force_wfi_trap from 1 to 0, no need to kick vcpus here. + * The HCR_TWI flag will be cleared in kvm_arch_vcpu_load(). + */ + if (force_wfi_trap == 0) + return 0; + + /* + * We need to kick vcpus out of guest mode here to reload + * wfx trapping config when re-enter guest mode. + */ + mutex_lock(&kvm_lock); + list_for_each_entry(kvm, &vm_list, vm_list) + kvm_make_all_cpus_request(kvm, KVM_REQ_RELOAD_WFI_TRAPS); + mutex_unlock(&kvm_lock); + return err; +} + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) { return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE; @@ -958,6 +1000,13 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu) if (kvm_check_request(KVM_REQ_RELOAD_TLBI_DVMBM, vcpu)) kvm_hisi_reload_lsudvmbm(vcpu->kvm); + + if (kvm_check_request(KVM_REQ_RELOAD_WFI_TRAPS, vcpu)) { + if (single_task_running()) + vcpu_clear_wfx_traps(vcpu); + else + vcpu_set_wfx_traps(vcpu); + } } return 1; -- 2.43.0

2 1

[PATCH OLK-6.6] RDMA/hns: Fix ah error counter in sw stat not increasing
by Junxian Huang 19 Sep '24

19 Sep '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARV1S CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?id=39… ---------------------------------------------------------------------- There are several error cases where hns_roce_create_ah() returns directly without jumping to sw stat path, thus leading to a problem that the ah error counter does not increase. Fixes: db90f0012b30 ("RDMA/hns: Support SW stats with debugfs") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://patch.msgid.link/20240912115700.2016443-1-huangjunxian6@hisilicon.c… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_ah.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c index a1adf249b86a..2af9cfd435ec 100644 --- a/drivers/infiniband/hw/hns/hns_roce_ah.c +++ b/drivers/infiniband/hw/hns/hns_roce_ah.c @@ -63,8 +63,10 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, u32 max_sl; int ret; - if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 && udata) - return -EOPNOTSUPP; + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 && udata) { + ret = -EOPNOTSUPP; + goto err_out; + } ah->av.port = rdma_ah_get_port_num(ah_attr); ah->av.gid_index = grh->sgid_index; @@ -83,7 +85,7 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, ret = 0; if (ret && grh->sgid_attr->gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) - return ret; + goto err_out; if (tc_mode == HNAE3_TC_MAP_MODE_DSCP && grh->sgid_attr->gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) @@ -96,7 +98,8 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, ibdev_err_ratelimited(&hr_dev->ib_dev, "failed to set sl, sl (%u) shouldn't be larger than %u.\n", ah->av.sl, max_sl); - return -EINVAL; + ret = -EINVAL; + goto err_out; } memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE); -- 2.33.0

2 1

[PATCH OLK-6.6 v2 0/2] Fix VSYNC referencing an unmapped VPE on GIC v4.0/v4.1
by Zhou Wang 19 Sep '24

19 Sep '24

From: caijian <caijian11(a)h-partners.com> Patch#1 Fix VSYNC referencing an unmapped VPE on GIC v4.1 Patch#2 Fix VSYNC referencing an unmapped VPE on GIC v4.0 Nianyao Tang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 Zhou Wang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0 drivers/irqchip/irq-gic-v3-its.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS] mmc: mmc_test: Fix NULL dereference on allocation failure
by Cai Xinchen 19 Sep '24

19 Sep '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v4.19.321 commit e97be13a9f51284da450dd2a592e3fa87b49cdc9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJH CVE: CVE-2024-45028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a1e627af32ed60713941cbfc8075d44cad07f6dd ] If the "test->highmem = alloc_pages()" allocation fails then calling __free_pages(test->highmem) will result in a NULL dereference. Also change the error code to -ENOMEM instead of returning success. Fixes: 2661081f5ab9 ("mmc_test: highmem tests") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/8c90be28-67b4-4b0d-a105-034dc72a0b31@stanley.moun… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/mmc/core/mmc_test.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c index ef18daeaa4cc..164b4e43050e 100644 --- a/drivers/mmc/core/mmc_test.c +++ b/drivers/mmc/core/mmc_test.c @@ -3101,13 +3101,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL); #ifdef CONFIG_HIGHMEM test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER); + if (!test->highmem) { + count = -ENOMEM; + goto free_test_buffer; + } #endif -#ifdef CONFIG_HIGHMEM - if (test->buffer && test->highmem) { -#else if (test->buffer) { -#endif mutex_lock(&mmc_test_lock); mmc_test_run(test, testcase); mutex_unlock(&mmc_test_lock); @@ -3115,6 +3115,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, #ifdef CONFIG_HIGHMEM __free_pages(test->highmem, BUFFER_ORDER); +free_test_buffer: #endif kfree(test->buffer); kfree(test); -- 2.34.1

2 1

[PATCH OLK-5.10] mmc: mmc_test: Fix NULL dereference on allocation failure
by Cai Xinchen 19 Sep '24

19 Sep '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.225 commit 9b9ba386d7bfdbc38445932c90fa9444c0524bea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJH CVE: CVE-2024-45028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a1e627af32ed60713941cbfc8075d44cad07f6dd ] If the "test->highmem = alloc_pages()" allocation fails then calling __free_pages(test->highmem) will result in a NULL dereference. Also change the error code to -ENOMEM instead of returning success. Fixes: 2661081f5ab9 ("mmc_test: highmem tests") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/8c90be28-67b4-4b0d-a105-034dc72a0b31@stanley.moun… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/mmc/core/mmc_test.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c index b9b6f000154b..9ebd5cebd4e1 100644 --- a/drivers/mmc/core/mmc_test.c +++ b/drivers/mmc/core/mmc_test.c @@ -3125,13 +3125,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL); #ifdef CONFIG_HIGHMEM test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER); + if (!test->highmem) { + count = -ENOMEM; + goto free_test_buffer; + } #endif -#ifdef CONFIG_HIGHMEM - if (test->buffer && test->highmem) { -#else if (test->buffer) { -#endif mutex_lock(&mmc_test_lock); mmc_test_run(test, testcase); mutex_unlock(&mmc_test_lock); @@ -3139,6 +3139,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, #ifdef CONFIG_HIGHMEM __free_pages(test->highmem, BUFFER_ORDER); +free_test_buffer: #endif kfree(test->buffer); kfree(test); -- 2.34.1

2 1

[PATCH OLK-6.6] kvm: hisi_virt: Remove cpu_type check for feature dvmbm
by Zhou Wang 19 Sep '24

19 Sep '24

From: Xiang Chen <chenxiang66(a)hisilicon.com> virt inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR6N7 ------------------------------------------------------------------------ Feature dvmbm is supported on HIP09 and later version, so it is not suitable to use cpu_type to check whether dvmbm is supported, So remove cpu_type check for feature dmvmb. It is enough to judge register AIDR to check whether dvmbm is supported. Fixes: e85b97c7e2b4 ("KVM: arm64: Probe and configure DVMBM capability on HiSi CPUs") Signed-off-by: Xiang Chen <chenxiang66(a)hisilicon.com> Signed-off-by: Zhou Wang <wangzhou1(a)hisilicon.com> --- arch/arm64/kvm/hisilicon/hisi_virt.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/arch/arm64/kvm/hisilicon/hisi_virt.c b/arch/arm64/kvm/hisilicon/hisi_virt.c index 68809f10e8d7..f87f951c0d81 100644 --- a/arch/arm64/kvm/hisilicon/hisi_virt.c +++ b/arch/arm64/kvm/hisilicon/hisi_virt.c @@ -153,9 +153,6 @@ static void hardware_disable_dvmbm(void *data) bool hisi_dvmbm_supported(void) { - if (cpu_type != HI_IP09) - return false; - /* Determine whether DVMBM is supported by the hardware */ if (!(read_sysreg(aidr_el1) & AIDR_EL1_DVMBM_MASK)) return false; -- 2.33.0

2 1

[PATCH OLK-6.6] Input: uinput - reject requests with unreasonable number of slots
by Pu Lehui 19 Sep '24

19 Sep '24

From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> stable inclusion from stable-v6.6.51 commit a4858b00a1ec57043697fb935565fe267f161833 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX6S CVE: CVE-2024-46745 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 206f533a0a7c683982af473079c4111f4a0f9f5e ] From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts. Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+0122fa359a69694395d5(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 Link: https://lore.kernel.org/r/Zqgi7NYEbpRsJfa2@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/input/misc/uinput.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index d98212d55108..2c973f15cab7 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -417,6 +417,20 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code, return -EINVAL; } + /* + * Limit number of contacts to a reasonable value (100). This + * ensures that we need less than 2 pages for struct input_mt + * (we are not using in-kernel slot assignment so not going to + * allocate memory for the "red" table), and we should have no + * trouble getting this much memory. + */ + if (code == ABS_MT_SLOT && max > 99) { + printk(KERN_DEBUG + "%s: unreasonably large number of slots requested: %d\n", + UINPUT_NAME, max); + return -EINVAL; + } + return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10] Input: uinput - reject requests with unreasonable number of slots
by Pu Lehui 19 Sep '24

19 Sep '24

From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> stable inclusion from stable-v5.10.226 commit 51fa08edd80003db700bdaa099385c5900d27f4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX6S CVE: CVE-2024-46745 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 206f533a0a7c683982af473079c4111f4a0f9f5e ] From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts. Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+0122fa359a69694395d5(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 Link: https://lore.kernel.org/r/Zqgi7NYEbpRsJfa2@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/input/misc/uinput.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index f2593133e524..790db3ceb208 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -416,6 +416,20 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code, return -EINVAL; } + /* + * Limit number of contacts to a reasonable value (100). This + * ensures that we need less than 2 pages for struct input_mt + * (we are not using in-kernel slot assignment so not going to + * allocate memory for the "red" table), and we should have no + * trouble getting this much memory. + */ + if (code == ABS_MT_SLOT && max > 99) { + printk(KERN_DEBUG + "%s: unreasonably large number of slots requested: %d\n", + UINPUT_NAME, max); + return -EINVAL; + } + return 0; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Input: uinput - reject requests with unreasonable number of slots
by Pu Lehui 19 Sep '24

19 Sep '24

From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> stable inclusion from stable-v5.10.226 commit 51fa08edd80003db700bdaa099385c5900d27f4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX6S CVE: CVE-2024-46745 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 206f533a0a7c683982af473079c4111f4a0f9f5e ] From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts. Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+0122fa359a69694395d5(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 Link: https://lore.kernel.org/r/Zqgi7NYEbpRsJfa2@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/input/misc/uinput.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index f2593133e524..790db3ceb208 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -416,6 +416,20 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code, return -EINVAL; } + /* + * Limit number of contacts to a reasonable value (100). This + * ensures that we need less than 2 pages for struct input_mt + * (we are not using in-kernel slot assignment so not going to + * allocate memory for the "red" table), and we should have no + * trouble getting this much memory. + */ + if (code == ABS_MT_SLOT && max > 99) { + printk(KERN_DEBUG + "%s: unreasonably large number of slots requested: %d\n", + UINPUT_NAME, max); + return -EINVAL; + } + return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Input: uinput - reject requests with unreasonable number of slots
by Pu Lehui 19 Sep '24

19 Sep '24

From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> stable inclusion from stable-v4.19.322 commit 9c6d189f0c1c59ba9a32326ec82a0b367a3cd47b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX6S CVE: CVE-2024-46745 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 206f533a0a7c683982af473079c4111f4a0f9f5e ] From: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts. Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+0122fa359a69694395d5(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 Link: https://lore.kernel.org/r/Zqgi7NYEbpRsJfa2@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/input/misc/uinput.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 83d1499fe021..845e3632f8aa 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -425,6 +425,20 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code, return -EINVAL; } + /* + * Limit number of contacts to a reasonable value (100). This + * ensures that we need less than 2 pages for struct input_mt + * (we are not using in-kernel slot assignment so not going to + * allocate memory for the "red" table), and we should have no + * trouble getting this much memory. + */ + if (code == ABS_MT_SLOT && max > 99) { + printk(KERN_DEBUG + "%s: unreasonably large number of slots requested: %d\n", + UINPUT_NAME, max); + return -EINVAL; + } + return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF
by Zhihao Cheng 19 Sep '24

