- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1525/1525] drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3f8283040b83a49bdad8dc3dd4ccd3f50910af28 commit: b8c0480a3eba11ee6616019a3aaa75ee38f06f02 [1525/1525] svm: serach dts to init children device config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503280904.ByoMg5CF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer vim +353 drivers/char/svm.c 221 222 static int svm_init_core(struct svm_device *sdev) 223 { 224 int err = 0; 225 struct device *dev = sdev->dev; 226 struct acpi_device *adev = ACPI_COMPANION(sdev->dev); 227 struct acpi_device *cdev = NULL; 228 int id = 0; 229 230 down_write(&svm_sem); 231 if (!svm_bus_type.iommu_ops) { 232 err = bus_register(&svm_bus_type); 233 if (err) { 234 up_write(&svm_sem); 235 dev_err(dev, "failed to register svm_bus_type\n"); 236 return err; 237 } 238 239 err = bus_set_iommu(&svm_bus_type, dev->bus->iommu_ops); 240 if (err) { 241 up_write(&svm_sem); 242 dev_err(dev, "failed to set iommu for svm_bus_type\n"); 243 goto err_unregister_bus; 244 } 245 } else if (svm_bus_type.iommu_ops != dev->bus->iommu_ops) { 246 err = -EBUSY; 247 up_write(&svm_sem); 248 dev_err(dev, "iommu_ops configured, but changed!\n"); 249 goto err_unregister_bus; 250 } 251 up_write(&svm_sem); 252 253 list_for_each_entry(cdev, &adev->children, node) { 254 err = svm_acpi_add_core(sdev, cdev, id++); 255 if (err) 256 device_for_each_child(dev, NULL, svm_remove_core); 257 } 258 259 return err; 260 261 err_unregister_bus: 262 bus_unregister(&svm_bus_type); 263 264 return err; 265 } 266 #else 267 static int svm_of_add_core(struct svm_device *sdev, struct device_node *np) 268 { 269 int err; 270 struct resource res; 271 struct core_device *cdev = NULL; 272 char *name = NULL; 273 274 name = devm_kasprintf(sdev->dev, GFP_KERNEL, "svm%llu_%s", 275 sdev->id, np->name); 276 if (name == NULL) 277 return -ENOMEM; 278 279 cdev = kzalloc(sizeof(*cdev), GFP_KERNEL); 280 if (cdev == NULL) 281 return -ENOMEM; 282 283 cdev->dev.of_node = np; 284 cdev->dev.parent = sdev->dev; 285 cdev->dev.bus = &svm_bus_type; 286 cdev->dev.release = cdev_device_release; 287 cdev->smmu_bypass = of_property_read_bool(np, "hisi,smmu_bypass"); 288 dev_set_name(&cdev->dev, "%s", name); 289 290 err = device_register(&cdev->dev); 291 if (err) { 292 dev_info(&cdev->dev, "core_device register failed\n"); 293 put_device(&cdev->dev); 294 kfree(cdev); 295 return err; 296 } 297 298 err = of_dma_configure(&cdev->dev, np, true); 299 if (err) { 300 dev_dbg(&cdev->dev, "of_dma_configure failed\n"); 301 goto err_unregister_dev; 302 } 303 304 err = of_address_to_resource(np, 0, &res); 305 if (err) { 306 dev_info(&cdev->dev, "no reg, FW should install the sid\n"); 307 } else { 308 /* If the reg specified, install sid for the core */ 309 void __iomem *core_base = NULL; 310 int sid = cdev->dev.iommu_fwspec->ids[0]; 311 312 core_base = ioremap(res.start, resource_size(&res)); 313 if (core_base == NULL) { 314 err = -ENOMEM; 315 dev_err(&cdev->dev, "ioremap failed\n"); 316 goto err_unregister_dev; 317 } 318 319 writel_relaxed(sid, core_base + CORE_SID); 320 iounmap(core_base); 321 } 322 323 /* If core device is smmu bypass, request direct map. */ 324 if (cdev->smmu_bypass) { 325 err = iommu_request_dm_for_dev(&cdev->dev); 326 if (err) 327 goto err_unregister_dev; 328 329 return 0; 330 } 331 332 cdev->group = iommu_group_get(&cdev->dev); 333 if (IS_ERR_OR_NULL(cdev->group)) { 334 err = -ENXIO; 335 dev_err(&cdev->dev, "smmu is not right configured\n"); 336 goto err_unregister_dev; 337 } 338 339 cdev->domain = iommu_domain_alloc(sdev->dev->bus); 340 if (cdev->domain == NULL) { 341 err = -ENOMEM; 342 dev_info(&cdev->dev, "failed to alloc domain\n"); 343 goto err_unregister_dev; 344 } 345 346 err = iommu_attach_group(cdev->domain, cdev->group); 347 if (err) { 348 dev_err(&cdev->dev, "failed group to domain\n"); 349 goto err_free_domain; 350 } 351 352 err = iommu_sva_device_init(&cdev->dev, IOMMU_SVA_FEAT_IOPF, > 353 UINT_MAX, 0); 354 if (err) { 355 dev_err(&cdev->dev, "failed to init sva device\n"); 356 goto err_detach_group; 357 } 358 359 return 0; 360 361 err_detach_group: 362 iommu_detach_group(cdev->domain, cdev->group); 363 err_free_domain: 364 iommu_domain_free(cdev->domain); 365 err_unregister_dev: 366 device_unregister(&cdev->dev); 367 368 return err; 369 } 370 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2063/2063] error: unknown target ABI 'ilp32'
by kernel test robot 28 Mar '25

