- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 V4 00/12] sched: basic infrastructure for scheduler bpf
by Guan Jing 11 Jan '24

11 Jan '24

sched: basic infrastructure for scheduler bpf Guan Jing (12): sched: programmable: Introduce bpf sched sched: programmable: Add a tag for the task sched: programmable: Add a tag for the task group sched: programmable: Add user interface of task group tag sched: programmable: Add user interface of task tag sched: basic infrastructure for scheduler bpf sched: introduce bpf_sched_enable() libbpf: add support for scheduler bpf programs bpftool: recognize scheduler programs sched: programmable: Add hook in select_task_rq_fair() sched: programmable: Add hook in can_migrate_task() openeuler_defconfig: enable CONFIG_BPF_SCHED arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/proc/base.c | 64 ++++++++++++++ include/linux/bpf_sched.h | 50 +++++++++++ include/linux/bpf_types.h | 4 + include/linux/sched.h | 28 ++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 2 + init/init_task.c | 3 + kernel/bpf/Kconfig | 12 +++ kernel/bpf/btf.c | 1 + kernel/bpf/syscall.c | 27 ++++++ kernel/bpf/trampoline.c | 1 + kernel/bpf/verifier.c | 11 ++- kernel/sched/bpf_sched.c | 64 ++++++++++++++ kernel/sched/build_utility.c | 4 + kernel/sched/core.c | 118 +++++++++++++++++++++++++ kernel/sched/fair.c | 45 ++++++++++ kernel/sched/sched.h | 10 +++ scripts/bpf_doc.py | 2 + tools/include/uapi/linux/bpf.h | 2 + tools/lib/bpf/bpf.c | 1 + tools/lib/bpf/libbpf.c | 23 ++++- tools/lib/bpf/libbpf.h | 2 + tools/lib/bpf/libbpf.map | 1 + 25 files changed, 479 insertions(+), 2 deletions(-) create mode 100644 include/linux/bpf_sched.h create mode 100644 include/linux/sched_hook_defs.h create mode 100644 kernel/sched/bpf_sched.c -- 2.34.1

2 13

[PATCH OLK-6.6 000/124] arm_mpam: support mpam feature in OLK-6.6 repo
by Zeng Heng 11 Jan '24

