- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

CVE-2024-43892 Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

CVE-2024-43892 Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

CVE-2024-43892 Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/6] Backport smart grid
by Yipeng Zou 28 Aug '24

28 Aug '24

Backport smart grid form OLK-5.10 to openEuler-1.0-LTS Yipeng Zou (6): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control smart_grid: introducing rebuild_affinity_domain sched: smart_grid: silence complier error drivers/cpufreq/cpufreq.c | 236 +++++++++++++++++++++++++++++++++ fs/proc/base.c | 78 +++++++++++ include/linux/cpufreq.h | 12 ++ include/linux/sched/grid_qos.h | 33 ++++- include/linux/sched/sysctl.h | 1 + kernel/sched/core.c | 26 ++++ kernel/sched/fair.c | 57 +++++++- kernel/sched/grid/qos.c | 123 +++++++++++++++++ kernel/sched/grid/stat.c | 15 +++ kernel/sched/sched.h | 2 + kernel/sysctl.c | 9 ++ 11 files changed, 586 insertions(+), 6 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 0/1] CVE-2024-43907
by Yongqiang Liu 28 Aug '24

28 Aug '24

Ma Jun (1): drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 7 +++++-- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 14 ++++++++------ .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 7 +++++-- 3 files changed, 18 insertions(+), 10 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-43907
by Yongqiang Liu 28 Aug '24

28 Aug '24

Ma Jun (1): drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 7 +++++-- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 14 ++++++++------ .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 7 +++++-- 3 files changed, 18 insertions(+), 10 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS 0/1] ARM: 9324/1: fix get_user() broken with veneer
by Yuntao Liu 28 Aug '24

28 Aug '24

ARM: 9324/1: fix get_user() broken with veneer Masahiro Yamada (1): ARM: 9324/1: fix get_user() broken with veneer arch/arm/include/asm/uaccess.h | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] efi: fix NULL-deref in init error path
by Gu Bowen 28 Aug '24

28 Aug '24

From: Johan Hovold <johan+linaro(a)kernel.org> stable inclusion from stable-v4.19.320 commit 585a0b2b3ae7903c6abee3087d09c69e955a7794 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIAT CVE: CVE-2022-48879 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 703c13fe3c9af557d312f5895ed6a5fda2711104 ] In cases where runtime services are not supported or have been disabled, the runtime services workqueue will never have been allocated. Do not try to destroy the workqueue unconditionally in the unlikely event that EFI initialisation fails to avoid dereferencing a NULL pointer. Fixes: 98086df8b70c ("efi: add missed destroy_workqueue when efisubsys_init fails") Cc: stable(a)vger.kernel.org Cc: Li Heng <liheng40(a)huawei.com> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/firmware/efi/efi.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 184ad34b9c58..e71037917dd5 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -361,8 +361,8 @@ static int __init efisubsys_init(void) efi_kobj = kobject_create_and_add("efi", firmware_kobj); if (!efi_kobj) { pr_err("efi: Firmware registration failed.\n"); - destroy_workqueue(efi_rts_wq); - return -ENOMEM; + error = -ENOMEM; + goto err_destroy_wq; } error = generic_ops_register(); @@ -398,7 +398,10 @@ static int __init efisubsys_init(void) generic_ops_unregister(); err_put: kobject_put(efi_kobj); - destroy_workqueue(efi_rts_wq); +err_destroy_wq: + if (efi_rts_wq) + destroy_workqueue(efi_rts_wq); + return error; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

*** BLURB HERE *** Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: MGMT: Add error handling to pair_device()
by Zhengchao Shao 28 Aug '24

28 Aug '24

From: Griffin Kroah-Hartman <griffin(a)kroah.com> mainline inclusion from mainline-v6.11-rc5 commit 538fd3921afac97158d4177139a0ad39f056dbb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMK01 CVE: CVE-2024-43884 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function. Cc: Stable <stable(a)kernel.org> Fixes: 5157b8a503fa ("Bluetooth: Fix initializing conn_params in scan phase") Signed-off-by: Griffin Kroah-Hartman <griffin(a)kroah.com> Reported-by: Yiwei Zhang <zhan4630(a)purdue.edu> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/mgmt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 878bf7382244..2b1687485be0 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -2961,6 +2961,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, * will be kept and this function does nothing. */ p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); + if (!p) { + err = -EIO; + goto unlock; + } if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) p->auto_connect = HCI_AUTO_CONN_DISABLED; -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: MGMT: Add error handling to pair_device()
by Zhengchao Shao 28 Aug '24

28 Aug '24

From: Griffin Kroah-Hartman <griffin(a)kroah.com> mainline inclusion from mainline-v6.11-rc5 commit 538fd3921afac97158d4177139a0ad39f056dbb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMK01 CVE: CVE-2024-43884 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function. Cc: Stable <stable(a)kernel.org> Fixes: 5157b8a503fa ("Bluetooth: Fix initializing conn_params in scan phase") Signed-off-by: Griffin Kroah-Hartman <griffin(a)kroah.com> Reported-by: Yiwei Zhang <zhan4630(a)purdue.edu> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/mgmt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index bd8cfcfca7ae..0078e33e12ba 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -2962,6 +2962,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, * will be kept and this function does nothing. */ p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); + if (!p) { + err = -EIO; + goto unlock; + } if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) p->auto_connect = HCI_AUTO_CONN_DISABLED; -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Have format file honor EVENT_FILE_FL_FREED
by Zheng Yejian 28 Aug '24

28 Aug '24

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.11-rc3 commit b1560408692cd0ab0370cfbe9deb03ce97ab3f6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMNBO CVE: CVE-2024-43891 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit b1560408692cd0ab0370cfbe9deb03ce97ab3f6d upstream. When eventfs was introduced, special care had to be done to coordinate the freeing of the file meta data with the files that are exposed to user space. The file meta data would have a ref count that is set when the file is created and would be decremented and freed after the last user that opened the file closed it. When the file meta data was to be freed, it would set a flag (EVENT_FILE_FL_FREED) to denote that the file is freed, and any new references made (like new opens or reads) would fail as it is marked freed. This allowed other meta data to be freed after this flag was set (under the event_mutex). All the files that were dynamically created in the events directory had a pointer to the file meta data and would call event_release() when the last reference to the user space file was closed. This would be the time that it is safe to free the file meta data. A shortcut was made for the "format" file. It's i_private would point to the "call" entry directly and not point to the file's meta data. This is because all format files are the same for the same "call", so it was thought there was no reason to differentiate them. The other files maintain state (like the "enable", "trigger", etc). But this meant if the file were to disappear, the "format" file would be unaware of it. This caused a race that could be trigger via the user_events test (that would create dynamic events and free them), and running a loop that would read the user_events format files: In one console run: # cd tools/testing/selftests/user_events # while true; do ./ftrace_test; done And in another console run: # cd /sys/kernel/tracing/ # while true; do cat events/user_events/__test_event/format; done 2>/dev/null With KASAN memory checking, it would trigger a use-after-free bug report (which was a real bug). This was because the format file was not checking the file's meta data flag "EVENT_FILE_FL_FREED", so it would access the event that the file meta data pointed to after the event was freed. After inspection, there are other locations that were found to not check the EVENT_FILE_FL_FREED flag when accessing the trace_event_file. Add a new helper function: event_file_file() that will make sure that the event_mutex is held, and will return NULL if the trace_event_file has the EVENT_FILE_FL_FREED flag set. Have the first reference of the struct file pointer use event_file_file() and check for NULL. Later uses can still use the event_file_data() helper function if the event_mutex is still held and was not released since the event_file_file() call. Link: https://lore.kernel.org/all/20240719204701.1605950-1-minipli@grsecurity.net/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Ajay Kaher <ajay.kaher(a)broadcom.com> Cc: Ilkka Naulapää <digirigawa(a)gmail.com> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: Beau Belgrave <beaub(a)linux.microsoft.com> Cc: Florian Fainelli <florian.fainelli(a)broadcom.com> Cc: Alexey Makhalov <alexey.makhalov(a)broadcom.com> Cc: Vasavi Sirnapalli <vasavi.sirnapalli(a)broadcom.com> Link: https://lore.kernel.org/20240730110657.3b69d3c1@gandalf.local.home Fixes: b63db58e2fa5d ("eventfs/tracing: Add callback for release of an eventfs_inode") Reported-by: Mathias Krause <minipli(a)grsecurity.net> Tested-by: Mathias Krause <minipli(a)grsecurity.net> Conflicts: kernel/trace/trace_events.c [Resolve conflict due to lack of commit a1f157c7a3bb ("tracing: Expand all ring buffers individually") which add tracing_update_buffers() in event_enable_write(), that commit is more of a feature than a bugfix and is not related to the problem fixed by this patch] Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace.h | 23 ++++++++++++++++++++ kernel/trace/trace_events.c | 33 +++++++++++++++++------------ kernel/trace/trace_events_hist.c | 4 ++-- kernel/trace/trace_events_inject.c | 2 +- kernel/trace/trace_events_trigger.c | 6 +++--- 5 files changed, 49 insertions(+), 19 deletions(-) diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 5d81b6efaa1e..3ff785aa9444 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -1563,6 +1563,29 @@ static inline void *event_file_data(struct file *filp) extern struct mutex event_mutex; extern struct list_head ftrace_events; +/* + * When the trace_event_file is the filp->i_private pointer, + * it must be taken under the event_mutex lock, and then checked + * if the EVENT_FILE_FL_FREED flag is set. If it is, then the + * data pointed to by the trace_event_file can not be trusted. + * + * Use the event_file_file() to access the trace_event_file from + * the filp the first time under the event_mutex and check for + * NULL. If it is needed to be retrieved again and the event_mutex + * is still held, then the event_file_data() can be used and it + * is guaranteed to be valid. + */ +static inline struct trace_event_file *event_file_file(struct file *filp) +{ + struct trace_event_file *file; + + lockdep_assert_held(&event_mutex); + file = READ_ONCE(file_inode(filp)->i_private); + if (!file || file->flags & EVENT_FILE_FL_FREED) + return NULL; + return file; +} + extern const struct file_operations event_trigger_fops; extern const struct file_operations event_hist_fops; extern const struct file_operations event_hist_debug_fops; diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 2ae0f2807438..c68dc50c8bec 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -1386,12 +1386,12 @@ event_enable_read(struct file *filp, char __user *ubuf, size_t cnt, char buf[4] = "0"; mutex_lock(&event_mutex); - file = event_file_data(filp); + file = event_file_file(filp); if (likely(file)) flags = file->flags; mutex_unlock(&event_mutex); - if (!file || flags & EVENT_FILE_FL_FREED) + if (!file) return -ENODEV; if (flags & EVENT_FILE_FL_ENABLED && @@ -1428,8 +1428,8 @@ event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt, case 1: ret = -ENODEV; mutex_lock(&event_mutex); - file = event_file_data(filp); - if (likely(file && !(file->flags & EVENT_FILE_FL_FREED))) + file = event_file_file(filp); + if (likely(file)) ret = ftrace_event_enable_disable(file, val); mutex_unlock(&event_mutex); break; @@ -1538,7 +1538,8 @@ enum { static void *f_next(struct seq_file *m, void *v, loff_t *pos) { - struct trace_event_call *call = event_file_data(m->private); + struct trace_event_file *file = event_file_data(m->private); + struct trace_event_call *call = file->event_call; struct list_head *common_head = &ftrace_common_fields; struct list_head *head = trace_get_fields(call); struct list_head *node = v; @@ -1570,7 +1571,8 @@ static void *f_next(struct seq_file *m, void *v, loff_t *pos) static int f_show(struct seq_file *m, void *v) { - struct trace_event_call *call = event_file_data(m->private); + struct trace_event_file *file = event_file_data(m->private); + struct trace_event_call *call = file->event_call; struct ftrace_event_field *field; const char *array_descriptor; @@ -1625,12 +1627,14 @@ static int f_show(struct seq_file *m, void *v) static void *f_start(struct seq_file *m, loff_t *pos) { + struct trace_event_file *file; void *p = (void *)FORMAT_HEADER; loff_t l = 0; /* ->stop() is called even if ->start() fails */ mutex_lock(&event_mutex); - if (!event_file_data(m->private)) + file = event_file_file(m->private); + if (!file) return ERR_PTR(-ENODEV); while (l < *pos && p) @@ -1704,8 +1708,8 @@ event_filter_read(struct file *filp, char __user *ubuf, size_t cnt, trace_seq_init(s); mutex_lock(&event_mutex); - file = event_file_data(filp); - if (file && !(file->flags & EVENT_FILE_FL_FREED)) + file = event_file_file(filp); + if (file) print_event_filter(file, s); mutex_unlock(&event_mutex); @@ -1734,9 +1738,13 @@ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt, return PTR_ERR(buf); mutex_lock(&event_mutex); - file = event_file_data(filp); - if (file) - err = apply_event_filter(file, buf); + file = event_file_file(filp); + if (file) { + if (file->flags & EVENT_FILE_FL_FREED) + err = -ENODEV; + else + err = apply_event_filter(file, buf); + } mutex_unlock(&event_mutex); kfree(buf); @@ -2451,7 +2459,6 @@ static int event_callback(const char *name, umode_t *mode, void **data, if (strcmp(name, "format") == 0) { *mode = TRACE_MODE_READ; *fops = &ftrace_event_format_fops; - *data = call; return 1; } diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 68aaf0bd7a78..dd16faf0d150 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -5609,7 +5609,7 @@ static int hist_show(struct seq_file *m, void *v) mutex_lock(&event_mutex); - event_file = event_file_data(m->private); + event_file = event_file_file(m->private); if (unlikely(!event_file)) { ret = -ENODEV; goto out_unlock; @@ -5888,7 +5888,7 @@ static int hist_debug_show(struct seq_file *m, void *v) mutex_lock(&event_mutex); - event_file = event_file_data(m->private); + event_file = event_file_file(m->private); if (unlikely(!event_file)) { ret = -ENODEV; goto out_unlock; diff --git a/kernel/trace/trace_events_inject.c b/kernel/trace/trace_events_inject.c index 8650562bdaa9..a8f076809db4 100644 --- a/kernel/trace/trace_events_inject.c +++ b/kernel/trace/trace_events_inject.c @@ -299,7 +299,7 @@ event_inject_write(struct file *filp, const char __user *ubuf, size_t cnt, strim(buf); mutex_lock(&event_mutex); - file = event_file_data(filp); + file = event_file_file(filp); if (file) { call = file->event_call; size = parse_entry(buf, call, &entry); diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c index b33c3861fbbb..76abc9a45f97 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -159,7 +159,7 @@ static void *trigger_start(struct seq_file *m, loff_t *pos) /* ->stop() is called even if ->start() fails */ mutex_lock(&event_mutex); - event_file = event_file_data(m->private); + event_file = event_file_file(m->private); if (unlikely(!event_file)) return ERR_PTR(-ENODEV); @@ -213,7 +213,7 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file) mutex_lock(&event_mutex); - if (unlikely(!event_file_data(file))) { + if (unlikely(!event_file_file(file))) { mutex_unlock(&event_mutex); return -ENODEV; } @@ -293,7 +293,7 @@ static ssize_t event_trigger_regex_write(struct file *file, strim(buf); mutex_lock(&event_mutex); - event_file = event_file_data(file); + event_file = event_file_file(file); if (unlikely(!event_file)) { mutex_unlock(&event_mutex); kfree(buf); -- 2.25.1

2 1

[PATCH OLK-6.6] Bluetooth: MGMT: Add error handling to pair_device()
by Zhengchao Shao 28 Aug '24

28 Aug '24

From: Griffin Kroah-Hartman <griffin(a)kroah.com> mainline inclusion from mainline-v6.11-rc5 commit 538fd3921afac97158d4177139a0ad39f056dbb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMK01 CVE: CVE-2024-43884 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function. Cc: Stable <stable(a)kernel.org> Fixes: 5157b8a503fa ("Bluetooth: Fix initializing conn_params in scan phase") Signed-off-by: Griffin Kroah-Hartman <griffin(a)kroah.com> Reported-by: Yiwei Zhang <zhan4630(a)purdue.edu> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/mgmt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 0ca6593a029c..3533ac679e42 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -3449,6 +3449,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, * will be kept and this function does nothing. */ p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); + if (!p) { + err = -EIO; + goto unlock; + } if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) p->auto_connect = HCI_AUTO_CONN_DISABLED; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ext4: sanity check for NULL pointer after ext4_force_shutdown
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> stable inclusion from stable-6.6.47 commit 3f6bbe6e07e5239294ecc3d2efa70d1f98aed52e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-43898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 83f4414b8f84249d538905825b088ff3ae555652 ] Test case: 2 threads write short inline data to a file. In ext4_page_mkwrite the resulting inline data is converted. Handling ext4_grp_locked_error with description "block bitmap and bg descriptor inconsistent: X vs Y free clusters" calls ext4_force_shutdown. The conversion clears EXT4_STATE_MAY_INLINE_DATA but fails for ext4_destroy_inline_data_nolock and ext4_mark_iloc_dirty due to ext4_forced_shutdown. The restoration of inline data fails for the same reason not setting EXT4_STATE_MAY_INLINE_DATA. Without the flag set a regular process path in ext4_da_write_end follows trying to dereference page folio private pointer that has not been set. The fix calls early return with -EIO error shall the pointer to private be NULL. Sample crash report: Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 20274 Comm: syz-executor185 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 lr : __block_commit_write+0x3c/0x2b0 fs/buffer.c:2160 sp : ffff8000a1957600 x29: ffff8000a1957610 x28: dfff800000000000 x27: ffff0000e30e34b0 x26: 0000000000000000 x25: dfff800000000000 x24: dfff800000000000 x23: fffffdffc397c9e0 x22: 0000000000000020 x21: 0000000000000020 x20: 0000000000000040 x19: fffffdffc397c9c0 x18: 1fffe000367bd196 x17: ffff80008eead000 x16: ffff80008ae89e3c x15: 00000000200000c0 x14: 1fffe0001cbe4e04 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000004 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffdffc397c9c0 x4 : 0000000000000020 x3 : 0000000000000020 x2 : 0000000000000040 x1 : 0000000000000020 x0 : fffffdffc397c9c0 Call trace: __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 block_write_end+0xb4/0x104 fs/buffer.c:2253 ext4_da_do_write_end fs/ext4/inode.c:2955 [inline] ext4_da_write_end+0x2c4/0xa40 fs/ext4/inode.c:3028 generic_perform_write+0x394/0x588 mm/filemap.c:3985 ext4_buffered_write_iter+0x2c0/0x4ec fs/ext4/file.c:299 ext4_file_write_iter+0x188/0x1780 call_write_iter include/linux/fs.h:2110 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x968/0xc3c fs/read_write.c:590 ksys_write+0x15c/0x26c fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:652 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Code: 97f85911 f94002da 91008356 d343fec8 (38796908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97f85911 bl 0xffffffffffe16444 4: f94002da ldr x26, [x22] 8: 91008356 add x22, x26, #0x20 c: d343fec8 lsr x8, x22, #3 * 10: 38796908 ldrb w8, [x8, x25] <-- trapping instruction Reported-by: syzbot+18df508cf00a0598d9a6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18df508cf00a0598d9a6 Link: https://lore.kernel.org/all/000000000000f19a1406109eb5c5@google.com/T/ Signed-off-by: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> Link: https://patch.msgid.link/20240703070112.10235-1-wojciech.gladysz@infogain.c… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/buffer.c fs/ext4/inode.c [Since folio is not defined in the earlier version, page_private is judged ahead of time.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/buffer.c | 3 +++ fs/ext4/inode.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index af88734d1d38..0a813fad9002 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2037,6 +2037,9 @@ static int __block_commit_write(struct inode *inode, struct page *page, unsigned blocksize; struct buffer_head *bh, *head; + if (!page_private(page)) + return 0; + bh = head = page_buffers(page); blocksize = bh->b_size; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 35033bb43149..6c3e5aedc2ca 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3155,6 +3155,9 @@ static int ext4_da_write_end(struct file *file, if (unlikely(copied < len) && !PageUptodate(page)) copied = 0; + if (unlikely(!page_private(page))) + return -EIO; + start = pos & (PAGE_SIZE - 1); end = start + copied - 1; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ext4: sanity check for NULL pointer after ext4_force_shutdown
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> stable inclusion from stable-6.6.47 commit 3f6bbe6e07e5239294ecc3d2efa70d1f98aed52e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-43898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 83f4414b8f84249d538905825b088ff3ae555652 ] Test case: 2 threads write short inline data to a file. In ext4_page_mkwrite the resulting inline data is converted. Handling ext4_grp_locked_error with description "block bitmap and bg descriptor inconsistent: X vs Y free clusters" calls ext4_force_shutdown. The conversion clears EXT4_STATE_MAY_INLINE_DATA but fails for ext4_destroy_inline_data_nolock and ext4_mark_iloc_dirty due to ext4_forced_shutdown. The restoration of inline data fails for the same reason not setting EXT4_STATE_MAY_INLINE_DATA. Without the flag set a regular process path in ext4_da_write_end follows trying to dereference page folio private pointer that has not been set. The fix calls early return with -EIO error shall the pointer to private be NULL. Sample crash report: Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 20274 Comm: syz-executor185 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 lr : __block_commit_write+0x3c/0x2b0 fs/buffer.c:2160 sp : ffff8000a1957600 x29: ffff8000a1957610 x28: dfff800000000000 x27: ffff0000e30e34b0 x26: 0000000000000000 x25: dfff800000000000 x24: dfff800000000000 x23: fffffdffc397c9e0 x22: 0000000000000020 x21: 0000000000000020 x20: 0000000000000040 x19: fffffdffc397c9c0 x18: 1fffe000367bd196 x17: ffff80008eead000 x16: ffff80008ae89e3c x15: 00000000200000c0 x14: 1fffe0001cbe4e04 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000004 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffdffc397c9c0 x4 : 0000000000000020 x3 : 0000000000000020 x2 : 0000000000000040 x1 : 0000000000000020 x0 : fffffdffc397c9c0 Call trace: __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 block_write_end+0xb4/0x104 fs/buffer.c:2253 ext4_da_do_write_end fs/ext4/inode.c:2955 [inline] ext4_da_write_end+0x2c4/0xa40 fs/ext4/inode.c:3028 generic_perform_write+0x394/0x588 mm/filemap.c:3985 ext4_buffered_write_iter+0x2c0/0x4ec fs/ext4/file.c:299 ext4_file_write_iter+0x188/0x1780 call_write_iter include/linux/fs.h:2110 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x968/0xc3c fs/read_write.c:590 ksys_write+0x15c/0x26c fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:652 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Code: 97f85911 f94002da 91008356 d343fec8 (38796908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97f85911 bl 0xffffffffffe16444 4: f94002da ldr x26, [x22] 8: 91008356 add x22, x26, #0x20 c: d343fec8 lsr x8, x22, #3 * 10: 38796908 ldrb w8, [x8, x25] <-- trapping instruction Reported-by: syzbot+18df508cf00a0598d9a6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18df508cf00a0598d9a6 Link: https://lore.kernel.org/all/000000000000f19a1406109eb5c5@google.com/T/ Signed-off-by: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> Link: https://patch.msgid.link/20240703070112.10235-1-wojciech.gladysz@infogain.c… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/buffer.c fs/ext4/inode.c [Since folio is not defined in the earlier version, page_private is judged ahead of time.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/buffer.c | 3 +++ fs/ext4/inode.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index af88734d1d38..0a813fad9002 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2037,6 +2037,9 @@ static int __block_commit_write(struct inode *inode, struct page *page, unsigned blocksize; struct buffer_head *bh, *head; + if (!page_private(page)) + return 0; + bh = head = page_buffers(page); blocksize = bh->b_size; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 35033bb43149..743141449809 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3155,6 +3155,9 @@ static int ext4_da_write_end(struct file *file, if (unlikely(copied < len) && !PageUptodate(page)) copied = 0; + if (!page_private(page)) + return -EIO; + start = pos & (PAGE_SIZE - 1); end = start + copied - 1; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] apparmor: Fix null pointer deref when receiving skb during sock creation
by Gu Bowen 28 Aug '24