28 Mar '25

Hi Andrew, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b28aab59b06935f0d1c9bce8f013f25b4094764d commit: f9b54a6714445cde83aeff0318cf767b3b81229d [2063/2063] arm64:ilp32: add ARM64_ILP32 to Kconfig config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503280313.olFyEFIT-lkp@…) compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project c2692afc0a92cd5da140dfcdfff7818a5b8ce997) reproduce: (https://download.01.org/0day-ci/archive/20250328/202503280313.olFyEFIT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503280313.olFyEFIT-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from arch/arm64/kernel/asm-offsets.c:12: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2168: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. arch/arm64/kernel/vdso-ilp32/Makefile:84: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:87: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:90: FORCE prerequisite is missing >> clang: warning: -Wl,-soname=linux-ilp32-vdso.so.1: 'linker' input unused [-Wunused-command-line-argument] >> error: unknown target ABI 'ilp32' >> error: unknown target ABI 'ilp32' make[3]: *** [scripts/Makefile.build:373: arch/arm64/kernel/vdso-ilp32/vdso-ilp32.lds] Error 1 make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:84: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o] Error 1 >> error: error: unknown target ABI 'ilp32' unknown target ABI 'ilp32' make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:87: arch/arm64/kernel/vdso-ilp32/note-ilp32.o] Error 1 make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:90: arch/arm64/kernel/vdso-ilp32/sigreturn-ilp32.o] Error 1 make[3]: Target 'include/generated/vdso-ilp32-offsets.h' not remade because of errors. make[2]: *** [arch/arm64/Makefile:201: vdso_prepare] Error 2 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 make: Target 'prepare' not remade because of errors. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-21858
by Zhang Changzhong 27 Mar '25

27 Mar '25

Kuniyuki Iwashima (2): geneve: Fix use-after-free in geneve_find_dev(). geneve: Suppress list corruption splat in geneve_destroy_tunnels(). drivers/net/geneve.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) -- 2.9.5

2 3

[openeuler:openEuler-1.0-LTS 1523/1523] fs/.tmp_select.o: warning: objtool: poll_select_finish()+0x1aa: can't find switch jump table
by kernel test robot 27 Mar '25

27 Mar '25

Hi Oleg, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 44ae3d3e5f1f99c0fd5f040e4da88b0c5b3ec76b [1523/1523] select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() config: x86_64-buildonly-randconfig-004-20250327 (https://download.01.org/0day-ci/archive/20250327/202503272038.iOCRCuV8-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503272038.iOCRCuV8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503272038.iOCRCuV8-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/.tmp_select.o: warning: objtool: poll_select_finish()+0x1aa: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ARM: versatile: Add missing of_node_put in dcscb_init
by Peng Zhang 27 Mar '25

27 Mar '25

From: Peng Wu <wupeng58(a)huawei.com> stable inclusion from stable-v4.19.247 commit a0fc05cd17617e63fc13ad0c01f3f0afd890d8ec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP128 CVE: CVE-2022-49457 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit 23b44f9c649bbef10b45fa33080cd8b4166800ae ] The device_node pointer is returned by of_find_compatible_node with refcount incremented. We should use of_node_put() to avoid the refcount leak. Signed-off-by: Peng Wu <wupeng58(a)huawei.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20220428230356.69418-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm/mach-vexpress/dcscb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c index ee2a0faafaa1..aaade91f6551 100644 --- a/arch/arm/mach-vexpress/dcscb.c +++ b/arch/arm/mach-vexpress/dcscb.c @@ -146,6 +146,7 @@ static int __init dcscb_init(void) if (!node) return -ENODEV; dcscb_base = of_iomap(node, 0); + of_node_put(node); if (!dcscb_base) return -EADDRNOTAVAIL; cfg = readl_relaxed(dcscb_base + DCS_CFG_R); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
by Peng Zhang 27 Mar '25

