2025

January

2024

2023

2022

2021

2020

2019

December

List overview
Download

Kernel

kernel@openeuler.org

63 participants
16392 discussions

Start a nNew thread

[PATCH OLK-6.6 0/2] fix tick broadcast issue
by Yu Liao 30 Jul '24

30 Jul '24

Yu Liao (2): Revert "tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled" tick/broadcast: Make takeover of broadcast hrtimer reliable kernel/time/tick-broadcast-hrtimer.c | 13 ------------- kernel/time/tick-broadcast.c | 23 +++++++++++++++++++++++ 2 files changed, 23 insertions(+), 13 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/4] BMA: Fix DMA reset problem and change the version number
by Li Nan 30 Jul '24

30 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. 2. Change the iBMA driver version. Wujiahai (4): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Change the version number. BMA/kbox_drv: Change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.27.0

2 5

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 87e97edb9d08052dcb1df91827fb9dd9edecf612
by kernel test robot 30 Jul '24

30 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 87e97edb9d08052dcb1df91827fb9dd9edecf612 !10227 MIPS: smp: fill in sibling and core maps earlier elapsed time: 727m configs tested: 35 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240729 gcc-14.1.0 arm64 randconfig-002-20240729 gcc-14.1.0 arm64 randconfig-003-20240729 gcc-14.1.0 arm64 randconfig-004-20240729 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240729 clang-18 x86_64 buildonly-randconfig-002-20240729 gcc-13 x86_64 buildonly-randconfig-003-20240729 gcc-10 x86_64 buildonly-randconfig-004-20240729 gcc-10 x86_64 buildonly-randconfig-005-20240729 gcc-10 x86_64 buildonly-randconfig-006-20240729 gcc-10 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240729 gcc-13 x86_64 randconfig-002-20240729 clang-18 x86_64 randconfig-003-20240729 clang-18 x86_64 randconfig-004-20240729 clang-18 x86_64 randconfig-005-20240729 clang-18 x86_64 randconfig-006-20240729 clang-18 x86_64 randconfig-011-20240729 gcc-8 x86_64 randconfig-012-20240729 gcc-8 x86_64 randconfig-013-20240729 gcc-13 x86_64 randconfig-014-20240729 clang-18 x86_64 randconfig-015-20240729 gcc-13 x86_64 randconfig-016-20240729 clang-18 x86_64 randconfig-071-20240729 gcc-13 x86_64 randconfig-072-20240729 gcc-13 x86_64 randconfig-073-20240729 clang-18 x86_64 randconfig-074-20240729 gcc-8 x86_64 randconfig-075-20240729 gcc-12 x86_64 randconfig-076-20240729 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS fbff37d503211903d1acab770e4b9ee263d9d49f
by kernel test robot 29 Jul '24