11 Jan '24

Amit Singh Tomar (1): fs/resctrl: Remove the limit on the number of CLOSID Babu Moger (9): x86/resctrl: Add multiple tasks to the resctrl group at once x86/resctrl: Simplify rftype flag definitions x86/resctrl: Rename rftype flags for consistency x86/resctrl: Unwind properly from rdt_enable_ctx() x86/resctrl: Move default group file creation to mount x86/resctrl: Introduce "-o debug" mount option x86/resctrl: Display CLOSID for resource group x86/resctrl: Add support for the files of MON groups only x86/resctrl: Display RMID of resource group Fenghua Yu (1): x86/resctrl: Add sparse_masks file in info James Morse (104): tick/nohz: Move tick_nohz_full_mask declaration outside the #ifdef x86/resctrl: kfree() rmid_ptrs from resctrl_exit() x86/resctrl: Create helper for RMID allocation and mondata dir creation x86/resctrl: Move rmid allocation out of mkdir_rdt_prepare() x86/resctrl: Track the closid with the rmid x86/resctrl: Access per-rmid structures by index x86/resctrl: Allow RMID allocation to be scoped by CLOSID x86/resctrl: Track the number of dirty RMID a CLOSID has x86/resctrl: Use __set_bit()/__clear_bit() instead of open coding x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid x86/resctrl: Move CLOSID/RMID matching and setting to use helpers x86/resctrl: Add cpumask_any_housekeeping() for limbo/overflow x86/resctrl: Queue mon_event_read() instead of sending an IPI x86/resctrl: Allow resctrl_arch_rmid_read() to sleep x86/resctrl: Allow arch to allocate memory needed in resctrl_arch_rmid_read() x86/resctrl: Make resctrl_mounted checks explicit x86/resctrl: Move alloc/mon static keys into helpers x86/resctrl: Make rdt_enable_key the arch's decision to switch x86/resctrl: Add helpers for system wide mon/alloc capable x86/resctrl: Add CPU online callback for resctrl work x86/resctrl: Allow overflow/limbo handlers to be scheduled on any-but cpu x86/resctrl: Add CPU offline callback for resctrl work x86/resctrl: Move domain helper migration into resctrl_offline_cpu() x86/resctrl: Separate arch and fs resctrl locks x86/resctrl: Add a helper to avoid reaching into the arch code resource list x86/resctrl: Move ctrlval string parsing links away from the arch code x86/resctrl: Add helper for setting CPU default properties x86/resctrl: Remove rdtgroup from update_cpu_closid_rmid() x86/resctrl: Export resctrl fs's init function x86/resctrl: Wrap resctrl_arch_find_domain() around rdt_find_domain() x86/resctrl: Move resctrl types to a separate header x86/resctrl: Add a resctrl helper to reset all the resources x86/resctrl: Move monitor init work to a resctrl init call x86/resctrl: Move monitor exit work to a restrl exit call x86/resctrl: Move max_{name,data}_width into resctrl code x86/resctrl: Stop using the for_each_*_rdt_resource() walkers x86/resctrl: Export the is_mbm_*_enabled() helpers to asm/resctrl.h x86/resctrl: Add resctrl_arch_is_evt_configurable() to abstract BMEC x86/resctrl: Change mon_event_config_{read,write}() to be arch helpers x86/resctrl: Allow resctrl_arch_mon_event_config_write() to return an error x86/resctrl: Allow an architecture to disable pseudo lock x86/resctrl: Make prefetch_disable_bits belong to the arch code x86/resctrl: Make resctrl_arch_pseudo_lock_fn() take a plr x86/resctrl: Move thread_throttle_mode_init() to be managed by resctrl x86/resctrl: Move get_config_index() to a header x86/resctrl: Claim get_domain_from_cpu() for resctrl x86/resctrl: Describe resctrl's bitmap size assumptions x86/resctrl: Drop __init/__exit on assorted symbols fs/resctrl: Add boiler plate for external resctrl code x86/resctrl: Move the filesystem bits to headers visible to fs/resctrl x86/resctrl: Move the filesystem portions of resctrl to live in '/fs/' arm64: head.S: Initialise MPAM EL2 registers and disable traps arm64: cpufeature: discover CPU support for MPAM KVM: arm64: Fix missing traps of guest accesses to the MPAM registers KVM: arm64: Disable MPAM visibility by default, and handle traps arm64: mpam: Context switch the MPAM registers untested: KVM: arm64: Force guest EL1 to use user-space's partid configuration ACPI / PPTT: Provide a helper to walk processor containers ACPI / PPTT: Find PPTT cache level by ID ACPI / PPTT: Add a helper to fill a cpumask from a processor container ACPI / PPTT: Add a helper to fill a cpumask from a cache_id cacheinfo: Expose the code to generate a cache-id from a device_node drivers: base: cacheinfo: Add helper to find the cache size from cpu+level ACPI / MPAM: Parse the MPAM table arm_mpam: Add probe/remove for mpam msc driver and kbuild boiler plate arm_mpam: Add the class and component structures for ris firmware described arm_mpam: Add MPAM MSC register layout definitions arm_mpam: Add cpuhp callbacks to probe MSC hardware arm_mpam: Probe MSCs to find the supported partid/pmg values arm_mpam: Probe the hardware features resctrl supports arm_mpam: Merge supported features during mpam_enable() into mpam_class arm_mpam: Reset MSC controls from cpu hp callbacks arm_mpam: Add a helper to touch an MSC from any CPU arm_mpam: Extend reset logic to allow devices to be reset any time arm_mpam: Register and enable IRQs arm_mpam: Use the arch static key to indicate when mpam is enabled arm_mpam: Allow configuration to be applied and restored during cpu online arm_mpam: Probe and reset the rest of the