19 Sep '24

From: Baokun Li <libaokun1(a)huawei.com> stable inclusion from stable-v6.6.52 commit e0d724932ad12e3528f4ce97fc0f6078d0cce4bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWDH CVE: CVE-2024-46786 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/fs/… -------------------------------- commit 72a6e22c604c95ddb3b10b5d3bb85b6ff4dbc34f upstream. The fscache_cookie_lru_timer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timer_reduce() is called before removing the fscache module, the fscache_cookie_lru_timer will be added to the timer list of the current cpu. Afterwards, a use-after-free will be triggered in the softIRQ after removing the fscache module, as follows: ================================================================== BUG: unable to handle page fault for address: fffffbfff803c9e9 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855 Tainted: [W]=WARN RIP: 0010:__run_timer_base.part.0+0x254/0x8a0 Call Trace: <IRQ> tmigr_handle_remote_up+0x627/0x810 __walk_groups.isra.0+0x47/0x140 tmigr_handle_remote+0x1fa/0x2f0 handle_softirqs+0x180/0x590 irq_exit_rcu+0x84/0xb0 sysvec_apic_timer_interrupt+0x6e/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 default_idle_call+0x38/0x60 do_idle+0x2b5/0x300 cpu_startup_entry+0x54/0x60 start_secondary+0x20d/0x280 common_startup_64+0x13e/0x148 </TASK> Modules linked in: [last unloaded: netfs] ================================================================== Therefore delete fscache_cookie_lru_timer when removing the fscahe module. Fixes: 12bb21a29c19 ("fscache: Implement cookie user counting and resource pinning") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Link: https://lore.kernel.org/r/20240826112056.2458299-1-libaokun@huaweicloud.com Acked-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/fscache/main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/fscache/main.c b/fs/fscache/main.c index dad85fd84f6f..7a60cd96e87e 100644 --- a/fs/fscache/main.c +++ b/fs/fscache/main.c @@ -114,6 +114,7 @@ static void __exit fscache_exit(void) kmem_cache_destroy(fscache_cookie_jar); fscache_proc_cleanup(); + timer_shutdown_sync(&fscache_cookie_lru_timer); destroy_workqueue(fscache_wq); pr_notice("Unloaded\n"); } -- 2.39.2

2 1

[PATCH OLK-6.6 v3 00/19] arm64: perf: Add support for event counting threshold
by Junhao He 19 Sep '24

19 Sep '24

ounting of PMU events depending on how much the event increments on a single cycle. Two new config fields for perf_event_open have been added, and a PMU cap file for reading the max_threshold. See the second commit message and the docs in the last commit for more details. The feature is not currently supported on KVM guests, and PMMIR is set to read as zero, so it's not advertised as available. But it can be added at a later time. Writes to PMEVTYPER.TC and TH from guests are already RES0. The change has been validated on the Arm FVP model: a) Zero values, works as expected (as before). $ perf stat -e dtlb_walk/threshold=0,threshold_compare=0/ -- true 5962 dtlb_walk/threshold=0,threshold_compare=0/ b) Threshold >= 255 causes count to be 0 because dtlb_walk doesn't increase by more than 1 per cycle. $ perf stat -e dtlb_walk/threshold=255,threshold_compare=2/ -- true 0 dtlb_walk/threshold=255,threshold_compare=2/ c) Keeping comparison as >= but lowering the threshold to 1 makes the count return. $ perf stat -e dtlb_walk/threshold=1,threshold_compare=2/ -- true 6329 dtlb_walk/threshold=1,threshold_compare=2/ Anshuman Khandual (3): drivers: perf: arm_pmuv3: Read PMMIR_EL1 unconditionally drivers: perf: arm_pmuv3: Drop some unused arguments from armv8_pmu_init() drivers: perf: arm_pmuv3: Add new macro PMUV3_INIT_MAP_EVENT() James Clark (11): arm: perf: Remove inlines from arm_pmuv3.c arm: perf/kvm: Use GENMASK for ARMV8_PMU_PMCR_N arm: perf: Use GENMASK for PMMIR fields arm: perf: Convert remaining fields to use GENMASK arm64: perf: Include threshold control fields in PMEVTYPER mask arm: pmu: Share user ABI format mechanism with SPE perf/arm_dmc620: Remove duplicate format attribute #defines arm: pmu: Move error message and -EOPNOTSUPP to individual PMUs arm64: perf: Add support for event counting threshold Documentation: arm64: Document the PMU event counting threshold feature arm: perf: Fix ARCH=arm build with GCC Oliver Upton (2): KVM: arm64: Make PMEVTYPER<n>_EL0.NSH RES0 if EL2 isn't advertised KVM: arm64: Add PMU event filter bits required if EL3 is implemented Reiji Watanabe (1): KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 Rob Herring (Arm) (1): perf: arm_pmuv3: Avoid assigning fixed cycle counter with threshold Will Deacon (1): Revert "perf/arm_dmc620: Remove duplicate format attribute #defines" Documentation/arch/arm64/perf.rst | 72 ++++++++ arch/arm/kernel/perf_event_v7.c | 6 +- arch/arm64/kvm/arm.c | 3 +- arch/arm64/kvm/pmu-emul.c | 58 +++++-- arch/arm64/kvm/sys_regs.c | 21 ++- drivers/perf/apple_m1_cpu_pmu.c | 6 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmuv3.c | 274 ++++++++++++++++++------------ drivers/perf/arm_spe_pmu.c | 22 --- include/kvm/arm_pmu.h | 11 ++ include/linux/perf/arm_pmu.h | 22 +++ include/linux/perf/arm_pmuv3.h | 43 +++-- 12 files changed, 366 insertions(+), 183 deletions(-) -- 2.33.0

2 20

[PATCH OLK-6.6] tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
by Yi Yang 19 Sep '24

19 Sep '24

From: Peng Fan <peng.fan(a)nxp.com> stable inclusion from stable-v6.6.48 commit 8eb92cfca6c2c5a15ab1773f3d18ab8d8f7dbb68 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR5BZ CVE: CVE-2024-46706 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dc98d76a15bc29a9a4e76f2f65f39f3e590fb15c upstream. With "earlycon initcall_debug=1 loglevel=8" in bootargs, kernel sometimes boot hang. It is because normal console still is not ready, but runtime suspend is called, so early console putchar will hang in waiting TRDE set in UARTSTAT. The lpuart driver has auto suspend delay set to 3000ms, but during uart_add_one_port, a child device serial ctrl will added and probed with its pm runtime enabled(see serial_ctrl.c). The runtime suspend call path is: device_add |-> bus_probe_device |->device_initial_probe |->__device_attach |-> pm_runtime_get_sync(dev->parent); |-> pm_request_idle(dev); |-> pm_runtime_put(dev->parent); So in the end, before normal console ready, the lpuart get runtime suspended. And earlycon putchar will hang. To address the issue, mark last busy just after pm_runtime_enable, three seconds is long enough to switch from bootconsole to normal console. Fixes: 43543e6f539b ("tty: serial: fsl_lpuart: Add runtime pm support") Cc: stable <stable(a)kernel.org> Signed-off-by: Peng Fan <peng.fan(a)nxp.com> Link: https://lore.kernel.org/r/20240808140325.580105-1-peng.fan@oss.nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/fsl_lpuart.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 385b41275e8b..8bd0f8e45b14 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -2930,6 +2930,7 @@ static int lpuart_probe(struct platform_device *pdev) pm_runtime_set_autosuspend_delay(&pdev->dev, UART_AUTOSUSPEND_TIMEOUT); pm_runtime_set_active(&pdev->dev); pm_runtime_enable(&pdev->dev); + pm_runtime_mark_last_busy(&pdev->dev); ret = lpuart_global_reset(sport); if (ret) -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] Fix VSYNC referencing an unmapped VPE on GIC v4.0/v4.1
by Zhou Wang 19 Sep '24

19 Sep '24

From: caijian <caijian11(a)h-partners.com> Patch#1 Fix VSYNC referencing an unmapped VPE on GIC v4.1 Patch#2 Fix VSYNC referencing an unmapped VPE on GIC v4.0 Nianyao Tang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 Zhou Wang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0 drivers/irqchip/irq-gic-v3-its.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) -- 2.33.0

1 2

[PATCH OLK-5.10 0/1] Fix iBMA bug and change version
by Li Nan 19 Sep '24

19 Sep '24

From: Wujiahai <wujiahai(a)huawei.com> 1. The initialization sequence of the edma_host.timer and edma_host is optimized when the iBMA initializes the edma driver. 2. Change the iBMA driver version. Wujiahai (1): BMA: Fix edma driver initialization problem and change the version number. .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../ethernet/huawei/bma/edma_drv/edma_host.c | 80 ++++++++----------- .../huawei/bma/kbox_drv/kbox_include.h | 2 +- .../ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 38 insertions(+), 50 deletions(-) -- 2.27.0

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] Fix iBMA bug and change version
by Li Nan 19 Sep '24

19 Sep '24

From: Wujiahai <wujiahai(a)huawei.com> 1. The initialization sequence of the edma_host.timer and edma_host is optimized when the iBMA initializes the edma driver. 2. Change the iBMA driver version. Wujiahai (1): BMA: Fix edma driver initialization problem and change the version number. .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../ethernet/huawei/bma/edma_drv/edma_host.c | 80 ++++++++----------- .../huawei/bma/kbox_drv/kbox_include.h | 2 +- .../ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 38 insertions(+), 50 deletions(-) -- 2.27.0

2 2

[PATCH OLK-6.6 v2 00/18] arm64: perf: Add support for event counting threshold
by Junhao He 19 Sep '24

19 Sep '24

ounting of PMU events depending on how much the event increments on a single cycle. Two new config fields for perf_event_open have been added, and a PMU cap file for reading the max_threshold. See the second commit message and the docs in the last commit for more details. The feature is not currently supported on KVM guests, and PMMIR is set to read as zero, so it's not advertised as available. But it can be added at a later time. Writes to PMEVTYPER.TC and TH from guests are already RES0. The change has been validated on the Arm FVP model: a) Zero values, works as expected (as before). $ perf stat -e dtlb_walk/threshold=0,threshold_compare=0/ -- true 5962 dtlb_walk/threshold=0,threshold_compare=0/ b) Threshold >= 255 causes count to be 0 because dtlb_walk doesn't increase by more than 1 per cycle. $ perf stat -e dtlb_walk/threshold=255,threshold_compare=2/ -- true 0 dtlb_walk/threshold=255,threshold_compare=2/ c) Keeping comparison as >= but lowering the threshold to 1 makes the count return. $ perf stat -e dtlb_walk/threshold=1,threshold_compare=2/ -- true 6329 dtlb_walk/threshold=1,threshold_compare=2/ Anshuman Khandual (3): drivers: perf: arm_pmuv3: Read PMMIR_EL1 unconditionally drivers: perf: arm_pmuv3: Drop some unused arguments from armv8_pmu_init() drivers: perf: arm_pmuv3: Add new macro PMUV3_INIT_MAP_EVENT() James Clark (11): arm: perf: Remove inlines from arm_pmuv3.c arm: perf/kvm: Use GENMASK for ARMV8_PMU_PMCR_N arm: perf: Use GENMASK for PMMIR fields arm: perf: Convert remaining fields to use GENMASK arm64: perf: Include threshold control fields in PMEVTYPER mask arm: pmu: Share user ABI format mechanism with SPE perf/arm_dmc620: Remove duplicate format attribute #defines arm: pmu: Move error message and -EOPNOTSUPP to individual PMUs arm64: perf: Add support for event counting threshold Documentation: arm64: Document the PMU event counting threshold feature arm: perf: Fix ARCH=arm build with GCC Oliver Upton (2): KVM: arm64: Make PMEVTYPER<n>_EL0.NSH RES0 if EL2 isn't advertised KVM: arm64: Add PMU event filter bits required if EL3 is implemented Reiji Watanabe (1): KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 Will Deacon (1): Revert "perf/arm_dmc620: Remove duplicate format attribute #defines" Documentation/arch/arm64/perf.rst | 72 ++++++++ arch/arm/kernel/perf_event_v7.c | 6 +- arch/arm64/kvm/arm.c | 3 +- arch/arm64/kvm/pmu-emul.c | 58 +++++-- arch/arm64/kvm/sys_regs.c | 21 ++- drivers/perf/apple_m1_cpu_pmu.c | 6 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmuv3.c | 266 ++++++++++++++++++------------ drivers/perf/arm_spe_pmu.c | 22 --- include/kvm/arm_pmu.h | 11 ++ include/linux/perf/arm_pmu.h | 22 +++ include/linux/perf/arm_pmuv3.h | 43 +++-- 12 files changed, 359 insertions(+), 182 deletions(-) -- 2.33.0

2 19

[PATCH OLK-6.6] net/mlx5e: Take state lock during tx timeout reporter
by Liu Jian 19 Sep '24

19 Sep '24

From: Dragos Tatulea <dtatulea(a)nvidia.com> stable inclusion from stable-v6.6.48 commit b3b9a87adee97854bcd71057901d46943076267e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOI7 CVE: CVE-2024-45019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit e6b5afd30b99b43682a7764e1a74a42fe4d5f4b3 ] mlx5e_safe_reopen_channels() requires the state lock taken. The referenced changed in the Fixes tag removed the lock to fix another issue. This patch adds it back but at a later point (when calling mlx5e_safe_reopen_channels()) to avoid the deadlock referenced in the Fixes tag. Fixes: eab0da38912e ("net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work") Signed-off-by: Dragos Tatulea <dtatulea(a)nvidia.com> Link: https://lore.kernel.org/all/ZplpKq8FKi3vwfxv@gmail.com/T/ Reviewed-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Moshe Shemesh <moshe(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20240808144107.2095424-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c index ff8242f67c54..51a23345caa1 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c @@ -149,7 +149,9 @@ static int mlx5e_tx_reporter_timeout_recover(void *ctx) return err; } + mutex_lock(&priv->state_lock); err = mlx5e_safe_reopen_channels(priv); + mutex_unlock(&priv->state_lock); if (!err) { to_ctx->status = 1; /* all channels recovered */ return err; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] mptcp: pm: avoid possible UaF when selecting endp
by Liu Jian 19 Sep '24