29 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: fbff37d503211903d1acab770e4b9ee263d9d49f !9904 ext4: improve buffered write with more than one blocks_per_folio Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-defconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-003-20240729 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-004-20240729 | `-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240729 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 729m configs tested: 40 configs skipped: 134 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240729 clang-17 arm64 randconfig-002-20240729 clang-20 arm64 randconfig-003-20240729 gcc-14.1.0 arm64 randconfig-004-20240729 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240729 gcc-14.1.0 loongarch randconfig-002-20240729 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240729 clang-18 x86_64 buildonly-randconfig-002-20240729 gcc-13 x86_64 buildonly-randconfig-003-20240729 gcc-10 x86_64 buildonly-randconfig-004-20240729 gcc-10 x86_64 buildonly-randconfig-005-20240729 gcc-10 x86_64 buildonly-randconfig-006-20240729 gcc-10 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240729 gcc-13 x86_64 randconfig-002-20240729 clang-18 x86_64 randconfig-003-20240729 clang-18 x86_64 randconfig-004-20240729 clang-18 x86_64 randconfig-005-20240729 clang-18 x86_64 randconfig-006-20240729 clang-18 x86_64 randconfig-011-20240729 gcc-8 x86_64 randconfig-012-20240729 gcc-8 x86_64 randconfig-013-20240729 gcc-13 x86_64 randconfig-014-20240729 clang-18 x86_64 randconfig-015-20240729 gcc-13 x86_64 randconfig-016-20240729 clang-18 x86_64 randconfig-071-20240729 gcc-13 x86_64 randconfig-072-20240729 gcc-13 x86_64 randconfig-073-20240729 clang-18 x86_64 randconfig-074-20240729 gcc-8 x86_64 randconfig-075-20240729 gcc-12 x86_64 randconfig-076-20240729 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] iommu/arm-smmu-v3: Reducing the CMD_SYNC times
by Zhang Zekun 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9G9TI ---------------------------------------- Benifiting from the hardware same address blocking mechanism. We only need to send the CMD_SYNC when creating pte entry other than lvl 3, this can reduce the amounts of CMD_SYNC times sent to avoiding the errata. Detecting the hardware ability by read the SMMU_USER_CONFIG1. Fixes: 46f0c5798ba5 ("iommu/arm-smmu-v3: Enable iotlb_sync_map according to SMMU_IIDR") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 52 +++++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 ++ drivers/iommu/io-pgtable-arm.c | 5 ++ 3 files changed, 60 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 16217647fd67..6fa7b0b3e90c 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2203,6 +2203,14 @@ static void arm_smmu_tlb_inv_page_nosync(struct iommu_iotlb_gather *gather, static void arm_smmu_tlb_inv_walk(unsigned long iova, size_t size, size_t granule, void *cookie) { +#ifdef CONFIG_HISILICON_ERRATUM_162100602 + struct arm_smmu_domain *smmu_domain = cookie; + + if (!size && smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) { + arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); + return; + } +#endif arm_smmu_tlb_inv_range_domain(iova, size, granule, false, cookie); } @@ -2736,6 +2744,9 @@ static int arm_smmu_iotlb_sync_map(struct iommu_domain *domain, if (!(smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_MAP)) return 0; + if (smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) + return 0; + granule_size = 1 << __ffs(smmu_domain->domain.pgsize_bitmap); /* Add a SYNC command to sync io-pgtale to avoid errors in pgtable prefetch*/ @@ -4241,6 +4252,45 @@ static void arm_smmu_get_httu(struct arm_smmu_device *smmu, u32 reg) fw_features); } +#ifdef CONFIG_HISILICON_ERRATUM_162100602 +static void hisi_smmu_check_errata(struct arm_smmu_device *smmu) +{ + u32 reg, i; + + if (!(smmu->options & ARM_SMMU_OPT_SYNC_MAP)) + return; + + smmu->options |= ARM_SMMU_OPT_SYNC_MAP; + + reg = readl_relaxed(smmu->base + ARM_SMMU_USER_CFG1); + reg = reg & GENMASK(15, 0); + for (i = 0; i < 8; i++) { + unsigned long val; + + val = (reg >> 2 * i) & GENMASK(1, 0); + switch (PAGE_SIZE) { + case SZ_4K: + if (!val) + return; + break; + case SZ_16K: + if (!val || val == 0x1) + return; + break; + case SZ_64K: + if (!val || val == 0x1 || val == 0x3) + return; + break; + default: + return; + } + } + smmu->options |= ARM_SMMU_OPT_SYNC_BATCH; +} +#else +static void hisi_smmu_check_errata(struct arm_smmu_device *smmu) {} +#endif + static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) { u32 reg; @@ -4455,6 +4505,8 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) smmu->oas = 48; } + hisi_smmu_check_errata(smmu); + if (arm_smmu_ops.pgsize_bitmap == -1UL) arm_smmu_ops.pgsize_bitmap = smmu->pgsize_bitmap; else diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 859d21729882..bc34d5a6aab9 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -139,6 +139,8 @@ #define ARM_SMMU_GERROR_IRQ_CFG1 0x70 #define ARM_SMMU_GERROR_IRQ_CFG2 0x74 +#define ARM_SMMU_USER_CFG1 0xe04 + #define ARM_SMMU_IDR6 0x190 #define IDR6_LOG2NUMP GENMASK(27, 24) #define IDR6_LOG2NUMQ GENMASK(19, 16) @@ -708,6 +710,7 @@ struct arm_smmu_device { #define ARM_SMMU_OPT_MSIPOLL (1 << 2) #define ARM_SMMU_OPT_CMDQ_FORCE_SYNC (1 << 3) #define ARM_SMMU_OPT_SYNC_MAP (1 << 4) +#define ARM_SMMU_OPT_SYNC_BATCH (1 << 5) u32 options; #ifdef CONFIG_ARM_SMMU_V3_ECMDQ diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index 79aa11d88c56..fb54baed3f49 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -407,6 +407,11 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, pte = arm_lpae_install_table(cptep, ptep, 0, data); if (pte) __arm_lpae_free_pages(cptep, tblsz, cfg, data->iop.cookie); + +#ifdef CONFIG_HISILICON_ERRATUM_162100602 + if (lvl <= 2) + io_pgtable_tlb_flush_walk(&data->iop, iova, 0, ARM_LPAE_GRANULE(data)); +#endif } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { __arm_lpae_sync_pte(ptep, 1, cfg); } -- 2.17.1

