- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] PCI/ASPM: Fix link state exit during switch upstream function removal
by Qi Xi 29 Apr '25

29 Apr '25

From: Daniel Stodden <daniel.stodden(a)gmail.com> mainline inclusion from mainline-v6.15-rc1 commit cbf937dcadfd571a434f8074d057b32cd14fbea5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QT2 CVE: CVE-2024-58093 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM link only after the last function on the bus pertaining to the given link was removed. That was too late. If function 0 is removed before sibling function, link->downstream would point to free'd memory after. After above change, we freed the ASPM parent link state upon any function removal on the bus pertaining to a given link. That is too early. If the link is to a PCIe switch with MFD on the upstream port, then removing functions other than 0 first would free a link which still remains parent_link to the remaining downstream ports. The resulting GPFs are especially frequent during hot-unplug, because pciehp removes devices on the link bus in reverse order. On that switch, function 0 is the virtual P2P bridge to the internal bus. Free exactly when function 0 is removed -- before the parent link is obsolete, but after all subordinate links are gone. Link: https://lore.kernel.org/r/e12898835f25234561c9d7de4435590d957b85d9.17349248… Fixes: 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free") Signed-off-by: Daniel Stodden <dns(a)arista.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Conflicts: drivers/pci/pcie/aspm.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/pci/pcie/aspm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c index a4b78c2bfc40..5add61365b2b 100644 --- a/drivers/pci/pcie/aspm.c +++ b/drivers/pci/pcie/aspm.c @@ -977,16 +977,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) parent_link = link->parent; /* - * link->downstream is a pointer to the pci_dev of function 0. If - * we remove that function, the pci_dev is about to be deallocated, - * so we can't use link->downstream again. Free the link state to - * avoid this. + * Free the parent link state, no later than function 0 (i.e. + * link->downstream) being removed. * - * If we're removing a non-0 function, it's possible we could - * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends - * programming the same ASPM Control value for all functions of - * multi-function devices, so disable ASPM for all of them. + * Do not free the link state any earlier. If function 0 is a + * switch upstream port, this link state is parent_link to all + * subordinate ones. */ + if (pdev != link->downstream) + goto out; + pcie_config_aspm_link(link, 0); list_del(&link->sibling); free_link_state(link); @@ -999,6 +999,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) pcie_aspm_update_sysfs_visibility(parent); +out: mutex_unlock(&aspm_lock); up_read(&pci_bus_sem); } -- 2.33.0

2 1

[PATCH OLK-6.6 v2] tracing: Verify event formats that have "%*p.."
by Pu Lehui 29 Apr '25

29 Apr '25

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.15-rc1 commit ea8d7647f9ddf1f81e2027ed305299797299aa03 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4TFV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory. The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses "%*p.." the verifier will ignore it, and that could be dangerous. Cover this case as well. Also add to the sample code a use case of "%*pbl". Link: https://lore.kernel.org/all/bcba4d76-2c3f-4d11-baf0-02905db953dd@oracle.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Fixes: 5013f454a352c ("tracing: Add check of trace event print fmts for dereferencing pointers") Link: https://lore.kernel.org/20250327195311.2d89ec66@gandalf.local.home Reported-by: Libo Chen <libo.chen(a)oracle.com> Reviewed-by: Libo Chen <libo.chen(a)oracle.com> Tested-by: Libo Chen <libo.chen(a)oracle.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_events.c samples/trace_events/trace-events-sample.h [The conflicts were due to some minor issues] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/trace_events.c | 7 +++++++ samples/trace_events/trace-events-sample.h | 8 ++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 9d22745cdea5..f2e07d470784 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -470,6 +470,7 @@ static void test_event_printk(struct trace_event_call *call) case '%': continue; case 'p': + do_pointer: /* Find dereferencing fields */ switch (fmt[i + 1]) { case 'B': case 'R': case 'r': @@ -498,6 +499,12 @@ static void test_event_printk(struct trace_event_call *call) continue; if (fmt[i + j] == '*') { star = true; + /* Handle %*pbl case */ + if (!j && fmt[i + 1] == 'p') { + arg++; + i++; + goto do_pointer; + } continue; } if ((fmt[i + j] == 's')) { diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h index 1c6b843b8c4e..6a5d4717f37a 100644 --- a/samples/trace_events/trace-events-sample.h +++ b/samples/trace_events/trace-events-sample.h @@ -315,7 +315,8 @@ TRACE_EVENT(foo_bar, __assign_cpumask(cpum, cpumask_bits(mask)); ), - TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s", __entry->foo, __entry->bar, + TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s [%d] %*pbl", + __entry->foo, __entry->bar, /* * Notice here the use of some helper functions. This includes: @@ -360,7 +361,10 @@ TRACE_EVENT(foo_bar, __get_dynamic_array_len(list) / sizeof(int), sizeof(int)), __get_str(str), __get_bitmask(cpus), __get_cpumask(cpum), - __get_str(vstr)) + __get_str(vstr), + __get_dynamic_array_len(cpus), + __get_dynamic_array_len(cpus), + __get_dynamic_array(cpus)) ); /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2022-49429
by Yongqiang Liu 29 Apr '25