28 Aug '24

From: Xiao Liang <shaw.leon(a)gmail.com> stable inclusion from stable-v5.10.224 commit 347dcb84a4874b5fb375092c08d8cc4069b94f81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPW7 CVE: CVE-2023-52889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fce09ea314505a52f2436397608fa0a5d0934fb1 ] The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK_CTX(sk)->label is updated in apparmor_socket_post_create(), but the packet is delivered to the socket before that, causing the null pointer dereference. Drop the packet if label context is not set. BUG: kernel NULL pointer dereference, address: 000000000000004c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020 RIP: 0010:aa_label_next_confined+0xb/0x40 Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2 RSP: 0018:ffffa92940003b08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002 R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 FS: 00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0 PKRU: 55555554 Call Trace: <IRQ> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? aa_label_next_confined+0xb/0x40 apparmor_secmark_check+0xec/0x330 security_sock_rcv_skb+0x35/0x50 sk_filter_trim_cap+0x47/0x250 sock_queue_rcv_skb_reason+0x20/0x60 raw_rcv+0x13c/0x210 raw_local_deliver+0x1f3/0x250 ip_protocol_deliver_rcu+0x4f/0x2f0 ip_local_deliver_finish+0x76/0xa0 __netif_receive_skb_one_core+0x89/0xa0 netif_receive_skb+0x119/0x170 ? __netdev_alloc_skb+0x3d/0x140 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] __napi_poll+0x28/0x1b0 net_rx_action+0x2a4/0x380 __do_softirq+0xd1/0x2c8 __irq_exit_rcu+0xbb/0xf0 common_interrupt+0x86/0xa0 </IRQ> <TASK> asm_common_interrupt+0x26/0x40 RIP: 0010:apparmor_socket_post_create+0xb/0x200 Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48 RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286 RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003 R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748 ? __pfx_apparmor_socket_post_create+0x10/0x10 security_socket_post_create+0x4b/0x80 __sock_create+0x176/0x1f0 __sys_socket+0x89/0x100 __x64_sys_socket+0x17/0x20 do_syscall_64+0x5d/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixes: ab9f2115081a ("apparmor: Allow filtering based on secmark policy") Signed-off-by: Xiao Liang <shaw.leon(a)gmail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/apparmor/lsm.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index ffeaee5ed968..44eaaa8b7754 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1048,6 +1048,13 @@ static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) if (!skb->secmark) return 0; + /* + * If reach here before socket_post_create hook is called, in which + * case label is null, drop the packet. + */ + if (!ctx->label) + return -EACCES; + return apparmor_secmark_check(ctx->label, OP_RECVMSG, AA_MAY_RECEIVE, skb->secmark, sk); } -- 2.25.1

2 1

[PATCH OLK-5.10] ext4: sanity check for NULL pointer after ext4_force_shutdown
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> stable inclusion from stable-6.6.47 commit 3f6bbe6e07e5239294ecc3d2efa70d1f98aed52e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-43898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 83f4414b8f84249d538905825b088ff3ae555652 ] Test case: 2 threads write short inline data to a file. In ext4_page_mkwrite the resulting inline data is converted. Handling ext4_grp_locked_error with description "block bitmap and bg descriptor inconsistent: X vs Y free clusters" calls ext4_force_shutdown. The conversion clears EXT4_STATE_MAY_INLINE_DATA but fails for ext4_destroy_inline_data_nolock and ext4_mark_iloc_dirty due to ext4_forced_shutdown. The restoration of inline data fails for the same reason not setting EXT4_STATE_MAY_INLINE_DATA. Without the flag set a regular process path in ext4_da_write_end follows trying to dereference page folio private pointer that has not been set. The fix calls early return with -EIO error shall the pointer to private be NULL. Sample crash report: Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 20274 Comm: syz-executor185 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 lr : __block_commit_write+0x3c/0x2b0 fs/buffer.c:2160 sp : ffff8000a1957600 x29: ffff8000a1957610 x28: dfff800000000000 x27: ffff0000e30e34b0 x26: 0000000000000000 x25: dfff800000000000 x24: dfff800000000000 x23: fffffdffc397c9e0 x22: 0000000000000020 x21: 0000000000000020 x20: 0000000000000040 x19: fffffdffc397c9c0 x18: 1fffe000367bd196 x17: ffff80008eead000 x16: ffff80008ae89e3c x15: 00000000200000c0 x14: 1fffe0001cbe4e04 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000004 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffdffc397c9c0 x4 : 0000000000000020 x3 : 0000000000000020 x2 : 0000000000000040 x1 : 0000000000000020 x0 : fffffdffc397c9c0 Call trace: __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 block_write_end+0xb4/0x104 fs/buffer.c:2253 ext4_da_do_write_end fs/ext4/inode.c:2955 [inline] ext4_da_write_end+0x2c4/0xa40 fs/ext4/inode.c:3028 generic_perform_write+0x394/0x588 mm/filemap.c:3985 ext4_buffered_write_iter+0x2c0/0x4ec fs/ext4/file.c:299 ext4_file_write_iter+0x188/0x1780 call_write_iter include/linux/fs.h:2110 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x968/0xc3c fs/read_write.c:590 ksys_write+0x15c/0x26c fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:652 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Code: 97f85911 f94002da 91008356 d343fec8 (38796908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97f85911 bl 0xffffffffffe16444 4: f94002da ldr x26, [x22] 8: 91008356 add x22, x26, #0x20 c: d343fec8 lsr x8, x22, #3 * 10: 38796908 ldrb w8, [x8, x25] <-- trapping instruction Reported-by: syzbot+18df508cf00a0598d9a6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18df508cf00a0598d9a6 Link: https://lore.kernel.org/all/000000000000f19a1406109eb5c5@google.com/T/ Signed-off-by: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> Link: https://patch.msgid.link/20240703070112.10235-1-wojciech.gladysz@infogain.c… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/buffer.c fs/ext4/inode.c [Since folio is not defined in the earlier version, page_private is judged ahead of time.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/buffer.c | 3 +++ fs/ext4/inode.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index a74312b1bb42..0419cbff9419 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2070,6 +2070,9 @@ static int __block_commit_write(struct inode *inode, struct page *page, unsigned blocksize; struct buffer_head *bh, *head; + if (!page_private(page)) + return 0; + bh = head = page_buffers(page); blocksize = bh->b_size; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 8e4407120cbc..c9326e059e3b 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3078,6 +3078,9 @@ static int ext4_da_do_write_end(struct address_space *mapping, bool disksize_changed = false; loff_t new_i_size; + if (unlikely(!page_private(page))) + return -EIO; + /* * block_write_end() will mark the inode as dirty with I_DIRTY_PAGES * flag, which all that's needed to trigger page writeback. -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] ext4: sanity check for NULL pointer after ext4_force_shutdown
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> stable inclusion from stable-6.6.47 commit 3f6bbe6e07e5239294ecc3d2efa70d1f98aed52e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-43898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 83f4414b8f84249d538905825b088ff3ae555652 ] Test case: 2 threads write short inline data to a file. In ext4_page_mkwrite the resulting inline data is converted. Handling ext4_grp_locked_error with description "block bitmap and bg descriptor inconsistent: X vs Y free clusters" calls ext4_force_shutdown. The conversion clears EXT4_STATE_MAY_INLINE_DATA but fails for ext4_destroy_inline_data_nolock and ext4_mark_iloc_dirty due to ext4_forced_shutdown. The restoration of inline data fails for the same reason not setting EXT4_STATE_MAY_INLINE_DATA. Without the flag set a regular process path in ext4_da_write_end follows trying to dereference page folio private pointer that has not been set. The fix calls early return with -EIO error shall the pointer to private be NULL. Sample crash report: Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 20274 Comm: syz-executor185 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 lr : __block_commit_write+0x3c/0x2b0 fs/buffer.c:2160 sp : ffff8000a1957600 x29: ffff8000a1957610 x28: dfff800000000000 x27: ffff0000e30e34b0 x26: 0000000000000000 x25: dfff800000000000 x24: dfff800000000000 x23: fffffdffc397c9e0 x22: 0000000000000020 x21: 0000000000000020 x20: 0000000000000040 x19: fffffdffc397c9c0 x18: 1fffe000367bd196 x17: ffff80008eead000 x16: ffff80008ae89e3c x15: 00000000200000c0 x14: 1fffe0001cbe4e04 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000004 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffdffc397c9c0 x4 : 0000000000000020 x3 : 0000000000000020 x2 : 0000000000000040 x1 : 0000000000000020 x0 : fffffdffc397c9c0 Call trace: __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 block_write_end+0xb4/0x104 fs/buffer.c:2253 ext4_da_do_write_end fs/ext4/inode.c:2955 [inline] ext4_da_write_end+0x2c4/0xa40 fs/ext4/inode.c:3028 generic_perform_write+0x394/0x588 mm/filemap.c:3985 ext4_buffered_write_iter+0x2c0/0x4ec fs/ext4/file.c:299 ext4_file_write_iter+0x188/0x1780 call_write_iter include/linux/fs.h:2110 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x968/0xc3c fs/read_write.c:590 ksys_write+0x15c/0x26c fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:652 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Code: 97f85911 f94002da 91008356 d343fec8 (38796908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97f85911 bl 0xffffffffffe16444 4: f94002da ldr x26, [x22] 8: 91008356 add x22, x26, #0x20 c: d343fec8 lsr x8, x22, #3 * 10: 38796908 ldrb w8, [x8, x25] <-- trapping instruction Reported-by: syzbot+18df508cf00a0598d9a6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18df508cf00a0598d9a6 Link: https://lore.kernel.org/all/000000000000f19a1406109eb5c5@google.com/T/ Signed-off-by: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> Link: https://patch.msgid.link/20240703070112.10235-1-wojciech.gladysz@infogain.c… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/buffer.c fs/ext4/inode.c [Since folio is not defined in the earlier version, page_private is judged ahead of time.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/buffer.c | 3 +++ fs/ext4/inode.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index 93324b06ecb4..a22d35004874 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2070,6 +2070,9 @@ static int __block_commit_write(struct inode *inode, struct page *page, unsigned blocksize; struct buffer_head *bh, *head; + if (!page_private(page)) + return 0; + bh = head = page_buffers(page); blocksize = bh->b_size; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 690f7866dc0c..f8459b6b9a27 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3089,6 +3089,9 @@ static int ext4_da_do_write_end(struct address_space *mapping, bool disksize_changed = false; loff_t new_i_size; + if (unlikely(!page_private(page))) + return -EIO; + /* * block_write_end() will mark the inode as dirty with I_DIRTY_PAGES * flag, which all that's needed to trigger page writeback. -- 2.39.2

2 1

[openeuler:OLK-5.10 27211/30000] arch/x86/kvm/x86.c:1076:6: warning: no previous prototype for function 'kvm_post_set_cr4'
by kernel test robot 28 Aug '24

28 Aug '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d96e94294726506c2893c3a71305c65168c22526 commit: 8a7e6f51a756aa6e88ebd5da8a5f3b6744cd07b5 [27211/30000] KVM: x86: Introduce kvm_post_set_cr4 to post handle the CR4 emulation config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20240828/202408281404.nd7rLidC-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281404.nd7rLidC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281404.nd7rLidC-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kvm/x86.c:893:6: warning: no previous prototype for function 'kvm_post_set_cr0' [-Wmissing-prototypes] 893 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^ arch/x86/kvm/x86.c:893:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 893 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^ | static >> arch/x86/kvm/x86.c:1076:6: warning: no previous prototype for function 'kvm_post_set_cr4' [-Wmissing-prototypes] 1076 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^ arch/x86/kvm/x86.c:1076:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1076 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^ | static 2 warnings generated. vim +/kvm_post_set_cr4 +1076 arch/x86/kvm/x86.c 1075 > 1076 void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) 1077 { 1078 unsigned long mmu_role_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE | 1079 X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE; 1080 1081 if (((cr4 ^ old_cr4) & mmu_role_bits) || 1082 (!(cr4 & X86_CR4_PCIDE) && (old_cr4 & X86_CR4_PCIDE))) 1083 kvm_mmu_reset_context(vcpu); 1084 } 1085 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] nfs: pass explicit offset/count to trace events
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Christoph Hellwig <hch(a)lst.de> stable inclusion from stable-v6.10.3 commit 387e6e9d110250946df4d4ebef9c2def5c7a4722 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2A CVE: CVE-2024-43826 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit fada32ed6dbc748f447c8d050a961b75d946055a ] nfs_folio_length is unsafe to use without having the folio locked and a check for a NULL ->f_mapping that protects against truncations and can lead to kernel crashes. E.g. when running xfstests generic/065 with all nfs trace points enabled. Follow the model of the XFS trace points and pass in an explіcit offset and length. This has the additional benefit that these values can be more accurate as some of the users touch partial folio ranges. Fixes: eb5654b3b89d ("NFS: Enable tracing of nfs_invalidate_folio() and nfs_launder_folio()") Reported-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nfs/file.c [Trace context conflict, no adaptation required.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/file.c | 5 +++-- fs/nfs/nfstrace.h | 36 ++++++++++++++++++++---------------- fs/nfs/read.c | 8 +++++--- fs/nfs/write.c | 10 +++++----- 4 files changed, 33 insertions(+), 26 deletions(-) diff --git a/fs/nfs/file.c b/fs/nfs/file.c index 3f9768810427..9342f8074801 100644 --- a/fs/nfs/file.c +++ b/fs/nfs/file.c @@ -434,7 +434,7 @@ static void nfs_invalidate_folio(struct folio *folio, size_t offset, /* Cancel any unstarted writes on this page */ nfs_wb_folio_cancel(inode, folio); folio_wait_fscache(folio); - trace_nfs_invalidate_folio(inode, folio); + trace_nfs_invalidate_folio(inode, folio_pos(folio) + offset, length); } /* @@ -502,7 +502,8 @@ static int nfs_launder_folio(struct folio *folio) folio_wait_fscache(folio); ret = nfs_wb_folio(inode, folio); - trace_nfs_launder_folio_done(inode, folio, ret); + trace_nfs_launder_folio_done(inode, folio_pos(folio), + folio_size(folio), ret); return ret; } diff --git a/fs/nfs/nfstrace.h b/fs/nfs/nfstrace.h index 4e90ca531176..004c25f0782b 100644 --- a/fs/nfs/nfstrace.h +++ b/fs/nfs/nfstrace.h @@ -933,10 +933,11 @@ TRACE_EVENT(nfs_sillyrename_unlink, DECLARE_EVENT_CLASS(nfs_folio_event, TP_PROTO( const struct inode *inode, - struct folio *folio + loff_t offset, + size_t count ), - TP_ARGS(inode, folio), + TP_ARGS(inode, offset, count), TP_STRUCT__entry( __field(dev_t, dev) @@ -944,7 +945,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event, __field(u64, fileid) __field(u64, version) __field(loff_t, offset) - __field(u32, count) + __field(size_t, count) ), TP_fast_assign( @@ -954,13 +955,13 @@ DECLARE_EVENT_CLASS(nfs_folio_event, __entry->fileid = nfsi->fileid; __entry->fhandle = nfs_fhandle_hash(&nfsi->fh); __entry->version = inode_peek_iversion_raw(inode); - __entry->offset = folio_file_pos(folio); - __entry->count = nfs_folio_length(folio); + __entry->offset = offset, + __entry->count = count; ), TP_printk( "fileid=%02x:%02x:%llu fhandle=0x%08x version=%llu " - "offset=%lld count=%u", + "offset=%lld count=%zu", MAJOR(__entry->dev), MINOR(__entry->dev), (unsigned long long)__entry->fileid, __entry->fhandle, __entry->version, @@ -972,18 +973,20 @@ DECLARE_EVENT_CLASS(nfs_folio_event, DEFINE_EVENT(nfs_folio_event, name, \ TP_PROTO( \ const struct inode *inode, \ - struct folio *folio \ + loff_t offset, \ + size_t count \ ), \ - TP_ARGS(inode, folio)) + TP_ARGS(inode, offset, count)) DECLARE_EVENT_CLASS(nfs_folio_event_done, TP_PROTO( const struct inode *inode, - struct folio *folio, + loff_t offset, + size_t count, int ret ), - TP_ARGS(inode, folio, ret), + TP_ARGS(inode, offset, count, ret), TP_STRUCT__entry( __field(dev_t, dev) @@ -992,7 +995,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done, __field(u64, fileid) __field(u64, version) __field(loff_t, offset) - __field(u32, count) + __field(size_t, count) ), TP_fast_assign( @@ -1002,14 +1005,14 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done, __entry->fileid = nfsi->fileid; __entry->fhandle = nfs_fhandle_hash(&nfsi->fh); __entry->version = inode_peek_iversion_raw(inode); - __entry->offset = folio_file_pos(folio); - __entry->count = nfs_folio_length(folio); + __entry->offset = offset, + __entry->count = count, __entry->ret = ret; ), TP_printk( "fileid=%02x:%02x:%llu fhandle=0x%08x version=%llu " - "offset=%lld count=%u ret=%d", + "offset=%lld count=%zu ret=%d", MAJOR(__entry->dev), MINOR(__entry->dev), (unsigned long long)__entry->fileid, __entry->fhandle, __entry->version, @@ -1021,10 +1024,11 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done, DEFINE_EVENT(nfs_folio_event_done, name, \ TP_PROTO( \ const struct inode *inode, \ - struct folio *folio, \ + loff_t offset, \ + size_t count, \ int ret \ ), \ - TP_ARGS(inode, folio, ret)) + TP_ARGS(inode, offset, count, ret)) DEFINE_NFS_FOLIO_EVENT(nfs_aop_readpage); DEFINE_NFS_FOLIO_EVENT_DONE(nfs_aop_readpage_done); diff --git a/fs/nfs/read.c b/fs/nfs/read.c index a142287d86f6..88e6a78d37fb 100644 --- a/fs/nfs/read.c +++ b/fs/nfs/read.c @@ -332,13 +332,15 @@ int nfs_read_add_folio(struct nfs_pageio_descriptor *pgio, int nfs_read_folio(struct file *file, struct folio *folio) { struct inode *inode = file_inode(file); + loff_t pos = folio_pos(folio); + size_t len = folio_size(folio); struct nfs_pageio_descriptor pgio; struct nfs_open_context *ctx; int ret; - trace_nfs_aop_readpage(inode, folio); + trace_nfs_aop_readpage(inode, pos, len); nfs_inc_stats(inode, NFSIOS_VFSREADPAGE); - task_io_account_read(folio_size(folio)); + task_io_account_read(len); /* * Try to flush any pending writes to the file.. @@ -381,7 +383,7 @@ int nfs_read_folio(struct file *file, struct folio *folio) out_put: put_nfs_open_context(ctx); out: - trace_nfs_aop_readpage_done(inode, folio, ret); + trace_nfs_aop_readpage_done(inode, pos, len, ret); return ret; out_unlock: folio_unlock(folio); diff --git a/fs/nfs/write.c b/fs/nfs/write.c index 7d03811f44a4..6bc36cef14cd 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -2088,17 +2088,17 @@ int nfs_wb_folio_cancel(struct inode *inode, struct folio *folio) */ int nfs_wb_folio(struct inode *inode, struct folio *folio) { - loff_t range_start = folio_file_pos(folio); - loff_t range_end = range_start + (loff_t)folio_size(folio) - 1; + loff_t range_start = folio_pos(folio); + size_t len = folio_size(folio); struct writeback_control wbc = { .sync_mode = WB_SYNC_ALL, .nr_to_write = 0, .range_start = range_start, - .range_end = range_end, + .range_end = range_start + len - 1, }; int ret; - trace_nfs_writeback_folio(inode, folio); + trace_nfs_writeback_folio(inode, range_start, len); for (;;) { folio_wait_writeback(folio); @@ -2116,7 +2116,7 @@ int nfs_wb_folio(struct inode *inode, struct folio *folio) goto out_error; } out_error: - trace_nfs_writeback_folio_done(inode, folio, ret); + trace_nfs_writeback_folio_done(inode, range_start, len, ret); return ret; } -- 2.39.2

2 1

[PATCH OLK-5.10] apparmor: Fix null pointer deref when receiving skb during sock creation
by Gu Bowen 28 Aug '24