features arm_mpam: Add helpers to allocate monitors arm_mpam: Add mpam_msmon_read() to read monitor value arm_mpam: Track bandwidth counter state for overflow and power management arm_mpam: Add helper to reset saved mbwu state arm_mpam: resctrl: Add boilerplate cpuhp and domain allocation arm_mpam: resctrl: Pick the caches we will use as resctrl resources arm_mpam: resctrl: Pick a value for num_rmid arm_mpam: resctrl: Implement resctrl_arch_reset_resources() arm_mpam: resctrl: Add resctrl_arch_get_config() arm_mpam: resctrl: Implement helpers to update configuration arm_mpam: resctrl: Add CDP emulation arm64: mpam: Add helpers to change a tasks and cpu mpam partid/pmg values arm_mpam: resctrl: Add rmid index helpers untested: arm_mpam: resctrl: Add support for MB resource untested: arm_mpam: resctrl: Add support for mbm counters arm_mpam: resctrl: Allow resctrl to allocate monitors arm_mpam: resctrl: Add resctrl_arch_rmid_read() and resctrl_arch_reset_rmid() untested: arm_mpam: resctrl: Allow monitors to be configured arm_mpam: resctrl: Add empty definitions for pseudo lock arm_mpam: resctrl: Add empty definitions for fine-grained enables arm_mpam: resctrl: Add dummy definition for free running counters arm64: mpam: Select ARCH_HAS_CPU_RESCTRL perf/arm-cmn: Stop claiming all the resources arm_mpam: resctrl: Tell resctrl about cpu/domain online/offline arm_mpam: resctrl: Call resctrl_exit() in the event of errors arm_mpam: resctrl: Update the rmid reallocation limit Maciej Wieczor-Retman (3): x86/resctrl: Fix remaining kernel-doc warnings x86/resctrl: Rename arch_has_sparse_bitmaps x86/resctrl: Enable non-contiguous CBMs in Intel CAT Rob Herring (3): cacheinfo: Allow for >32-bit cache 'id' cacheinfo: Set cache 'id' based on DT data dt-bindings: arm: Add MPAM MSC binding Rohit Mathew (2): arm_mpam: Probe for long/lwd mbwu counters arm_mpam: Use long MBWU counters if supported Zeng Heng (1): arm_mpam: control memory bandwidth with hard limit flag .../arch/arm64/cpu-feature-registers.rst | 2 + Documentation/arch/x86/resctrl.rst | 22 +- .../devicetree/bindings/arm/arm,mpam-msc.yaml | 227 + MAINTAINERS | 2 + arch/Kconfig | 8 + arch/arm64/Kconfig | 22 +- arch/arm64/include/asm/cpu.h | 1 + arch/arm64/include/asm/cpufeature.h | 13 + arch/arm64/include/asm/el2_setup.h | 16 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/mpam.h | 167 + arch/arm64/include/asm/resctrl.h | 1 + arch/arm64/include/asm/sysreg.h | 8 + arch/arm64/include/asm/thread_info.h | 3 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/cpufeature.c | 68 + arch/arm64/kernel/cpuinfo.c | 4 + arch/arm64/kernel/image-vars.h | 5 + arch/arm64/kernel/mpam.c | 23 + arch/arm64/kernel/process.c | 7 + arch/arm64/kvm/hyp/include/hyp/switch.h | 32 + arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 27 + arch/arm64/kvm/hyp/nvhe/switch.c | 11 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 1 + arch/arm64/kvm/sys_regs.c | 70 +- arch/arm64/tools/cpucaps | 1 + arch/arm64/tools/sysreg | 33 + arch/x86/Kconfig | 5 +- arch/x86/include/asm/resctrl.h | 131 +- arch/x86/kernel/cpu/resctrl/core.c | 212 +- arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 476 +- arch/x86/kernel/cpu/resctrl/internal.h | 394 +- arch/x86/kernel/cpu/resctrl/monitor.c | 594 +-- arch/x86/kernel/cpu/resctrl/pseudo_lock.c | 1123 +---- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 3916 +--------------- drivers/acpi/arm64/Kconfig | 3 + drivers/acpi/arm64/Makefile | 2 + drivers/acpi/arm64/mpam.c | 369 ++ drivers/acpi/pptt.c | 278 +- drivers/acpi/tables.c | 2 +- drivers/base/cacheinfo.c | 41 +- drivers/perf/arm-cmn.c | 12 +- drivers/platform/Kconfig | 2 + drivers/platform/Makefile | 1 + drivers/platform/mpam/Kconfig | 8 + drivers/platform/mpam/Makefile | 1 + drivers/platform/mpam/mpam_devices.c | 2422 ++++++++++ drivers/platform/mpam/mpam_internal.h | 576 +++ drivers/platform/mpam/mpam_resctrl.c | 1209 +++++ fs/Kconfig | 1 + fs/Makefile | 1 + fs/resctrl/Kconfig | 23 + fs/resctrl/Makefile | 1 + fs/resctrl/ctrlmondata.c | 528 +++ fs/resctrl/internal.h | 313 ++ fs/resctrl/monitor.c | 859 ++++ fs/resctrl/psuedo_lock.c | 1134 +++++ fs/resctrl/rdtgroup.c | 4015 +++++++++++++++++ include/linux/acpi.h | 17 + include/linux/arm_mpam.h | 105 + include/linux/cacheinfo.h | 30 +- include/linux/resctrl.h | 203 +- include/linux/resctrl_types.h | 98 + include/linux/tick.h | 9 +- 64 files changed, 13418 insertions(+), 6472 deletions(-) create mode 100644 Documentation/devicetree/bindings/arm/arm,mpam-msc.yaml create mode 100644 arch/arm64/include/asm/mpam.h create mode 100644 arch/arm64/include/asm/resctrl.h create mode 100644 arch/arm64/kernel/mpam.c create mode 100644 drivers/acpi/arm64/mpam.c create mode 100644 drivers/platform/mpam/Kconfig create mode 100644 drivers/platform/mpam/Makefile create mode 100644 drivers/platform/mpam/mpam_devices.c create mode 100644 drivers/platform/mpam/mpam_internal.h create mode 100644 drivers/platform/mpam/mpam_resctrl.c create mode 100644 fs/resctrl/Kconfig create mode 100644 fs/resctrl/Makefile create mode 100644 fs/resctrl/ctrlmondata.c create mode 100644 fs/resctrl/internal.h create mode 100644 fs/resctrl/monitor.c create mode 100644 fs/resctrl/psuedo_lock.c create mode 100644 fs/resctrl/rdtgroup.c create mode 100644 include/linux/arm_mpam.h create mode 100644 include/linux/resctrl_types.h -- 2.25.1