19 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> mainline inclusion from mainline-v6.11-rc5 commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY17 CVE: CVE-2024-44974 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni <pabeni(a)redhat.com> Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/mptcp/pm_netlink.c [Did not backport 90d930882139 ("mptcp: constify a bunch of of helpers"), 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set"), 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mptcp/pm_netlink.c | 44 ++++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 0d6f3d912891..8d7d60334609 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -128,11 +128,13 @@ static bool lookup_subflow_by_saddr(const struct list_head *list, return false; } -static struct mptcp_pm_addr_entry * +static bool select_local_address(const struct pm_nl_pernet *pernet, - struct mptcp_sock *msk) + struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; rcu_read_lock(); spin_lock_bh(&msk->join_list_lock); @@ -146,19 +148,23 @@ select_local_address(const struct pm_nl_pernet *pernet, if (entry->addr.family == ((struct sock *)msk)->sk_family && !lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) && !lookup_subflow_by_saddr(&msk->join_list, &entry->addr)) { - ret = entry; + *new_entry = *entry; + found = true; break; } } spin_unlock_bh(&msk->join_list_lock); rcu_read_unlock(); - return ret; + + return found; } -static struct mptcp_pm_addr_entry * -select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) +static bool +select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; int i = 0; rcu_read_lock(); @@ -171,12 +177,14 @@ select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) if (!(entry->addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) continue; if (i++ == pos) { - ret = entry; + *new_entry = *entry; + found = true; break; } } rcu_read_unlock(); - return ret; + + return found; } static void check_work_pending(struct mptcp_sock *msk) @@ -306,7 +314,7 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) { struct mptcp_addr_info remote = { 0 }; struct sock *sk = (struct sock *)msk; - struct mptcp_pm_addr_entry *local; + struct mptcp_pm_addr_entry local; struct pm_nl_pernet *pernet; pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id); @@ -318,13 +326,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) /* check first for announce */ if (msk->pm.add_addr_signaled < msk->pm.add_addr_signal_max) { - local = select_signal_address(pernet, - msk->pm.add_addr_signaled); - if (local) { - if (mptcp_pm_alloc_anno_list(msk, local)) { + if (select_signal_address(pernet, + msk->pm.add_addr_signaled, &local)) { + if (mptcp_pm_alloc_anno_list(msk, &local)) { msk->pm.add_addr_signaled++; - mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_announce_addr(msk, &local.addr, false); } } else { /* pick failed, avoid fourther attempts later */ @@ -339,13 +346,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) msk->pm.subflows < msk->pm.subflows_max) { remote_address((struct sock_common *)sk, &remote); - local = select_local_address(pernet, msk); - if (local) { + if (select_local_address(pernet, msk, &local)) { msk->pm.local_addr_used++; msk->pm.subflows++; check_work_pending(msk); spin_unlock_bh(&msk->pm.lock); - __mptcp_subflow_connect(sk, &local->addr, &remote); + __mptcp_subflow_connect(sk, &local.addr, &remote); spin_lock_bh(&msk->pm.lock); return; } -- 2.34.1

2 1

[openeuler:OLK-6.6 9567/13952] include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 19 Sep '24

19 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7df4077a020ac8c6b555718e171ec3b593a7aaf0 commit: d9ed39df777afd38fcbd4f4ca670cceb2f168124 [9567/13952] entry: Move exit to usermode functions to header file config: loongarch-randconfig-r123-20240918 (https://download.01.org/0day-ci/archive/20240918/202409182352.x3x3zSa8-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240918/202409182352.x3x3zSa8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409182352.x3x3zSa8-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c: note: in included file: >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * vim +285 include/linux/entry-common.h 264 265 /** 266 * exit_to_user_mode_loop - do any pending work before leaving to user space 267 */ 268 unsigned long exit_to_user_mode_loop(struct pt_regs *regs, 269 unsigned long ti_work); 270 271 /** 272 * exit_to_user_mode_prepare - call exit_to_user_mode_loop() if required 273 * @regs: Pointer to pt_regs on entry stack 274 * 275 * 1) check that interrupts are disabled 276 * 2) call tick_nohz_user_enter_prepare() 277 * 3) call exit_to_user_mode_loop() if any flags from 278 * EXIT_TO_USER_MODE_WORK are set 279 * 4) check that interrupts are still disabled 280 */ 281 static __always_inline void exit_to_user_mode_prepare(struct pt_regs *regs) 282 { 283 unsigned long ti_work; 284 > 285 lockdep_assert_irqs_disabled(); 286 287 /* Flush pending rcuog wakeup before the last need_resched() check */ 288 tick_nohz_user_enter_prepare(); 289 290 ti_work = read_thread_flags(); 291 if (unlikely(ti_work & EXIT_TO_USER_MODE_WORK)) 292 ti_work = exit_to_user_mode_loop(regs, ti_work); 293 294 arch_exit_to_user_mode_prepare(regs, ti_work); 295 296 /* Ensure that kernel state is sane for a return to userspace */ 297 kmap_assert_nomap(); 298 lockdep_assert_irqs_disabled(); 299 lockdep_sys_exit(); 300 } 301 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] gtp: pull network headers in gtp_dev_xmit()
by Zhang Changzhong 18 Sep '24

18 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.321 commit 3d89d0c4a1c6d4d2a755e826351b0a101dbc86f3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZX CVE: CVE-2024-44999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 upstream. syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing fields in them. Use pskb_inet_may_pull() to fix this issue. [1] BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline] BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 ipv6_pdp_find drivers/net/gtp.c:220 [inline] gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3994 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Fixes: 999cb275c807 ("gtp: add IPv6 support") Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Harald Welte <laforge(a)gnumonks.org> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/gtp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 64c7d64..0fbe3b6 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -574,6 +574,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) if (skb_cow_head(skb, dev->needed_headroom)) goto tx_err; + if (!pskb_inet_may_pull(skb)) + goto tx_err; + skb_reset_inner_headers(skb); /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] gtp: pull network headers in gtp_dev_xmit()
by Zhang Changzhong 18 Sep '24

18 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.225 commit cbb9a969fc190e85195d1b0f08038e7f6199044e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZX CVE: CVE-2024-44999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 upstream. syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing fields in them. Use pskb_inet_may_pull() to fix this issue. [1] BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline] BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 ipv6_pdp_find drivers/net/gtp.c:220 [inline] gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3994 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Fixes: 999cb275c807 ("gtp: add IPv6 support") Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Harald Welte <laforge(a)gnumonks.org> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/gtp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 84e6f2b..e298189 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -564,6 +564,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) if (skb_cow_head(skb, dev->needed_headroom)) goto tx_err; + if (!pskb_inet_may_pull(skb)) + goto tx_err; + skb_reset_inner_headers(skb); /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ -- 2.9.5

2 1

[PATCH OLK-6.6] gtp: pull network headers in gtp_dev_xmit()
by Zhang Changzhong 18 Sep '24

18 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.48 commit 34ba4f29f3d9eb52dee37512059efb2afd7e966f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZX CVE: CVE-2024-44999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 upstream. syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing fields in them. Use pskb_inet_may_pull() to fix this issue. [1] BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline] BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 ipv6_pdp_find drivers/net/gtp.c:220 [inline] gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3994 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Fixes: 999cb275c807 ("gtp: add IPv6 support") Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Harald Welte <laforge(a)gnumonks.org> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/gtp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 63f9322..931b655 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -901,6 +901,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) if (skb_cow_head(skb, dev->needed_headroom)) goto tx_err; + if (!pskb_inet_may_pull(skb)) + goto tx_err; + skb_reset_inner_headers(skb); /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ -- 2.9.5

2 1

[PATCH OLK-5.10] gtp: pull network headers in gtp_dev_xmit()
by Zhang Changzhong 18 Sep '24

18 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.225 commit cbb9a969fc190e85195d1b0f08038e7f6199044e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZX CVE: CVE-2024-44999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 upstream. syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing fields in them. Use pskb_inet_may_pull() to fix this issue. [1] BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline] BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 ipv6_pdp_find drivers/net/gtp.c:220 [inline] gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3994 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Fixes: 999cb275c807 ("gtp: add IPv6 support") Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Harald Welte <laforge(a)gnumonks.org> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/gtp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index c824636..993960f 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -567,6 +567,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) if (skb_cow_head(skb, dev->needed_headroom)) goto tx_err; + if (!pskb_inet_may_pull(skb)) + goto tx_err; + skb_reset_inner_headers(skb); /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ -- 2.9.5

2 1

[PATCH OLK-5.10 0/2] CVE-2024-36915
by Yongqiang Liu 18 Sep '24

18 Sep '24

Eric Dumazet (2): net: add copy_safe_from_sockptr() helper nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies include/linux/sockptr.h | 25 +++++++++++++++++++++++++ net/nfc/llcp_sock.c | 12 ++++++------ 2 files changed, 31 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-36915
by Yongqiang Liu 18 Sep '24

18 Sep '24

Eric Dumazet (2): net: add copy_safe_from_sockptr() helper nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies include/linux/sockptr.h | 25 +++++++++++++++++++++++++ net/nfc/llcp_sock.c | 12 ++++++------ 2 files changed, 31 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[OLK-5.10 0/2] CVE-2024-36915
by Yongqiang Liu 18 Sep '24

18 Sep '24

Eric Dumazet (2): net: add copy_safe_from_sockptr() helper nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies include/linux/sockptr.h | 25 +++++++++++++++++++++++++ net/nfc/llcp_sock.c | 12 ++++++------ 2 files changed, 31 insertions(+), 6 deletions(-) -- 2.34.1

1 2

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Skip finding free audio for unknown engine_id
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.222 commit ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGT0E CVE: CVE-2024-42119 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ] [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. [HOW] Skip and return NULL. This fixes 2 OVERRUN issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index f1eda1a6496d..0a13c06eea44 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1802,6 +1802,9 @@ static struct audio *find_first_free_audio( { int i, available_audio_count; + if (id == ENGINE_ID_UNKNOWN) + return NULL; + available_audio_count = pool->audio_count; for (i = 0; i < available_audio_count; i++) { -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Skip finding free audio for unknown engine_id
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.222 commit ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGT0E CVE: CVE-2024-42119 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ] [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. [HOW] Skip and return NULL. This fixes 2 OVERRUN issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index f1eda1a6496d..0a13c06eea44 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1802,6 +1802,9 @@ static struct audio *find_first_free_audio( { int i, available_audio_count; + if (id == ENGINE_ID_UNKNOWN) + return NULL; + available_audio_count = pool->audio_count; for (i = 0; i < available_audio_count; i++) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] jfs: don't walk off the end of ealist
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: lei lu <llfamsec(a)gmail.com> stable inclusion from stable-v5.10.223 commit 6386f1b6a10e5d1ddd03db4ff6dfc55d488852ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG918 CVE: CVE-2024-41017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit d0fa70aca54c8643248e89061da23752506ec0d4 upstream. Add a check before visiting the members of ea to make sure each ea stays within the ealist. Signed-off-by: lei lu <llfamsec(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- fs/jfs/xattr.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index 7ae54f78a5b0..aea5531559c0 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -797,7 +797,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, size_t buf_size) { struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; int xattr_size; ssize_t size; @@ -817,9 +817,16 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, goto not_found; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* Find the named attribute */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if ((namelen == ea->namelen) && memcmp(name, ea->name, namelen) == 0) { /* Found it */ @@ -834,6 +841,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, memcpy(data, value, size); goto release; } + } not_found: size = -ENODATA; release: @@ -861,7 +869,7 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) ssize_t size = 0; int xattr_size; struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; down_read(&JFS_IP(inode)->xattr_sem); @@ -876,9 +884,16 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) goto release; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* compute required size of list */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) { + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if (can_list(ea)) size += name_size(ea) + 1; } -- 2.34.1

2 1

[PATCH OLK-5.10] jfs: don't walk off the end of ealist
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: lei lu <llfamsec(a)gmail.com> stable inclusion from stable-v5.10.223 commit 6386f1b6a10e5d1ddd03db4ff6dfc55d488852ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG918 CVE: CVE-2024-41017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit d0fa70aca54c8643248e89061da23752506ec0d4 upstream. Add a check before visiting the members of ea to make sure each ea stays within the ealist. Signed-off-by: lei lu <llfamsec(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- fs/jfs/xattr.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index 7ae54f78a5b0..aea5531559c0 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -797,7 +797,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, size_t buf_size) { struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; int xattr_size; ssize_t size; @@ -817,9 +817,16 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, goto not_found; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* Find the named attribute */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if ((namelen == ea->namelen) && memcmp(name, ea->name, namelen) == 0) { /* Found it */ @@ -834,6 +841,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, memcpy(data, value, size); goto release; } + } not_found: size = -ENODATA; release: @@ -861,7 +869,7 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) ssize_t size = 0; int xattr_size; struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; down_read(&JFS_IP(inode)->xattr_sem); @@ -876,9 +884,16 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) goto release; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* compute required size of list */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) { + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if (can_list(ea)) size += name_size(ea) + 1; } -- 2.34.1