28 Aug '24

From: Xiao Liang <shaw.leon(a)gmail.com> stable inclusion from stable-v5.10.224 commit 347dcb84a4874b5fb375092c08d8cc4069b94f81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPW7 CVE: CVE-2023-52889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fce09ea314505a52f2436397608fa0a5d0934fb1 ] The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK_CTX(sk)->label is updated in apparmor_socket_post_create(), but the packet is delivered to the socket before that, causing the null pointer dereference. Drop the packet if label context is not set. BUG: kernel NULL pointer dereference, address: 000000000000004c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020 RIP: 0010:aa_label_next_confined+0xb/0x40 Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2 RSP: 0018:ffffa92940003b08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002 R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 FS: 00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0 PKRU: 55555554 Call Trace: <IRQ> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? aa_label_next_confined+0xb/0x40 apparmor_secmark_check+0xec/0x330 security_sock_rcv_skb+0x35/0x50 sk_filter_trim_cap+0x47/0x250 sock_queue_rcv_skb_reason+0x20/0x60 raw_rcv+0x13c/0x210 raw_local_deliver+0x1f3/0x250 ip_protocol_deliver_rcu+0x4f/0x2f0 ip_local_deliver_finish+0x76/0xa0 __netif_receive_skb_one_core+0x89/0xa0 netif_receive_skb+0x119/0x170 ? __netdev_alloc_skb+0x3d/0x140 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] __napi_poll+0x28/0x1b0 net_rx_action+0x2a4/0x380 __do_softirq+0xd1/0x2c8 __irq_exit_rcu+0xbb/0xf0 common_interrupt+0x86/0xa0 </IRQ> <TASK> asm_common_interrupt+0x26/0x40 RIP: 0010:apparmor_socket_post_create+0xb/0x200 Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48 RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286 RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003 R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748 ? __pfx_apparmor_socket_post_create+0x10/0x10 security_socket_post_create+0x4b/0x80 __sock_create+0x176/0x1f0 __sys_socket+0x89/0x100 __x64_sys_socket+0x17/0x20 do_syscall_64+0x5d/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixes: ab9f2115081a ("apparmor: Allow filtering based on secmark policy") Signed-off-by: Xiao Liang <shaw.leon(a)gmail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/apparmor/lsm.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 052f1b920e43..37aa1650c74e 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1048,6 +1048,13 @@ static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) if (!skb->secmark) return 0; + /* + * If reach here before socket_post_create hook is called, in which + * case label is null, drop the packet. + */ + if (!ctx->label) + return -EACCES; + return apparmor_secmark_check(ctx->label, OP_RECVMSG, AA_MAY_RECEIVE, skb->secmark, sk); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] io_uring: add a schedule point in io_add_buffers()
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-5.10.103 commit 4a93c6594613c3429b6f30136fff115c7f803af4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALQ20 CVE: CVE-2022-48937 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit f240762f88b4b1b58561939ffd44837759756477 upstream. Looping ~65535 times doing kmalloc() calls can trigger soft lockups, especially with DEBUG features (like KASAN). [ 253.536212] watchdog: BUG: soft lockup - CPU#64 stuck for 26s! [b219417889:12575] [ 253.544433] Modules linked in: vfat fat i2c_mux_pca954x i2c_mux spidev cdc_acm xhci_pci xhci_hcd sha3_generic gq(O) [ 253.544451] CPU: 64 PID: 12575 Comm: b219417889 Tainted: G S O 5.17.0-smp-DEV #801 [ 253.544457] RIP: 0010:kernel_text_address (./include/asm-generic/sections.h:192 ./include/linux/kallsyms.h:29 kernel/extable.c:67 kernel/extable.c:98) [ 253.544464] Code: 0f 93 c0 48 c7 c1 e0 63 d7 a4 48 39 cb 0f 92 c1 20 c1 0f b6 c1 5b 5d c3 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 fb <48> c7 c0 00 00 80 a0 41 be 01 00 00 00 48 39 c7 72 0c 48 c7 c0 40 [ 253.544468] RSP: 0018:ffff8882d8baf4c0 EFLAGS: 00000246 [ 253.544471] RAX: 1ffff1105b175e00 RBX: ffffffffa13ef09a RCX: 00000000a13ef001 [ 253.544474] RDX: ffffffffa13ef09a RSI: ffff8882d8baf558 RDI: ffffffffa13ef09a [ 253.544476] RBP: ffff8882d8baf4d8 R08: ffff8882d8baf5e0 R09: 0000000000000004 [ 253.544479] R10: ffff8882d8baf5e8 R11: ffffffffa0d59a50 R12: ffff8882eab20380 [ 253.544481] R13: ffffffffa0d59a50 R14: dffffc0000000000 R15: 1ffff1105b175eb0 [ 253.544483] FS: 00000000016d3380(0000) GS:ffff88af48c00000(0000) knlGS:0000000000000000 [ 253.544486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 253.544488] CR2: 00000000004af0f0 CR3: 00000002eabfa004 CR4: 00000000003706e0 [ 253.544491] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 253.544492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 253.544494] Call Trace: [ 253.544496] <TASK> [ 253.544498] ? io_queue_sqe (fs/io_uring.c:7143) [ 253.544505] __kernel_text_address (kernel/extable.c:78) [ 253.544508] unwind_get_return_address (arch/x86/kernel/unwind_frame.c:19) [ 253.544514] arch_stack_walk (arch/x86/kernel/stacktrace.c:27) [ 253.544517] ? io_queue_sqe (fs/io_uring.c:7143) [ 253.544521] stack_trace_save (kernel/stacktrace.c:123) [ 253.544527] ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544531] ? ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544533] ? __kasan_kmalloc (mm/kasan/common.c:524) [ 253.544535] ? kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567) [ 253.544541] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) [ 253.544544] ? __io_queue_sqe (fs/io_uring.c:?) [ 253.544551] __kasan_kmalloc (mm/kasan/common.c:524) [ 253.544553] kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567) [ 253.544556] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) [ 253.544560] io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) [ 253.544564] ? __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) [ 253.544567] ? __kasan_slab_alloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) [ 253.544569] ? kmem_cache_alloc_bulk (mm/slab.h:732 mm/slab.c:3546) [ 253.544573] ? __io_alloc_req_refill (fs/io_uring.c:2078) [ 253.544578] ? io_submit_sqes (fs/io_uring.c:7441) [ 253.544581] ? __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096) [ 253.544584] ? __x64_sys_io_uring_enter (fs/io_uring.c:10096) [ 253.544587] ? do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 253.544590] ? entry_SYSCALL_64_after_hwframe (??:?) [ 253.544596] __io_queue_sqe (fs/io_uring.c:?) [ 253.544600] io_queue_sqe (fs/io_uring.c:7143) [ 253.544603] io_submit_sqe (fs/io_uring.c:?) [ 253.544608] io_submit_sqes (fs/io_uring.c:?) [ 253.544612] __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096) [ 253.544616] __x64_sys_io_uring_enter (fs/io_uring.c:10096) [ 253.544619] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 253.544623] entry_SYSCALL_64_after_hwframe (??:?) Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Pavel Begunkov <asml.silence(a)gmail.com> Cc: io-uring <io-uring(a)vger.kernel.org> Reported-by: syzbot <syzkaller(a)googlegroups.com> Link: https://lore.kernel.org/r/20220215041003.2394784-1-eric.dumazet@gmail.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index dde9205fc287..411b7491f3f5 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3647,6 +3647,7 @@ static int io_add_buffers(struct io_provide_buf *pbuf, struct io_buffer **head) } else { list_add_tail(&buf->list, &(*head)->list); } + cond_resched(); } return i ? i : -ENOMEM; -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 17746/23570] drivers/dax/.tmp_bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7ad52b4435297d752bdb8c2fce6524544448d4af commit: 9bb67bd58e6a7e3ef00793b4966be7bb0a346830 [17746/23570] Intel: device-dax: Add support for a dax override driver config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240828/202408281448.DeW129VU-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281448.DeW129VU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281448.DeW129VU-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dax/.tmp_bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7193/13757] mm/page_alloc.c:4110:9: error: implicit declaration of function 'dynamic_pool_should_alloc' is invalid in C99
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e59105d1ac962dacde2b6480857e834f97ca108e commit: fd855715f24e3eeadaa56de5fde21c55a14aeea0 [7193/13757] mm/mem_reliable: Fallback to dpool if reliable memory is not enough config: arm64-randconfig-003-20240827 (https://download.01.org/0day-ci/archive/20240828/202408281316.tzOrTedV-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281316.tzOrTedV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281316.tzOrTedV-lkp@intel.com/ All errors (new ones prefixed by >>): >> mm/page_alloc.c:4110:9: error: implicit declaration of function 'dynamic_pool_should_alloc' is invalid in C99 [-Werror,-Wimplicit-function-declaration] return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); ^ 1 error generated. vim +/dynamic_pool_should_alloc +4110 mm/page_alloc.c 4101 4102 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4103 { 4104 if (!reliable_allow_fb_enabled()) 4105 return false; 4106 4107 if (!(gfp_mask & GFP_RELIABLE)) 4108 return false; 4109 > 4110 return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); 4111 } 4112 #else 4113 static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, 4114 struct alloc_context *ac) 4115 { 4116 return NULL; 4117 } 4118 static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, 4119 struct alloc_context *ac) {} 4120 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4121 { 4122 return false; 4123 } 4124 #endif 4125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 27370/30000] arch/x86/kvm/x86.c:805:5: warning: no previous prototype for 'kvm_read_guest_page_mmu'
by kernel test robot 28 Aug '24

28 Aug '24

Hi Sean, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d96e94294726506c2893c3a71305c65168c22526 commit: aeaeb4dcb428b870d4207cc0fae7c125b7522406 [27370/30000] KVM: x86: Subsume nested GPA read helper into load_pdptrs() config: x86_64-buildonly-randconfig-005-20240828 (https://download.01.org/0day-ci/archive/20240828/202408281227.MN7ngvtP-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281227.MN7ngvtP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281227.MN7ngvtP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kvm/x86.c:805:5: warning: no previous prototype for 'kvm_read_guest_page_mmu' [-Wmissing-prototypes] 805 | int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, | ^~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kvm/x86.c:900:6: warning: no previous prototype for 'kvm_post_set_cr0' [-Wmissing-prototypes] 900 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^~~~~~~~~~~~~~~~ arch/x86/kvm/x86.c:1081:6: warning: no previous prototype for 'kvm_post_set_cr4' [-Wmissing-prototypes] 1081 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^~~~~~~~~~~~~~~~ vim +/kvm_read_guest_page_mmu +805 arch/x86/kvm/x86.c 16f8a6f9798ab9 Nadav Amit 2014-10-03 799 ec92fe44e7ff94 Joerg Roedel 2010-09-10 800 /* ec92fe44e7ff94 Joerg Roedel 2010-09-10 801 * This function will be used to read from the physical memory of the currently 54bf36aac52031 Paolo Bonzini 2015-04-08 802 * running guest. The difference to kvm_vcpu_read_guest_page is that this function ec92fe44e7ff94 Joerg Roedel 2010-09-10 803 * can read from guest physical or from the guest's guest physical memory. ec92fe44e7ff94 Joerg Roedel 2010-09-10 804 */ ec92fe44e7ff94 Joerg Roedel 2010-09-10 @805 int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, ec92fe44e7ff94 Joerg Roedel 2010-09-10 806 gfn_t ngfn, void *data, int offset, int len, ec92fe44e7ff94 Joerg Roedel 2010-09-10 807 u32 access) ec92fe44e7ff94 Joerg Roedel 2010-09-10 808 { 54987b7afa902e Paolo Bonzini 2014-09-02 809 struct x86_exception exception; ec92fe44e7ff94 Joerg Roedel 2010-09-10 810 gfn_t real_gfn; ec92fe44e7ff94 Joerg Roedel 2010-09-10 811 gpa_t ngpa; ec92fe44e7ff94 Joerg Roedel 2010-09-10 812 ec92fe44e7ff94 Joerg Roedel 2010-09-10 813 ngpa = gfn_to_gpa(ngfn); 54987b7afa902e Paolo Bonzini 2014-09-02 814 real_gfn = mmu->translate_gpa(vcpu, ngpa, access, &exception); ec92fe44e7ff94 Joerg Roedel 2010-09-10 815 if (real_gfn == UNMAPPED_GVA) ec92fe44e7ff94 Joerg Roedel 2010-09-10 816 return -EFAULT; ec92fe44e7ff94 Joerg Roedel 2010-09-10 817 ec92fe44e7ff94 Joerg Roedel 2010-09-10 818 real_gfn = gpa_to_gfn(real_gfn); ec92fe44e7ff94 Joerg Roedel 2010-09-10 819 54bf36aac52031 Paolo Bonzini 2015-04-08 820 return kvm_vcpu_read_guest_page(vcpu, real_gfn, data, offset, len); ec92fe44e7ff94 Joerg Roedel 2010-09-10 821 } ec92fe44e7ff94 Joerg Roedel 2010-09-10 822 EXPORT_SYMBOL_GPL(kvm_read_guest_page_mmu); ec92fe44e7ff94 Joerg Roedel 2010-09-10 823 :::::: The code at line 805 was first introduced by commit :::::: ec92fe44e7ff94d04d8305e49efcffd8773e1cf6 KVM: X86: Add kvm_read_guest_page_mmu function :::::: TO: Joerg Roedel <joerg.roedel(a)amd.com> :::::: CC: Avi Kivity <avi(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
by Yue Haibing 28 Aug '24

28 Aug '24

Commit 591481cccbad trigger a warning: In file included from ./include/net/genetlink.h:6, from net/wireless/nl80211.c:25: net/wireless/nl80211.c:692:69: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] 692 | [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), | ^ ./include/net/netlink.h:407:18: note: in definition of macro 'NLA_POLICY_FULL_RANGE' 407 | .range = _range, \ | ^~~~~~ Remove const qualifier to fix this. Fixes: 591481cccbad ("wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values") Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 89b94d482fcf..674a0d54aff8 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -403,7 +403,7 @@ nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + .len = IEEE80211_MAX_DATA_LEN } }; -static const struct netlink_range_validation q_range = { +static struct netlink_range_validation q_range = { .max = INT_MAX, }; -- 2.34.1

2 1

[openeuler:OLK-6.6 7193/13757] mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e59105d1ac962dacde2b6480857e834f97ca108e commit: fd855715f24e3eeadaa56de5fde21c55a14aeea0 [7193/13757] mm/mem_reliable: Fallback to dpool if reliable memory is not enough config: arm64-randconfig-r064-20240828 (https://download.01.org/0day-ci/archive/20240828/202408281109.dl4CIWeu-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281109.dl4CIWeu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281109.dl4CIWeu-lkp@intel.com/ All errors (new ones prefixed by >>): >> mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); ^ 1 error generated. vim +/dynamic_pool_should_alloc +4110 mm/page_alloc.c 4101 4102 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4103 { 4104 if (!reliable_allow_fb_enabled()) 4105 return false; 4106 4107 if (!(gfp_mask & GFP_RELIABLE)) 4108 return false; 4109 > 4110 return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); 4111 } 4112 #else 4113 static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, 4114 struct alloc_context *ac) 4115 { 4116 return NULL; 4117 } 4118 static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, 4119 struct alloc_context *ac) {} 4120 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4121 { 4122 return false; 4123 } 4124 #endif 4125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] scsi: qla2xxx: validate nvme_local_port correctly
by He Yujie 28 Aug '24

28 Aug '24

From: Nilesh Javali <njavali(a)marvell.com> mainline inclusion from mainline-v6.11-rc1 commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ0D CVE: CVE-2024-42286 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port. Cc: stable(a)vger.kernel.org Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240710171057.35066-3-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/scsi/qla2xxx/qla_nvme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c index d63ccdf6e988..f898a9cc8d06 100644 --- a/drivers/scsi/qla2xxx/qla_nvme.c +++ b/drivers/scsi/qla2xxx/qla_nvme.c @@ -27,7 +27,10 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) return 0; } - if (!vha->nvme_local_port && qla_nvme_register_hba(vha)) + if (qla_nvme_register_hba(vha)) + return 0; + + if (!vha->nvme_local_port) return 0; if (!(fcport->nvme_prli_service_param & -- 2.34.1

2 1

[PATCH OLK-5.10] scsi: qla2xxx: validate nvme_local_port correctly
by He Yujie 28 Aug '24

28 Aug '24

From: Nilesh Javali <njavali(a)marvell.com> mainline inclusion from mainline-v6.11-rc1 commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ0D CVE: CVE-2024-42286 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port. Cc: stable(a)vger.kernel.org Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240710171057.35066-3-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/scsi/qla2xxx/qla_nvme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c index 6dad7787f20d..28a5b40e0f32 100644 --- a/drivers/scsi/qla2xxx/qla_nvme.c +++ b/drivers/scsi/qla2xxx/qla_nvme.c @@ -27,7 +27,10 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) return 0; } - if (!vha->nvme_local_port && qla_nvme_register_hba(vha)) + if (qla_nvme_register_hba(vha)) + return 0; + + if (!vha->nvme_local_port) return 0; if (!(fcport->nvme_prli_service_param & -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] scsi: qla2xxx: validate nvme_local_port correctly
by He Yujie 28 Aug '24

28 Aug '24

From: Nilesh Javali <njavali(a)marvell.com> mainline inclusion from mainline-v6.11-rc1 commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ0D CVE: CVE-2024-42286 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port. Cc: stable(a)vger.kernel.org Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240710171057.35066-3-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/scsi/qla2xxx/qla_nvme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c index db367e428095..daa412667d6e 100644 --- a/drivers/scsi/qla2xxx/qla_nvme.c +++ b/drivers/scsi/qla2xxx/qla_nvme.c @@ -30,7 +30,10 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) return 0; } - if (!vha->nvme_local_port && qla_nvme_register_hba(vha)) + if (qla_nvme_register_hba(vha)) + return 0; + + if (!vha->nvme_local_port) return 0; if (!(fcport->nvme_prli_service_param & -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/4] Fix CVE-2024-40901
by Wang Wensheng 28 Aug '24

28 Aug '24

Breno Leitao (1): scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory Jia-Ju Bai (1): scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() Joe Perches (1): scsi: mpt3sas: Add ioc_<level> logging macros Suganath Prabu (1): scsi: mpt3sas: Gracefully handle online firmware update drivers/scsi/mpt3sas/mpt3sas_base.c | 120 +++++++++++++++++++++++++++- drivers/scsi/mpt3sas/mpt3sas_base.h | 11 +++ 2 files changed, 129 insertions(+), 2 deletions(-) -- 2.17.1

2 5

[openeuler:OLK-5.10 29634/30000] net/wireless/nl80211.c:692:62: error: initializing 'struct netlink_range_validation *' with an expression of type 'const struct netlink_range_validation *' discards qualifiers
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 3e3bb79c307826ef516265644ccc984250795495 commit: 591481cccbad338e0c98905d08ffd0e454886a70 [29634/30000] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values config: x86_64-buildonly-randconfig-001-20240828 (https://download.01.org/0day-ci/archive/20240828/202408281103.NN6DJ2d4-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281103.NN6DJ2d4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281103.NN6DJ2d4-lkp@intel.com/ All errors (new ones prefixed by >>): >> net/wireless/nl80211.c:692:62: error: initializing 'struct netlink_range_validation *' with an expression of type 'const struct netlink_range_validation *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers] 692 | [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), | ^~~~~~~~ include/net/netlink.h:407:11: note: expanded from macro 'NLA_POLICY_FULL_RANGE' 407 | .range = _range, \ | ^~~~~~ 1 error generated. vim +692 net/wireless/nl80211.c 409 410 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 411 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, 412 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 413 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 414 .len = 20-1 }, 415 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 416 417 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 418 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 419 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8, 420 NL80211_EDMG_CHANNELS_MIN, 421 NL80211_EDMG_CHANNELS_MAX), 422 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8, 423 NL80211_EDMG_BW_CONFIG_MIN, 424 NL80211_EDMG_BW_CONFIG_MAX), 425 426 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 427 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 428 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 429 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 430 431 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 432 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 433 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 434 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 435 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 436 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 437 438 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 439 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 440 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 441 442 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 443 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 444 445 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 446 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 447 .len = WLAN_MAX_KEY_LEN }, 448 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7), 449 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 450 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 451 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 452 [NL80211_ATTR_KEY_TYPE] = 453 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 454 455 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 456 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 457 [NL80211_ATTR_BEACON_HEAD] = 458 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, 459 IEEE80211_MAX_DATA_LEN), 460 [NL80211_ATTR_BEACON_TAIL] = 461 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 462 IEEE80211_MAX_DATA_LEN), 463 [NL80211_ATTR_STA_AID] = 464 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 465 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 466 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 467 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 468 .len = NL80211_MAX_SUPP_RATES }, 469 [NL80211_ATTR_STA_PLINK_ACTION] = 470 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 471 [NL80211_ATTR_STA_TX_POWER_SETTING] = 472 NLA_POLICY_RANGE(NLA_U8, 473 NL80211_TX_POWER_AUTOMATIC, 474 NL80211_TX_POWER_FIXED), 475 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 }, 476 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 477 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 478 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 479 .len = IEEE80211_MAX_MESH_ID_LEN }, 480 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, 481 482 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */ 483 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3), 484 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 485 486 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 487 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 488 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 489 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 490 .len = NL80211_MAX_SUPP_RATES }, 491 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 492 493 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 494 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 495 496 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN), 497 498 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 499 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 500 validate_ie_attr, 501 IEEE80211_MAX_DATA_LEN), 502 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 503 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 504 505 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 506 .len = IEEE80211_MAX_SSID_LEN }, 507 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 508 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 509 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 510 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 511 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 512 NL80211_MFP_NO, 513 NL80211_MFP_OPTIONAL), 514 [NL80211_ATTR_STA_FLAGS2] = { 515 .len = sizeof(struct nl80211_sta_flag_update), 516 }, 517 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 518 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 519 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 520 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 521 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 522 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, 523 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 524 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 525 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 526 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 527 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN), 528 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 529 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 530 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 531 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 532 .len = IEEE80211_MAX_DATA_LEN }, 533 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 534 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 535 NL80211_PS_DISABLED, 536 NL80211_PS_ENABLED), 537 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 538 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 539 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 540 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 541 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 542 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 543 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 544 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 545 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 546 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 547 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 548 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 549 [NL80211_ATTR_STA_PLINK_STATE] = 550 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 551 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, 552 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, 553 [NL80211_ATTR_MESH_PEER_AID] = 554 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 555 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 556 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 557 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 558 [NL80211_ATTR_HIDDEN_SSID] = 559 NLA_POLICY_RANGE(NLA_U32, 560 NL80211_HIDDEN_SSID_NOT_IN_USE, 561 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 562 [NL80211_ATTR_IE_PROBE_RESP] = 563 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 564 IEEE80211_MAX_DATA_LEN), 565 [NL80211_ATTR_IE_ASSOC_RESP] = 566 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 567 IEEE80211_MAX_DATA_LEN), 568 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 569 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 570 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 571 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 572 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 573 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 574 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 575 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 576 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 577 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 578 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 579 .len = IEEE80211_MAX_DATA_LEN }, 580 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 581 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 582 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 583 .len = NL80211_HT_CAPABILITY_LEN 584 }, 585 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 586 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 587 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 588 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 589 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 590 591 /* need to include at least Auth Transaction and Status Code */ 592 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4), 593 594 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN), 595 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 596 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 597 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 598 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 599 NLA_POLICY_RANGE(NLA_U32, 600 NL80211_MESH_POWER_UNKNOWN + 1, 601 NL80211_MESH_POWER_MAX), 602 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 603 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 604 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 605 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 606 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 607 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 608 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 609 .len = NL80211_VHT_CAPABILITY_LEN, 610 }, 611 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 612 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 613 .len = IEEE80211_MAX_DATA_LEN }, 614 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, 615 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = 616 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION), 617 [NL80211_ATTR_PEER_AID] = 618 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 619 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 620 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 621 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 622 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY }, 623 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY }, 624 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2), 625 /* 626 * The value of the Length field of the Supported Operating 627 * Classes element is between 2 and 253. 628 */ 629 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = 630 NLA_POLICY_RANGE(NLA_BINARY, 2, 253), 631 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 632 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 633 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 634 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 635 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 636 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY, 637 IEEE80211_QOS_MAP_LEN_MIN, 638 IEEE80211_QOS_MAP_LEN_MAX), 639 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 640 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 641 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 642 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 643 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 644 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 645 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 646 [NL80211_ATTR_USER_PRIO] = 647 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 648 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 649 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 650 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, 651 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 652 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 653 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 654 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 655 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 656 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 657 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 658 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 659 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 660 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 661 .len = VHT_MUMIMO_GROUPS_DATA_LEN 662 }, 663 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 664 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 665 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 666 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 667 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 668 .len = FILS_MAX_KEK_LEN }, 669 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN), 670 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 671 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 672 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 673 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 674 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 675 }, 676 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 677 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 678 .len = FILS_ERP_MAX_USERNAME_LEN }, 679 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 680 .len = FILS_ERP_MAX_REALM_LEN }, 681 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 682 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 683 .len = FILS_ERP_MAX_RRK_LEN }, 684 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2), 685 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 686 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN), 687 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 688 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 689 690 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 691 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, > 692 [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), 693 [NL80211_ATTR_HE_CAPABILITY] = 694 NLA_POLICY_RANGE(NLA_BINARY, 695 NL80211_HE_MIN_CAPABILITY_LEN, 696 NL80211_HE_MAX_CAPABILITY_LEN), 697 [NL80211_ATTR_FTM_RESPONDER] = 698 NLA_POLICY_NESTED(nl80211_ftm_responder_policy), 699 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), 700 [NL80211_ATTR_PEER_MEASUREMENTS] = 701 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), 702 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1), 703 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY, 704 .len = SAE_PASSWORD_MAX_LEN }, 705 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG }, 706 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy), 707 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2), 708 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy), 709 [NL80211_ATTR_TID_CONFIG] = 710 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy), 711 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG }, 712 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1), 713 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100), 714 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG }, 715 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 716 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED }, 717 [NL80211_ATTR_HE_6GHZ_CAPABILITY] = 718 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)), 719 [NL80211_ATTR_FILS_DISCOVERY] = 720 NLA_POLICY_NESTED(nl80211_fils_discovery_policy), 721 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] = 722 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy), 723 [NL80211_ATTR_S1G_CAPABILITY] = 724 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 725 [NL80211_ATTR_S1G_CAPABILITY_MASK] = 726 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 727 }; 728 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] drm/amdgpu: Fix the null pointer dereference to ras_manager
by Ye Bin 28 Aug '24