2 125

[PATCH OLK-5.10] drm/radeon: possible buffer overflow
by Baogen Shang 11 Jan '24

11 Jan '24

From: Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> stable inclusion from stable-v5.10.205 commit 7b063c93bece827fde237fae1c101bceeee4e896 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AS5P CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit dd05484f99d16715a88eedfca363828ef9a4c2d4 ] Buffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is checked after access. Fixes: 5cc4e5fc293b ("drm/radeon: Cleanup HDMI audio interrupt handling for evergreen") Co-developed-by: Ivanov Mikhail <ivanov.mikhail1(a)huawei-partners.com> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/radeon/evergreen.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c index 11e3e99a9f01..96dbf595254c 100644 --- a/drivers/gpu/drm/radeon/evergreen.c +++ b/drivers/gpu/drm/radeon/evergreen.c @@ -4819,14 +4819,15 @@ int evergreen_irq_process(struct radeon_device *rdev) break; case 44: /* hdmi */ afmt_idx = src_data; - if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG)) - DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); - if (afmt_idx > 5) { DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data); break; } + + if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG)) + DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); + afmt_status[afmt_idx] &= ~AFMT_AZ_FORMAT_WTRIG; queue_hdmi = true; DRM_DEBUG("IH: HDMI%d\n", afmt_idx + 1); -- 2.33.0

1 0

[PATCH openEuler-1.0-LTS v2] time: Handle negative seconds correctly in timespec64_to_ns()
by liwei 11 Jan '24