2 1

[PATCH OLK-6.6] vfs: Don't evict inode under the inode lru traversing context
by Zheng Qixing 18 Sep '24

18 Sep '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v6.6.48 commit b9bda5f6012dd00372f3a06a82ed8971a4c57c32 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZK CVE: CVE-2024-45003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2a0629834cd82f05d424bbc193374f9a43d1f87d upstream. The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink = 0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----→ AA deadlock dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ↓ ubifs_jnl_write_inode ABBA deadlock ←-----make_reservation(BASEHD) dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate() reclaims its pages instead of using ordinary inode reference. This way inode deletion cannot be triggered from inode_lru_isolate() thus avoiding the deadlock. evict() is made to wait for I_LRU_ISOLATING to be cleared before proceeding with inode cleanup. Link: https://lore.kernel.org/all/37c29c42-7685-d1f0-067d-63582ffac405@huaweiclou… Link: https://bugzilla.kernel.org/show_bug.cgi?id=219022 Fixes: e50e5129f384 ("ext4: xattr-in-inode support") Fixes: 7959cf3a7506 ("ubifs: journal: Handle xattrs like files") Cc: stable(a)vger.kernel.org Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Link: https://lore.kernel.org/r/20240809031628.1069873-1-chengzhihao@huaweicloud.… Reviewed-by: Jan Kara <jack(a)suse.cz> Suggested-by: Jan Kara <jack(a)suse.cz> Suggested-by: Mateusz Guzik <mjguzik(a)gmail.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/inode.c | 39 +++++++++++++++++++++++++++++++++++++-- include/linux/fs.h | 5 +++++ 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/fs/inode.c b/fs/inode.c index 2d8b8d353750..d31fd643c7ef 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -486,6 +486,39 @@ static void inode_lru_list_del(struct inode *inode) this_cpu_dec(nr_unused); } +static void inode_pin_lru_isolating(struct inode *inode) +{ + lockdep_assert_held(&inode->i_lock); + WARN_ON(inode->i_state & (I_LRU_ISOLATING | I_FREEING | I_WILL_FREE)); + inode->i_state |= I_LRU_ISOLATING; +} + +static void inode_unpin_lru_isolating(struct inode *inode) +{ + spin_lock(&inode->i_lock); + WARN_ON(!(inode->i_state & I_LRU_ISOLATING)); + inode->i_state &= ~I_LRU_ISOLATING; + smp_mb(); + wake_up_bit(&inode->i_state, __I_LRU_ISOLATING); + spin_unlock(&inode->i_lock); +} + +static void inode_wait_for_lru_isolating(struct inode *inode) +{ + spin_lock(&inode->i_lock); + if (inode->i_state & I_LRU_ISOLATING) { + DEFINE_WAIT_BIT(wq, &inode->i_state, __I_LRU_ISOLATING); + wait_queue_head_t *wqh; + + wqh = bit_waitqueue(&inode->i_state, __I_LRU_ISOLATING); + spin_unlock(&inode->i_lock); + __wait_on_bit(wqh, &wq, bit_wait, TASK_UNINTERRUPTIBLE); + spin_lock(&inode->i_lock); + WARN_ON(inode->i_state & I_LRU_ISOLATING); + } + spin_unlock(&inode->i_lock); +} + /** * inode_sb_list_add - add inode to the superblock list of inodes * @inode: inode to add @@ -655,6 +688,8 @@ static void evict(struct inode *inode) inode_sb_list_del(inode); + inode_wait_for_lru_isolating(inode); + /* * Wait for flusher thread to be done with the inode so that filesystem * does not start destroying it while writeback is still running. Since @@ -843,7 +878,7 @@ static enum lru_status inode_lru_isolate(struct list_head *item, * be under pressure before the cache inside the highmem zone. */ if (inode_has_buffers(inode) || !mapping_empty(&inode->i_data)) { - __iget(inode); + inode_pin_lru_isolating(inode); spin_unlock(&inode->i_lock); spin_unlock(lru_lock); if (remove_inode_buffers(inode)) { @@ -855,7 +890,7 @@ static enum lru_status inode_lru_isolate(struct list_head *item, __count_vm_events(PGINODESTEAL, reap); mm_account_reclaimed_pages(reap); } - iput(inode); + inode_unpin_lru_isolating(inode); spin_lock(lru_lock); return LRU_RETRY; } diff --git a/include/linux/fs.h b/include/linux/fs.h index e4ea5c34b90c..e7c55ebb9d71 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2334,6 +2334,9 @@ static inline void kiocb_clone(struct kiocb *kiocb, struct kiocb *kiocb_src, * * I_PINNING_FSCACHE_WB Inode is pinning an fscache object for writeback. * + * I_LRU_ISOLATING Inode is pinned being isolated from LRU without holding + * i_count. + * * Q: What is the difference between I_WILL_FREE and I_FREEING? */ #define I_DIRTY_SYNC (1 << 0) @@ -2357,6 +2360,8 @@ static inline void kiocb_clone(struct kiocb *kiocb, struct kiocb *kiocb_src, #define I_DONTCACHE (1 << 16) #define I_SYNC_QUEUED (1 << 17) #define I_PINNING_FSCACHE_WB (1 << 18) +#define __I_LRU_ISOLATING 19 +#define I_LRU_ISOLATING (1 << __I_LRU_ISOLATING) #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC) #define I_DIRTY (I_DIRTY_INODE | I_DIRTY_PAGES) -- 2.39.2

2 1

[PATCH OLK-5.10] vfs: Don't evict inode under the inode lru traversing context
by Zheng Qixing 18 Sep '24

18 Sep '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v6.6.48 commit b9bda5f6012dd00372f3a06a82ed8971a4c57c32 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZK CVE: CVE-2024-45003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------------------- commit 2a0629834cd82f05d424bbc193374f9a43d1f87d upstream. The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink = 0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----→ AA deadlock dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ↓ ubifs_jnl_write_inode ABBA deadlock ←-----make_reservation(BASEHD) dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate() reclaims its pages instead of using ordinary inode reference. This way inode deletion cannot be triggered from inode_lru_isolate() thus avoiding the deadlock. evict() is made to wait for I_LRU_ISOLATING to be cleared before proceeding with inode cleanup. Link: https://lore.kernel.org/all/37c29c42-7685-d1f0-067d-63582ffac405@huaweiclou… Link: https://bugzilla.kernel.org/show_bug.cgi?id=219022 Fixes: e50e5129f384 ("ext4: xattr-in-inode support") Fixes: 7959cf3a7506 ("ubifs: journal: Handle xattrs like files") Cc: stable(a)vger.kernel.org Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Link: https://lore.kernel.org/r/20240809031628.1069873-1-chengzhihao@huaweicloud.… Reviewed-by: Jan Kara <jack(a)suse.cz> Suggested-by: Jan Kara <jack(a)suse.cz> Suggested-by: Mateusz Guzik <mjguzik(a)gmail.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/inode.c | 39 +++++++++++++++++++++++++++++++++++++-- include/linux/fs.h | 5 +++++ 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/fs/inode.c b/fs/inode.c index bec790bde7ca..c4eaa1db9d1a 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -453,6 +453,39 @@ static void inode_lru_list_del(struct inode *inode) this_cpu_dec(nr_unused); } +static void inode_pin_lru_isolating(struct inode *inode) +{ + lockdep_assert_held(&inode->i_lock); + WARN_ON(inode->i_state & (I_LRU_ISOLATING | I_FREEING | I_WILL_FREE)); + inode->i_state |= I_LRU_ISOLATING; +} + +static void inode_unpin_lru_isolating(struct inode *inode) +{ + spin_lock(&inode->i_lock); + WARN_ON(!(inode->i_state & I_LRU_ISOLATING)); + inode->i_state &= ~I_LRU_ISOLATING; + smp_mb(); + wake_up_bit(&inode->i_state, __I_LRU_ISOLATING); + spin_unlock(&inode->i_lock); +} + +static void inode_wait_for_lru_isolating(struct inode *inode) +{ + spin_lock(&inode->i_lock); + if (inode->i_state & I_LRU_ISOLATING) { + DEFINE_WAIT_BIT(wq, &inode->i_state, __I_LRU_ISOLATING); + wait_queue_head_t *wqh; + + wqh = bit_waitqueue(&inode->i_state, __I_LRU_ISOLATING); + spin_unlock(&inode->i_lock); + __wait_on_bit(wqh, &wq, bit_wait, TASK_UNINTERRUPTIBLE); + spin_lock(&inode->i_lock); + WARN_ON(inode->i_state & I_LRU_ISOLATING); + } + spin_unlock(&inode->i_lock); +} + /** * inode_sb_list_add - add inode to the superblock list of inodes * @inode: inode to add @@ -572,6 +605,8 @@ static void evict(struct inode *inode) inode_sb_list_del(inode); + inode_wait_for_lru_isolating(inode); + /* * Wait for flusher thread to be done with the inode so that filesystem * does not start destroying it while writeback is still running. Since @@ -771,7 +806,7 @@ static enum lru_status inode_lru_isolate(struct list_head *item, } if (inode_has_buffers(inode) || inode->i_data.nrpages) { - __iget(inode); + inode_pin_lru_isolating(inode); spin_unlock(&inode->i_lock); spin_unlock(lru_lock); if (remove_inode_buffers(inode)) { @@ -784,7 +819,7 @@ static enum lru_status inode_lru_isolate(struct list_head *item, if (current->reclaim_state) current->reclaim_state->reclaimed_slab += reap; } - iput(inode); + inode_unpin_lru_isolating(inode); spin_lock(lru_lock); return LRU_RETRY; } diff --git a/include/linux/fs.h b/include/linux/fs.h index 9d7e901b71fd..7e8684e3f05d 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2280,6 +2280,9 @@ static inline void kiocb_clone(struct kiocb *kiocb, struct kiocb *kiocb_src, * Used to detect that mark_inode_dirty() should not move * inode between dirty lists. * + * I_LRU_ISOLATING Inode is pinned being isolated from LRU without holding + * i_count. + * * Q: What is the difference between I_WILL_FREE and I_FREEING? */ #define I_DIRTY_SYNC (1 << 0) @@ -2302,6 +2305,8 @@ static inline void kiocb_clone(struct kiocb *kiocb, struct kiocb *kiocb_src, #define I_CREATING (1 << 15) #define I_DONTCACHE (1 << 16) #define I_SYNC_QUEUED (1 << 17) +#define __I_LRU_ISOLATING 19 +#define I_LRU_ISOLATING (1 << __I_LRU_ISOLATING) #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC) #define I_DIRTY (I_DIRTY_INODE | I_DIRTY_PAGES) -- 2.39.2

2 1

[PATCH OLK-5.10] nfs: always check dreq->error after a commit
by Li Lingfeng 18 Sep '24