28 Aug '24

From: Ma Jun <Jun.Ma2(a)amd.com> stable inclusion from stable-v5.10.224 commit d81c1eeb333d84b3012a91c0500189dc1d71e46c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM8O CVE: CVE-2024-43908 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c11d30c95576937c6c35e6f29884761f2dddb43 ] Check ras_manager before using it Signed-off-by: Ma Jun <Jun.Ma2(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c index 454473c9db6c..88fc38df4b0b 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c @@ -1345,12 +1345,15 @@ static void amdgpu_ras_interrupt_process_handler(struct work_struct *work) int amdgpu_ras_interrupt_dispatch(struct amdgpu_device *adev, struct ras_dispatch_if *info) { - struct ras_manager *obj = amdgpu_ras_find_obj(adev, &info->head); - struct ras_ih_data *data = &obj->ih_data; + struct ras_manager *obj; + struct ras_ih_data *data; + obj = amdgpu_ras_find_obj(adev, &info->head); if (!obj) return -EINVAL; + data = &obj->ih_data; + if (data->inuse == 0) return 0; -- 2.34.1

2 1

[openeuler:OLK-5.10 27226/30000] arch/x86/kvm/x86.c:1076:6: warning: no previous prototype for 'kvm_post_set_cr4'
by kernel test robot 28 Aug '24

28 Aug '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a3e2493c22a624aefb09b92b040c97ecd2e8e2dd commit: 8a7e6f51a756aa6e88ebd5da8a5f3b6744cd07b5 [27226/30000] KVM: x86: Introduce kvm_post_set_cr4 to post handle the CR4 emulation config: x86_64-buildonly-randconfig-005-20240828 (https://download.01.org/0day-ci/archive/20240828/202408281038.faDmsrP1-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281038.faDmsrP1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281038.faDmsrP1-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kvm/x86.c:893:6: warning: no previous prototype for 'kvm_post_set_cr0' [-Wmissing-prototypes] 893 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^~~~~~~~~~~~~~~~ >> arch/x86/kvm/x86.c:1076:6: warning: no previous prototype for 'kvm_post_set_cr4' [-Wmissing-prototypes] 1076 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^~~~~~~~~~~~~~~~ vim +/kvm_post_set_cr4 +1076 arch/x86/kvm/x86.c 892 > 893 void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) 894 { 895 unsigned long update_bits = X86_CR0_PG | X86_CR0_WP; 896 897 if ((cr0 ^ old_cr0) & X86_CR0_PG) { 898 kvm_clear_async_pf_completion_queue(vcpu); 899 kvm_async_pf_hash_reset(vcpu); 900 } 901 902 if ((cr0 ^ old_cr0) & update_bits) 903 kvm_mmu_reset_context(vcpu); 904 905 if (((cr0 ^ old_cr0) & X86_CR0_CD) && 906 kvm_arch_has_noncoherent_dma(vcpu->kvm) && 907 !kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED)) 908 kvm_zap_gfn_range(vcpu->kvm, 0, ~0ULL); 909 } 910 911 int kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) 912 { 913 unsigned long old_cr0 = kvm_read_cr0(vcpu); 914 unsigned long pdptr_bits = X86_CR0_CD | X86_CR0_NW | X86_CR0_PG; 915 916 cr0 |= X86_CR0_ET; 917 918 #ifdef CONFIG_X86_64 919 if (cr0 & 0xffffffff00000000UL) 920 return 1; 921 #endif 922 923 cr0 &= ~CR0_RESERVED_BITS; 924 925 if ((cr0 & X86_CR0_NW) && !(cr0 & X86_CR0_CD)) 926 return 1; 927 928 if ((cr0 & X86_CR0_PG) && !(cr0 & X86_CR0_PE)) 929 return 1; 930 931 #ifdef CONFIG_X86_64 932 if ((vcpu->arch.efer & EFER_LME) && !is_paging(vcpu) && 933 (cr0 & X86_CR0_PG)) { 934 int cs_db, cs_l; 935 936 if (!is_pae(vcpu)) 937 return 1; 938 kvm_x86_ops.get_cs_db_l_bits(vcpu, &cs_db, &cs_l); 939 if (cs_l) 940 return 1; 941 } 942 #endif 943 if (!(vcpu->arch.efer & EFER_LME) && (cr0 & X86_CR0_PG) && 944 is_pae(vcpu) && ((cr0 ^ old_cr0) & pdptr_bits) && 945 !load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu))) 946 return 1; 947 948 if (!(cr0 & X86_CR0_PG) && kvm_read_cr4_bits(vcpu, X86_CR4_PCIDE)) 949 return 1; 950 951 kvm_x86_ops.set_cr0(vcpu, cr0); 952 953 kvm_post_set_cr0(vcpu, old_cr0, cr0); 954 955 return 0; 956 } 957 EXPORT_SYMBOL_GPL(kvm_set_cr0); 958 959 void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw) 960 { 961 (void)kvm_set_cr0(vcpu, kvm_read_cr0_bits(vcpu, ~0x0eul) | (msw & 0x0f)); 962 } 963 EXPORT_SYMBOL_GPL(kvm_lmsw); 964 965 void kvm_load_guest_xsave_state(struct kvm_vcpu *vcpu) 966 { 967 if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE)) { 968 969 if (vcpu->arch.xcr0 != host_xcr0) 970 xsetbv(XCR_XFEATURE_ENABLED_MASK, vcpu->arch.xcr0); 971 972 if (vcpu->arch.xsaves_enabled && 973 vcpu->arch.ia32_xss != host_xss) 974 wrmsrl(MSR_IA32_XSS, vcpu->arch.ia32_xss); 975 } 976 977 if (static_cpu_has(X86_FEATURE_PKU) && 978 (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) || 979 (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU)) && 980 vcpu->arch.pkru != vcpu->arch.host_pkru) 981 write_pkru(vcpu->arch.pkru); 982 } 983 EXPORT_SYMBOL_GPL(kvm_load_guest_xsave_state); 984 985 void kvm_load_host_xsave_state(struct kvm_vcpu *vcpu) 986 { 987 if (static_cpu_has(X86_FEATURE_PKU) && 988 (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) || 989 (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU))) { 990 vcpu->arch.pkru = rdpkru(); 991 if (vcpu->arch.pkru != vcpu->arch.host_pkru) 992 write_pkru(vcpu->arch.host_pkru); 993 } 994 995 if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE)) { 996 997 if (vcpu->arch.xcr0 != host_xcr0) 998 xsetbv(XCR_XFEATURE_ENABLED_MASK, host_xcr0); 999 1000 if (vcpu->arch.xsaves_enabled && 1001 vcpu->arch.ia32_xss != host_xss) 1002 wrmsrl(MSR_IA32_XSS, host_xss); 1003 } 1004 1005 } 1006 EXPORT_SYMBOL_GPL(kvm_load_host_xsave_state); 1007 1008 static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr) 1009 { 1010 u64 xcr0 = xcr; 1011 u64 old_xcr0 = vcpu->arch.xcr0; 1012 u64 valid_bits; 1013 1014 /* Only support XCR_XFEATURE_ENABLED_MASK(xcr0) now */ 1015 if (index != XCR_XFEATURE_ENABLED_MASK) 1016 return 1; 1017 if (!(xcr0 & XFEATURE_MASK_FP)) 1018 return 1; 1019 if ((xcr0 & XFEATURE_MASK_YMM) && !(xcr0 & XFEATURE_MASK_SSE)) 1020 return 1; 1021 1022 /* 1023 * Do not allow the guest to set bits that we do not support 1024 * saving. However, xcr0 bit 0 is always set, even if the 1025 * emulated CPU does not support XSAVE (see fx_init). 1026 */ 1027 valid_bits = vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FP; 1028 if (xcr0 & ~valid_bits) 1029 return 1; 1030 1031 if ((!(xcr0 & XFEATURE_MASK_BNDREGS)) != 1032 (!(xcr0 & XFEATURE_MASK_BNDCSR))) 1033 return 1; 1034 1035 if (xcr0 & XFEATURE_MASK_AVX512) { 1036 if (!(xcr0 & XFEATURE_MASK_YMM)) 1037 return 1; 1038 if ((xcr0 & XFEATURE_MASK_AVX512) != XFEATURE_MASK_AVX512) 1039 return 1; 1040 } 1041 1042 if ((xcr0 & XFEATURE_MASK_XTILE) && 1043 ((xcr0 & XFEATURE_MASK_XTILE) != XFEATURE_MASK_XTILE)) 1044 return 1; 1045 1046 vcpu->arch.xcr0 = xcr0; 1047 1048 if ((xcr0 ^ old_xcr0) & XFEATURE_MASK_EXTEND) 1049 kvm_update_cpuid_runtime(vcpu); 1050 return 0; 1051 } 1052 1053 int kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr) 1054 { 1055 if (kvm_x86_ops.get_cpl(vcpu) != 0 || 1056 __kvm_set_xcr(vcpu, index, xcr)) { 1057 kvm_inject_gp(vcpu, 0); 1058 return 1; 1059 } 1060 return 0; 1061 } 1062 EXPORT_SYMBOL_GPL(kvm_set_xcr); 1063 1064 bool kvm_is_valid_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) 1065 { 1066 if (cr4 & cr4_reserved_bits) 1067 return false; 1068 1069 if (cr4 & vcpu->arch.cr4_guest_rsvd_bits) 1070 return false; 1071 1072 return kvm_x86_ops.is_valid_cr4(vcpu, cr4); 1073 } 1074 EXPORT_SYMBOL_GPL(kvm_is_valid_cr4); 1075 > 1076 void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) 1077 { 1078 unsigned long mmu_role_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE | 1079 X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE; 1080 1081 if (((cr4 ^ old_cr4) & mmu_role_bits) || 1082 (!(cr4 & X86_CR4_PCIDE) && (old_cr4 & X86_CR4_PCIDE))) 1083 kvm_mmu_reset_context(vcpu); 1084 } 1085 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7228/13744] drivers/scsi/sssraid/sssraid_os.c:1553: undefined reference to `msi_domain_first_desc'
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e65c0786c5c765daf978c13bfe587f5426745bc7 commit: 165b3cc224374728856b5584455d7ae7f054fbe5 [7228/13744] SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers config: x86_64-randconfig-074-20240827 (https://download.01.org/0day-ci/archive/20240828/202408281025.qPre06ub-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281025.qPre06ub-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281025.qPre06ub-lkp@intel.com/ All errors (new ones prefixed by >>): ld: vmlinux.o: in function `ls2k500sfb_events_fn': drivers/video/fbdev/ls2k500sfb.c:249: undefined reference to `fg_console' ld: drivers/video/fbdev/ls2k500sfb.c:249: undefined reference to `fg_console' ld: drivers/video/fbdev/ls2k500sfb.c:249: undefined reference to `fg_console' ld: vmlinux.o: in function `sssraid_map_queues': >> drivers/scsi/sssraid/sssraid_os.c:1553: undefined reference to `msi_domain_first_desc' >> ld: drivers/scsi/sssraid/sssraid_os.c:1553: undefined reference to `msi_next_desc' vim +1553 drivers/scsi/sssraid/sssraid_os.c 1535 1536 static void sssraid_map_queues(struct Scsi_Host *shost) 1537 { 1538 struct sssraid_ioc *sdioc = shost_priv(shost); 1539 struct pci_dev *pdev = sdioc->pdev; 1540 struct msi_desc *entry = NULL; 1541 struct irq_affinity_desc *affinity = NULL; 1542 struct blk_mq_tag_set *tag_set = &shost->tag_set; 1543 struct blk_mq_queue_map *queue_map = &tag_set->map[HCTX_TYPE_DEFAULT]; 1544 const struct cpumask *node_mask = NULL; 1545 unsigned int queue_offset = queue_map->queue_offset; 1546 unsigned int *map = queue_map->mq_map; 1547 unsigned int nr_queues = queue_map->nr_queues; 1548 unsigned int node_id, node_id_last = 0xFFFFFFFF; 1549 int cpu, first_sibling, cpu_index = 0; 1550 u8 node_count = 0, i; 1551 unsigned int node_id_array[100]; 1552 > 1553 msi_for_each_desc(entry, &pdev->dev, MSI_DESC_ALL) { 1554 if (entry->irq) { 1555 affinity = entry->affinity; 1556 node_mask = &affinity->mask; 1557 1558 cpu = cpumask_first(node_mask); 1559 node_id = cpu_to_node(cpu); 1560 if (node_id_last == node_id) 1561 continue; 1562 1563 for (i = 0; i < node_count; i++) { 1564 if (node_id == node_id_array[i]) 1565 goto get_next_numa_node; 1566 } 1567 node_id_array[node_count++] = node_id; 1568 node_id_last = node_id; 1569 } 1570 get_next_numa_node: 1571 continue; 1572 } 1573 1574 for (i = 0; i < node_count; i++) { 1575 node_mask = cpumask_of_node(node_id_array[i]); 1576 dbgprint(sdioc, "NUMA_node = %d\n", node_id_array[i]); 1577 for_each_cpu(cpu, node_mask) { 1578 if (cpu_index < nr_queues) { 1579 map[cpu_index++] = queue_offset + (cpu % nr_queues); 1580 } else { 1581 first_sibling = sssraid_get_first_sibling(cpu); 1582 if (first_sibling == cpu) 1583 map[cpu_index++] = queue_offset + (cpu % nr_queues); 1584 else 1585 map[cpu_index++] = map[first_sibling]; 1586 } 1587 dbgprint(sdioc, "map[%d] = %d\n", cpu_index - 1, map[cpu_index - 1]); 1588 } 1589 } 1590 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS] drm/amdgpu: Fix the null pointer dereference to ras_manager
by Ye Bin 28 Aug '24

28 Aug '24

From: Ma Jun <Jun.Ma2(a)amd.com> stable inclusion from stable-v5.10.224 commit d81c1eeb333d84b3012a91c0500189dc1d71e46c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM8O CVE: CVE-2024-43908 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c11d30c95576937c6c35e6f29884761f2dddb43 ] Check ras_manager before using it Signed-off-by: Ma Jun <Jun.Ma2(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c index eb22a190c242..d0f6b5a49d69 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c @@ -1345,12 +1345,15 @@ static void amdgpu_ras_interrupt_process_handler(struct work_struct *work) int amdgpu_ras_interrupt_dispatch(struct amdgpu_device *adev, struct ras_dispatch_if *info) { - struct ras_manager *obj = amdgpu_ras_find_obj(adev, &info->head); - struct ras_ih_data *data = &obj->ih_data; + struct ras_manager *obj; + struct ras_ih_data *data; + obj = amdgpu_ras_find_obj(adev, &info->head); if (!obj) return -EINVAL; + data = &obj->ih_data; + if (data->inuse == 0) return 0; -- 2.34.1

2 5

[openeuler:OLK-5.10 27219/30000] arch/x86/kvm/x86.c:893:6: warning: no previous prototype for function 'kvm_post_set_cr0'
by kernel test robot 28 Aug '24

28 Aug '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a3e2493c22a624aefb09b92b040c97ecd2e8e2dd commit: 1686d271f795f8756b49151978b95b095c0598ad [27219/30000] KVM: x86: Introduce kvm_post_set_cr0 to post handle the CR0 emulation config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20240828/202408281042.WYKCGMvH-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281042.WYKCGMvH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281042.WYKCGMvH-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kvm/x86.c:893:6: warning: no previous prototype for function 'kvm_post_set_cr0' [-Wmissing-prototypes] 893 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^ arch/x86/kvm/x86.c:893:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 893 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^ | static 1 warning generated. vim +/kvm_post_set_cr0 +893 arch/x86/kvm/x86.c 892 > 893 void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) 894 { 895 unsigned long update_bits = X86_CR0_PG | X86_CR0_WP; 896 897 if ((cr0 ^ old_cr0) & X86_CR0_PG) { 898 kvm_clear_async_pf_completion_queue(vcpu); 899 kvm_async_pf_hash_reset(vcpu); 900 } 901 902 if ((cr0 ^ old_cr0) & update_bits) 903 kvm_mmu_reset_context(vcpu); 904 905 if (((cr0 ^ old_cr0) & X86_CR0_CD) && 906 kvm_arch_has_noncoherent_dma(vcpu->kvm) && 907 !kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED)) 908 kvm_zap_gfn_range(vcpu->kvm, 0, ~0ULL); 909 } 910 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 6858/13744] drivers/char/ipmi/ipmi_bt_sm.c:194:11: error: implicit declaration of function 'acpi_evaluate_integer' is invalid in C99
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e65c0786c5c765daf978c13bfe587f5426745bc7 commit: 6449ff7a5a2b148bc0a60efb3f0d723aaeceaae6 [6858/13744] ipmi: Errata workaround to prevent SMS message processing timeout config: arm64-randconfig-003-20240827 (https://download.01.org/0day-ci/archive/20240828/202408281024.R754Msvr-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281024.R754Msvr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281024.R754Msvr-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/char/ipmi/ipmi_bt_sm.c:194:11: error: implicit declaration of function 'acpi_evaluate_integer' is invalid in C99 [-Werror,-Wimplicit-function-declaration] status = acpi_evaluate_integer(handle, "SATN", NULL, &tmp); ^ drivers/char/ipmi/ipmi_bt_sm.c:194:11: note: did you mean 'acpi_evaluate_object'? include/acpi/acpixf.h:550:8: note: 'acpi_evaluate_object' declared here acpi_evaluate_object(acpi_handle object, ^ include/acpi/platform/aclinux.h:93:21: note: expanded from macro 'ACPI_EXTERNAL_RETURN_STATUS' static ACPI_INLINE prototype {return(AE_NOT_CONFIGURED);} ^ 1 error generated. vim +/acpi_evaluate_integer +194 drivers/char/ipmi/ipmi_bt_sm.c 177 178 #ifdef CONFIG_HISILICON_ERRATUM_162102203 179 /* 180 * To confirm whether the SMS_ATN flag needs to be stored and get 181 * quirk through the method reported by the BIOS. Because in special 182 * cases SMS_ATN flag bits may be lost before being processed. 183 */ 184 static bool get_sms_atn_quirk(struct si_sm_io *io) 185 { 186 acpi_handle handle; 187 acpi_status status; 188 unsigned long long tmp; 189 190 handle = ACPI_HANDLE(io->dev); 191 if (!handle) 192 return false; 193 > 194 status = acpi_evaluate_integer(handle, "SATN", NULL, &tmp); 195 if (ACPI_FAILURE(status)) 196 return false; 197 else if (tmp != 1) 198 return false; 199 200 return true; 201 } 202 #endif 203 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] drm/amdgpu: Fix the null pointer dereference to ras_manager
by Ye Bin 28 Aug '24

28 Aug '24

From: Ma Jun <Jun.Ma2(a)amd.com> stable inclusion from stable-v5.10.224 commit d81c1eeb333d84b3012a91c0500189dc1d71e46c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM8O CVE: CVE-2024-43908 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c11d30c95576937c6c35e6f29884761f2dddb43 ] Check ras_manager before using it Signed-off-by: Ma Jun <Jun.Ma2(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c index aafda5c32847..b8da22477875 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c @@ -1348,12 +1348,15 @@ static void amdgpu_ras_interrupt_process_handler(struct work_struct *work) int amdgpu_ras_interrupt_dispatch(struct amdgpu_device *adev, struct ras_dispatch_if *info) { - struct ras_manager *obj = amdgpu_ras_find_obj(adev, &info->head); - struct ras_ih_data *data = &obj->ih_data; + struct ras_manager *obj; + struct ras_ih_data *data; + obj = amdgpu_ras_find_obj(adev, &info->head); if (!obj) return -EINVAL; + data = &obj->ih_data; + if (data->inuse == 0) return 0; -- 2.34.1