27 Mar '25

From: Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> stable inclusion from stable-v4.19.238 commit f04a520a422222fc921bf035dc67414c500a286a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3SR CVE: CVE-2022-49247 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit fbe04b49a54e31f4321d632270207f0e6304cd16 ] If the callback 'start_streaming' fails, then all queued buffers in the driver should be returned with state 'VB2_BUF_STATE_QUEUED'. Currently, they are returned with 'VB2_BUF_STATE_ERROR' which is wrong. Fix this. This also fixes the warning: [ 65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6 [ 65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G W 5.16.0-rc4-62408-g32447129cb30-dirty #14 [ 65.590293] Hardware name: Radxa ROCK Pi 4B (DT) [ 65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common] [ 65.592395] sp : ffff800012bc3ad0 [ 65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8 [ 65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612 [ 65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0 [ 65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff [ 65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78 [ 65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce [ 65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228 [ 65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78 [ 65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880 [ 65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0 [ 65.598940] Call trace: [ 65.599155] vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.599672] vb2_core_streamon+0x17c/0x1a8 [videobuf2_common] [ 65.600179] vb2_streamon+0x54/0x88 [videobuf2_v4l2] [ 65.600619] vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2] [ 65.601103] v4l_streamon+0x3c/0x50 [videodev] [ 65.601521] __video_do_ioctl+0x1a4/0x428 [videodev] [ 65.601977] video_usercopy+0x320/0x828 [videodev] [ 65.602419] video_ioctl2+0x3c/0x58 [videodev] [ 65.602830] v4l2_ioctl+0x60/0x90 [videodev] [ 65.603227] __arm64_sys_ioctl+0xa8/0xe0 [ 65.603576] invoke_syscall+0x54/0x118 [ 65.603911] el0_svc_common.constprop.3+0x84/0x100 [ 65.604332] do_el0_svc+0x34/0xa0 [ 65.604625] el0_svc+0x1c/0x50 [ 65.604897] el0t_64_sync_handler+0x88/0xb0 [ 65.605264] el0t_64_sync+0x16c/0x170 [ 65.605587] ---[ end trace 578e0ba07742170d ]--- Fixes: 8ac456495a33d ("[media] stk1160: Stop device and unqueue buffers when start_streaming() fails") Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> Reviewed-by: Ezequiel Garcia <ezequiel(a)vanguardiasur.com.ar> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +++++----- drivers/media/usb/stk1160/stk1160.h | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c index 468f5ccf4ae6..685872f8b306 100644 --- a/drivers/media/usb/stk1160/stk1160-core.c +++ b/drivers/media/usb/stk1160/stk1160-core.c @@ -413,7 +413,7 @@ static void stk1160_disconnect(struct usb_interface *interface) /* Here is the only place where isoc get released */ stk1160_uninit_isoc(dev); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); video_unregister_device(&dev->vdev); v4l2_device_disconnect(&dev->v4l2_dev); diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c index 504e413edcd2..381f9f189bb7 100644 --- a/drivers/media/usb/stk1160/stk1160-v4l.c +++ b/drivers/media/usb/stk1160/stk1160-v4l.c @@ -269,7 +269,7 @@ static int stk1160_start_streaming(struct stk1160 *dev) stk1160_uninit_isoc(dev); out_stop_hw: usb_set_interface(dev->udev, 0, 0); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED); mutex_unlock(&dev->v4l_lock); @@ -317,7 +317,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev) stk1160_stop_hw(dev); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); stk1160_dbg("streaming stopped\n"); @@ -762,7 +762,7 @@ static const struct video_device v4l_template = { /********************************************************************/ /* Must be called with both v4l_lock and vb_queue_lock hold */ -void stk1160_clear_queue(struct stk1160 *dev) +void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state) { struct stk1160_buffer *buf; unsigned long flags; @@ -773,7 +773,7 @@ void stk1160_clear_queue(struct stk1160 *dev) buf = list_first_entry(&dev->avail_bufs, struct stk1160_buffer, list); list_del(&buf->list); - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); stk1160_dbg("buffer [%p/%d] aborted\n", buf, buf->vb.vb2_buf.index); } @@ -783,7 +783,7 @@ void stk1160_clear_queue(struct stk1160 *dev) buf = dev->isoc_ctl.buf; dev->isoc_ctl.buf = NULL; - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); stk1160_dbg("buffer [%p/%d] aborted\n", buf, buf->vb.vb2_buf.index); } diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h index acd1c811db08..54a046aacd33 100644 --- a/drivers/media/usb/stk1160/stk1160.h +++ b/drivers/media/usb/stk1160/stk1160.h @@ -177,7 +177,7 @@ struct regval { int stk1160_vb2_setup(struct stk1160 *dev); int stk1160_video_register(struct stk1160 *dev); void stk1160_video_unregister(struct stk1160 *dev); -void stk1160_clear_queue(struct stk1160 *dev); +void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state); /* Provided by stk1160-video.c */ int stk1160_alloc_isoc(struct stk1160 *dev); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
by Peng Zhang 27 Mar '25