18 Sep '24

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v6.0-rc1 commit 55051c0ced7d322a169f8603d306ee6ec079f8ae category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARK13 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the client gets back a short DIO write, it will then attempt to issue another write to finish the DIO request. If that write then fails (as is often the case in an -ENOSPC situation), then we still may need to issue a COMMIT if the earlier short write was unstable. If that COMMIT then succeeds, then we don't want the client to reschedule the write requests, and to instead just return a short write. Otherwise, we can end up looping over the same DIO write forever. Always consult dreq->error after a successful RPC, even when the flag state is not NFS_ODIRECT_DONE. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2028370 Reported-by: Boyang Xue <bxue(a)redhat.com> Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/direct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 499519f0f6ec..5b8ab542ee84 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -629,8 +629,9 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data) dreq->max_count = 0; dreq->count = 0; dreq->flags = NFS_ODIRECT_DONE; - } else if (dreq->flags == NFS_ODIRECT_DONE) + } else { status = dreq->error; + } nfs_init_cinfo_from_dreq(&cinfo, dreq); -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Skip finding free audio for unknown engine_id
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.222 commit ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8 category: bugfix https://gitee.com/src-openeuler/kernel/issues/IAGT0E CVE: CVE-2024-42119 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ] [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. [HOW] Skip and return NULL. This fixes 2 OVERRUN issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index f1eda1a6496d..0a13c06eea44 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1802,6 +1802,9 @@ static struct audio *find_first_free_audio( { int i, available_audio_count; + if (id == ENGINE_ID_UNKNOWN) + return NULL; + available_audio_count = pool->audio_count; for (i = 0; i < available_audio_count; i++) { -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Skip finding free audio for unknown engine_id
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.222 commit ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8 category: bugfix https://gitee.com/src-openeuler/kernel/issues/IAGT0E CVE: CVE-2024-42119 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ] [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. [HOW] Skip and return NULL. This fixes 2 OVERRUN issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index f1eda1a6496d..0a13c06eea44 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1802,6 +1802,9 @@ static struct audio *find_first_free_audio( { int i, available_audio_count; + if (id == ENGINE_ID_UNKNOWN) + return NULL; + available_audio_count = pool->audio_count; for (i = 0; i < available_audio_count; i++) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] kobject_uevent: Fix OOB access within zap_modalias_env()
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Zijun Hu <quic_zijuhu(a)quicinc.com> stable inclusion from stable-v5.10.224 commit 648d5490460d38436640da0812bf7f6351c150d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXP CVE: CVE-2024-42292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit dd6e9894b451e7c85cceb8e9dc5432679a70e7dc upstream. zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove. Fixes: 9b3fa47d4a76 ("kobject: fix suppressing modalias in uevents delivered over netlink") Cc: stable(a)vger.kernel.org Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> Reviewed-by: Lk Sii <lk_sii(a)163.com> Link: https://lore.kernel.org/r/1717074877-11352-1-git-send-email-quic_zijuhu@qui… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- lib/kobject_uevent.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index 8056def4c028..c0214080e233 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -432,8 +432,23 @@ static void zap_modalias_env(struct kobj_uevent_env *env) len = strlen(env->envp[i]) + 1; if (i != env->envp_idx - 1) { + /* @env->envp[] contains pointers to @env->buf[] + * with @env->buflen chars, and we are removing + * variable MODALIAS here pointed by @env->envp[i] + * with length @len as shown below: + * + * 0 @env->buf[] @env->buflen + * --------------------------------------------- + * ^ ^ ^ ^ + * | |-> @len <-| target block | + * @env->envp[0] @env->envp[i] @env->envp[i + 1] + * + * so the "target block" indicated above is moved + * backward by @len, and its right size is + * @env->buflen - (@env->envp[i + 1] - @env->envp[0]). + */ memmove(env->envp[i], env->envp[i + 1], - env->buflen - len); + env->buflen - (env->envp[i + 1] - env->envp[0])); for (j = i; j < env->envp_idx - 1; j++) env->envp[j] = env->envp[j + 1] - len; -- 2.34.1

2 1

[PATCH OLK-5.10] kobject_uevent: Fix OOB access within zap_modalias_env()
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Zijun Hu <quic_zijuhu(a)quicinc.com> stable inclusion from stable-v5.10.224 commit 648d5490460d38436640da0812bf7f6351c150d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXP CVE: CVE-2024-42292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit dd6e9894b451e7c85cceb8e9dc5432679a70e7dc upstream. zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove. Fixes: 9b3fa47d4a76 ("kobject: fix suppressing modalias in uevents delivered over netlink") Cc: stable(a)vger.kernel.org Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> Reviewed-by: Lk Sii <lk_sii(a)163.com> Link: https://lore.kernel.org/r/1717074877-11352-1-git-send-email-quic_zijuhu@qui… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- lib/kobject_uevent.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index 8056def4c028..c0214080e233 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -432,8 +432,23 @@ static void zap_modalias_env(struct kobj_uevent_env *env) len = strlen(env->envp[i]) + 1; if (i != env->envp_idx - 1) { + /* @env->envp[] contains pointers to @env->buf[] + * with @env->buflen chars, and we are removing + * variable MODALIAS here pointed by @env->envp[i] + * with length @len as shown below: + * + * 0 @env->buf[] @env->buflen + * --------------------------------------------- + * ^ ^ ^ ^ + * | |-> @len <-| target block | + * @env->envp[0] @env->envp[i] @env->envp[i + 1] + * + * so the "target block" indicated above is moved + * backward by @len, and its right size is + * @env->buflen - (@env->envp[i + 1] - @env->envp[0]). + */ memmove(env->envp[i], env->envp[i + 1], - env->buflen - len); + env->buflen - (env->envp[i + 1] - env->envp[0])); for (j = i; j < env->envp_idx - 1; j++) env->envp[j] = env->envp[j + 1] - len; -- 2.34.1

2 1

[PATCH OLK-5.10] net: fix one compile error in net_rship_refresh_timeout()
by Liu Jian 18 Sep '24

18 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARV38 -------------------------------- Fix the below error when disable CONFIG_PROC_SYSCTL compile macro: aarch64-linux-gnu-ld: net/ipv4/tcp.o: in function \ `net_rship_refresh_timeout': include/net/net_rship.h:92: undefined reference to \ `net_numa_rship_jiffies' Fixes: 64ba5634c4c6 ("net: add some bpf hooks in tcp stack for network numa relationship") Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 3 +++ net/core/sysctl_net_core.c | 1 - 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 9ef84e86b5c5..a4e94a3e8c76 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -10787,7 +10787,10 @@ static int __init gnet_bpf_init(void) } late_initcall(gnet_bpf_init); +#if defined(CONFIG_SCHED_TASK_RELATIONSHIP) #include <linux/sched/relationship.h> +unsigned long net_numa_rship_jiffies __read_mostly = HZ / 10; /* 100ms */ +#endif BPF_CALL_3(bpf_sched_net_rship_submit, void *, reqbuf, size_t, sz, u64, flags) { #if defined(CONFIG_SCHED_TASK_RELATIONSHIP) diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c index ea0ee32f27bb..8ac874fd9271 100644 --- a/net/core/sysctl_net_core.c +++ b/net/core/sysctl_net_core.c @@ -47,7 +47,6 @@ int sysctl_devconf_inherit_init_net __read_mostly; EXPORT_SYMBOL(sysctl_devconf_inherit_init_net); #ifdef CONFIG_SCHED_TASK_RELATIONSHIP -unsigned long net_numa_rship_jiffies __read_mostly = HZ / 10; /* 100ms */ static unsigned long net_numa_rship_ms_min = HZ / 10; /* 100ms */ static unsigned long net_numa_rship_ms_max = 100 * HZ; /* 100s */ #endif -- 2.34.1

2 1

[PATCH OLK-5.10] tcp: fix one compile error in __inet_hash_connect()
by Liu Jian 18 Sep '24

18 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARV38 -------------------------------- Fix the below error when disable CONFIG_PROC_SYSCTL compile macro: aarch64-linux-gnu-ld: net/ipv4/inet_hashtables.o: in \ function `__inet_hash_connect': net/ipv4/inet_hashtables.c:759: undefined reference to \ `sysctl_local_port_allocation' Fixes: 726c52655f7 ("tcp/dccp: Add another way to allocate local ports in connect()") Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/inet_hashtables.c | 2 ++ net/ipv4/sysctl_net_ipv4.c | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index 1ca02944ae90..1894cf014129 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -28,6 +28,8 @@ #include <net/tcp.h> #include <net/sock_reuseport.h> +int sysctl_local_port_allocation; + static u32 inet_ehashfn(const struct net *net, const __be32 laddr, const __u16 lport, const __be32 faddr, const __be16 fport) diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index a013df55e933..207a8b00a77d 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -51,7 +51,6 @@ static int comp_sack_nr_max = 255; static u32 u32_max_div_HZ = UINT_MAX / HZ; static int one_day_secs = 24 * 3600; -int sysctl_local_port_allocation; /* obsolete */ static int sysctl_tcp_low_latency __read_mostly; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: add missing check for inode numbers on directory entries
by Xia Fukun 18 Sep '24

18 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.223 commit 2f2fa9cf7c3537958a82fbe8c8595a5eb0861ad7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPRT CVE: CVE-2024-42104 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit bb76c6c274683c8570ad788f79d4b875bde0e458 upstream. Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free of metadata file inodes, which triggers a kernel bug in lru_add_fn(). As Jan Kara pointed out, this is because the link count of a metadata file gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(), tries to delete that inode (ifile inode in this case). The inconsistency occurs because directories containing the inode numbers of these metadata files that should not be visible in the namespace are read without checking. Fix this issue by treating the inode numbers of these internal files as errors in the sanity check helper when reading directory folios/pages. Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer analysis. Link: https://lkml.kernel.org/r/20240623051135.4180-3-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d79afb004be235636ee8(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d79afb004be235636ee8 Reported-by: Jan Kara <jack(a)suse.cz> Closes: https://lkml.kernel.org/r/20240617075758.wewhukbrjod5fp5o@quack3 Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: Hillf Danton <hdanton(a)sina.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/nilfs2/dir.c | 6 ++++++ fs/nilfs2/nilfs.h | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 75cf7fef8987a..7269a7d8bb95c 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -143,6 +143,9 @@ static bool nilfs_check_page(struct page *page) goto Enamelen; if (((offs + rec_len - 1) ^ offs) & ~(chunk_size-1)) goto Espan; + if (unlikely(p->inode && + NILFS_PRIVATE_INODE(le64_to_cpu(p->inode)))) + goto Einumber; } if (offs != limit) goto Eend; @@ -168,6 +171,9 @@ static bool nilfs_check_page(struct page *page) goto bad_entry; Espan: error = "directory entry across blocks"; + goto bad_entry; +Einumber: + error = "disallowed inode number"; bad_entry: nilfs_error(sb, "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%d, name_len=%d", diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h index cefd2cfc7012c..3f3971e0292da 100644 --- a/fs/nilfs2/nilfs.h +++ b/fs/nilfs2/nilfs.h @@ -121,6 +121,11 @@ enum { ((ino) >= NILFS_FIRST_INO(sb) || \ ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino)))) +#define NILFS_PRIVATE_INODE(ino) ({ \ + ino_t __ino = (ino); \ + ((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO && \ + (__ino) != NILFS_SKETCH_INO); }) + /** * struct nilfs_transaction_info: context information for synchronization * @ti_magic: Magic number -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: add missing check for inode numbers on directory entries
by Xia Fukun 18 Sep '24

18 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.223 commit 2f2fa9cf7c3537958a82fbe8c8595a5eb0861ad7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPRT CVE: CVE-2024-42104 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit bb76c6c274683c8570ad788f79d4b875bde0e458 upstream. Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free of metadata file inodes, which triggers a kernel bug in lru_add_fn(). As Jan Kara pointed out, this is because the link count of a metadata file gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(), tries to delete that inode (ifile inode in this case). The inconsistency occurs because directories containing the inode numbers of these metadata files that should not be visible in the namespace are read without checking. Fix this issue by treating the inode numbers of these internal files as errors in the sanity check helper when reading directory folios/pages. Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer analysis. Link: https://lkml.kernel.org/r/20240623051135.4180-3-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d79afb004be235636ee8(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d79afb004be235636ee8 Reported-by: Jan Kara <jack(a)suse.cz> Closes: https://lkml.kernel.org/r/20240617075758.wewhukbrjod5fp5o@quack3 Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: Hillf Danton <hdanton(a)sina.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/nilfs2/dir.c | 6 ++++++ fs/nilfs2/nilfs.h | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 75cf7fef8987a..7269a7d8bb95c 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -143,6 +143,9 @@ static bool nilfs_check_page(struct page *page) goto Enamelen; if (((offs + rec_len - 1) ^ offs) & ~(chunk_size-1)) goto Espan; + if (unlikely(p->inode && + NILFS_PRIVATE_INODE(le64_to_cpu(p->inode)))) + goto Einumber; } if (offs != limit) goto Eend; @@ -168,6 +171,9 @@ static bool nilfs_check_page(struct page *page) goto bad_entry; Espan: error = "directory entry across blocks"; + goto bad_entry; +Einumber: + error = "disallowed inode number"; bad_entry: nilfs_error(sb, "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%d, name_len=%d", diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h index cefd2cfc7012c..3f3971e0292da 100644 --- a/fs/nilfs2/nilfs.h +++ b/fs/nilfs2/nilfs.h @@ -121,6 +121,11 @@ enum { ((ino) >= NILFS_FIRST_INO(sb) || \ ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino)))) +#define NILFS_PRIVATE_INODE(ino) ({ \ + ino_t __ino = (ino); \ + ((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO && \ + (__ino) != NILFS_SKETCH_INO); }) + /** * struct nilfs_transaction_info: context information for synchronization * @ti_magic: Magic number -- 2.34.1

2 1

[PATCH OLK-6.6] btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()
by Yifan Qiao 18 Sep '24