2 1

[PATCH 0/4] Fix CVE-2024-40901
by Wang Wensheng 28 Aug '24

28 Aug '24

Breno Leitao (1): scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory Jia-Ju Bai (1): scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() Joe Perches (1): scsi: mpt3sas: Add ioc_<level> logging macros Suganath Prabu (1): scsi: mpt3sas: Gracefully handle online firmware update drivers/scsi/mpt3sas/mpt3sas_base.c | 120 +++++++++++++++++++++++++++- drivers/scsi/mpt3sas/mpt3sas_base.h | 11 +++ 2 files changed, 129 insertions(+), 2 deletions(-) -- 2.17.1

1 4

[PATCH OLK-6.6] jfs: Fix shift-out-of-bounds in dbDiscardAG
by GONG Ruiqi 28 Aug '24

28 Aug '24

From: Pei Li <peili.dev(a)gmail.com> stable inclusion from stable-v6.6.47 commit f650148b43949ca9e37e820804bb6026fff404f3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMML CVE: CVE-2024-44938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7063b80268e2593e58bee8a8d709c2f3ff93e2f2 ] When searching for the next smaller log2 block, BLKSTOL2() returned 0, causing shift exponent -1 to be negative. This patch fixes the issue by exiting the loop directly when negative shift is found. Reported-by: syzbot+61be3359d2ee3467e7e4(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=61be3359d2ee3467e7e4 Signed-off-by: Pei Li <peili.dev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index cb3cda1390ad..5713994328cb 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1626,6 +1626,8 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen) } else if (rc == -ENOSPC) { /* search for next smaller log2 block */ l2nb = BLKSTOL2(nblocks) - 1; + if (unlikely(l2nb < 0)) + break; nblocks = 1LL << l2nb; } else { /* Trim any already allocated blocks */ -- 2.25.1

2 1

[PATCH OLK-5.10] jfs: Fix shift-out-of-bounds in dbDiscardAG
by GONG Ruiqi 28 Aug '24

28 Aug '24

From: Pei Li <peili.dev(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit 7063b80268e2593e58bee8a8d709c2f3ff93e2f2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMML CVE: CVE-2024-44938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- When searching for the next smaller log2 block, BLKSTOL2() returned 0, causing shift exponent -1 to be negative. This patch fixes the issue by exiting the loop directly when negative shift is found. Reported-by: syzbot+61be3359d2ee3467e7e4(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=61be3359d2ee3467e7e4 Signed-off-by: Pei Li <peili.dev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index e678fa517cf7..2bbdae936076 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1694,6 +1694,8 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen) } else if (rc == -ENOSPC) { /* search for next smaller log2 block */ l2nb = BLKSTOL2(nblocks) - 1; + if (unlikely(l2nb < 0)) + break; nblocks = 1LL << l2nb; } else { /* Trim any already allocated blocks */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/4] LTS patches round
by Zhengchao Shao 28 Aug '24

28 Aug '24

LTS patches round. Neal Cardwell (1): UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open() Yousuk Seung (1): tcp: add ece_ack flag to reno sack functions Yuchung Cheng (1): net: tcp better handling of reordering then loss cases zhang kai (1): tcp: tcp_mark_head_lost is only valid for sack-tcp net/ipv4/tcp_input.c | 97 ++++++++++++++++++++------------------------ 1 file changed, 44 insertions(+), 53 deletions(-) -- 2.34.1

2 5

[openeuler:OLK-5.10 29634/30000] net/wireless/nl80211.c:692:69: warning: initialization discards 'const' qualifier from pointer target type
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b32a887db4e5c4c061e61977efabbc1d5e867aa7 commit: 591481cccbad338e0c98905d08ffd0e454886a70 [29634/30000] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20240828/202408280817.4JzsMhxK-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408280817.4JzsMhxK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408280817.4JzsMhxK-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/net/genetlink.h:6, from net/wireless/nl80211.c:25: >> net/wireless/nl80211.c:692:69: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] 692 | [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), | ^ include/net/netlink.h:407:18: note: in definition of macro 'NLA_POLICY_FULL_RANGE' 407 | .range = _range, \ | ^~~~~~ vim +/const +692 net/wireless/nl80211.c 409 410 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 411 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, 412 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 413 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 414 .len = 20-1 }, 415 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 416 417 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 418 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 419 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8, 420 NL80211_EDMG_CHANNELS_MIN, 421 NL80211_EDMG_CHANNELS_MAX), 422 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8, 423 NL80211_EDMG_BW_CONFIG_MIN, 424 NL80211_EDMG_BW_CONFIG_MAX), 425 426 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 427 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 428 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 429 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 430 431 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 432 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 433 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 434 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 435 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 436 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 437 438 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 439 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 440 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 441 442 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 443 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 444 445 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 446 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 447 .len = WLAN_MAX_KEY_LEN }, 448 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7), 449 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 450 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 451 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 452 [NL80211_ATTR_KEY_TYPE] = 453 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 454 455 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 456 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 457 [NL80211_ATTR_BEACON_HEAD] = 458 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, 459 IEEE80211_MAX_DATA_LEN), 460 [NL80211_ATTR_BEACON_TAIL] = 461 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 462 IEEE80211_MAX_DATA_LEN), 463 [NL80211_ATTR_STA_AID] = 464 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 465 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 466 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 467 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 468 .len = NL80211_MAX_SUPP_RATES }, 469 [NL80211_ATTR_STA_PLINK_ACTION] = 470 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 471 [NL80211_ATTR_STA_TX_POWER_SETTING] = 472 NLA_POLICY_RANGE(NLA_U8, 473 NL80211_TX_POWER_AUTOMATIC, 474 NL80211_TX_POWER_FIXED), 475 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 }, 476 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 477 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 478 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 479 .len = IEEE80211_MAX_MESH_ID_LEN }, 480 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, 481 482 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */ 483 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3), 484 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 485 486 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 487 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 488 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 489 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 490 .len = NL80211_MAX_SUPP_RATES }, 491 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 492 493 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 494 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 495 496 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN), 497 498 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 499 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 500 validate_ie_attr, 501 IEEE80211_MAX_DATA_LEN), 502 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 503 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 504 505 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 506 .len = IEEE80211_MAX_SSID_LEN }, 507 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 508 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 509 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 510 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 511 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 512 NL80211_MFP_NO, 513 NL80211_MFP_OPTIONAL), 514 [NL80211_ATTR_STA_FLAGS2] = { 515 .len = sizeof(struct nl80211_sta_flag_update), 516 }, 517 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 518 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 519 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 520 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 521 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 522 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, 523 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 524 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 525 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 526 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 527 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN), 528 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 529 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 530 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 531 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 532 .len = IEEE80211_MAX_DATA_LEN }, 533 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 534 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 535 NL80211_PS_DISABLED, 536 NL80211_PS_ENABLED), 537 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 538 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 539 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 540 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 541 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 542 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 543 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 544 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 545 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 546 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 547 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 548 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 549 [NL80211_ATTR_STA_PLINK_STATE] = 550 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 551 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, 552 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, 553 [NL80211_ATTR_MESH_PEER_AID] = 554 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 555 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 556 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 557 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 558 [NL80211_ATTR_HIDDEN_SSID] = 559 NLA_POLICY_RANGE(NLA_U32, 560 NL80211_HIDDEN_SSID_NOT_IN_USE, 561 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 562 [NL80211_ATTR_IE_PROBE_RESP] = 563 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 564 IEEE80211_MAX_DATA_LEN), 565 [NL80211_ATTR_IE_ASSOC_RESP] = 566 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 567 IEEE80211_MAX_DATA_LEN), 568 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 569 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 570 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 571 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 572 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 573 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 574 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 575 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 576 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 577 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 578 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 579 .len = IEEE80211_MAX_DATA_LEN }, 580 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 581 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 582 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 583 .len = NL80211_HT_CAPABILITY_LEN 584 }, 585 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 586 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 587 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 588 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 589 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 590 591 /* need to include at least Auth Transaction and Status Code */ 592 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4), 593 594 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN), 595 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 596 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 597 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 598 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 599 NLA_POLICY_RANGE(NLA_U32, 600 NL80211_MESH_POWER_UNKNOWN + 1, 601 NL80211_MESH_POWER_MAX), 602 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 603 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 604 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 605 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 606 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 607 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 608 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 609 .len = NL80211_VHT_CAPABILITY_LEN, 610 }, 611 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 612 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 613 .len = IEEE80211_MAX_DATA_LEN }, 614 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, 615 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = 616 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION), 617 [NL80211_ATTR_PEER_AID] = 618 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 619 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 620 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 621 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 622 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY }, 623 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY }, 624 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2), 625 /* 626 * The value of the Length field of the Supported Operating 627 * Classes element is between 2 and 253. 628 */ 629 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = 630 NLA_POLICY_RANGE(NLA_BINARY, 2, 253), 631 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 632 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 633 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 634 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 635 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 636 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY, 637 IEEE80211_QOS_MAP_LEN_MIN, 638 IEEE80211_QOS_MAP_LEN_MAX), 639 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 640 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 641 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 642 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 643 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 644 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 645 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 646 [NL80211_ATTR_USER_PRIO] = 647 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 648 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 649 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 650 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, 651 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 652 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 653 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 654 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 655 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 656 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 657 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 658 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 659 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 660 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 661 .len = VHT_MUMIMO_GROUPS_DATA_LEN 662 }, 663 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 664 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 665 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 666 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 667 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 668 .len = FILS_MAX_KEK_LEN }, 669 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN), 670 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 671 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 672 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 673 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 674 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 675 }, 676 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 677 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 678 .len = FILS_ERP_MAX_USERNAME_LEN }, 679 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 680 .len = FILS_ERP_MAX_REALM_LEN }, 681 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 682 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 683 .len = FILS_ERP_MAX_RRK_LEN }, 684 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2), 685 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 686 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN), 687 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 688 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 689 690 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 691 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, > 692 [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), 693 [NL80211_ATTR_HE_CAPABILITY] = 694 NLA_POLICY_RANGE(NLA_BINARY, 695 NL80211_HE_MIN_CAPABILITY_LEN, 696 NL80211_HE_MAX_CAPABILITY_LEN), 697 [NL80211_ATTR_FTM_RESPONDER] = 698 NLA_POLICY_NESTED(nl80211_ftm_responder_policy), 699 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), 700 [NL80211_ATTR_PEER_MEASUREMENTS] = 701 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), 702 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1), 703 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY, 704 .len = SAE_PASSWORD_MAX_LEN }, 705 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG }, 706 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy), 707 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2), 708 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy), 709 [NL80211_ATTR_TID_CONFIG] = 710 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy), 711 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG }, 712 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1), 713 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100), 714 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG }, 715 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 716 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED }, 717 [NL80211_ATTR_HE_6GHZ_CAPABILITY] = 718 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)), 719 [NL80211_ATTR_FILS_DISCOVERY] = 720 NLA_POLICY_NESTED(nl80211_fils_discovery_policy), 721 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] = 722 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy), 723 [NL80211_ATTR_S1G_CAPABILITY] = 724 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 725 [NL80211_ATTR_S1G_CAPABILITY_MASK] = 726 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 727 }; 728 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 27225/30000] arch/x86/kvm/x86.c:893:6: warning: no previous prototype for 'kvm_post_set_cr0'
by kernel test robot 28 Aug '24

28 Aug '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b32a887db4e5c4c061e61977efabbc1d5e867aa7 commit: 1686d271f795f8756b49151978b95b095c0598ad [27225/30000] KVM: x86: Introduce kvm_post_set_cr0 to post handle the CR0 emulation config: x86_64-buildonly-randconfig-005-20240828 (https://download.01.org/0day-ci/archive/20240828/202408280830.Hi3clUWN-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408280830.Hi3clUWN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408280830.Hi3clUWN-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kvm/x86.c:893:6: warning: no previous prototype for 'kvm_post_set_cr0' [-Wmissing-prototypes] 893 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^~~~~~~~~~~~~~~~ vim +/kvm_post_set_cr0 +893 arch/x86/kvm/x86.c 892 > 893 void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) 894 { 895 unsigned long update_bits = X86_CR0_PG | X86_CR0_WP; 896 897 if ((cr0 ^ old_cr0) & X86_CR0_PG) { 898 kvm_clear_async_pf_completion_queue(vcpu); 899 kvm_async_pf_hash_reset(vcpu); 900 } 901 902 if ((cr0 ^ old_cr0) & update_bits) 903 kvm_mmu_reset_context(vcpu); 904 905 if (((cr0 ^ old_cr0) & X86_CR0_CD) && 906 kvm_arch_has_noncoherent_dma(vcpu->kvm) && 907 !kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED)) 908 kvm_zap_gfn_range(vcpu->kvm, 0, ~0ULL); 909 } 910 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17447/23564] block/.tmp_blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 73a86ad60aabf460a4c8a0f96a1b2ddb98522fd8 commit: cbd9fe6e727ed12c1e542f74514e6dd4419f1cf6 [17447/23564] blk-mq: fix hang caused by freeze/unfreeze sequence config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240828/202408280826.MupKFjBW-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408280826.MupKFjBW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408280826.MupKFjBW-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from block/blk-mq.c:9: In file included from include/linux/backing-dev.h:15: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ block/blk-mq.c:600:44: warning: passing 8-byte aligned argument to 32-byte aligned parameter 2 of 'smp_call_function_single_async' may result in an unaligned pointer access [-Walign-mismatch] 600 | smp_call_function_single_async(ctx->cpu, &rq->csd); | ^ 2 warnings generated. >> block/.tmp_blk-mq.o: warning: objtool: blk_mq_unfreeze_queue()+0x75: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 26811/30000] include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b32a887db4e5c4c061e61977efabbc1d5e867aa7 commit: 13e5c52d7cec7621f78bce452b78785e689ed0b2 [26811/30000] cgroup_writeback: bind blkcg and memcg config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20240828/202408280725.RGVxlJvi-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408280725.RGVxlJvi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408280725.RGVxlJvi-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/sysctl.c:54: In file included from include/linux/nfs_fs.h:31: In file included from include/linux/sunrpc/auth.h:13: In file included from include/linux/sunrpc/sched.h:19: include/linux/sunrpc/xdr.h:606:10: warning: result of comparison of constant 4611686018427387903 with expression of type '__u32' (aka 'unsigned int') is always false [-Wtautological-constant-out-of-range-compare] 606 | if (len > SIZE_MAX / sizeof(*p)) | ~~~ ^ ~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sysctl.c:54: In file included from include/linux/nfs_fs.h:39: In file included from include/linux/nfs_fs_sb.h:6: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ 2 warnings generated. vim +418 include/linux/backing-dev.h 417 > 418 static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, 419 struct css_set *cset) 420 { 421 } 422 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 26549/30000] kernel/static_call_inline.c:458:5: warning: no previous prototype for 'klp_static_call_register'
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b32a887db4e5c4c061e61977efabbc1d5e867aa7 commit: 581f41f797bd88092689c43c47ee06a8ab2eec7f [26549/30000] static_call: Don't make __static_call_return0 static config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20240828/202408280714.V3WjAG3t-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408280714.V3WjAG3t-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408280714.V3WjAG3t-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/static_call_inline.c:458:5: warning: no previous prototype for 'klp_static_call_register' [-Wmissing-prototypes] 458 | int klp_static_call_register(struct module *mod) | ^~~~~~~~~~~~~~~~~~~~~~~~ vim +/klp_static_call_register +458 kernel/static_call_inline.c 457 > 458 int klp_static_call_register(struct module *mod) 459 { 460 int ret; 461 462 ret = static_call_module_notify(&static_call_module_nb, MODULE_STATE_COMING, mod); 463 return notifier_to_errno(ret); 464 } 465 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 26811/30000] include/linux/backing-dev.h:418:49: warning: 'struct cgroup_subsys' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b32a887db4e5c4c061e61977efabbc1d5e867aa7 commit: 13e5c52d7cec7621f78bce452b78785e689ed0b2 [26811/30000] cgroup_writeback: bind blkcg and memcg config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20240828/202408280630.Xx6ILcbO-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408280630.Xx6ILcbO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408280630.Xx6ILcbO-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/nfs_fs_sb.h:6, from include/linux/nfs_fs.h:39, from init/do_mounts.c:23: >> include/linux/backing-dev.h:418:49: warning: 'struct cgroup_subsys' declared inside parameter list will not be visible outside of this definition or declaration 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^~~~~~~~~~~~~ vim +418 include/linux/backing-dev.h 417 > 418 static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, 419 struct css_set *cset) 420 { 421 } 422 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 26549/30000] kernel/static_call_inline.c:468:5: warning: no previous prototype for function 'klp_static_call_register'
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b32a887db4e5c4c061e61977efabbc1d5e867aa7 commit: 581f41f797bd88092689c43c47ee06a8ab2eec7f [26549/30000] static_call: Don't make __static_call_return0 static config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20240828/202408280504.viXVjhyZ-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408280504.viXVjhyZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408280504.viXVjhyZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/static_call_inline.c:468:5: warning: no previous prototype for function 'klp_static_call_register' [-Wmissing-prototypes] 468 | int klp_static_call_register(struct module *mod) | ^ kernel/static_call_inline.c:468:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 468 | int klp_static_call_register(struct module *mod) | ^ | static 1 warning generated. vim +/klp_static_call_register +468 kernel/static_call_inline.c 467 > 468 int klp_static_call_register(struct module *mod) 469 { 470 return 0; 471 } 472 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 73a86ad60aabf460a4c8a0f96a1b2ddb98522fd8
by kernel test robot 28 Aug '24

28 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 73a86ad60aabf460a4c8a0f96a1b2ddb98522fd8 !11150 protect the fetch of ->fd[fd elapsed time: 757m configs tested: 34 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240828 gcc-14.1.0 arm64 randconfig-002-20240828 gcc-14.1.0 arm64 randconfig-003-20240828 gcc-14.1.0 arm64 randconfig-004-20240828 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240827 clang-18 x86_64 buildonly-randconfig-002-20240827 gcc-12 x86_64 buildonly-randconfig-003-20240827 gcc-12 x86_64 buildonly-randconfig-004-20240827 gcc-12 x86_64 buildonly-randconfig-005-20240827 clang-18 x86_64 buildonly-randconfig-006-20240827 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240827 clang-18 x86_64 randconfig-002-20240827 gcc-12 x86_64 randconfig-003-20240827 gcc-12 x86_64 randconfig-004-20240827 gcc-12 x86_64 randconfig-005-20240827 clang-18 x86_64 randconfig-006-20240827 gcc-12 x86_64 randconfig-011-20240827 gcc-12 x86_64 randconfig-012-20240827 gcc-12 x86_64 randconfig-013-20240827 gcc-12 x86_64 randconfig-014-20240827 clang-18 x86_64 randconfig-015-20240827 gcc-12 x86_64 randconfig-016-20240827 gcc-12 x86_64 randconfig-071-20240827 gcc-12 x86_64 randconfig-072-20240827 gcc-11 x86_64 randconfig-073-20240827 gcc-12 x86_64 randconfig-074-20240827 gcc-12 x86_64 randconfig-075-20240827 clang-18 x86_64 randconfig-076-20240827 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17249/23564] kernel/.tmp_kprobes.o: warning: objtool: register_kprobe()+0x6d4: unreachable instruction
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 73a86ad60aabf460a4c8a0f96a1b2ddb98522fd8 commit: 388c9a84a807812e7226e0e1ca606563e14a7f5a [17249/23564] kprobes: Warn if the kprobe is reregistered config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240828/202408280332.EuYU3ttl-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408280332.EuYU3ttl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408280332.EuYU3ttl-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/kprobes.c:120:14: warning: no previous prototype for function 'alloc_insn_page' [-Wmissing-prototypes] 120 | void __weak *alloc_insn_page(void) | ^ kernel/kprobes.c:120:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 120 | void __weak *alloc_insn_page(void) | ^ | static kernel/kprobes.c:125:13: warning: no previous prototype for function 'free_insn_page' [-Wmissing-prototypes] 125 | void __weak free_insn_page(void *page) | ^ kernel/kprobes.c:125:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 125 | void __weak free_insn_page(void *page) | ^ | static 2 warnings generated. kernel/kprobes.c:145: warning: Function parameter or member 'c' not described in '__get_insn_slot' >> kernel/.tmp_kprobes.o: warning: objtool: register_kprobe()+0x6d4: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] jfs: Fix shift-out-of-bounds in dbDiscardAG
by GONG Ruiqi 27 Aug '24

27 Aug '24

From: Pei Li <peili.dev(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit 7063b80268e2593e58bee8a8d709c2f3ff93e2f2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMML CVE: CVE-2024-44938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- When searching for the next smaller log2 block, BLKSTOL2() returned 0, causing shift exponent -1 to be negative. This patch fixes the issue by exiting the loop directly when negative shift is found. Reported-by: syzbot+61be3359d2ee3467e7e4(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=61be3359d2ee3467e7e4 Signed-off-by: Pei Li <peili.dev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Conflicts: fs/jfs/jfs_dmap.c [Just context conflicts: 1 vs 1LL at the next line.] Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index bd69bc08222f..2b3df1704d23 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1700,6 +1700,8 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen) } else if (rc == -ENOSPC) { /* search for next smaller log2 block */ l2nb = BLKSTOL2(nblocks) - 1; + if (unlikely(l2nb < 0)) + break; nblocks = 1 << l2nb; } else { /* Trim any already allocated blocks */ -- 2.25.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION e65c0786c5c765daf978c13bfe587f5426745bc7
by kernel test robot 27 Aug '24

27 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: e65c0786c5c765daf978c13bfe587f5426745bc7 !11156 v3 Fix CVE-2024-43869 Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kernel-virtcca_cvm_tsi.c:warning:variable-ver-is-uninitialized-when-used-here | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-001-20240827 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-002-20240827 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) `-- x86_64-buildonly-randconfig-003-20240827 `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) elapsed time: 736m configs tested: 28 configs skipped: 122 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240827 gcc-14.1.0 arm64 randconfig-002-20240827 clang-14 arm64 randconfig-003-20240827 clang-14 arm64 randconfig-004-20240827 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240827 gcc-14.1.0 loongarch randconfig-002-20240827 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240827 clang-18 x86_64 buildonly-randconfig-002-20240827 gcc-12 x86_64 buildonly-randconfig-003-20240827 gcc-12 x86_64 buildonly-randconfig-004-20240827 gcc-12 x86_64 buildonly-randconfig-005-20240827 clang-18 x86_64 buildonly-randconfig-006-20240827 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240827 clang-18 x86_64 randconfig-002-20240827 gcc-12 x86_64 randconfig-003-20240827 gcc-12 x86_64 randconfig-004-20240827 gcc-12 x86_64 randconfig-005-20240827 clang-18 x86_64 randconfig-006-20240827 gcc-12 x86_64 randconfig-011-20240827 gcc-12 x86_64 randconfig-012-20240827 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/4] kprobe support %pd/%pD type
by Ye Bin 27 Aug '24