29 Apr '25

CVE-2022-49429 Douglas Miller (1): RDMA/hfi1: Prevent panic when SDMA is disabled drivers/infiniband/hw/hfi1/file_ops.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49626
by Yongqiang Liu 29 Apr '25

29 Apr '25

CVE-2022-49626 Íñigo Huguet (2): sfc: error code if SRIOV cannot be disabled sfc: fix use after free when disabling sriov drivers/net/ethernet/sfc/ef10_sriov.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] mpage: fix softlockup in mpage_readahead()
by Zheng Qixing 29 Apr '25

29 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBYXQD --------------------------- When using null_blk with a large readahead window, calling madvise to trigger readahead can lead to system softlocks. This occurs because the CPU can remain in the mpage_readahead loop for extended periods without rescheduling, preventing other processes from running. The issue manifests as follows: Call Trace: bio_add_page+0x7f/0x120 bio_add_folio+0x24/0x40 do_mpage_readpage+0x6de/0xbc0 xas_load+0x1e/0x240 xa_load+0x8f/0xf0 mpage_readahead+0xe7/0x230 __pfx_blkdev_get_block+0x10/0x10 blkdev_readahead+0x14/0x30 read_pages+0x71/0x460 folio_add_lru+0x6a/0x140 ? filemap_add_folio+0xb6/0x190 page_cache_ra_unbounded+0x197/0x2a0 do_page_cache_ra+0x42/0x70 page_cache_ra_order+0x360/0x610 filemap_fault+0x7d8/0x1200 __do_fault+0x3e/0x380 do_pte_missing+0x628/0x1cd0 ? __pte_offset_map+0x1a/0x200 __handle_mm_fault+0x7f2/0x19b0 ? __pte_offset_map+0x1a/0x200 ? __pte_offset_map_lock+0x78/0x170 handle_mm_fault+0x275/0x560 __get_user_pages+0x1f0/0xbd0 faultin_page_range+0xae/0x460 madvise_vma_behavior+0x62e/0xfa0 ? find_vma_prev+0x85/0xe0 do_madvise+0x1eb/0x5a0 __x64_sys_madvise+0x2b/0x40 x64_sys_call+0x23b3/0x4620 do_syscall_64+0x9e/0x1b0 ? irqentry_exit_to_user_mode+0x7d/0x300 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Add a cond_resched() call at the beginning of each loop iteration to allow the CPU to schedule other tasks when necessary, avoiding potential softlocks during heavy readahead operations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/mpage.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/mpage.c b/fs/mpage.c index 242e213ee064..73947fc8ff1e 100644 --- a/fs/mpage.c +++ b/fs/mpage.c @@ -376,6 +376,7 @@ void mpage_readahead(struct readahead_control *rac, get_block_t get_block) }; while ((folio = readahead_folio(rac))) { + cond_resched(); prefetchw(&folio->flags); args.folio = folio; args.nr_pages = readahead_count(rac); -- 2.39.2

2 1

[PATCH OLK-6.6] x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
by Qi Xi 29 Apr '25

29 Apr '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.15-rc1 commit 3ef938c3503563bfc2ac15083557f880d29c2e64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QSV CVE: CVE-2025-22045 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table: collapse_pte_mapped_thp pmdp_collapse_flush flush_tlb_range The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way. Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact: - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks. - In Hyper-V TLB paravirtualization, again for lazy TLB stuff. The patch "x86/mm: only invalidate final translations with INVLPGB" which is currently under review (see <https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>) would probably be making the impact of this a lot worse. Fixes: 016c4d92cd16 ("x86/mm/tlb: Add freed_tables argument to flush_tlb_mm_range") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lkml.kernel.org/r/20250103-x86-collapse-flush-fix-v1-1-3c521856cfa6… Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/x86/include/asm/tlbflush.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h index 25726893c6f4..4bd3c1a1b355 100644 --- a/arch/x86/include/asm/tlbflush.h +++ b/arch/x86/include/asm/tlbflush.h @@ -241,7 +241,7 @@ void flush_tlb_multi(const struct cpumask *cpumask, flush_tlb_mm_range((vma)->vm_mm, start, end, \ ((vma)->vm_flags & VM_HUGETLB) \ ? huge_page_shift(hstate_vma(vma)) \ - : PAGE_SHIFT, false) + : PAGE_SHIFT, true) extern void flush_tlb_all(void); extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, -- 2.33.0

2 1

[PATCH OLK-6.6] acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
by Qi Xi 29 Apr '25