11 Jan '24

From: Lukas Hannen <lukas.hannen(a)opensource.tttech-industrial.com> mainline inclusion from mainline-v5.15-rc1 commit 39ff83f2f6cc5cc1458dfcea9697f96338210beb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8MCB5 CVE: NA --------------------------- timespec64_ns() prevents multiplication overflows by comparing the seconds value of the timespec to KTIME_SEC_MAX. If the value is greater or equal it returns KTIME_MAX. But that check casts the signed seconds value to unsigned which makes the comparision true for all negative values and therefore return wrongly KTIME_MAX. Negative second values are perfectly valid and required in some places, e.g. ptp_clock_adjtime(). Remove the cast and add a check for the negative boundary which is required to prevent undefined behaviour due to multiplication underflow. Fixes: cb47755725da ("time: Prevent undefined behaviour in timespec64_to_ns()")' Signed-off-by: Lukas Hannen <lukas.hannen(a)opensource.tttech-industrial.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/AM6PR01MB541637BD6F336B8FFB72AF80EEC69@AM6PR01MB5… Signed-off-by: liwei <liwei728(a)huawei.com> --- include/linux/time64.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/include/linux/time64.h b/include/linux/time64.h index e58f59674ad6..681c2e34034a 100644 --- a/include/linux/time64.h +++ b/include/linux/time64.h @@ -39,7 +39,9 @@ struct itimerspec64 { /* Located here for timespec[64]_valid_strict */ #define TIME64_MAX ((s64)~((u64)1 << 63)) #define KTIME_MAX ((s64)~((u64)1 << 63)) +#define KTIME_MIN (-KTIME_MAX - 1) #define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) +#define KTIME_SEC_MIN (KTIME_MIN / NSEC_PER_SEC) /* * Limits for settimeofday(): @@ -140,10 +142,13 @@ static inline bool timespec64_valid_settod(const struct timespec64 *ts) */ static inline s64 timespec64_to_ns(const struct timespec64 *ts) { - /* Prevent multiplication overflow */ - if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX) + /* Prevent multiplication overflow / underflow */ + if (ts->tv_sec >= KTIME_SEC_MAX) return KTIME_MAX; + if (ts->tv_sec <= KTIME_SEC_MIN) + return KTIME_MIN; + return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2] timerqueue: Use rb_entry_safe() in timerqueue_getnext()
by liwei 11 Jan '24

11 Jan '24

From: Barnabás Pőcze <pobrn(a)protonmail.com> mainline inclusion from mainline-v6.2-rc1 commit 2f117484329b233455ee278f2d9b0a4356835060 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8MCB5 CVE: NA --------------------------- When `timerqueue_getnext()` is called on an empty timer queue, it will use `rb_entry()` on a NULL pointer, which is invalid. Fix that by using `rb_entry_safe()` which handles NULL pointers. This has not caused any issues so far because the offset of the `rb_node` member in `timerqueue_node` is 0, so `rb_entry()` is essentially a no-op. Fixes: 511885d7061e ("lib/timerqueue: Rely on rbtree semantics for next timer") Signed-off-by: Barnabás Pőcze <pobrn(a)protonmail.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20221114195421.342929-1-pobrn@protonmail.com Signed-off-by: liwei <liwei728(a)huawei.com> --- include/linux/timerqueue.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/timerqueue.h b/include/linux/timerqueue.h index f71c1ce1421f..bcc0afc62522 100644 --- a/include/linux/timerqueue.h +++ b/include/linux/timerqueue.h @@ -40,7 +40,7 @@ struct timerqueue_node *timerqueue_getnext(struct timerqueue_head *head) { struct rb_node *leftmost = rb_first_cached(&head->rb_root); - return rb_entry(leftmost, struct timerqueue_node, node); + return rb_entry_safe(leftmost, struct timerqueue_node, node); } static inline void timerqueue_init(struct timerqueue_node *node) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2] efi/x86: Map the entire EFI vendor string before copying it
by liwei 11 Jan '24

11 Jan '24

From: Ard Biesheuvel <ardb(a)kernel.org> mainline inclusion from mainline-v5.6-rc1 commit ffc2760bcf2dba0dbef74013ed73eea8310cc52c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8MCB5 CVE: NA --------------------------- Fix a couple of issues with the way we map and copy the vendor string: - we map only 2 bytes, which usually works since you get at least a page, but if the vendor string happens to cross a page boundary, a crash will result - only call early_memunmap() if early_memremap() succeeded, or we will call it with a NULL address which it doesn't like, - while at it, switch to early_memremap_ro(), and array indexing rather than pointer dereferencing to read the CHAR16 characters. Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> Cc: Arvind Sankar <nivedita(a)alum.mit.edu> Cc: Matthew Garrett <mjg59(a)google.com> Cc: linux-efi(a)vger.kernel.org Fixes: 5b83683f32b1 ("x86: EFI runtime service support") Link: https://lkml.kernel.org/r/20200103113953.9571-5-ardb@kernel.org Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/platform/efi/efi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index b8cb57edd424..d8f295926485 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -446,7 +446,6 @@ void __init efi_init(void) efi_char16_t *c16; char vendor[100] = "unknown"; int i = 0; - void *tmp; #ifdef CONFIG_X86_32 if (boot_params.efi_info.efi_systab_hi || @@ -471,14 +470,16 @@ void __init efi_init(void) /* * Show what we know for posterity */ - c16 = tmp = early_memremap(efi.systab->fw_vendor, 2); + c16 = early_memremap_ro(efi.systab->fw_vendor, + sizeof(vendor) * sizeof(efi_char16_t)); if (c16) { - for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i) - vendor[i] = *c16++; + for (i = 0; i < sizeof(vendor) - 1 && c16[i]; ++i) + vendor[i] = c16[i]; vendor[i] = '\0'; - } else + early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t)); + } else { pr_err("Could not map the firmware vendor!\n"); - early_memunmap(tmp, 2); + } pr_info("EFI v%u.%.02u by %s\n", efi.systab->hdr.revision >> 16, -- 2.25.1