27 Aug '24

Ye Bin (4): tracing/probes: support '%pd' type for print struct dentry's name tracing/probes: support '%pD' type for print struct file's name Documentation: tracing: add new type '%pd' and '%pD' for kprobe selftests/ftrace: add kprobe test cases for VFS type "%pd" and "%pD" Documentation/trace/kprobetrace.rst | 7 +- kernel/trace/trace.c | 2 +- kernel/trace/trace_kprobe.c | 6 ++ kernel/trace/trace_probe.c | 64 +++++++++++++++++++ kernel/trace/trace_probe.h | 2 + .../ftrace/test.d/kprobe/kprobe_args_vfs.tc | 40 ++++++++++++ 6 files changed, 118 insertions(+), 3 deletions(-) create mode 100644 tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_vfs.tc -- 2.34.1

2 5

[PATCH OLK-6.6 0/6] kprobe support %pd/%pD type
by Ye Bin 27 Aug '24

27 Aug '24

Masami Hiramatsu (Google) (1): selftests/ftrace: Fix required features for VFS type test case Ye Bin (5): tracing/probes: support '%pd' type for print struct dentry's name tracing/probes: support '%pD' type for print struct file's name Documentation: tracing: add new type '%pd' and '%pD' for kprobe selftests/ftrace: add kprobe test cases for VFS type "%pd" and "%pD" selftests/ftrace: add fprobe test cases for VFS type "%pd" and "%pD" Documentation/trace/kprobetrace.rst | 6 +- kernel/trace/trace.c | 2 +- kernel/trace/trace_fprobe.c | 6 ++ kernel/trace/trace_kprobe.c | 6 ++ kernel/trace/trace_probe.c | 63 +++++++++++++++++++ kernel/trace/trace_probe.h | 2 + .../ftrace/test.d/dynevent/fprobe_args_vfs.tc | 41 ++++++++++++ .../ftrace/test.d/kprobe/kprobe_args_vfs.tc | 40 ++++++++++++ 8 files changed, 164 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/fprobe_args_vfs.tc create mode 100644 tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_vfs.tc -- 2.34.1

2 7

[PATCH OLK-5.10] ksmbd: discard write access to the directory open
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Hobin Woo <hobin.woo(a)samsung.com> mainline inclusion from mainline-v6.10-rc7 commit e2e33caa5dc2eae7bddf88b22ce11ec3d760e5cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELQ CVE: CVE-2024-41030 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- may_open() does not allow a directory to be opened with the write access. However, some writing flags set by client result in adding write access on server, making ksmbd incompatible with FUSE file system. Simply, let's discard the write access when opening a directory. list_add corruption. next is NULL. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:26! pc : __list_add_valid+0x88/0xbc lr : __list_add_valid+0x88/0xbc Call trace: __list_add_valid+0x88/0xbc fuse_finish_open+0x11c/0x170 fuse_open_common+0x284/0x5e8 fuse_dir_open+0x14/0x24 do_dentry_open+0x2a4/0x4e0 dentry_open+0x50/0x80 smb2_open+0xbe4/0x15a4 handle_ksmbd_work+0x478/0x5ec process_one_work+0x1b4/0x448 worker_thread+0x25c/0x430 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20 Cc: stable(a)vger.kernel.org Signed-off-by: Yoonho Shin <yoonho.shin(a)samsung.com> Signed-off-by: Hobin Woo <hobin.woo(a)samsung.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..feec18445829 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -2043,15 +2043,22 @@ int smb2_tree_connect(struct ksmbd_work *work) * @access: file access flags * @disposition: file disposition flags * @may_flags: set with MAY_ flags + * @is_dir: is creating open flags for directory * * Return: file open flags */ static int smb2_create_open_flags(bool file_present, __le32 access, __le32 disposition, - int *may_flags) + int *may_flags, + bool is_dir) { int oflags = O_NONBLOCK | O_LARGEFILE; + if (is_dir) { + access &= ~FILE_WRITE_DESIRE_ACCESS_LE; + ksmbd_debug(SMB, "Discard write access to a directory\n"); + } + if (access & FILE_READ_DESIRED_ACCESS_LE && access & FILE_WRITE_DESIRE_ACCESS_LE) { oflags |= O_RDWR; @@ -2891,7 +2898,9 @@ int smb2_open(struct ksmbd_work *work) open_flags = smb2_create_open_flags(file_present, daccess, req->CreateDisposition, - &may_flags); + &may_flags, + req->CreateOptions & FILE_DIRECTORY_FILE_LE || + (file_present && S_ISDIR(d_inode(path.dentry)->i_mode))); if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { if (open_flags & O_CREAT) { -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ksmbd: discard write access to the directory open
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Hobin Woo <hobin.woo(a)samsung.com> mainline inclusion from mainline-v6.10-rc7 commit e2e33caa5dc2eae7bddf88b22ce11ec3d760e5cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELQ CVE: CVE-2024-41030 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- may_open() does not allow a directory to be opened with the write access. However, some writing flags set by client result in adding write access on server, making ksmbd incompatible with FUSE file system. Simply, let's discard the write access when opening a directory. list_add corruption. next is NULL. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:26! pc : __list_add_valid+0x88/0xbc lr : __list_add_valid+0x88/0xbc Call trace: __list_add_valid+0x88/0xbc fuse_finish_open+0x11c/0x170 fuse_open_common+0x284/0x5e8 fuse_dir_open+0x14/0x24 do_dentry_open+0x2a4/0x4e0 dentry_open+0x50/0x80 smb2_open+0xbe4/0x15a4 handle_ksmbd_work+0x478/0x5ec process_one_work+0x1b4/0x448 worker_thread+0x25c/0x430 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20 Cc: stable(a)vger.kernel.org Signed-off-by: Yoonho Shin <yoonho.shin(a)samsung.com> Signed-off-by: Hobin Woo <hobin.woo(a)samsung.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..feec18445829 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -2043,15 +2043,22 @@ int smb2_tree_connect(struct ksmbd_work *work) * @access: file access flags * @disposition: file disposition flags * @may_flags: set with MAY_ flags + * @is_dir: is creating open flags for directory * * Return: file open flags */ static int smb2_create_open_flags(bool file_present, __le32 access, __le32 disposition, - int *may_flags) + int *may_flags, + bool is_dir) { int oflags = O_NONBLOCK | O_LARGEFILE; + if (is_dir) { + access &= ~FILE_WRITE_DESIRE_ACCESS_LE; + ksmbd_debug(SMB, "Discard write access to a directory\n"); + } + if (access & FILE_READ_DESIRED_ACCESS_LE && access & FILE_WRITE_DESIRE_ACCESS_LE) { oflags |= O_RDWR; @@ -2891,7 +2898,9 @@ int smb2_open(struct ksmbd_work *work) open_flags = smb2_create_open_flags(file_present, daccess, req->CreateDisposition, - &may_flags); + &may_flags, + req->CreateOptions & FILE_DIRECTORY_FILE_LE || + (file_present && S_ISDIR(d_inode(path.dentry)->i_mode))); if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) { if (open_flags & O_CREAT) { -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drivers: core: synchronize really_probe() and dev_uevent()
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Dirk Behme <dirk.behme(a)de.bosch.com> mainline inclusion from mainline-v6.10-rc4 commit c0a40097f0bc81deafc15f9195d1fb54595cd6d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACSAA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Synchronize the dev->driver usage in really_probe() and dev_uevent(). These can run in different threads, what can result in the following race condition for dev->driver uninitialization: Thread #1: ========== really_probe() { ... probe_failed: ... device_unbind_cleanup(dev) { ... dev->driver = NULL; // <= Failed probe sets dev->driver to NULL ... } ... } Thread #2: ========== dev_uevent() { ... if (dev->driver) // If dev->driver is NULLed from really_probe() from here on, // after above check, the system crashes add_uevent_var(env, "DRIVER=%s", dev->driver->name); ... } really_probe() holds the lock, already. So nothing needs to be done there. dev_uevent() is called with lock held, often, too. But not always. What implies that we can't add any locking in dev_uevent() itself. So fix this race by adding the lock to the non-protected path. This is the path where above race is observed: dev_uevent+0x235/0x380 uevent_show+0x10c/0x1f0 <= Add lock here dev_attr_show+0x3a/0xa0 sysfs_kf_seq_show+0x17c/0x250 kernfs_seq_show+0x7c/0x90 seq_read_iter+0x2d7/0x940 kernfs_fop_read_iter+0xc6/0x310 vfs_read+0x5bc/0x6b0 ksys_read+0xeb/0x1b0 __x64_sys_read+0x42/0x50 x64_sys_call+0x27ad/0x2d30 do_syscall_64+0xcd/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Similar cases are reported by syzkaller in https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a But these are regarding the *initialization* of dev->driver dev->driver = drv; As this switches dev->driver to non-NULL these reports can be considered to be false-positives (which should be "fixed" by this commit, as well, though). The same issue was reported and tried to be fixed back in 2015 in https://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@sam… already. Fixes: 239378f16aa1 ("Driver core: add uevent vars for devices of a class") Cc: stable <stable(a)kernel.org> Cc: syzbot+ffa8143439596313a85a(a)syzkaller.appspotmail.com Cc: Ashish Sangwan <a.sangwan(a)samsung.com> Cc: Namjae Jeon <namjae.jeon(a)samsung.com> Signed-off-by: Dirk Behme <dirk.behme(a)de.bosch.com> Link: https://lore.kernel.org/r/20240513050634.3964461-1-dirk.behme@de.bosch.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/base/core.c [Resolve conflicts due to several refactor patches not merged.] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/base/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/base/core.c b/drivers/base/core.c index 1070e1bb501f..fcb5daf6604d 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -2006,8 +2006,11 @@ static ssize_t uevent_show(struct device *dev, struct device_attribute *attr, if (!env) return -ENOMEM; + /* Synchronize with really_probe() */ + device_lock(dev); /* let the kset specific function add its keys */ retval = kset->uevent_ops->uevent(kset, &dev->kobj, env); + device_unlock(dev); if (retval) goto out; -- 2.17.1

2 1

[PATCH OLK-5.10] drivers: core: synchronize really_probe() and dev_uevent()
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Dirk Behme <dirk.behme(a)de.bosch.com> mainline inclusion from mainline-v6.10-rc4 commit c0a40097f0bc81deafc15f9195d1fb54595cd6d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACSAA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Synchronize the dev->driver usage in really_probe() and dev_uevent(). These can run in different threads, what can result in the following race condition for dev->driver uninitialization: Thread #1: ========== really_probe() { ... probe_failed: ... device_unbind_cleanup(dev) { ... dev->driver = NULL; // <= Failed probe sets dev->driver to NULL ... } ... } Thread #2: ========== dev_uevent() { ... if (dev->driver) // If dev->driver is NULLed from really_probe() from here on, // after above check, the system crashes add_uevent_var(env, "DRIVER=%s", dev->driver->name); ... } really_probe() holds the lock, already. So nothing needs to be done there. dev_uevent() is called with lock held, often, too. But not always. What implies that we can't add any locking in dev_uevent() itself. So fix this race by adding the lock to the non-protected path. This is the path where above race is observed: dev_uevent+0x235/0x380 uevent_show+0x10c/0x1f0 <= Add lock here dev_attr_show+0x3a/0xa0 sysfs_kf_seq_show+0x17c/0x250 kernfs_seq_show+0x7c/0x90 seq_read_iter+0x2d7/0x940 kernfs_fop_read_iter+0xc6/0x310 vfs_read+0x5bc/0x6b0 ksys_read+0xeb/0x1b0 __x64_sys_read+0x42/0x50 x64_sys_call+0x27ad/0x2d30 do_syscall_64+0xcd/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Similar cases are reported by syzkaller in https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a But these are regarding the *initialization* of dev->driver dev->driver = drv; As this switches dev->driver to non-NULL these reports can be considered to be false-positives (which should be "fixed" by this commit, as well, though). The same issue was reported and tried to be fixed back in 2015 in https://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@sam… already. Fixes: 239378f16aa1 ("Driver core: add uevent vars for devices of a class") Cc: stable <stable(a)kernel.org> Cc: syzbot+ffa8143439596313a85a(a)syzkaller.appspotmail.com Cc: Ashish Sangwan <a.sangwan(a)samsung.com> Cc: Namjae Jeon <namjae.jeon(a)samsung.com> Signed-off-by: Dirk Behme <dirk.behme(a)de.bosch.com> Link: https://lore.kernel.org/r/20240513050634.3964461-1-dirk.behme@de.bosch.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/base/core.c [Resolve conflicts due to several refactor patches not merged.] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/base/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/base/core.c b/drivers/base/core.c index 82b50a89cedc..a5ff2a88bbeb 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -2041,8 +2041,11 @@ static ssize_t uevent_show(struct device *dev, struct device_attribute *attr, if (!env) return -ENOMEM; + /* Synchronize with really_probe() */ + device_lock(dev); /* let the kset specific function add its keys */ retval = kset->uevent_ops->uevent(kset, &dev->kobj, env); + device_unlock(dev); if (retval) goto out; -- 2.17.1

2 1

[PATCH OLK-5.10] ibmvnic: don't release napi in __ibmvnic_open()
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> mainline inclusion from mainline-v5.17-rc4 commit 61772b0908c640d0309c40f7d41d062ca4e979fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGL6 CVE: CVE-2022-48811 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If __ibmvnic_open() encounters an error such as when setting link state, it calls release_resources() which frees the napi structures needlessly. Instead, have __ibmvnic_open() only clean up the work it did so far (i.e. disable napi and irqs) and leave the rest to the callers. If caller of __ibmvnic_open() is ibmvnic_open(), it should release the resources immediately. If the caller is do_reset() or do_hard_reset(), they will release the resources on the next reset. This fixes following crash that occurred when running the drmgr command several times to add/remove a vnic interface: [102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq [102056] ibmvnic 30000003 env3: Disabling rx_scrq[7] irq [102056] ibmvnic 30000003 env3: Replenished 8 pools Kernel attempted to read user page (10) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000a3c840 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries ... CPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1 Workqueue: events_long __ibmvnic_reset [ibmvnic] NIP: c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820 REGS: c0000000548e37e0 TRAP: 0300 Not tainted (5.16.0-rc5-autotest-g6441998e2e37) MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 28248484 XER: 00000004 CFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0 GPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000 ... NIP [c000000000a3c840] napi_enable+0x20/0xc0 LR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic] Call Trace: [c0000000548e3a80] [0000000000000006] 0x6 (unreliable) [c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic] [c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic] [c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570 [c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660 [c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0 [c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 Instruction dump: 7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010 38a0fff6 e92d1100 f9210028 39200000 <e9030010> f9010020 60420000 e9210020 ---[ end trace 5f8033b08fd27706 ]--- Fixes: ed651a10875f ("ibmvnic: Updated reset handling") Reported-by: Abdul Haleem <abdhalee(a)linux.vnet.ibm.com> Signed-off-by: Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> Reviewed-by: Dany Madden <drt(a)linux.ibm.com> Link: https://lore.kernel.org/r/20220208001918.900602-1-sukadev@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/ibm/ibmvnic.c [commit bbd809305bc7 invocate release_rx_pools() if resources initialization failed, which not merged lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/ibm/ibmvnic.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c index 955eea41dc16..89b36c928b0e 100644 --- a/drivers/net/ethernet/ibm/ibmvnic.c +++ b/drivers/net/ethernet/ibm/ibmvnic.c @@ -109,6 +109,7 @@ static void release_crq_queue(struct ibmvnic_adapter *); static int __ibmvnic_set_mac(struct net_device *, u8 *); static int init_crq_queue(struct ibmvnic_adapter *adapter); static int send_query_phys_parms(struct ibmvnic_adapter *adapter); +static void ibmvnic_disable_irqs(struct ibmvnic_adapter *adapter); struct ibmvnic_stat { char name[ETH_GSTRING_LEN]; @@ -1177,7 +1178,7 @@ static int __ibmvnic_open(struct net_device *netdev) rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP); if (rc) { ibmvnic_napi_disable(adapter); - release_resources(adapter); + ibmvnic_disable_irqs(adapter); return rc; } @@ -1213,7 +1214,6 @@ static int ibmvnic_open(struct net_device *netdev) rc = init_resources(adapter); if (rc) { netdev_err(netdev, "failed to initialize resources\n"); - release_resources(adapter); goto out; } } @@ -1229,6 +1229,10 @@ static int ibmvnic_open(struct net_device *netdev) adapter->state = VNIC_OPEN; rc = 0; } + + if (rc) + release_resources(adapter); + return rc; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ibmvnic: don't release napi in __ibmvnic_open()
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> mainline inclusion from mainline-v5.17-rc4 commit 61772b0908c640d0309c40f7d41d062ca4e979fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGL6 CVE: CVE-2022-48811 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If __ibmvnic_open() encounters an error such as when setting link state, it calls release_resources() which frees the napi structures needlessly. Instead, have __ibmvnic_open() only clean up the work it did so far (i.e. disable napi and irqs) and leave the rest to the callers. If caller of __ibmvnic_open() is ibmvnic_open(), it should release the resources immediately. If the caller is do_reset() or do_hard_reset(), they will release the resources on the next reset. This fixes following crash that occurred when running the drmgr command several times to add/remove a vnic interface: [102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq [102056] ibmvnic 30000003 env3: Disabling rx_scrq[7] irq [102056] ibmvnic 30000003 env3: Replenished 8 pools Kernel attempted to read user page (10) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000a3c840 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries ... CPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1 Workqueue: events_long __ibmvnic_reset [ibmvnic] NIP: c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820 REGS: c0000000548e37e0 TRAP: 0300 Not tainted (5.16.0-rc5-autotest-g6441998e2e37) MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 28248484 XER: 00000004 CFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0 GPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000 ... NIP [c000000000a3c840] napi_enable+0x20/0xc0 LR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic] Call Trace: [c0000000548e3a80] [0000000000000006] 0x6 (unreliable) [c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic] [c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic] [c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570 [c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660 [c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0 [c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 Instruction dump: 7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010 38a0fff6 e92d1100 f9210028 39200000 <e9030010> f9010020 60420000 e9210020 ---[ end trace 5f8033b08fd27706 ]--- Fixes: ed651a10875f ("ibmvnic: Updated reset handling") Reported-by: Abdul Haleem <abdhalee(a)linux.vnet.ibm.com> Signed-off-by: Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> Reviewed-by: Dany Madden <drt(a)linux.ibm.com> Link: https://lore.kernel.org/r/20220208001918.900602-1-sukadev@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/ibm/ibmvnic.c [commit bbd809305bc7 invocate release_rx_pools() if resources initialization failed, which not merged lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/ibm/ibmvnic.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c index 48757a59fadd..6e0092937017 100644 --- a/drivers/net/ethernet/ibm/ibmvnic.c +++ b/drivers/net/ethernet/ibm/ibmvnic.c @@ -109,6 +109,7 @@ static void release_crq_queue(struct ibmvnic_adapter *); static int __ibmvnic_set_mac(struct net_device *, u8 *); static int init_crq_queue(struct ibmvnic_adapter *adapter); static int send_query_phys_parms(struct ibmvnic_adapter *adapter); +static void ibmvnic_disable_irqs(struct ibmvnic_adapter *adapter); struct ibmvnic_stat { char name[ETH_GSTRING_LEN]; @@ -1167,7 +1168,7 @@ static int __ibmvnic_open(struct net_device *netdev) rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP); if (rc) { ibmvnic_napi_disable(adapter); - release_resources(adapter); + ibmvnic_disable_irqs(adapter); return rc; } @@ -1203,7 +1204,6 @@ static int ibmvnic_open(struct net_device *netdev) rc = init_resources(adapter); if (rc) { netdev_err(netdev, "failed to initialize resources\n"); - release_resources(adapter); goto out; } } @@ -1219,6 +1219,10 @@ static int ibmvnic_open(struct net_device *netdev) adapter->state = VNIC_OPEN; rc = 0; } + + if (rc) + release_resources(adapter); + return rc; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nvme-fabrics: use reserved tag for reg read/write command
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Chunguang Xu <chunguang.xu(a)shopee.com> mainline inclusion from mainline-v6.10-rc3 commit 7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEKB CVE: CVE-2024-41082 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In some scenarios, if too many commands are issued by nvme command in the same time by user tasks, this may exhaust all tags of admin_q. If a reset (nvme reset or IO timeout) occurs before these commands finish, reconnect routine may fail to update nvme regs due to insufficient tags, which will cause kernel hang forever. In order to workaround this issue, maybe we can let reg_read32()/reg_read64()/reg_write32() use reserved tags. This maybe safe for nvmf: 1. For the disable ctrl path, we will not issue connect command 2. For the enable ctrl / fw activate path, since connect and reg_xx() are called serially. So the reserved tags may still be enough while reg_xx() use reserved tags. Signed-off-by: Chunguang Xu <chunguang.xu(a)shopee.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/fabrics.c [Ma Wupeng: BLK_MQ_REQ_RESERVED is replaced by NVME_SUBMIT_RESERVED in v6.8] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/nvme/host/fabrics.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c index 7015fba2e512..2687454351bc 100644 --- a/drivers/nvme/host/fabrics.c +++ b/drivers/nvme/host/fabrics.c @@ -151,7 +151,7 @@ int nvmf_reg_read32(struct nvme_ctrl *ctrl, u32 off, u32 *val) cmd.prop_get.offset = cpu_to_le32(off); ret = __nvme_submit_sync_cmd(ctrl->fabrics_q, &cmd, &res, NULL, 0, 0, - NVME_QID_ANY, 0, 0, false); + NVME_QID_ANY, 0, BLK_MQ_REQ_RESERVED, false); if (ret >= 0) *val = le64_to_cpu(res.u64); @@ -198,7 +198,7 @@ int nvmf_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val) cmd.prop_get.offset = cpu_to_le32(off); ret = __nvme_submit_sync_cmd(ctrl->fabrics_q, &cmd, &res, NULL, 0, 0, - NVME_QID_ANY, 0, 0, false); + NVME_QID_ANY, 0, BLK_MQ_REQ_RESERVED, false); if (ret >= 0) *val = le64_to_cpu(res.u64); @@ -244,7 +244,7 @@ int nvmf_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val) cmd.prop_set.value = cpu_to_le64(val); ret = __nvme_submit_sync_cmd(ctrl->fabrics_q, &cmd, NULL, NULL, 0, 0, - NVME_QID_ANY, 0, 0, false); + NVME_QID_ANY, 0, BLK_MQ_REQ_RESERVED, false); if (unlikely(ret)) dev_err(ctrl->device, "Property Set error: %d, offset %#x\n", -- 2.17.1