29 Apr '25

From: Murad Masimov <m.masimov(a)mt-integration.ru> mainline inclusion from mainline-v6.15-rc1 commit 2ff0e408db36c21ed3fa5e3c1e0e687c82cf132f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QRM CVE: CVE-2025-22044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the argument is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function acpi_nfit_ctl() first verifies that a user-provided value call_pkg->nd_family of type u64 is not equal to 0. Then the value is converted to int, and only after that is compared to NVDIMM_BUS_FAMILY_MAX. This can lead to passing an invalid argument to acpi_nfit_ctl(), if call_pkg->nd_family is non-zero, while the lower 32 bits are zero. Furthermore, it is best to return EINVAL immediately upon seeing the invalid user input. The WARNING is insufficient to prevent further undefined behavior based on other invalid user input. All checks of the input value should be applied to the original variable call_pkg->nd_family. [iweiny: update commit message] Fixes: 6450ddbd5d8e ("ACPI: NFIT: Define runtime firmware activation commands") Cc: stable(a)vger.kernel.org Reported-by: syzbot+c80d8dc0d9fa81a3cd8c(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c80d8dc0d9fa81a3cd8c Signed-off-by: Murad Masimov <m.masimov(a)mt-integration.ru> Link: https://patch.msgid.link/20250123163945.251-1-m.masimov@mt-integration.ru Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/acpi/nfit/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 7918923e3b74..a466ad6e5d93 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -485,7 +485,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, cmd_mask = nd_desc->cmd_mask; if (cmd == ND_CMD_CALL && call_pkg->nd_family) { family = call_pkg->nd_family; - if (family > NVDIMM_BUS_FAMILY_MAX || + if (call_pkg->nd_family > NVDIMM_BUS_FAMILY_MAX || !test_bit(family, &nd_desc->bus_family_mask)) return -EINVAL; family = array_index_nospec(family, -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/3] Backport SMC patchs
by Wang Liang 29 Apr '25

29 Apr '25

Karsten Graul (1): net/smc: fix restoring of fallback changes Ursula Braun (2): net/smc: propagate file from SMC to TCP socket net/smc: fix closing of fallback SMC sockets include/net/sock.h | 6 ------ net/smc/af_smc.c | 47 ++++++++++++++++++++++++++++++++++++---------- 2 files changed, 37 insertions(+), 16 deletions(-) -- 2.34.1

2 4

[openeuler:OLK-6.6 2175/2175] drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_ethtool.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 85cae3bfc6f56b1f497d5521a0caa9b8c299ac01 commit: dd013ad487534c1838afc2f55efdb5daec15aace [2175/2175] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-161-20250429 (https://download.01.org/0day-ci/archive/20250429/202504290927.uassI0w9-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290927.uassI0w9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290927.uassI0w9-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_ethtool.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. vim +3 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_ethtool.c > 3 * Copyright (C), 2020, Linkdata Technologies Co., Ltd. 4 * 5 * @file: sxevf_ethtool.c 6 * @author: Linkdata 7 * @date: 2025.02.16 8 * @brief: 9 * @note: 10 */ 11 #include "sxe_version.h" 12 #include "sxevf_ethtool.h" 13 #include "sxevf_hw.h" 14 #include "sxe_log.h" 15 #include "sxevf_tx_proc.h" 16 #include "sxevf_rx_proc.h" 17 #include "sxevf_netdev.h" 18 #include "sxevf_msg.h" 19 #include "sxevf_irq.h" 20 #include "sxevf_ring.h" 21 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)'
by kernel test robot 29 Apr '25

29 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 230c2b30f879859ac3e9d3cc46407a9dbb103160 commit: eb761d6521c32c006a4987260394a61c6684fb35 [1597/1597] mm: parallelize deferred struct page initialization within each node config: arm64-randconfig-002-20250429 (https://download.01.org/0day-ci/archive/20250429/202504290808.iYcj1P8f-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250429/202504290808.iYcj1P8f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504290808.iYcj1P8f-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/page_alloc.c:69: mm/page_alloc.c: In function 'deferred_init_memmap': >> include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1645:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 1645 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~ >> include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1661:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 1661 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~ vim +123 include/linux/ktask.h c48676ef6b6f9c Daniel Jordan 2019-08-14 120 c48676ef6b6f9c Daniel Jordan 2019-08-14 121 #define KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ c48676ef6b6f9c Daniel Jordan 2019-08-14 122 { \ c48676ef6b6f9c Daniel Jordan 2019-08-14 @123 .kc_thread_func = (ktask_thread_func)(thread_func), \ 69cc5b58cc50d2 Daniel Jordan 2019-08-14 124 .kc_undo_func = NULL, \ c48676ef6b6f9c Daniel Jordan 2019-08-14 125 .kc_func_arg = (func_arg), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 126 .kc_min_chunk_size = (min_chunk_size), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 127 .kc_iter_func = (ktask_iter_range), \ c48676ef6b6f9c Daniel Jordan 2019-08-14 128 .kc_max_threads = 0, \ c48676ef6b6f9c Daniel Jordan 2019-08-14 129 } c48676ef6b6f9c Daniel Jordan 2019-08-14 130 :::::: The code at line 123 was first introduced by commit :::::: c48676ef6b6f9cb8497d6264ae9ff71b87630337 ktask: multithread CPU-intensive kernel work :::::: TO: Daniel Jordan <daniel.m.jordan(a)oracle.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0