2 1

[PATCH OLK-5.10 0/3] xfs: fix tail alignment
by Long Li 29 Jul '24

29 Jul '24

This patch set fix maxlen fallback to availble len, it cause tail is no alignment. Dave Chinner (3): xfs: only allow minlen allocations when near ENOSPC xfs: always tail align maxlen allocations xfs: align args->minlen for forced allocation alignment fs/xfs/libxfs/xfs_alloc.c | 31 +++++++++++++++++++------------ fs/xfs/libxfs/xfs_bmap.c | 28 +++++++++++++++++++++------- 2 files changed, 40 insertions(+), 19 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS v2] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Conflicts: fs/jbd2/journal.c [Since disk deletion does not call ext4_shutdown, abort the journal when the jbd2 sb_buffer is unmapped to avoid a dead loop.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- fs/jbd2/journal.c | 2 ++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b35f0b63baf0..ab6c0b9c5336 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -96,8 +96,11 @@ void __jbd2_log_wait_for_space(journal_t *journal) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 4462b6ec32b7..bf83e1c64aa4 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1431,6 +1431,8 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) /* Buffer got discarded which means block device got invalidated */ if (!buffer_mapped(bh)) { unlock_buffer(bh); + if (!is_journal_aborted(journal)) + jbd2_journal_abort(journal, -EIO); return -EIO; } -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Conflicts: fs/jbd2/journal.c [Since disk deletion does not call ext4_shutdown, abort the journal when the jbd2 sb_buffer is unmapped to avoid a dead loop.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- fs/jbd2/journal.c | 2 ++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 13506e2ae3e8..9bbd9c69ba64 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1619,6 +1619,8 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) /* Buffer got discarded which means block device got invalidated */ if (!buffer_mapped(bh)) { unlock_buffer(bh); + if (!is_journal_aborted(journal)) + jbd2_journal_abort(journal, -EIO); return -EIO; } -- 2.31.1

2 1

[PATCH OLK-5.10 v2] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Conflicts: fs/jbd2/journal.c [Since disk deletion does not call ext4_shutdown, abort the journal when the jbd2 sb_buffer is unmapped to avoid a dead loop.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- fs/jbd2/journal.c | 2 ++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 6e2848b10aaf..7775ad53b291 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1621,6 +1621,8 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) /* Buffer got discarded which means block device got invalidated */ if (!buffer_mapped(bh)) { unlock_buffer(bh); + if (!is_journal_aborted(journal)) + jbd2_journal_abort(journal, -EIO); return -EIO; } -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
by Zhang Changzhong 29 Jul '24

29 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> mainline inclusion from mainline-v6.9 commit be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAEF52 CVE: CVE-2024-41011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We don't get the right offset in that case. The GPU has an unused 4K area of the register BAR space into which you can remap registers. We remap the HDP flush registers into this space to allow userspace (CPU or GPU) to flush the HDP when it updates VRAM. However, on systems with >4K pages, we end up exposing PAGE_SIZE of MMIO space. Fixes: d8e408a82704 ("drm/amdkfd: Expose HDP registers to user space") Reviewed-by: Felix Kuehling <felix.kuehling(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_chardev.c [Commit 73fa13b6a511 ("drm/amdkfd: CRIU Implement KFD restore ioctl") is not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 2a99edf..4155010 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -1304,7 +1304,7 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, goto err_unlock; } offset = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); - if (!offset) { + if (!offset || (PAGE_SIZE > 4096)) { err = -ENOMEM; goto err_unlock; } @@ -1962,6 +1962,9 @@ static int kfd_mmio_mmap(struct kfd_dev *dev, struct kfd_process *process, if (vma->vm_end - vma->vm_start != PAGE_SIZE) return -EINVAL; + if (PAGE_SIZE > 4096) + return -EINVAL; + address = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); vma->vm_flags |= VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_NORESERVE | -- 2.9.5