27 Mar '25

From: Zekun Shen <bruceshenzk(a)gmail.com> stable inclusion from stable-v4.19.238 commit 25efc5d03455c3839249bc77fce5e29ecb54677e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5YP CVE: CVE-2021-47633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit 564d4eceb97eaf381dd6ef6470b06377bb50c95a ] The bug was found during fuzzing. Stacktrace locates it in ath5k_eeprom_convert_pcal_info_5111. When none of the curve is selected in the loop, idx can go up to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound. pd = &chinfo[pier].pd_curves[idx]; There are many OOB writes using pd later in the code. So I added a sanity check for idx. Checks for other loops involving AR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not used outside the loops. The patch is NOT tested with real device. The following is the fuzzing report BUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] Write of size 1 at addr ffff8880174a4d60 by task modprobe/214 CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1 Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] __kasan_report.cold+0x37/0x7c ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] kasan_report+0xe/0x20 ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k] ath5k_eeprom_init+0x2513/0x6290 [ath5k] ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? usleep_range+0xb8/0x100 ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k] ath5k_hw_init+0xb60/0x1970 [ath5k] ath5k_init_ah+0x6fe/0x2530 [ath5k] ? kasprintf+0xa6/0xe0 ? ath5k_stop+0x140/0x140 [ath5k] ? _dev_notice+0xf6/0xf6 ? apic_timer_interrupt+0xa/0x20 ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k] ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] ? mutex_lock+0x89/0xd0 ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] local_pci_probe+0xd3/0x160 pci_device_probe+0x23f/0x3e0 ? pci_device_remove+0x280/0x280 ? pci_device_remove+0x280/0x280 really_probe+0x209/0x5d0 Reported-by: Brendan Dolan-Gavitt <brendandg(a)nyu.edu> Signed-off-by: Zekun Shen <bruceshenzk(a)gmail.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/YckvDdj3mtCkDRIt@a-10-27-26-18.dynapool.vpn.nyu.e… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/net/wireless/ath/ath5k/eeprom.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c index 94d34ee02265..01163b333945 100644 --- a/drivers/net/wireless/ath/ath5k/eeprom.c +++ b/drivers/net/wireless/ath/ath5k/eeprom.c @@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, } } + if (idx == AR5K_EEPROM_N_PD_CURVES) + goto err_out; + ee->ee_pd_gains[mode] = 1; pd = &chinfo[pier].pd_curves[idx]; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1523/1523] ERROR: "ata_dev_same_device" [drivers/scsi/libsas/libsas.ko] undefined!
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: d856ec500c97835c591ffacc005f514509f1a931 [1523/1523] scsi: libsas: check if the same sata device when flutter config: x86_64-buildonly-randconfig-005-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271838.22rCFdNn-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271838.22rCFdNn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271838.22rCFdNn-lkp@intel.com/ All errors (new ones prefixed by >>): >> ERROR: "ata_dev_same_device" [drivers/scsi/libsas/libsas.ko] undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1520/1520] arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.
by kernel test robot 27 Mar '25

27 Mar '25

Hi Peter, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 3acbac72baea337e0ac79801a8ba4b81e3b67014 [1520/1520] x86/speculation: Change FILL_RETURN_BUFFER to work with objtool config: x86_64-randconfig-161-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271858.j6vJ9Bhc-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271858.j6vJ9Bhc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271858.j6vJ9Bhc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e1: unsupported intra-function call >> arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 V2 0/3] add support DVMBM in HIP12
by Jinqian Yang 27 Mar '25

27 Mar '25

Patch#1 kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE Patch#2 kvm: hisi_virt: Update TLBI broadcast feature for hip12 Patch#3 KVM: arm64: Add new HiSi CPU type to support DVMBM Xiang Chen (1): kvm: hisi_virt: Update TLBI broadcast feature for hip12 yangjinqian (2): kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE KVM: arm64: Add new HiSi CPU type to support DVMBM arch/arm64/kvm/hisilicon/hisi_virt.c | 72 ++++++++++++++++++++++++++-- arch/arm64/kvm/hisilicon/hisi_virt.h | 8 ++++ 2 files changed, 76 insertions(+), 4 deletions(-) -- 2.33.0

2 4