2 1

[PATCH OLK-5.10] drm/radeon: possible buffer overflow
by Baogen Shang 11 Jan '24

11 Jan '24

From: Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> stable inclusion from stable-v5.10.205 commit 7b063c93bece827fde237fae1c101bceeee4e896 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AS5P CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit dd05484f99d16715a88eedfca363828ef9a4c2d4 ] Buffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is checked after access. Fixes: 5cc4e5fc293b ("drm/radeon: Cleanup HDMI audio interrupt handling for evergreen") Co-developed-by: Ivanov Mikhail <ivanov.mikhail1(a)huawei-partners.com> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/radeon/evergreen.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c index 11e3e99a9f01..96dbf595254c 100644 --- a/drivers/gpu/drm/radeon/evergreen.c +++ b/drivers/gpu/drm/radeon/evergreen.c @@ -4819,14 +4819,15 @@ int evergreen_irq_process(struct radeon_device *rdev) break; case 44: /* hdmi */ afmt_idx = src_data; - if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG)) - DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); - if (afmt_idx > 5) { DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data); break; } + + if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG)) + DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); + afmt_status[afmt_idx] &= ~AFMT_AZ_FORMAT_WTRIG; queue_hdmi = true; DRM_DEBUG("IH: HDMI%d\n", afmt_idx + 1); -- 2.33.0

1 0

[PATCH openEuler-1.0-LTS] efi/x86: Map the entire EFI vendor string before copying it
by liwei 11 Jan '24

11 Jan '24

From: Ard Biesheuvel <ardb(a)kernel.org> mainline inclusion form mainline-v5.6-rc1 commit ffc2760bcf2dba0dbef74013ed73eea8310cc52c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8MCB5 CVE: NA ---------------------------------- Fix a couple of issues with the way we map and copy the vendor string: - we map only 2 bytes, which usually works since you get at least a page, but if the vendor string happens to cross a page boundary, a crash will result - only call early_memunmap() if early_memremap() succeeded, or we will call it with a NULL address which it doesn't like, - while at it, switch to early_memremap_ro(), and array indexing rather than pointer dereferencing to read the CHAR16 characters. Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> Cc: Arvind Sankar <nivedita(a)alum.mit.edu> Cc: Matthew Garrett <mjg59(a)google.com> Cc: linux-efi(a)vger.kernel.org Fixes: 5b83683f32b1 ("x86: EFI runtime service support") Link: https://lkml.kernel.org/r/20200103113953.9571-5-ardb@kernel.org Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/platform/efi/efi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index b8cb57edd424..d8f295926485 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -446,7 +446,6 @@ void __init efi_init(void) efi_char16_t *c16; char vendor[100] = "unknown"; int i = 0; - void *tmp; #ifdef CONFIG_X86_32 if (boot_params.efi_info.efi_systab_hi || @@ -471,14 +470,16 @@ void __init efi_init(void) /* * Show what we know for posterity */ - c16 = tmp = early_memremap(efi.systab->fw_vendor, 2); + c16 = early_memremap_ro(efi.systab->fw_vendor, + sizeof(vendor) * sizeof(efi_char16_t)); if (c16) { - for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i) - vendor[i] = *c16++; + for (i = 0; i < sizeof(vendor) - 1 && c16[i]; ++i) + vendor[i] = c16[i]; vendor[i] = '\0'; - } else + early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t)); + } else { pr_err("Could not map the firmware vendor!\n"); - early_memunmap(tmp, 2); + } pr_info("EFI v%u.%.02u by %s\n", efi.systab->hdr.revision >> 16, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] timerqueue: Use rb_entry_safe() in timerqueue_getnext()
by liwei 11 Jan '24