2 1

[PATCH OLK-5.10 0/2] fix tick broadcast issue
by Yu Liao 29 Jul '24

29 Jul '24

Yu Liao (2): Revert "tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled" tick/broadcast: Make takeover of broadcast hrtimer reliable kernel/time/tick-broadcast-hrtimer.c | 14 -------------- kernel/time/tick-broadcast.c | 23 +++++++++++++++++++++++ 2 files changed, 23 insertions(+), 14 deletions(-) -- 2.33.0

2 3

[PATCH OLK-5.10] drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
by Zhang Changzhong 29 Jul '24

29 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> mainline inclusion from mainline-v6.9 commit be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAEF52 CVE: CVE-2024-41011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We don't get the right offset in that case. The GPU has an unused 4K area of the register BAR space into which you can remap registers. We remap the HDP flush registers into this space to allow userspace (CPU or GPU) to flush the HDP when it updates VRAM. However, on systems with >4K pages, we end up exposing PAGE_SIZE of MMIO space. Fixes: d8e408a82704 ("drm/amdkfd: Expose HDP registers to user space") Reviewed-by: Felix Kuehling <felix.kuehling(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_chardev.c [Commit 73fa13b6a511 ("drm/amdkfd: CRIU Implement KFD restore ioctl") is not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 2a99edf..4155010 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -1304,7 +1304,7 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, goto err_unlock; } offset = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); - if (!offset) { + if (!offset || (PAGE_SIZE > 4096)) { err = -ENOMEM; goto err_unlock; } @@ -1962,6 +1962,9 @@ static int kfd_mmio_mmap(struct kfd_dev *dev, struct kfd_process *process, if (vma->vm_end - vma->vm_start != PAGE_SIZE) return -EINVAL; + if (PAGE_SIZE > 4096) + return -EINVAL; + address = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); vma->vm_flags |= VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_NORESERVE | -- 2.9.5