18 Sep '24

From: Qu Wenruo <wqu(a)suse.com> stable inclusion from stable-v6.6.49 commit 51722b99f41f5e722ffa10b8f61e802a0e70b331 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR4CF CVE: CVE-2024-46687 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10 upstream. [BUG] There is an internal report that KASAN is reporting use-after-free, with the following backtrace: BUG: KASAN: slab-use-after-free in btrfs_check_read_bio+0xa68/0xb70 [btrfs] Read of size 4 at addr ffff8881117cec28 by task kworker/u16:2/45 CPU: 1 UID: 0 PID: 45 Comm: kworker/u16:2 Not tainted 6.11.0-rc2-next-20240805-default+ #76 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Workqueue: btrfs-endio btrfs_end_bio_work [btrfs] Call Trace: dump_stack_lvl+0x61/0x80 print_address_description.constprop.0+0x5e/0x2f0 print_report+0x118/0x216 kasan_report+0x11d/0x1f0 btrfs_check_read_bio+0xa68/0xb70 [btrfs] process_one_work+0xce0/0x12a0 worker_thread+0x717/0x1250 kthread+0x2e3/0x3c0 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x11/0x20 Allocated by task 20917: kasan_save_stack+0x37/0x60 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x7d/0x80 kmem_cache_alloc_noprof+0x16e/0x3e0 mempool_alloc_noprof+0x12e/0x310 bio_alloc_bioset+0x3f0/0x7a0 btrfs_bio_alloc+0x2e/0x50 [btrfs] submit_extent_page+0x4d1/0xdb0 [btrfs] btrfs_do_readpage+0x8b4/0x12a0 [btrfs] btrfs_readahead+0x29a/0x430 [btrfs] read_pages+0x1a7/0xc60 page_cache_ra_unbounded+0x2ad/0x560 filemap_get_pages+0x629/0xa20 filemap_read+0x335/0xbf0 vfs_read+0x790/0xcb0 ksys_read+0xfd/0x1d0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 20917: kasan_save_stack+0x37/0x60 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x50 __kasan_slab_free+0x4b/0x60 kmem_cache_free+0x214/0x5d0 bio_free+0xed/0x180 end_bbio_data_read+0x1cc/0x580 [btrfs] btrfs_submit_chunk+0x98d/0x1880 [btrfs] btrfs_submit_bio+0x33/0x70 [btrfs] submit_one_bio+0xd4/0x130 [btrfs] submit_extent_page+0x3ea/0xdb0 [btrfs] btrfs_do_readpage+0x8b4/0x12a0 [btrfs] btrfs_readahead+0x29a/0x430 [btrfs] read_pages+0x1a7/0xc60 page_cache_ra_unbounded+0x2ad/0x560 filemap_get_pages+0x629/0xa20 filemap_read+0x335/0xbf0 vfs_read+0x790/0xcb0 ksys_read+0xfd/0x1d0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [CAUSE] Although I cannot reproduce the error, the report itself is good enough to pin down the cause. The call trace is the regular endio workqueue context, but the free-by-task trace is showing that during btrfs_submit_chunk() we already hit a critical error, and is calling btrfs_bio_end_io() to error out. And the original endio function called bio_put() to free the whole bio. This means a double freeing thus causing use-after-free, e.g.: 1. Enter btrfs_submit_bio() with a read bio The read bio length is 128K, crossing two 64K stripes. 2. The first run of btrfs_submit_chunk() 2.1 Call btrfs_map_block(), which returns 64K 2.2 Call btrfs_split_bio() Now there are two bios, one referring to the first 64K, the other referring to the second 64K. 2.3 The first half is submitted. 3. The second run of btrfs_submit_chunk() 3.1 Call btrfs_map_block(), which by somehow failed Now we call btrfs_bio_end_io() to handle the error 3.2 btrfs_bio_end_io() calls the original endio function Which is end_bbio_data_read(), and it calls bio_put() for the original bio. Now the original bio is freed. 4. The submitted first 64K bio finished Now we call into btrfs_check_read_bio() and tries to advance the bio iter. But since the original bio (thus its iter) is already freed, we trigger the above use-after free. And even if the memory is not poisoned/corrupted, we will later call the original endio function, causing a double freeing. [FIX] Instead of calling btrfs_bio_end_io(), call btrfs_orig_bbio_end_io(), which has the extra check on split bios and do the proper refcounting for cloned bios. Furthermore there is already one extra btrfs_cleanup_bio() call, but that is duplicated to btrfs_orig_bbio_end_io() call, so remove that label completely. Reported-by: David Sterba <dsterba(a)suse.com> Fixes: 852eee62d31a ("btrfs: allow btrfs_submit_bio to split bios") CC: stable(a)vger.kernel.org # 6.6+ Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/bio.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/fs/btrfs/bio.c b/fs/btrfs/bio.c index e47eb248309f..650972895652 100644 --- a/fs/btrfs/bio.c +++ b/fs/btrfs/bio.c @@ -646,7 +646,6 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) { struct btrfs_inode *inode = bbio->inode; struct btrfs_fs_info *fs_info = bbio->fs_info; - struct btrfs_bio *orig_bbio = bbio; struct bio *bio = &bbio->bio; u64 logical = bio->bi_iter.bi_sector << SECTOR_SHIFT; u64 length = bio->bi_iter.bi_size; @@ -682,7 +681,7 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) bbio->saved_iter = bio->bi_iter; ret = btrfs_lookup_bio_sums(bbio); if (ret) - goto fail_put_bio; + goto fail; } if (btrfs_op(bio) == BTRFS_MAP_WRITE) { @@ -704,13 +703,13 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) ret = btrfs_bio_csum(bbio); if (ret) - goto fail_put_bio; + goto fail; } else if (use_append || (btrfs_is_zoned(fs_info) && inode && inode->flags & BTRFS_INODE_NODATASUM)) { ret = btrfs_alloc_dummy_sum(bbio); if (ret) - goto fail_put_bio; + goto fail; } } @@ -718,12 +717,23 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) done: return map_length == length; -fail_put_bio: - if (map_length < length) - btrfs_cleanup_bio(bbio); fail: btrfs_bio_counter_dec(fs_info); - btrfs_bio_end_io(orig_bbio, ret); + /* + * We have split the original bbio, now we have to end both the current + * @bbio and remaining one, as the remaining one will never be submitted. + */ + if (map_length < length) { + struct btrfs_bio *remaining = bbio->private; + + ASSERT(bbio->bio.bi_pool == &btrfs_clone_bioset); + ASSERT(remaining); + + remaining->bio.bi_status = ret; + btrfs_orig_bbio_end_io(remaining); + } + bbio->bio.bi_status = ret; + btrfs_orig_bbio_end_io(bbio); /* Do not submit another chunk */ return true; } -- 2.39.2

2 1

openEuler Kernel SIG双周例会
by openEuler conference 18 Sep '24

18 Sep '24

您好！ Kernel 邀请您参加 2024-09-20 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复此邮件申请，或直接填写至会议纪要看板。）会议链接：https://meeting.huaweicloud.com:36443/#/j/988452631 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-09-20 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复此邮件申请，或直接填写至会议纪要看板。） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/988452631. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10] fix: fix ethtool version and HINIC3_NIC_DRV_VERSION
by s00851154 18 Sep '24

18 Sep '24

--- hinic3_ethtool.c | 1 - hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/hinic3_ethtool.c b/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/hinic3_ethtool.c +++ b/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/hinic3_nic_dev.h b/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/hinic3_nic_dev.h +++ b/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix general protection fault in nilfs_btree_insert()
by Yang Yingliang 18 Sep '24

18 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.165 commit 712bd74eccb9d3626a0a236641962eca8e11a243 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALLDY CVE: CVE-2023-52900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7633355e5c7f29c049a9048e461427d1d8ed3051 upstream. If nilfs2 reads a corrupted disk image and tries to reads a b-tree node block by calling __nilfs_btree_get_block() against an invalid virtual block address, it returns -ENOENT because conversion of the virtual block address to a disk block address fails. However, this return value is the same as the internal code that b-tree lookup routines return to indicate that the block being searched does not exist, so functions that operate on that b-tree may misbehave. When nilfs_btree_insert() receives this spurious 'not found' code from nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was successful and continues the insert operation using incomplete lookup path data, causing the following crash: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] ... RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline] RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline] RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238 Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02 ... Call Trace: <TASK> nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline] nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147 nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101 __block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991 __block_write_begin fs/buffer.c:2041 [inline] block_write_begin+0x93/0x1e0 fs/buffer.c:2102 nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261 generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 __generic_file_write_iter+0x176/0x400 mm/filemap.c:3900 generic_file_write_iter+0xab/0x310 mm/filemap.c:3932 call_write_iter include/linux/fs.h:2186 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK> This patch fixes the root cause of this problem by replacing the error code that __nilfs_btree_get_block() returns on block address conversion failure from -ENOENT to another internal code -EINVAL which means that the b-tree metadata is corrupted. By returning -EINVAL, it propagates without glitches, and for all relevant b-tree operations, functions in the upper bmap layer output an error message indicating corrupted b-tree metadata via nilfs_bmap_convert_error(), and code -EIO will be eventually returned as it should be. Link: https://lkml.kernel.org/r/000000000000bd89e205f0e38355@google.com Link: https://lkml.kernel.org/r/20230105055356.8811-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+ede796cecd5296353515(a)syzkaller.appspotmail.com Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/nilfs2/btree.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c index 270c5422df86..90842645328b 100644 --- a/fs/nilfs2/btree.c +++ b/fs/nilfs2/btree.c @@ -480,9 +480,18 @@ static int __nilfs_btree_get_block(const struct nilfs_bmap *btree, __u64 ptr, ret = nilfs_btnode_submit_block(btnc, ptr, 0, REQ_OP_READ, 0, &bh, &submit_ptr); if (ret) { - if (ret != -EEXIST) - return ret; - goto out_check; + if (likely(ret == -EEXIST)) + goto out_check; + if (ret == -ENOENT) { + /* + * Block address translation failed due to invalid + * value of 'ptr'. In this case, return internal code + * -EINVAL (broken bmap) to notify bmap layer of fatal + * metadata corruption. + */ + ret = -EINVAL; + } + return ret; } if (ra) { -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] NFSD: Fix ia_size underflow
by Xia Fukun 18 Sep '24

18 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v5.10.221 commit 38d02ba22e43b6fc7d291cf724bc6e3b7be6626b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGCI CVE: CVE-2022-48828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit e6faac3f58c7c4176b66f63def17a34232a17b0e ] iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle. Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr(). Cc: stable(a)vger.kernel.org [ cel: context adjusted, 2f221d6f7b88 has not been applied ] Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/nfsd/vfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 31edb883afd0d..7820945e2d075 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -448,6 +448,10 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, .ia_size = iap->ia_size, }; + host_err = -EFBIG; + if (iap->ia_size < 0) + goto out_unlock; + host_err = notify_change(dentry, &size_attr, NULL); if (host_err) goto out_unlock; -- 2.34.1

2 1

[PATCH OLK-5.10] NFSD: Fix ia_size underflow
by Xia Fukun 18 Sep '24

18 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v5.10.221 commit 38d02ba22e43b6fc7d291cf724bc6e3b7be6626b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGCI CVE: CVE-2022-48828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit e6faac3f58c7c4176b66f63def17a34232a17b0e ] iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle. Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr(). Cc: stable(a)vger.kernel.org [ cel: context adjusted, 2f221d6f7b88 has not been applied ] Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/nfsd/vfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 31edb883afd0d..7820945e2d075 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -448,6 +448,10 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, .ia_size = iap->ia_size, }; + host_err = -EFBIG; + if (iap->ia_size < 0) + goto out_unlock; + host_err = notify_change(dentry, &size_attr, NULL); if (host_err) goto out_unlock; -- 2.34.1

2 1

[PATCH OLK-6.6 0/8] support poison recover from migrate folio
by Tong Tiangen 18 Sep '24

18 Sep '24

The folio migration is widely used in kernel, memory compaction, memory hotplug, soft offline page, numa balance, memory demote/promotion, etc, but once access a poisoned source folio when migrating, the kernel will panic. There is a mechanism in the kernel to recover from uncorrectable memory errors, ARCH_HAS_COPY_MC(eg, Machine Check Safe Memory Copy on x86), which is already used in NVDIMM or core-mm paths(eg, CoW, khugepaged, coredump, ksm copy), see copy_mc_to_{user,kernel}, copy_mc_{user_}highpage callers. This series of patches provide the recovery mechanism from folio copy for the widely used folio migration. Please note, because folio migration is no guarantee of success, so we could chose to make folio migration tolerant of memory failures, adding folio_mc_copy() which is a #MC versions of folio_copy(), once accessing a poisoned source folio, we could return error and make the folio migration fail, and this could avoid the similar panic shown below. CPU: 1 PID: 88343 Comm: test_softofflin Kdump: loaded Not tainted 6.6.0 pc : copy_page+0x10/0xc0 lr : copy_highpage+0x38/0x50 ... Call trace: copy_page+0x10/0xc0 folio_copy+0x78/0x90 migrate_folio_extra+0x54/0xa0 move_to_new_folio+0xd8/0x1f0 migrate_folio_move+0xb8/0x300 migrate_pages_batch+0x528/0x788 migrate_pages_sync+0x8c/0x258 migrate_pages+0x440/0x528 soft_offline_in_use_page+0x2ec/0x3c0 soft_offline_page+0x238/0x310 soft_offline_page_store+0x6c/0xc0 dev_attr_store+0x20/0x40 sysfs_kf_write+0x4c/0x68 kernfs_fop_write_iter+0x130/0x1c8 new_sync_write+0xa4/0x138 vfs_write+0x238/0x2d8 ksys_write+0x74/0x110 Kefeng Wang (8): mm: migrate: simplify __buffer_migrate_folio() mm: migrate_device: unify migrate folio for MIGRATE_SYNC_NO_COPY mm: migrate: remove migrate_folio_extra() mm: move memory_failure_queue() into copy_mc_[user]_highpage() mm: add folio_mc_copy() mm: migrate: split folio_migrate_mapping() mm: migrate: support poisoned recover from migrate folio fs: hugetlbfs: support poisoned recover from hugetlbfs_migrate_folio() fs/hugetlbfs/inode.c | 5 +- include/linux/highmem.h | 6 +++ include/linux/migrate.h | 2 - include/linux/mm.h | 1 + mm/ksm.c | 1 - mm/memory.c | 13 ++--- mm/migrate.c | 102 ++++++++++++++++++++-------------------- mm/migrate_device.c | 16 ++++--- mm/util.c | 17 +++++++ 9 files changed, 88 insertions(+), 75 deletions(-) -- 2.25.1