2 1

[PATCH OLK-5.10] nvme-fabrics: use reserved tag for reg read/write command
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Chunguang Xu <chunguang.xu(a)shopee.com> mainline inclusion from mainline-v6.10-rc3 commit 7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEKB CVE: CVE-2024-41082 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In some scenarios, if too many commands are issued by nvme command in the same time by user tasks, this may exhaust all tags of admin_q. If a reset (nvme reset or IO timeout) occurs before these commands finish, reconnect routine may fail to update nvme regs due to insufficient tags, which will cause kernel hang forever. In order to workaround this issue, maybe we can let reg_read32()/reg_read64()/reg_write32() use reserved tags. This maybe safe for nvmf: 1. For the disable ctrl path, we will not issue connect command 2. For the enable ctrl / fw activate path, since connect and reg_xx() are called serially. So the reserved tags may still be enough while reg_xx() use reserved tags. Signed-off-by: Chunguang Xu <chunguang.xu(a)shopee.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/fabrics.c [Ma Wupeng: BLK_MQ_REQ_RESERVED is replaced by NVME_SUBMIT_RESERVED in v6.8] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/nvme/host/fabrics.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c index 7015fba2e512..2687454351bc 100644 --- a/drivers/nvme/host/fabrics.c +++ b/drivers/nvme/host/fabrics.c @@ -151,7 +151,7 @@ int nvmf_reg_read32(struct nvme_ctrl *ctrl, u32 off, u32 *val) cmd.prop_get.offset = cpu_to_le32(off); ret = __nvme_submit_sync_cmd(ctrl->fabrics_q, &cmd, &res, NULL, 0, 0, - NVME_QID_ANY, 0, 0, false); + NVME_QID_ANY, 0, BLK_MQ_REQ_RESERVED, false); if (ret >= 0) *val = le64_to_cpu(res.u64); @@ -198,7 +198,7 @@ int nvmf_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val) cmd.prop_get.offset = cpu_to_le32(off); ret = __nvme_submit_sync_cmd(ctrl->fabrics_q, &cmd, &res, NULL, 0, 0, - NVME_QID_ANY, 0, 0, false); + NVME_QID_ANY, 0, BLK_MQ_REQ_RESERVED, false); if (ret >= 0) *val = le64_to_cpu(res.u64); @@ -244,7 +244,7 @@ int nvmf_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val) cmd.prop_set.value = cpu_to_le64(val); ret = __nvme_submit_sync_cmd(ctrl->fabrics_q, &cmd, NULL, NULL, 0, 0, - NVME_QID_ANY, 0, 0, false); + NVME_QID_ANY, 0, BLK_MQ_REQ_RESERVED, false); if (unlikely(ret)) dev_err(ctrl->device, "Property Set error: %d, offset %#x\n", -- 2.17.1

2 1

[PATCH OLK-5.10] drm/radeon: check bo_va->bo is non-NULL before using it
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> stable inclusion from stable-v6.6.42 commit f13c96e0e325a057c03f8a47734adb360e112efe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEMD CVE: CVE-2024-41060 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6fb15dcbcf4f212930350eaee174bb60ed40a536 ] The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it. Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/radeon/radeon_gem.c [Ma Wupeng: Context conflict] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/gpu/drm/radeon/radeon_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c index 75053917d213..51b6f38b5c47 100644 --- a/drivers/gpu/drm/radeon/radeon_gem.c +++ b/drivers/gpu/drm/radeon/radeon_gem.c @@ -582,7 +582,7 @@ static void radeon_gem_va_update_vm(struct radeon_device *rdev, if (r) goto error_unlock; - if (bo_va->it.start) + if (bo_va->it.start && bo_va->bo) r = radeon_vm_bo_update(rdev, bo_va, &bo_va->bo->tbo.mem); error_unlock: -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/radeon: check bo_va->bo is non-NULL before using it
by Guo Mengqi 27 Aug '24

27 Aug '24

From: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> stable inclusion from stable-v6.6.42 commit f13c96e0e325a057c03f8a47734adb360e112efe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEMD CVE: CVE-2024-41060 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6fb15dcbcf4f212930350eaee174bb60ed40a536 ] The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it. Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/radeon/radeon_gem.c [Ma Wupeng: Context conflict] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/gpu/drm/radeon/radeon_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c index e5c4271e64ed..1c9c6e49cb22 100644 --- a/drivers/gpu/drm/radeon/radeon_gem.c +++ b/drivers/gpu/drm/radeon/radeon_gem.c @@ -584,7 +584,7 @@ static void radeon_gem_va_update_vm(struct radeon_device *rdev, if (r) goto error_unlock; - if (bo_va->it.start) + if (bo_va->it.start && bo_va->bo) r = radeon_vm_bo_update(rdev, bo_va, &bo_va->bo->tbo.mem); error_unlock: -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
by Xiang Yang 27 Aug '24

27 Aug '24

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> stable inclusion from stable-v5.10.215 commit ada28eb4b9561aab93942f3224a2e41d76fe57fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S26U CVE: CVE-2023-52880 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 67c37756898a5a6b2941a13ae7260c89b54e0d88 upstream. Any unprivileged user can attach N_GSM0710 ldisc, but it requires CAP_NET_ADMIN to create a GSM network anyway. Require initial namespace CAP_NET_ADMIN to do that. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Link: https://lore.kernel.org/r/20230731185942.279611-1-cascardo@canonical.com Cc: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/n_gsm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 6cd87e71fecc..96a5e0f91c15 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2619,6 +2619,9 @@ static int gsmld_open(struct tty_struct *tty) struct gsm_mux *gsm; int ret; + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + if (tty->ops->write == NULL) return -EINVAL; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 13475/23564] net/can/j1939/.tmp_socket.o: warning: objtool: j1939_sk_queue_activate_next()+0x89: unreachable instruction
by kernel test robot 27 Aug '24

27 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 73a86ad60aabf460a4c8a0f96a1b2ddb98522fd8 commit: e0c2ee9edcacfdda0e806166eaec1310cdf9e324 [13475/23564] can: add support of SAE J1939 protocol config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240827/202408272140.3C5OLBQP-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240827/202408272140.3C5OLBQP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408272140.3C5OLBQP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/can/j1939/.tmp_socket.o: warning: objtool: j1939_sk_queue_activate_next()+0x89: unreachable instruction -- >> net/can/j1939/.tmp_transport.o: warning: objtool: j1939_xtp_abort_to_errno()+0xea: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] Fix mainline patchs
by Luo Gengkun 27 Aug '24

27 Aug '24

Breno Leitao (1): perf/x86/amd/core: Always clear status for idx Sandipan Das (1): perf/x86/amd/core: Fix overflow reset on hotplug arch/x86/events/amd/core.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] net/ipv6: Fix the RT cache flush via sysctl using a previous delay
by Liu Jian 27 Aug '24

27 Aug '24

From: Petr Pavlu <petr.pavlu(a)suse.com> stable inclusion from stable-v4.19.317 commit ebde6e8a52c68dc45b4ae354e279ba74788579e7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAMPH5 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 14a20e5b4ad998793c5f43b0330d9e1388446cf3 ] The net.ipv6.route.flush system parameter takes a value which specifies a delay used during the flush operation for aging exception routes. The written value is however not used in the currently requested flush and instead utilized only in the next one. A problem is that ipv6_sysctl_rtcache_flush() first reads the old value of net->ipv6.sysctl.flush_delay into a local delay variable and then calls proc_dointvec() which actually updates the sysctl based on the provided input. Fix the problem by switching the order of the two operations. Fixes: 4990509f19e8 ("[NETNS][IPV6]: Make sysctls route per namespace.") Signed-off-by: Petr Pavlu <petr.pavlu(a)suse.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20240607112828.30285-1-petr.pavlu@suse.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv6/route.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index e7ff0f40867b..907a5e507819 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5186,12 +5186,12 @@ int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write, if (!write) return -EINVAL; - net = (struct net *)ctl->extra1; - delay = net->ipv6.sysctl.flush_delay; ret = proc_dointvec(ctl, write, buffer, lenp, ppos); if (ret) return ret; + net = (struct net *)ctl->extra1; + delay = net->ipv6.sysctl.flush_delay; fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0); return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
by Dong Chenchen 27 Aug '24

27 Aug '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.316 commit 4f3ae7d846b4565c0b80d65ed607c3277bc984d4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAMPH5 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 581073f626e387d3e7eed55c48c8495584ead7ba ] trafgen performance considerably sank on hosts with many cores after the blamed commit. packet_read_pending() is very expensive, and calling it in af_packet fast path defeats Daniel intent in commit b013840810c2 ("packet: use percpu mmap tx frame pending refcount") tpacket_destruct_skb() makes room for one packet, we can immediately wakeup a producer, no need to completely drain the tx ring. Fixes: 89ed5b519004 ("af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Neil Horman <nhorman(a)tuxdriver.com> Cc: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://lore.kernel.org/r/20240515163358.4105915-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/packet/af_packet.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index c64bcba21e47..e26ee0486ded 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2437,8 +2437,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb) ts = __packet_set_timestamp(po, ph, skb); __packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts); - if (!packet_read_pending(&po->tx_ring)) - complete(&po->skb_completion); + complete(&po->skb_completion); } sock_wfree(skb); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
by Long Li 27 Aug '24

27 Aug '24

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v5.15.164 commit 0484adcb5fbcadd9ba0fd4485c42630f72e97da9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPVC CVE: CVE-2024-42299 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 2fef55d8f78383c8e6d6d4c014b9597375132696 upstream. If an NTFS file system is mounted to another system with different PAGE_SIZE from the original system, log->page_size will change in log_replay(), but log->page_{mask,bits} don't change correspondingly. This will cause a panic because "u32 bytes = log->page_size - page_off" will get a negative value in the later read_log_page(). Cc: stable(a)vger.kernel.org Fixes: b46acd6a6a627d876898e ("fs/ntfs3: Add NTFS journal") Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ntfs3/fslog.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index f78aa66313d2..fb56c4c33987 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -3953,6 +3953,9 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) goto out; } + log->page_mask = log->page_size - 1; + log->page_bits = blksize_bits(log->page_size); + /* If the file size has shrunk then we won't mount it. */ if (l_size < le64_to_cpu(ra2->l_size)) { err = -EINVAL; -- 2.39.2

2 1

[PATCH OLK-5.10] fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
by Long Li 27 Aug '24

27 Aug '24

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v5.15.164 commit 0484adcb5fbcadd9ba0fd4485c42630f72e97da9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPVC CVE: CVE-2024-42299 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 2fef55d8f78383c8e6d6d4c014b9597375132696 upstream. If an NTFS file system is mounted to another system with different PAGE_SIZE from the original system, log->page_size will change in log_replay(), but log->page_{mask,bits} don't change correspondingly. This will cause a panic because "u32 bytes = log->page_size - page_off" will get a negative value in the later read_log_page(). Cc: stable(a)vger.kernel.org Fixes: b46acd6a6a627d876898e ("fs/ntfs3: Add NTFS journal") Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ntfs3/fslog.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index f78aa66313d2..fb56c4c33987 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -3953,6 +3953,9 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) goto out; } + log->page_mask = log->page_size - 1; + log->page_bits = blksize_bits(log->page_size); + /* If the file size has shrunk then we won't mount it. */ if (l_size < le64_to_cpu(ra2->l_size)) { err = -EINVAL; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] tcp: fix race in tcp_v6_syn_recv_sock()
by Yue Haibing 27 Aug '24

27 Aug '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.317 commit 06f208ae0670ef97b0bf253a5523863e113026b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMPH5 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit d37fe4255abe8e7b419b90c5847e8ec2b8debb08 ] tcp_v6_syn_recv_sock() calls ip6_dst_store() before inet_sk(newsk)->pinet6 has been set up. This means ip6_dst_store() writes over the parent (listener) np->dst_cookie. This is racy because multiple threads could share the same parent and their final np->dst_cookie could be wrong. Move ip6_dst_store() call after inet_sk(newsk)->pinet6 has been changed and after the copy of parent ipv6_pinfo. Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/ipv6/tcp_ipv6.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index e3878cf00dd4..4d9c9fbef8b9 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1176,7 +1176,6 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * */ newsk->sk_gso_type = SKB_GSO_TCPV6; - ip6_dst_store(newsk, dst, NULL, NULL); inet6_sk_rx_dst_set(newsk, skb); newtcp6sk = (struct tcp6_sock *)newsk; @@ -1188,6 +1187,8 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * memcpy(newnp, np, sizeof(struct ipv6_pinfo)); + ip6_dst_store(newsk, dst, NULL, NULL); + newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr; newnp->saddr = ireq->ir_v6_loc_addr; newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] net: Backport lts-4.19 patches
by Dong Chenchen 27 Aug '24

27 Aug '24

backport lts-4.19 patches. Eric Dumazet (1): af_packet: do not call packet_read_pending() from tpacket_destruct_skb() Qingfang DENG (1): neighbour: fix unaligned access to pneigh_entry include/net/neighbour.h | 2 +- net/packet/af_packet.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/5] Bugfix patches for hns RoCE
by Chengchang Tang 27 Aug '24

27 Aug '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bugfix patches for hns roce. Chengchang Tang (4): RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS RDMA/hns: Fix possible RAS when DCA is not attached RDMA/hns: Fix a meaningless loop in active_dca_pages_proc() RDMA/hns: Fix list_*_careful() not being used in pairs Junxian Huang (1): RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler drivers/infiniband/hw/hns/hns_roce_dca.c | 60 +++++++++++++++++++-- drivers/infiniband/hw/hns/hns_roce_dca.h | 2 + drivers/infiniband/hw/hns/hns_roce_device.h | 3 ++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 ++-- drivers/infiniband/hw/hns/hns_roce_main.c | 12 +++++ drivers/infiniband/hw/hns/hns_roce_qp.c | 23 ++++++++ 6 files changed, 102 insertions(+), 7 deletions(-) -- 2.33.0

2 6

[PATCH openEuler-1.0-LTS v1 0/2] Backport bugfix for AMD SMN
by Wei Li 27 Aug '24

27 Aug '24

Backport bugfix for AMD SMN. Naveen Naidu (1): PCI: Add PCI_ERROR_RESPONSE and related definitions Yazen Ghannam (1): x86/amd_nb: Check for invalid SMN reads arch/x86/kernel/amd_nb.c | 9 ++++++++- include/linux/pci.h | 9 +++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] kobject_uevent: Fix OOB access within zap_modalias_env()
by Zhao Wenhui 27 Aug '24

27 Aug '24

From: Zijun Hu <quic_zijuhu(a)quicinc.com> mainline inclusion from mainline-v6.11-rc1 commit dd6e9894b451e7c85cceb8e9dc5432679a70e7dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXP CVE: CVE-2024-42292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove. Fixes: 9b3fa47d4a76 ("kobject: fix suppressing modalias in uevents delivered over netlink") Cc: stable(a)vger.kernel.org Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> Reviewed-by: Lk Sii <lk_sii(a)163.com> Link: https://lore.kernel.org/r/1717074877-11352-1-git-send-email-quic_zijuhu@qui… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- lib/kobject_uevent.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index b5fc7b9ce197..1af2e79b5c2d 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -430,8 +430,23 @@ static void zap_modalias_env(struct kobj_uevent_env *env) len = strlen(env->envp[i]) + 1; if (i != env->envp_idx - 1) { + /* @env->envp[] contains pointers to @env->buf[] + * with @env->buflen chars, and we are removing + * variable MODALIAS here pointed by @env->envp[i] + * with length @len as shown below: + * + * 0 @env->buf[] @env->buflen + * --------------------------------------------- + * ^ ^ ^ ^ + * | |-> @len <-| target block | + * @env->envp[0] @env->envp[i] @env->envp[i + 1] + * + * so the "target block" indicated above is moved + * backward by @len, and its right size is + * @env->buflen - (@env->envp[i + 1] - @env->envp[0]). + */ memmove(env->envp[i], env->envp[i + 1], - env->buflen - len); + env->buflen - (env->envp[i + 1] - env->envp[0])); for (j = i; j < env->envp_idx - 1; j++) env->envp[j] = env->envp[j + 1] - len; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Fix Mainline patchs
by Luo Gengkun 27 Aug '24

27 Aug '24

Breno Leitao (1): perf/x86/amd/core: Always clear status for idx Sandipan Das (1): perf/x86/amd/core: Fix overflow reset on hotplug arch/x86/events/amd/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2]
by Luo Gengkun 27 Aug '24

27 Aug '24

Breno Leitao (1): perf/x86/amd/core: Always clear status for idx Sandipan Das (1): perf/x86/amd/core: Fix overflow reset on hotplug arch/x86/events/amd/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 0/1] CVE-2024-42287
by Chen Ridong 27 Aug '24

27 Aug '24

CVE-2024-42287 Shreyas Deodhar (1): scsi: qla2xxx: Complete command early within lock drivers/scsi/qla2xxx/qla_os.c | 5 ----- 1 file changed, 5 deletions(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 12062/23560] drivers/tty/serial/.tmp_qcom_geni_serial.o: warning: objtool: qcom_geni_serial_isr()+0x6c8: unreachable instruction
by kernel test robot 27 Aug '24

27 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4ac8b0d82ef645e01323a31304f6455504295672 commit: c33757a1508dbe0d07881dbe5d82c59dcc6f28ac [12062/23560] tty: serial: qcom_geni_serial: Fix softlock config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240827/202408271554.zPOb5Yqp-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240827/202408271554.zPOb5Yqp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408271554.zPOb5Yqp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/tty/serial/.tmp_qcom_geni_serial.o: warning: objtool: qcom_geni_serial_isr()+0x6c8: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1] block: initialize integrity buffer to zero before writing it to media
by Cheng Yu 27 Aug '24

27 Aug '24

From: Christoph Hellwig <hch(a)lst.de> stable inclusion from stable-v6.6.44 commit 23a19655fb56f241e592041156dfb1c6d04da644 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5R CVE: CVE-2024-43854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f ] Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For PI metadata this is limited to the app tag that isn't used by kernel generated metadata, but for non-PI metadata the entire buffer leaks kernel memory. Fix this by adding the __GFP_ZERO flag to allocations for writes. Fixes: 7ba1ba12eeef ("block: Block layer data integrity support") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Martin K. Petersen <martin.petersen(a)oracle.com> Reviewed-by: Kanchan Joshi <joshi.k(a)samsung.com> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Link: https://lore.kernel.org/r/20240613084839.1044015-2-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: block/bio-integrity.c [This is a conflict caused by commit ce288e053568("block: remove BLK_BOUNCE_ISA support") which is not merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- block/bio-integrity.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/block/bio-integrity.c b/block/bio-integrity.c index a4cfc97275df..a5fd04db5ae8 100644 --- a/block/bio-integrity.c +++ b/block/bio-integrity.c @@ -216,6 +216,7 @@ bool bio_integrity_prep(struct bio *bio) unsigned int bytes, offset, i; unsigned int intervals; blk_status_t status; + gfp_t gfp = GFP_NOIO; if (!bi) return true; @@ -238,12 +239,20 @@ bool bio_integrity_prep(struct bio *bio) if (!bi->profile->generate_fn || !(bi->flags & BLK_INTEGRITY_GENERATE)) return true; + + /* + * Zero the memory allocated to not leak uninitialized kernel + * memory to disk. For PI this only affects the app tag, but + * for non-integrity metadata it affects the entire metadata + * buffer. + */ + gfp |= __GFP_ZERO; } intervals = bio_integrity_intervals(bi, bio_sectors(bio)); /* Allocate kernel buffer for protection data */ len = intervals * bi->tuple_size; - buf = kmalloc(len, GFP_NOIO | q->bounce_gfp); + buf = kmalloc(len, gfp | q->bounce_gfp); status = BLK_STS_RESOURCE; if (unlikely(buf == NULL)) { printk(KERN_ERR "could not allocate integrity buffer\n"); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 V1] block: initialize integrity buffer to zero before writing it to media
by Cheng Yu 27 Aug '24

27 Aug '24

From: Christoph Hellwig <hch(a)lst.de> stable inclusion from stable-v6.6.44 commit 23a19655fb56f241e592041156dfb1c6d04da644 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5R CVE: CVE-2024-43854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f ] Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For PI metadata this is limited to the app tag that isn't used by kernel generated metadata, but for non-PI metadata the entire buffer leaks kernel memory. Fix this by adding the __GFP_ZERO flag to allocations for writes. Fixes: 7ba1ba12eeef ("block: Block layer data integrity support") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Martin K. Petersen <martin.petersen(a)oracle.com> Reviewed-by: Kanchan Joshi <joshi.k(a)samsung.com> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Link: https://lore.kernel.org/r/20240613084839.1044015-2-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: block/bio-integrity.c [This is a conflict caused by commit ce288e053568("block: remove BLK_BOUNCE_ISA support") which is not merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- block/bio-integrity.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/block/bio-integrity.c b/block/bio-integrity.c index 4f6f140a44e0..3473e0133468 100644 --- a/block/bio-integrity.c +++ b/block/bio-integrity.c @@ -216,6 +216,7 @@ bool bio_integrity_prep(struct bio *bio) unsigned int bytes, offset, i; unsigned int intervals; blk_status_t status; + gfp_t gfp = GFP_NOIO; if (!bi) return true; @@ -238,12 +239,20 @@ bool bio_integrity_prep(struct bio *bio) if (!bi->profile->generate_fn || !(bi->flags & BLK_INTEGRITY_GENERATE)) return true; + + /* + * Zero the memory allocated to not leak uninitialized kernel + * memory to disk. For PI this only affects the app tag, but + * for non-integrity metadata it affects the entire metadata + * buffer. + */ + gfp |= __GFP_ZERO; } intervals = bio_integrity_intervals(bi, bio_sectors(bio)); /* Allocate kernel buffer for protection data */ len = intervals * bi->tuple_size; - buf = kmalloc(len, GFP_NOIO | q->bounce_gfp); + buf = kmalloc(len, gfp | q->bounce_gfp); status = BLK_STS_RESOURCE; if (unlikely(buf == NULL)) { printk(KERN_ERR "could not allocate integrity buffer\n"); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tcp: fix race in tcp_v6_syn_recv_sock()
by Yue Haibing 27 Aug '24