11 Jan '24

From: Barnabás Pőcze <pobrn(a)protonmail.com> mainline inclusion form mainline-v6.2-rc1 commit 2f117484329b233455ee278f2d9b0a4356835060 category: bugfix https://gitee.com/openeuler/kernel/issues/I8MCB5 CVE: NA ---------------------------------- When `timerqueue_getnext()` is called on an empty timer queue, it will use `rb_entry()` on a NULL pointer, which is invalid. Fix that by using `rb_entry_safe()` which handles NULL pointers. This has not caused any issues so far because the offset of the `rb_node` member in `timerqueue_node` is 0, so `rb_entry()` is essentially a no-op. Fixes: 511885d7061e ("lib/timerqueue: Rely on rbtree semantics for next timer") Signed-off-by: Barnabás Pőcze <pobrn(a)protonmail.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20221114195421.342929-1-pobrn@protonmail.com Signed-off-by: liwei <liwei728(a)huawei.com> --- include/linux/timerqueue.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/timerqueue.h b/include/linux/timerqueue.h index f71c1ce1421f..bcc0afc62522 100644 --- a/include/linux/timerqueue.h +++ b/include/linux/timerqueue.h @@ -40,7 +40,7 @@ struct timerqueue_node *timerqueue_getnext(struct timerqueue_head *head) { struct rb_node *leftmost = rb_first_cached(&head->rb_root); - return rb_entry(leftmost, struct timerqueue_node, node); + return rb_entry_safe(leftmost, struct timerqueue_node, node); } static inline void timerqueue_init(struct timerqueue_node *node) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] time: Handle negative seconds correctly in timespec64_to_ns()
by liwei 11 Jan '24

11 Jan '24

From: Lukas Hannen <lukas.hannen(a)opensource.tttech-industrial.com> mainline inclusion form mainline-v5.15-rc1 commit 39ff83f2f6cc5cc1458dfcea9697f96338210beb category: bugfix https://gitee.com/openeuler/kernel/issues/I8MCB5 CVE: NA ---------------------------------- timespec64_ns() prevents multiplication overflows by comparing the seconds value of the timespec to KTIME_SEC_MAX. If the value is greater or equal it returns KTIME_MAX. But that check casts the signed seconds value to unsigned which makes the comparision true for all negative values and therefore return wrongly KTIME_MAX. Negative second values are perfectly valid and required in some places, e.g. ptp_clock_adjtime(). Remove the cast and add a check for the negative boundary which is required to prevent undefined behaviour due to multiplication underflow. Fixes: cb47755725da ("time: Prevent undefined behaviour in timespec64_to_ns()")' Signed-off-by: Lukas Hannen <lukas.hannen(a)opensource.tttech-industrial.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/AM6PR01MB541637BD6F336B8FFB72AF80EEC69@AM6PR01MB5… Signed-off-by: liwei <liwei728(a)huawei.com> --- include/linux/time64.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/include/linux/time64.h b/include/linux/time64.h index e58f59674ad6..681c2e34034a 100644 --- a/include/linux/time64.h +++ b/include/linux/time64.h @@ -39,7 +39,9 @@ struct itimerspec64 { /* Located here for timespec[64]_valid_strict */ #define TIME64_MAX ((s64)~((u64)1 << 63)) #define KTIME_MAX ((s64)~((u64)1 << 63)) +#define KTIME_MIN (-KTIME_MAX - 1) #define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) +#define KTIME_SEC_MIN (KTIME_MIN / NSEC_PER_SEC) /* * Limits for settimeofday(): @@ -140,10 +142,13 @@ static inline bool timespec64_valid_settod(const struct timespec64 *ts) */ static inline s64 timespec64_to_ns(const struct timespec64 *ts) { - /* Prevent multiplication overflow */ - if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX) + /* Prevent multiplication overflow / underflow */ + if (ts->tv_sec >= KTIME_SEC_MAX) return KTIME_MAX; + if (ts->tv_sec <= KTIME_SEC_MIN) + return KTIME_MIN; + return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec; } -- 2.25.1

2 1

2024

2023

2022

2021

2020

2019

Kernel