2 9

[openeuler:openEuler-1.0-LTS 20295/23714] drivers/net/bonding/bond_sysctl.c:9:25: sparse: sparse: symbol 'bond_broadcast_arp_or_nd_table_header' was not declared. Should it be static?
by kernel test robot 17 Sep '24

17 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 0397c33121652647d544d4bcdceb9f2d868146af [20295/23714] anolis: bond: broadcast ARP or ND messages to all slaves config: x86_64-randconfig-123-20240915 (https://download.01.org/0day-ci/archive/20240917/202409170243.8clAJD1d-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240917/202409170243.8clAJD1d-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409170243.8clAJD1d-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/bonding/bond_sysctl.c:9:25: sparse: sparse: symbol 'bond_broadcast_arp_or_nd_table_header' was not declared. Should it be static? vim +/bond_broadcast_arp_or_nd_table_header +9 drivers/net/bonding/bond_sysctl.c 8 > 9 struct ctl_table_header *bond_broadcast_arp_or_nd_table_header; 10 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19376/23714] net/ax25/ax25_dev.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 17 Sep '24

17 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 5ba8a3eb026f02aa75f4a22099250bfd4db659cb [19376/23714] ax25: add refcount in ax25_dev to avoid UAF bugs config: x86_64-buildonly-randconfig-005-20240915 (https://download.01.org/0day-ci/archive/20240917/202409170005.Q9skpI8V-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240917/202409170005.Q9skpI8V-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409170005.Q9skpI8V-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/ax25/ax25_dev.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 9570/23714] drivers/scsi/scsi_logging.o: warning: objtool: missing symbol for section .text
by kernel test robot 16 Sep '24

16 Sep '24

Hi Bart, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 63b053c4efdb2e27f350bc9c1db4fed08a30801d [9570/23714] scsi: core: Reduce memory required for SCSI logging config: x86_64-buildonly-randconfig-002-20240915 (https://download.01.org/0day-ci/archive/20240916/202409162223.ddty3va3-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409162223.ddty3va3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409162223.ddty3va3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/scsi/scsi_logging.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17157/23714] drivers/md/bcache/request.c:1333:27: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: cb004e127a5500466043986dbc4cc43ec63d849e [17157/23714] Add traffic policy for low cache available. config: x86_64-randconfig-123-20240915 (https://download.01.org/0day-ci/archive/20240916/202409162232.mD47BzHq-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409162232.mD47BzHq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409162232.mD47BzHq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/md/bcache/request.c: note: in included file (through drivers/md/bcache/bcache.h): include/uapi/linux/bcache.h:294:38: sparse: sparse: array of flexible structures drivers/md/bcache/request.c: note: in included file (through drivers/md/bcache/bcache.h): drivers/md/bcache/bset.h:231:36: sparse: sparse: array of flexible structures >> drivers/md/bcache/request.c:1333:27: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got struct get_bcache_status * @@ drivers/md/bcache/request.c:1333:27: sparse: expected void [noderef] <asn:1> *to drivers/md/bcache/request.c:1333:27: sparse: got struct get_bcache_status * >> drivers/md/bcache/request.c:1346:33: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got struct set_bcache_status * @@ drivers/md/bcache/request.c:1346:33: sparse: expected void const [noderef] <asn:1> *from drivers/md/bcache/request.c:1346:33: sparse: got struct set_bcache_status * vim +1333 drivers/md/bcache/request.c 1315 1316 static int bcache_get_write_status(struct cached_dev *dc, unsigned long arg) 1317 { 1318 struct get_bcache_status a; 1319 uint64_t cache_sectors; 1320 struct cache_set *c = dc->disk.c; 1321 1322 if (c == NULL) 1323 return -ENODEV; 1324 1325 a.writeback_sector_size_per_sec = dc->writeback_sector_size_per_sec; 1326 a.writeback_io_num_per_sec = dc->writeback_io_num_per_sec; 1327 a.front_io_num_per_sec = dc->front_io_num_per_sec; 1328 cache_sectors = c->nbuckets * c->sb.bucket_size - 1329 atomic_long_read(&c->flash_dev_dirty_sectors); 1330 a.dirty_rate = div64_u64(bcache_dev_sectors_dirty(&dc->disk) * 100, 1331 cache_sectors); 1332 a.available = 100 - c->gc_stats.in_use; > 1333 if (copy_to_user((struct get_bcache_status *)arg, &a, 1334 sizeof(struct get_bcache_status))) 1335 return -EFAULT; 1336 return 0; 1337 } 1338 1339 static int bcache_set_write_status(struct cached_dev *dc, unsigned long arg) 1340 { 1341 struct set_bcache_status a; 1342 struct cache_set *c = dc->disk.c; 1343 1344 if (c == NULL) 1345 return -ENODEV; > 1346 if (copy_from_user(&a, (struct set_bcache_status *)arg, 1347 sizeof(struct set_bcache_status))) 1348 return -EFAULT; 1349 1350 if (c->traffic_policy_start != a.traffic_policy_start) 1351 pr_info("%s traffic policy %s", dc->disk.disk->disk_name, 1352 (a.traffic_policy_start == true) ? "enable" : "disable"); 1353 if (c->force_write_through != a.force_write_through) 1354 pr_info("%s force write through %s", dc->disk.disk->disk_name, 1355 (a.force_write_through == true) ? "enable" : "disable"); 1356 if (a.trigger_gc) { 1357 pr_info("trigger %s gc", dc->disk.disk->disk_name); 1358 atomic_set(&c->sectors_to_gc, -1); 1359 wake_up_gc(c); 1360 } 1361 if ((a.cutoff_writeback_sync >= MIN_CUTOFF_WRITEBACK_SYNC) && 1362 (a.cutoff_writeback_sync <= MAX_CUTOFF_WRITEBACK_SYNC)) { 1363 c->cutoff_writeback_sync = a.cutoff_writeback_sync; 1364 } 1365 1366 dc->max_sector_size = a.write_token_sector_size; 1367 dc->max_io_num = a.write_token_io_num; 1368 c->traffic_policy_start = a.traffic_policy_start; 1369 c->force_write_through = a.force_write_through; 1370 c->gc_sectors = a.gc_sectors; 1371 dc->writeback_state = a.writeback_state; 1372 return 0; 1373 } 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15748/23714] include/linux/uaccess.h:112:17: warning: 'kmask' may be used uninitialized
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: b77633c8236f2383f8d994249b40ed1bd3d012c0 [15748/23714] signal: simplify set_user_sigmask/restore_user_sigmask config: arm64-randconfig-001-20240913 (https://download.01.org/0day-ci/archive/20240916/202409162133.aY7fqmYk-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409162133.aY7fqmYk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409162133.aY7fqmYk-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): | ^~~~~~~~~~~ In file included from include/asm-generic/termios.h:6, from ./arch/arm64/include/generated/uapi/asm/termios.h:1, from include/uapi/linux/termios.h:6, from include/linux/tty.h:7, from kernel/signal.c:23: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_sigaltstack' at kernel/signal.c:3635:13, inlined from '__se_sys_sigaltstack' at kernel/signal.c:3631:1: include/linux/uaccess.h:112:17: warning: 'new' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/asm-generic/bug.h:5, from arch/arm64/include/asm/bug.h:37, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/gfp.h:5, from include/linux/slab.h:15, from kernel/signal.c:13: include/linux/kasan-checks.h: In function '__se_sys_sigaltstack': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3633:17: note: 'new' declared here 3633 | stack_t new, old; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'do_compat_sigaltstack' at kernel/signal.c:3678:7: include/linux/uaccess.h:112:17: warning: 'uss32' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'do_compat_sigaltstack': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3677:32: note: 'uss32' declared here 3677 | compat_stack_t uss32; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_tgsigqueueinfo' at kernel/signal.c:3496:6, inlined from '__se_sys_rt_tgsigqueueinfo' at kernel/signal.c:3491:1: include/linux/uaccess.h:112:17: warning: 'info' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_tgsigqueueinfo': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3494:19: note: 'info' declared here 3494 | siginfo_t info; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigqueueinfo' at kernel/signal.c:3454:6, inlined from '__se_sys_rt_sigqueueinfo' at kernel/signal.c:3450:1: include/linux/uaccess.h:112:17: warning: 'info' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigqueueinfo': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3453:19: note: 'info' declared here 3453 | siginfo_t info; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_sigprocmask' at kernel/signal.c:3783:7, inlined from '__se_sys_sigprocmask' at kernel/signal.c:3774:1: include/linux/uaccess.h:112:17: warning: 'new_set' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_sigprocmask': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3777:31: note: 'new_set' declared here 3777 | old_sigset_t old_set, new_set; | ^~~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigprocmask' at kernel/signal.c:2887:7, inlined from '__se_sys_rt_sigprocmask' at kernel/signal.c:2874:1: include/linux/uaccess.h:112:17: warning: 'new_set' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigprocmask': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:2877:27: note: 'new_set' declared here 2877 | sigset_t old_set, new_set; | ^~~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'set_user_sigmask' at kernel/signal.c:2836:6: >> include/linux/uaccess.h:112:17: warning: 'kmask' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'set_user_sigmask': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:2830:18: note: 'kmask' declared here 2830 | sigset_t kmask; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigtimedwait' at kernel/signal.c:3281:6, inlined from '__se_sys_rt_sigtimedwait' at kernel/signal.c:3268:1: include/linux/uaccess.h:112:17: warning: 'these' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigtimedwait': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3272:18: note: 'these' declared here 3272 | sigset_t these; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'copy_siginfo_from_user32' at kernel/signal.c:3125:6: include/linux/uaccess.h:112:17: warning: 'from' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'copy_siginfo_from_user32': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3123:31: note: 'from' declared here 3123 | struct compat_siginfo from; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigaction' at kernel/signal.c:3834:13, inlined from '__se_sys_rt_sigaction' at kernel/signal.c:3822:1: include/linux/uaccess.h:112:17: warning: 'new_sa' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigaction': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3827:28: note: 'new_sa' declared here 3827 | struct k_sigaction new_sa, old_sa; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'restore_altstack' at kernel/signal.c:3648:6: include/linux/uaccess.h:112:17: warning: 'new' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'restore_altstack': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3647:17: note: 'new' declared here 3647 | stack_t new; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigsuspend' at kernel/signal.c:4053:6, inlined from '__se_sys_rt_sigsuspend' at kernel/signal.c:4045:1, inlined from '__arm64_sys_rt_sigsuspend' at kernel/signal.c:4045:1: include/linux/uaccess.h:112:17: warning: 'newset' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__arm64_sys_rt_sigsuspend': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:4047:18: note: 'newset' declared here 4047 | sigset_t newset; | ^~~~~~ vim +/kmask +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 16693/23714] arch/x86/kernel/unwind_orc.o: warning: objtool: missing symbol for section .text
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: badd79c400ed404df871e1d035bed971d20ead4c [16693/23714] x86/unwind/orc: Remove boot-time ORC unwind tables sorting config: x86_64-buildonly-randconfig-005-20240915 (https://download.01.org/0day-ci/archive/20240916/202409162123.h3UocbtQ-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409162123.h3UocbtQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409162123.h3UocbtQ-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/unwind_orc.c:179:13: warning: unused function 'orc_sort_swap' [-Wunused-function] 179 | static void orc_sort_swap(void *_a, void *_b, int size) | ^~~~~~~~~~~~~ arch/x86/kernel/unwind_orc.c:199:12: warning: unused function 'orc_sort_cmp' [-Wunused-function] 199 | static int orc_sort_cmp(const void *_a, const void *_b) | ^~~~~~~~~~~~ 2 warnings generated. >> arch/x86/kernel/unwind_orc.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15692/23714] include/linux/uaccess.h:112:17: warning: 'ciov' may be used uninitialized
by kernel test robot 16 Sep '24