27 Aug '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.317 commit 06f208ae0670ef97b0bf253a5523863e113026b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMPH5 CVE: Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit d37fe4255abe8e7b419b90c5847e8ec2b8debb08 ] tcp_v6_syn_recv_sock() calls ip6_dst_store() before inet_sk(newsk)->pinet6 has been set up. This means ip6_dst_store() writes over the parent (listener) np->dst_cookie. This is racy because multiple threads could share the same parent and their final np->dst_cookie could be wrong. Move ip6_dst_store() call after inet_sk(newsk)->pinet6 has been changed and after the copy of parent ipv6_pinfo. Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/ipv6/tcp_ipv6.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index e3878cf00dd4..4d9c9fbef8b9 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1176,7 +1176,6 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * */ newsk->sk_gso_type = SKB_GSO_TCPV6; - ip6_dst_store(newsk, dst, NULL, NULL); inet6_sk_rx_dst_set(newsk, skb); newtcp6sk = (struct tcp6_sock *)newsk; @@ -1188,6 +1187,8 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * memcpy(newnp, np, sizeof(struct ipv6_pinfo)); + ip6_dst_store(newsk, dst, NULL, NULL); + newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr; newnp->saddr = ireq->ir_v6_loc_addr; newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] irqchip/alpine-msi: Fix off-by-one in allocation error path
by Yuntao Liu 27 Aug '24

27 Aug '24

irqchip/alpine-msi: Fix off-by-one in allocation error path Zenghui Yu (1): irqchip/alpine-msi: Fix off-by-one in allocation error path drivers/irqchip/irq-alpine-msi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] dma: fix call order in dmam_free_coherent
by Kaixiong Yu 27 Aug '24

27 Aug '24

From: Lance Richardson <rlance(a)google.com> stable inclusion from stable-v6.6.44 commit 1fe97f68fce1ba24bf823bfb0eb0956003473130 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2W CVE: CVE-2024-43856 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 28e8b7406d3a1f5329a03aa25a43aa28e087cb20 ] dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list. If this happens, there will be two entries in the devres list with the same vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match. Fix by destroying the devres entry before freeing the DMA allocation. Tested: kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03 Fixes: 9ac7849e35f7 ("devres: device resource management") Signed-off-by: Lance Richardson <rlance(a)google.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- kernel/dma/mapping.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c index 9cc1b34cab8f..9d0b026e6aba 100644 --- a/kernel/dma/mapping.c +++ b/kernel/dma/mapping.c @@ -97,8 +97,8 @@ void dmam_free_coherent(struct device *dev, size_t size, void *vaddr, { struct dma_devres match_data = { size, vaddr, dma_handle }; - dma_free_coherent(dev, size, vaddr, dma_handle); WARN_ON(devres_destroy(dev, dmam_release, dmam_match, &match_data)); + dma_free_coherent(dev, size, vaddr, dma_handle); } EXPORT_SYMBOL(dmam_free_coherent); -- 2.25.1

2 1

[PATCH OLK-5.10] dma: fix call order in dmam_free_coherent
by Kaixiong Yu 27 Aug '24

27 Aug '24

From: Lance Richardson <rlance(a)google.com> stable inclusion from stable-v6.6.44 commit 1fe97f68fce1ba24bf823bfb0eb0956003473130 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2W CVE: CVE-2024-43856 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 28e8b7406d3a1f5329a03aa25a43aa28e087cb20 ] dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list. If this happens, there will be two entries in the devres list with the same vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match. Fix by destroying the devres entry before freeing the DMA allocation. Tested: kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03 Fixes: 9ac7849e35f7 ("devres: device resource management") Signed-off-by: Lance Richardson <rlance(a)google.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- kernel/dma/mapping.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c index 51bb8fa8eb89..453c0fbe87ff 100644 --- a/kernel/dma/mapping.c +++ b/kernel/dma/mapping.c @@ -60,8 +60,8 @@ void dmam_free_coherent(struct device *dev, size_t size, void *vaddr, { struct dma_devres match_data = { size, vaddr, dma_handle }; - dma_free_coherent(dev, size, vaddr, dma_handle); WARN_ON(devres_destroy(dev, dmam_release, dmam_match, &match_data)); + dma_free_coherent(dev, size, vaddr, dma_handle); } EXPORT_SYMBOL(dmam_free_coherent); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] irqchip/alpine-msi: Fix off-by-one in allocation error path
by Yuntao Liu 27 Aug '24

27 Aug '24

irqchip/alpine-msi: Fix off-by-one in allocation error path Zenghui Yu (1): irqchip/alpine-msi: Fix off-by-one in allocation error path drivers/irqchip/irq-alpine-msi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS cbbc4774e41c354f5b0f9fc7a9be442fcee74b3f
by kernel test robot 27 Aug '24

27 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: cbbc4774e41c354f5b0f9fc7a9be442fcee74b3f !11122 fix CVE-2023-52893 elapsed time: 771m configs tested: 34 configs skipped: 127 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240827 gcc-14.1.0 arm64 randconfig-002-20240827 gcc-14.1.0 arm64 randconfig-003-20240827 gcc-14.1.0 arm64 randconfig-004-20240827 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240827 clang-18 x86_64 buildonly-randconfig-002-20240827 gcc-12 x86_64 buildonly-randconfig-003-20240827 gcc-12 x86_64 buildonly-randconfig-004-20240827 gcc-12 x86_64 buildonly-randconfig-005-20240827 clang-18 x86_64 buildonly-randconfig-006-20240827 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240827 clang-18 x86_64 randconfig-002-20240827 gcc-12 x86_64 randconfig-003-20240827 gcc-12 x86_64 randconfig-004-20240827 gcc-12 x86_64 randconfig-005-20240827 clang-18 x86_64 randconfig-006-20240827 gcc-12 x86_64 randconfig-011-20240827 gcc-12 x86_64 randconfig-012-20240827 gcc-12 x86_64 randconfig-013-20240827 gcc-12 x86_64 randconfig-014-20240827 clang-18 x86_64 randconfig-015-20240827 gcc-12 x86_64 randconfig-016-20240827 gcc-12 x86_64 randconfig-071-20240827 gcc-12 x86_64 randconfig-072-20240827 gcc-11 x86_64 randconfig-073-20240827 gcc-12 x86_64 randconfig-074-20240827 gcc-12 x86_64 randconfig-075-20240827 clang-18 x86_64 randconfig-076-20240827 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] md: restore 'noio_flag' for the last mddev_resume()
by Zheng Qixing 27 Aug '24

27 Aug '24

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.6-rc1 commit e24ed04389f9619e0aaef615a8948633c182a8b0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAMIV7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- memalloc_noio_save() is called for the first mddev_suspend(), and repeated mddev_suspend() only increase 'suspended'. However, memalloc_noio_restore() is also called for the first mddev_resume(), which means that memory reclaim will be enabled before the last mddev_resume() is called, while the array is still suspended. Fix this problem by restore 'noio_flag' for the last mddev_resume(). Fixes: 78f57ef9d50a ("md: use memalloc scope APIs in mddev_suspend()/mddev_resume()") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Link: https://lore.kernel.org/r/20230628012931.88911-3-yukuai1@huaweicloud.com Signed-off-by: Song Liu <song(a)kernel.org> Conflicts: drivers/md/md.c [The modifications made in commit 72adae23a72c ("md: Change active_io to percpu") are related to performance optimization and involve multiple parts. The conflict here is only due to inconsistencies in the context.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/md.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 6d53a4078c08..897bb0aad180 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -520,11 +520,13 @@ EXPORT_SYMBOL_GPL(mddev_suspend); void mddev_resume(struct mddev *mddev) { - /* entred the memalloc scope from mddev_suspend() */ - memalloc_noio_restore(mddev->noio_flag); lockdep_assert_held(&mddev->reconfig_mutex); if (--mddev->suspended) return; + + /* entred the memalloc scope from mddev_suspend() */ + memalloc_noio_restore(mddev->noio_flag); + wake_up(&mddev->sb_wait); mddev->pers->quiesce(mddev, 0); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] tracing: Fix overflow in get_free_elt()
by Liu Chuang 27 Aug '24

27 Aug '24

From: Tze-nan Wu <Tze-nan.Wu(a)mediatek.com> stable inclusion from stable-v4.19.320 commit 302ceb625d7b990db205a15e371f9a71238de91c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUB CVE: CVE-2024-43890 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bcf86c01ca4676316557dd482c8416ece8c2e143 upstream. "tracing_map->next_elt" in get_free_elt() is at risk of overflowing. Once it overflows, new elements can still be inserted into the tracing_map even though the maximum number of elements (`max_elts`) has been reached. Continuing to insert elements after the overflow could result in the tracing_map containing "tracing_map->max_size" elements, leaving no empty entries. If any attempt is made to insert an element into a full tracing_map using `__tracing_map_insert()`, it will cause an infinite loop with preemption disabled, leading to a CPU hang problem. Fix this by preventing any further increments to "tracing_map->next_elt" once it reaches "tracing_map->max_elt". Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Fixes: 08d43a5fa063e ("tracing: Add lock-free tracing_map") Co-developed-by: Cheng-Jui Wang <cheng-jui.wang(a)mediatek.com> Link: https://lore.kernel.org/20240805055922.6277-1-Tze-nan.Wu@mediatek.com Signed-off-by: Cheng-Jui Wang <cheng-jui.wang(a)mediatek.com> Signed-off-by: Tze-nan Wu <Tze-nan.Wu(a)mediatek.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- kernel/trace/tracing_map.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index da7337f0c9bc..5e534ef6d695 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -451,7 +451,7 @@ static struct tracing_map_elt *get_free_elt(struct tracing_map *map) struct tracing_map_elt *elt = NULL; int idx; - idx = atomic_inc_return(&map->next_elt); + idx = atomic_fetch_add_unless(&map->next_elt, 1, map->max_elts); if (idx < map->max_elts) { elt = *(TRACING_MAP_ELT(map->elts, idx)); if (map->ops && map->ops->elt_init) @@ -696,7 +696,7 @@ void tracing_map_clear(struct tracing_map *map) { unsigned int i; - atomic_set(&map->next_elt, -1); + atomic_set(&map->next_elt, 0); atomic64_set(&map->hits, 0); atomic64_set(&map->drops, 0); @@ -780,7 +780,7 @@ struct tracing_map *tracing_map_create(unsigned int map_bits, map->map_bits = map_bits; map->max_elts = (1 << map_bits); - atomic_set(&map->next_elt, -1); + atomic_set(&map->next_elt, 0); map->map_size = (1 << (map_bits + 1)); map->ops = ops; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] tracing: Fix overflow in get_free_elt()
by Liu Chuang 27 Aug '24

27 Aug '24

From: Tze-nan Wu <Tze-nan.Wu(a)mediatek.com> stable inclusion from stable-v5.10.224 commit eb223bf01e688dfe37e813c8988ee11c8c9f8d0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUB CVE: CVE-2024-43890 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bcf86c01ca4676316557dd482c8416ece8c2e143 upstream. "tracing_map->next_elt" in get_free_elt() is at risk of overflowing. Once it overflows, new elements can still be inserted into the tracing_map even though the maximum number of elements (`max_elts`) has been reached. Continuing to insert elements after the overflow could result in the tracing_map containing "tracing_map->max_size" elements, leaving no empty entries. If any attempt is made to insert an element into a full tracing_map using `__tracing_map_insert()`, it will cause an infinite loop with preemption disabled, leading to a CPU hang problem. Fix this by preventing any further increments to "tracing_map->next_elt" once it reaches "tracing_map->max_elt". Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Fixes: 08d43a5fa063e ("tracing: Add lock-free tracing_map") Co-developed-by: Cheng-Jui Wang <cheng-jui.wang(a)mediatek.com> Link: https://lore.kernel.org/20240805055922.6277-1-Tze-nan.Wu@mediatek.com Signed-off-by: Cheng-Jui Wang <cheng-jui.wang(a)mediatek.com> Signed-off-by: Tze-nan Wu <Tze-nan.Wu(a)mediatek.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- kernel/trace/tracing_map.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index d47641f9740b..e6cc8d5ab1a4 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -454,7 +454,7 @@ static struct tracing_map_elt *get_free_elt(struct tracing_map *map) struct tracing_map_elt *elt = NULL; int idx; - idx = atomic_inc_return(&map->next_elt); + idx = atomic_fetch_add_unless(&map->next_elt, 1, map->max_elts); if (idx < map->max_elts) { elt = *(TRACING_MAP_ELT(map->elts, idx)); if (map->ops && map->ops->elt_init) @@ -699,7 +699,7 @@ void tracing_map_clear(struct tracing_map *map) { unsigned int i; - atomic_set(&map->next_elt, -1); + atomic_set(&map->next_elt, 0); atomic64_set(&map->hits, 0); atomic64_set(&map->drops, 0); @@ -783,7 +783,7 @@ struct tracing_map *tracing_map_create(unsigned int map_bits, map->map_bits = map_bits; map->max_elts = (1 << map_bits); - atomic_set(&map->next_elt, -1); + atomic_set(&map->next_elt, 0); map->map_size = (1 << (map_bits + 1)); map->ops = ops; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Fix overflow in get_free_elt()
by Liu Chuang 27 Aug '24

27 Aug '24

From: Tze-nan Wu <Tze-nan.Wu(a)mediatek.com> stable inclusion from stable-v5.10.224 commit eb223bf01e688dfe37e813c8988ee11c8c9f8d0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUB CVE: CVE-2024-43890 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bcf86c01ca4676316557dd482c8416ece8c2e143 upstream. "tracing_map->next_elt" in get_free_elt() is at risk of overflowing. Once it overflows, new elements can still be inserted into the tracing_map even though the maximum number of elements (`max_elts`) has been reached. Continuing to insert elements after the overflow could result in the tracing_map containing "tracing_map->max_size" elements, leaving no empty entries. If any attempt is made to insert an element into a full tracing_map using `__tracing_map_insert()`, it will cause an infinite loop with preemption disabled, leading to a CPU hang problem. Fix this by preventing any further increments to "tracing_map->next_elt" once it reaches "tracing_map->max_elt". Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Fixes: 08d43a5fa063e ("tracing: Add lock-free tracing_map") Co-developed-by: Cheng-Jui Wang <cheng-jui.wang(a)mediatek.com> Link: https://lore.kernel.org/20240805055922.6277-1-Tze-nan.Wu@mediatek.com Signed-off-by: Cheng-Jui Wang <cheng-jui.wang(a)mediatek.com> Signed-off-by: Tze-nan Wu <Tze-nan.Wu(a)mediatek.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- kernel/trace/tracing_map.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index d47641f9740b..e6cc8d5ab1a4 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -454,7 +454,7 @@ static struct tracing_map_elt *get_free_elt(struct tracing_map *map) struct tracing_map_elt *elt = NULL; int idx; - idx = atomic_inc_return(&map->next_elt); + idx = atomic_fetch_add_unless(&map->next_elt, 1, map->max_elts); if (idx < map->max_elts) { elt = *(TRACING_MAP_ELT(map->elts, idx)); if (map->ops && map->ops->elt_init) @@ -699,7 +699,7 @@ void tracing_map_clear(struct tracing_map *map) { unsigned int i; - atomic_set(&map->next_elt, -1); + atomic_set(&map->next_elt, 0); atomic64_set(&map->hits, 0); atomic64_set(&map->drops, 0); @@ -783,7 +783,7 @@ struct tracing_map *tracing_map_create(unsigned int map_bits, map->map_bits = map_bits; map->max_elts = (1 << map_bits); - atomic_set(&map->next_elt, -1); + atomic_set(&map->next_elt, 0); map->map_size = (1 << (map_bits + 1)); map->ops = ops; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 10069/23560] net/mac80211/.tmp_mlme.o: warning: objtool: ieee80211_sta_rx_queued_mgmt()+0x21c3: unreachable instruction
by kernel test robot 27 Aug '24

27 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cbbc4774e41c354f5b0f9fc7a9be442fcee74b3f commit: 3d9b47cc5bf272c32ac3004c433a102db71407c2 [10069/23560] mac80211: Reject malformed SSID elements config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240827/202408270942.wU6VgBgJ-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240827/202408270942.wU6VgBgJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408270942.wU6VgBgJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/mac80211/.tmp_mlme.o: warning: objtool: ieee80211_sta_rx_queued_mgmt()+0x21c3: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS b17777fccf5a57968815d48b9e2e6f8999725850
by kernel test robot 27 Aug '24

27 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: b17777fccf5a57968815d48b9e2e6f8999725850 !11071 【olk 5.10】net: hns3: add some feature patches elapsed time: 761m configs tested: 35 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240827 gcc-14.1.0 arm64 randconfig-002-20240827 clang-14 arm64 randconfig-003-20240827 clang-14 arm64 randconfig-004-20240827 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240827 clang-18 x86_64 buildonly-randconfig-002-20240827 gcc-12 x86_64 buildonly-randconfig-003-20240827 gcc-12 x86_64 buildonly-randconfig-004-20240827 gcc-12 x86_64 buildonly-randconfig-005-20240827 clang-18 x86_64 buildonly-randconfig-006-20240827 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240827 clang-18 x86_64 randconfig-002-20240827 gcc-12 x86_64 randconfig-003-20240827 gcc-12 x86_64 randconfig-004-20240827 gcc-12 x86_64 randconfig-005-20240827 clang-18 x86_64 randconfig-006-20240827 gcc-12 x86_64 randconfig-011-20240827 gcc-12 x86_64 randconfig-012-20240827 gcc-12 x86_64 randconfig-013-20240827 gcc-12 x86_64 randconfig-014-20240827 clang-18 x86_64 randconfig-015-20240827 gcc-12 x86_64 randconfig-016-20240827 gcc-12 x86_64 randconfig-071-20240827 gcc-12 x86_64 randconfig-072-20240827 gcc-11 x86_64 randconfig-073-20240827 gcc-12 x86_64 randconfig-074-20240827 gcc-12 x86_64 randconfig-075-20240827 clang-18 x86_64 randconfig-076-20240827 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 8969/23560] fs/btrfs/.tmp_inode.o: warning: objtool: run_delalloc_nocow()+0x62c: unreachable instruction
by kernel test robot 27 Aug '24

27 Aug '24

Hi Nikolay, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cbbc4774e41c354f5b0f9fc7a9be442fcee74b3f commit: c5bcfc0da15495ae5441f91a2572559e7e44142c [8969/23560] btrfs: Remove extent_io_ops::fill_delalloc config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240827/202408270310.2w8xfOVc-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240827/202408270310.2w8xfOVc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408270310.2w8xfOVc-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/btrfs/inode.c:8: In file included from include/linux/buffer_head.h:14: include/linux/pagemap.h:401:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 401 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/btrfs/inode.c:2776:16: warning: variable 'inode' set but not used [-Wunused-but-set-variable] 2776 | struct inode *inode; | ^ fs/btrfs/inode.c:6727:6: warning: variable 'drop_on_err' set but not used [-Wunused-but-set-variable] 6727 | int drop_on_err = 0; | ^ 3 warnings generated. >> fs/btrfs/.tmp_inode.o: warning: objtool: run_delalloc_nocow()+0x62c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 41c1e56bf85bfb57a3804161dc15f38855a513ae
by kernel test robot 27 Aug '24

27 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 41c1e56bf85bfb57a3804161dc15f38855a513ae !11100 exec: Fix ToCToU between perm check and set-uid/gid usage Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kernel-virtcca_cvm_tsi.c:warning:variable-ver-is-uninitialized-when-used-here | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-003-20240826 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-005-20240826 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-006-20240826 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-randconfig-003-20240826 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | `-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier `-- x86_64-randconfig-076-20240826 |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier `-- vmlinux.o:warning:objtool:amd_set_spi_freq-falls-through-to-next-function-amd_spi_busy_wait() elapsed time: 743m configs tested: 38 configs skipped: 124 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240826 clang-20 arm64 randconfig-002-20240826 gcc-14.1.0 arm64 randconfig-003-20240826 gcc-14.1.0 arm64 randconfig-004-20240826 clang-15 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240826 gcc-14.1.0 loongarch randconfig-002-20240826 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240826 clang-18 x86_64 buildonly-randconfig-002-20240826 gcc-12 x86_64 buildonly-randconfig-003-20240826 gcc-12 x86_64 buildonly-randconfig-004-20240826 gcc-12 x86_64 buildonly-randconfig-005-20240826 clang-18 x86_64 buildonly-randconfig-006-20240826 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240826 gcc-12 x86_64 randconfig-002-20240826 clang-18 x86_64 randconfig-003-20240826 clang-18 x86_64 randconfig-004-20240826 clang-18 x86_64 randconfig-005-20240826 gcc-12 x86_64 randconfig-006-20240826 clang-18 x86_64 randconfig-011-20240826 clang-18 x86_64 randconfig-012-20240826 clang-18 x86_64 randconfig-013-20240826 gcc-12 x86_64 randconfig-014-20240826 gcc-12 x86_64 randconfig-015-20240826 clang-18 x86_64 randconfig-016-20240826 clang-18 x86_64 randconfig-071-20240826 clang-18 x86_64 randconfig-072-20240826 clang-18 x86_64 randconfig-073-20240826 clang-18 x86_64 randconfig-074-20240826 gcc-12 x86_64 randconfig-075-20240826 gcc-12 x86_64 randconfig-076-20240826 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS] tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
by Xiang Yang 26 Aug '24

26 Aug '24

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> stable inclusion from stable-v5.10.215 commit ada28eb4b9561aab93942f3224a2e41d76fe57fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S26U CVE: CVE-2023-52880 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 67c37756898a5a6b2941a13ae7260c89b54e0d88 upstream. Any unprivileged user can attach N_GSM0710 ldisc, but it requires CAP_NET_ADMIN to create a GSM network anyway. Require initial namespace CAP_NET_ADMIN to do that. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Link: https://lore.kernel.org/r/20230731185942.279611-1-cascardo@canonical.com Cc: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/n_gsm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 6cd87e71fecc..96a5e0f91c15 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2619,6 +2619,9 @@ static int gsmld_open(struct tty_struct *tty) struct gsm_mux *gsm; int ret; + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + if (tty->ops->write == NULL) return -EINVAL; -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-42267
by Yongqiang Liu 26 Aug '24

26 Aug '24

Zhe Qiao (1): riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() arch/riscv/mm/fault.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) -- 2.25.1

2 2