16 Sep '24

Hi Jens, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 6c08191286995b0594d2ecf12fe7fca3cea1a5ca [15692/23714] io_uring: add support for pre-mapped user IO buffers config: arm64-randconfig-001-20240913 (https://download.01.org/0day-ci/archive/20240916/202409161843.Wdlfbwor-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409161843.Wdlfbwor-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409161843.Wdlfbwor-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/linux/poll.h:12, from include/linux/ring_buffer.h:7, from include/linux/trace_events.h:6, from include/trace/syscall.h:7, from include/linux/syscalls.h:86, from fs/io_uring.c:32: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'io_copy_iov.isra' at fs/io_uring.c:1457:7: >> include/linux/uaccess.h:112:17: warning: 'ciov' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/linux/export.h:45, from include/linux/linkage.h:7, from include/linux/kernel.h:7, from fs/io_uring.c:29: include/linux/kasan-checks.h: In function 'io_copy_iov.isra': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/io_uring.c:1454:37: note: 'ciov' declared here 1454 | struct compat_iovec ciov; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'io_uring_setup' at fs/io_uring.c:1960:6: include/linux/uaccess.h:112:17: warning: 'p' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'io_uring_setup': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/io_uring.c:1956:32: note: 'p' declared here 1956 | struct io_uring_params p; | ^ In file included from include/linux/uaccess.h:11: In function 'set_fs', inlined from 'io_sq_wq_submit_work' at fs/io_uring.c:1114:3: arch/arm64/include/asm/uaccess.h:59:12: warning: 'old_fs' may be used uninitialized [-Wmaybe-uninitialized] 59 | if (IS_ENABLED(CONFIG_ARM64_UAO) && fs == KERNEL_DS) | ^ fs/io_uring.c: In function 'io_sq_wq_submit_work': fs/io_uring.c:1074:22: note: 'old_fs' was declared here 1074 | mm_segment_t old_fs; | ^~~~~~ vim +/ciov +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 8359/23714] fs/gfs2/bmap.c:960:31: warning: 'lblock' may be used uninitialized
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 484798bc8218ce6a0f8269675897b870a12c49e2 [8359/23714] gfs2: gfs2_walk_metadata fix config: x86_64-buildonly-randconfig-006-20240915 (https://download.01.org/0day-ci/archive/20240916/202409161757.QAy2sdT1-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409161757.QAy2sdT1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409161757.QAy2sdT1-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): fs/gfs2/bmap.c: In function 'gfs2_iomap_alloc': fs/gfs2/bmap.c:748:28: warning: this statement may fall through [-Wimplicit-fallthrough=] 748 | if (n == 0) | ^ fs/gfs2/bmap.c:751:17: note: here 751 | case ALLOC_GROW_DEPTH: | ^~~~ fs/gfs2/bmap.c:759:28: warning: this statement may fall through [-Wimplicit-fallthrough=] 759 | if (n == 0) | ^ fs/gfs2/bmap.c:762:17: note: here 762 | case ALLOC_DATA: | ^~~~ fs/gfs2/bmap.c: In function 'gfs2_iomap_get': >> fs/gfs2/bmap.c:960:31: warning: 'lblock' may be used uninitialized [-Wmaybe-uninitialized] 960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:851:18: note: 'lblock' was declared here 851 | sector_t lblock; | ^~~~~~ fs/gfs2/bmap.c:960:31: warning: 'len' may be used uninitialized [-Wmaybe-uninitialized] 960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:855:13: note: 'len' was declared here 855 | u64 len; | ^~~ fs/gfs2/bmap.c:959:32: warning: 'height' may be used uninitialized [-Wmaybe-uninitialized] 959 | if (pos < size && height == ip->i_height) | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:857:12: note: 'height' was declared here 857 | u8 height; | ^~~~~~ fs/gfs2/bmap.c:1290: warning: Function parameter or member 'inode' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1290: warning: Function parameter or member 'from' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1290: warning: Function parameter or member 'length' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1493: warning: Function parameter or member 'rd_gh' not described in 'sweep_bh_for_rgrps' fs/gfs2/bmap.c:1493: warning: Excess function parameter 'rg_gh' description in 'sweep_bh_for_rgrps' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'sdp' not described in 'find_nonnull_ptr' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_list' not described in 'find_nonnull_ptr' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_aligned' not described in 'find_nonnull_ptr' vim +/lblock +960 fs/gfs2/bmap.c 7ee66c03e40a57 Christoph Hellwig 2018-06-01 831 3974320ca6aa68 Bob Peterson 2017-02-16 832 /** 628e366df11c0a Andreas Gruenbacher 2018-06-04 833 * gfs2_iomap_get - Map blocks from an inode to disk blocks 3974320ca6aa68 Bob Peterson 2017-02-16 834 * @inode: The inode 3974320ca6aa68 Bob Peterson 2017-02-16 835 * @pos: Starting position in bytes 3974320ca6aa68 Bob Peterson 2017-02-16 836 * @length: Length to map, in bytes 3974320ca6aa68 Bob Peterson 2017-02-16 837 * @flags: iomap flags 3974320ca6aa68 Bob Peterson 2017-02-16 838 * @iomap: The iomap structure 628e366df11c0a Andreas Gruenbacher 2018-06-04 839 * @mp: The metapath 3974320ca6aa68 Bob Peterson 2017-02-16 840 * 3974320ca6aa68 Bob Peterson 2017-02-16 841 * Returns: errno 3974320ca6aa68 Bob Peterson 2017-02-16 842 */ 628e366df11c0a Andreas Gruenbacher 2018-06-04 843 static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, 628e366df11c0a Andreas Gruenbacher 2018-06-04 844 unsigned flags, struct iomap *iomap, 628e366df11c0a Andreas Gruenbacher 2018-06-04 845 struct metapath *mp) b3b94faa5fe596 David Teigland 2006-01-16 846 { feaa7bba026c18 Steven Whitehouse 2006-06-14 847 struct gfs2_inode *ip = GFS2_I(inode); feaa7bba026c18 Steven Whitehouse 2006-06-14 848 struct gfs2_sbd *sdp = GFS2_SB(inode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 849 loff_t size = i_size_read(inode); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 850 __be64 *ptr; 3974320ca6aa68 Bob Peterson 2017-02-16 851 sector_t lblock; 628e366df11c0a Andreas Gruenbacher 2018-06-04 852 sector_t lblock_stop; 628e366df11c0a Andreas Gruenbacher 2018-06-04 853 int ret; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 854 int eob; 628e366df11c0a Andreas Gruenbacher 2018-06-04 855 u64 len; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 856 struct buffer_head *dibh = NULL, *bh; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 857 u8 height; 7276b3b0c77101 Steven Whitehouse 2006-09-21 858 628e366df11c0a Andreas Gruenbacher 2018-06-04 859 if (!length) 628e366df11c0a Andreas Gruenbacher 2018-06-04 860 return -EINVAL; b3b94faa5fe596 David Teigland 2006-01-16 861 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 862 down_read(&ip->i_rw_mutex); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 863 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 864 ret = gfs2_meta_inode_buffer(ip, &dibh); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 865 if (ret) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 866 goto unlock; 38084377af4fc8 Andreas Gruenbacher 2018-11-11 867 mp->mp_bh[0] = dibh; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 868 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 869 if (gfs2_is_stuffed(ip)) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 870 if (flags & IOMAP_WRITE) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 871 loff_t max_size = gfs2_max_stuffed_size(ip); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 872 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 873 if (pos + length > max_size) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 874 goto unstuff; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 875 iomap->length = max_size; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 876 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 877 if (pos >= size) { 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 878 if (flags & IOMAP_REPORT) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 879 ret = -ENOENT; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 880 goto unlock; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 881 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 882 /* report a hole */ d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 883 iomap->offset = pos; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 884 iomap->length = length; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 885 goto do_alloc; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 886 } 3974320ca6aa68 Bob Peterson 2017-02-16 887 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 888 iomap->length = size; 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 889 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 890 iomap->addr = (ip->i_no_addr << inode->i_blkbits) + d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 891 sizeof(struct gfs2_dinode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 892 iomap->type = IOMAP_INLINE; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 893 iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 894 goto out; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 895 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 896 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 897 unstuff: 3974320ca6aa68 Bob Peterson 2017-02-16 898 lblock = pos >> inode->i_blkbits; 3974320ca6aa68 Bob Peterson 2017-02-16 899 iomap->offset = lblock << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 900 lblock_stop = (pos + length - 1) >> inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 901 len = lblock_stop - lblock + 1; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 902 iomap->length = len << inode->i_blkbits; 20cdc1931ee8e0 Andreas Gruenbacher 2017-09-22 903 9b8c81d1de4994 Steven Whitehouse 2008-02-22 904 height = ip->i_height; 9a38662ba4e268 Andreas Gruenbacher 2018-04-16 905 while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height]) ecc30c79157103 Steven Whitehouse 2008-01-28 906 height++; 628e366df11c0a Andreas Gruenbacher 2018-06-04 907 find_metapath(sdp, lblock, mp, height); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 908 if (height > ip->i_height || gfs2_is_stuffed(ip)) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 909 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 910 628e366df11c0a Andreas Gruenbacher 2018-06-04 911 ret = lookup_metapath(ip, mp); e8b43fe0c1e035 Andreas Gruenbacher 2017-12-08 912 if (ret) 628e366df11c0a Andreas Gruenbacher 2018-06-04 913 goto unlock; 3974320ca6aa68 Bob Peterson 2017-02-16 914 628e366df11c0a Andreas Gruenbacher 2018-06-04 915 if (mp->mp_aheight != ip->i_height) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 916 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 917 628e366df11c0a Andreas Gruenbacher 2018-06-04 918 ptr = metapointer(ip->i_height - 1, mp); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 919 if (*ptr == 0) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 920 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 921 628e366df11c0a Andreas Gruenbacher 2018-06-04 922 bh = mp->mp_bh[ip->i_height - 1]; bcfe94139a45fa Andreas Gruenbacher 2018-05-11 923 len = gfs2_extent_length(bh, ptr, len, &eob); 3974320ca6aa68 Bob Peterson 2017-02-16 924 628e366df11c0a Andreas Gruenbacher 2018-06-04 925 iomap->addr = be64_to_cpu(*ptr) << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 926 iomap->length = len << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 927 iomap->type = IOMAP_MAPPED; 0ed91eca1130e6 Andreas Gruenbacher 2018-07-25 928 iomap->flags |= IOMAP_F_MERGED; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 929 if (eob) 7ee66c03e40a57 Christoph Hellwig 2018-06-01 930 iomap->flags |= IOMAP_F_GFS2_BOUNDARY; 3974320ca6aa68 Bob Peterson 2017-02-16 931 3974320ca6aa68 Bob Peterson 2017-02-16 932 out: 628e366df11c0a Andreas Gruenbacher 2018-06-04 933 iomap->bdev = inode->i_sb->s_bdev; 628e366df11c0a Andreas Gruenbacher 2018-06-04 934 unlock: 628e366df11c0a Andreas Gruenbacher 2018-06-04 935 up_read(&ip->i_rw_mutex); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 936 return ret; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 937 9b8c81d1de4994 Steven Whitehouse 2008-02-22 938 do_alloc: 628e366df11c0a Andreas Gruenbacher 2018-06-04 939 iomap->addr = IOMAP_NULL_ADDR; 628e366df11c0a Andreas Gruenbacher 2018-06-04 940 iomap->type = IOMAP_HOLE; 628e366df11c0a Andreas Gruenbacher 2018-06-04 941 if (flags & IOMAP_REPORT) { 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 942 if (pos >= size) 3974320ca6aa68 Bob Peterson 2017-02-16 943 ret = -ENOENT; 628e366df11c0a Andreas Gruenbacher 2018-06-04 944 else if (height == ip->i_height) 628e366df11c0a Andreas Gruenbacher 2018-06-04 945 ret = gfs2_hole_size(inode, lblock, len, mp, iomap); 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 946 else 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 947 iomap->length = size - pos; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 948 } else if (flags & IOMAP_WRITE) { 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 949 u64 alloc_size; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 950 967bcc91b04493 Andreas Gruenbacher 2018-06-19 951 if (flags & IOMAP_DIRECT) 967bcc91b04493 Andreas Gruenbacher 2018-06-19 952 goto out; /* (see gfs2_file_direct_write) */ 967bcc91b04493 Andreas Gruenbacher 2018-06-19 953 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 954 len = gfs2_alloc_size(inode, mp, len); 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 955 alloc_size = len << inode->i_blkbits; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 956 if (alloc_size < iomap->length) 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 957 iomap->length = alloc_size; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 958 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 959 if (pos < size && height == ip->i_height) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 @960 ret = gfs2_hole_size(inode, lblock, len, mp, iomap); 3974320ca6aa68 Bob Peterson 2017-02-16 961 } 628e366df11c0a Andreas Gruenbacher 2018-06-04 962 goto out; 628e366df11c0a Andreas Gruenbacher 2018-06-04 963 } 628e366df11c0a Andreas Gruenbacher 2018-06-04 964 :::::: The code at line 960 was first introduced by commit :::::: d505a96a3b16f46455035dc0296bc2da6014e163 gfs2: Further iomap cleanups :::::: TO: Andreas Gruenbacher <agruenba(a)redhat.com> :::::: CC: Andreas Gruenbacher <agruenba(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0