2 1

[PATCH OLK-6.6 000/717] Backport 6.6.33
by Wang Hai 29 Jul '24

29 Jul '24

Backport 6.6.33 Aapo Vienamo (1): mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() Aaron Conole (1): openvswitch: Set the skbuff pkt_type for proper pmtud support. Abdelrahman Morsy (1): HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled Adrian Hunter (5): x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and VPDPWSSDS perf record: Fix debug message placement for test consumption perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer) mmc: sdhci: Add support for "Tuning Error" interrupts Al Viro (1): parisc: add missing export of __cmpxchg_u8() Aleksandr Aprelkov (1): sunrpc: removed redundant procp check Aleksandr Burakov (1): media: ngene: Add dvb_ca_en50221_init return value check Aleksandr Mishin (3): thermal/drivers/tsens: Fix null pointer dereference ASoC: kirkwood: Fix potential NULL dereference drm: vc4: Fix possible null pointer dereference Alex Deucher (1): Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices" Alexander Aring (1): dlm: fix user space lock decision to copy lvb Alexander Egorenkov (2): s390/ipl: Fix incorrect initialization of len fields in nvme reipl block s390/ipl: Fix incorrect initialization of nvme dump block Alexander Lobakin (1): bitops: add missing prototype check Alexander Potapenko (1): kmsan: do not wipe out origin when doing partial unpoisoning Alexander Shishkin (1): intel_th: pci: Add Meteor Lake-S CPU support Alexandre Mergnat (1): clk: mediatek: mt8365-mm: fix DPI0 parent Alison Schofield (1): cxl/trace: Correct DPA field masks for general_media & dram events Aloka Dixit (1): wifi: ath12k: use correct flag field for 320 MHz channels Alvin Lee (1): drm/amd/display: Remove pixle rate limit for subvp Andi Shyti (1): drm/i915/gt: Fix CCS id's calculation for CCS mode setting Andrea Mayer (1): ipv6: sr: fix missing sk_buff release in seg6_input_core Andreas Gruenbacher (10): gfs2: Don't forget to complete delayed withdraw gfs2: Fix "ignore unlock failures after withdraw" gfs2: Get rid of gfs2_alloc_blocks generation parameter gfs2: Convert gfs2_internal_read to folios gfs2: Rename gfs2_lookup_{ simple => meta } gfs2: Mark withdraws as unlikely gfs2: Rename gfs2_withdrawn to gfs2_withdrawing_or_withdrawn gfs2: finish_xmote cleanup gfs2: do_xmote fixes kthread: add kthread_stop_put Andrew Halaney (8): scsi: ufs: qcom: Perform read back after writing reset bit scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US scsi: ufs: qcom: Perform read back after writing unipro mode scsi: ufs: qcom: Perform read back after writing CGC enable scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV scsi: ufs: core: Perform read back after writing UTP_TASK_REQ_LIST_BASE_H scsi: ufs: core: Perform read back after disabling interrupts scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL Andrey Konovalov (1): kasan, fortify: properly rename memintrinsics Andrii Nakryiko (1): bpf: prevent r10 register from being marked as precise Andy Chi (1): ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 440/460 G11. Andy Shevchenko (6): ACPI: LPSS: Advertise number of chip selects via property iio: core: Leave private pointer NULL when no private data supplied serial: max3100: Update uart_driver_registered on driver removal serial: max3100: Fix bitwise types usb: fotg210: Add missing kernel doc description spi: Don't mark message DMA mapped when no transfer in it is Anna Schumaker (1): NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS Anshuman Khandual (1): coresight: etm4x: Fix unbalanced pm_runtime_enable() Anton Protopopov (1): bpf: Pack struct bpf_fib_lookup Ard Biesheuvel (3): x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 x86/purgatory: Switch to the position-independent small code model x86/efistub: Omit physical KASLR when memory reservations exist Armin Wolf (1): ACPI: Fix Generic Initiator Affinity _OSC bit Arnaldo Carvalho de Melo (1): perf probe: Add missing libgen.h header needed for using basename() Arnd Bergmann (17): nilfs2: fix out-of-range warning crypto: ccp - drop platform ifdef checks enetc: avoid truncating error message qed: avoid truncating work queue length mlx5: avoid truncating error message mlx5: stop warning for 64KB pages wifi: carl9170: re-fix fortified-memset warning ACPI: disable -Wstringop-truncation fbdev: shmobile: fix snprintf truncation powerpc/fsl-soc: hide unused const variable fbdev: sisfb: hide unused variables media: rcar-vin: work around -Wenum-compare-conditional warning firmware: dmi-id: add a release callback function greybus: arche-ctrl: move device table to its right location module: don't ignore sysfs_create_link() failures Input: ims-pcu - fix printf string overflow drm/i915/guc: avoid FIELD_PREP warning Arun T (2): ASoC: Intel: common: add ACPI matching tables for Arrow Lake ASoC: SOF: Intel: pci-mtl: use ARL specific firmware definitions Baochen Qiang (2): wifi: ath10k: poll service ready message before failing wifi: ath11k: don't force enable power save on non-running vdevs Bart Van Assche (1): scsi: ufs: core: mcq: Fix ufshcd_mcq_sqe_search() Basavaraj Natikar (1): HID: amd_sfh: Handle "no sensors" in PM operations Beau Belgrave (3): tracing/user_events: Allow events to persist for perfmon_capable users tracing/user_events: Prepare find/delete for same name events tracing/user_events: Fix non-spaced field matching Benjamin Coddington (1): NFSv4: Fixup smatch warning for ambiguous return Benjamin Gray (1): selftests/powerpc/dexcr: Add -no-pie to hashchk tests Benjamin Poirier (1): selftests: net: List helper scripts in TEST_FILES Makefile variable Bibo Mao (1): LoongArch: Lately init pmu after smp is online Binbin Zhou (3): dt-bindings: thermal: loongson,ls2k-thermal: Fix binding check issues dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 compatible dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible definition Bitterblue Smith (4): wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path Bjorn Andersson (1): soc: qcom: pmic_glink: Make client-lock non-sleeping Bjorn Helgaas (1): x86/pci: Skip early E820 check for ECAM region Bob Pearson (2): RDMA/rxe: Allow good work requests to be executed RDMA/rxe: Fix incorrect rxe_put in error path Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Brennan Xavier McManus (1): tools/nolibc/stdlib: fix memory error in realloc() Bui Quang Minh (1): scsi: bfa: Ensure the copied buf is NUL terminated Carolina Jubran (1): net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion Catalin Popescu (1): clk: rs9: fix wrong default value for clock amplitude Cezary Rojewski (5): ASoC: Intel: Disable route checks for Skylake boards ASoC: Intel: avs: ssm4567: Do not ignore route checks ASoC: Intel: avs: Fix ASRC module initialization ASoC: Intel: avs: Fix potential integer overflow ASoC: Intel: avs: Test result of avs_get_module_entry() Chandramohan Akula (2): RDMA/bnxt_re: Refactor the queue index update RDMA/bnxt_re: Remove roundup_pow_of_two depth for all hardware queue resources Chao Yu (14): f2fs: fix to wait on page writeback in __clone_blkaddrs() f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks() f2fs: compress: fix to relocate check condition in f2fs_ioc_{,de}compress_file() f2fs: fix to relocate check condition in f2fs_fallocate() f2fs: fix to check pinfile flag in f2fs_move_file_range() f2fs: support printk_ratelimited() in f2fs_printk() f2fs: compress: fix to update i_compr_blocks correctly f2fs: introduce get_available_block_count() for cleanup f2fs: compress: fix error path of inc_valid_block_count() f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock f2fs: fix to release node block count in error path of f2fs_new_node_page() f2fs: fix to add missing iput() in gc_data_segment() f2fs: use f2fs_{err,info}_ratelimited() for cleanup f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() Charles Keepax (1): ASoC: cs42l43: Only restrict 44.1kHz for the ASP Chen Ni (3): HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors dmaengine: idma64: Add check for dma_set_max_seg_size watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() Chengming Zhou (1): mm/ksm: fix ksm_pages_scanned accounting Chris Lew (1): net: qrtr: ns: Fix module refcnt Chris Wulff (1): usb: gadget: u_audio: Clear uac pointer when freed. Christian Brauner (1): i915: make inject_virtual_interrupt() void Christian Hewitt (1): drm/meson: vclk: fix calculation of 59.94 fractional rates Christoffer Sandberg (1): ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx Christophe JAILLET (3): VMCI: Fix an error handling path in vmci_guest_probe_device() ppdev: Remove usage of the deprecated ida_simple_xx() API i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() Chuck Lever (2): SUNRPC: Fix gss_free_in_token_pages() SUNRPC: Fix loop termination condition in gss_free_in_token_pages() Chun-Kuang Hu (1): soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE Clément Léger (1): selftests: sud_test: return correct emulated syscall value on RISC-V Daeho Jeong (3): f2fs: separate f2fs_gc_range() to use GC for a range f2fs: support file pinning for zoned devices f2fs: write missing last sum blk of file pinning section Dan Aloni (2): sunrpc: fix NFSACL RPC retry on soft mount rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL Dan Carpenter (5): nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists() wifi: mwl8k: initialize cmd->addr[] properly Bluetooth: qca: Fix error code in qca_read_fw_build_info() ext4: fix potential unnitialized variable stm class: Fix a double free in stm_register_device() Daniel Borkmann (1): vxlan: Fix regression when dropping packets due to invalid src addresses Daniel J Blueman (1): x86/tsc: Trust initial offset in architectural TSC-adjust MSRs Daniel Starke (1): tty: n_gsm: fix missing receive state reset after mode switch Daniel Thompson (4): kdb: Use format-strings rather than '\0' injection in kdb_read() kdb: Fix console handling when editing and tab-completing commands kdb: Merge identical case statements in kdb_read() kdb: Use format-specifiers rather than memset() for padding in kdb_read() Daniele Palmas (1): net: usb: qmi_wwan: add Telit FN920C04 compositions Danila Tikhonov (1): pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs Dave Airlie (3): nouveau: add an ioctl to return vram bar size. nouveau: add an ioctl to report vram usage nouveau: report byte usage in VRAM usage. David Arinzon (1): net: ena: Reduce lines with longer column width boundary David E. Box (3): tools/arch/x86/intel_sdsi: Fix maximum meter bundle length tools/arch/x86/intel_sdsi: Fix meter_show display tools/arch/x86/intel_sdsi: Fix meter_certificate decoding David Hildenbrand (2): mm/userfaultfd: Do not place zeropages when zeropages are disallowed s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests Derek Fang (2): ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating ASoC: dt-bindings: rt5645: add cbj sleeve gpio property Derek Foreman (1): drm/etnaviv: fix tx clock gating on some GC7000 variants Detlev Casanova (1): drm/rockchip: vop2: Do not divide height twice for YUV Dev Jain (1): selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages Dhananjay Ugwekar (1): cpufreq: amd-pstate: Fix the inconsistency in max frequency units Dmitry Baryshkov (13): soc: qcom: pmic_glink: don't traverse clients list without a lock soc: qcom: pmic_glink: notify clients about the current state wifi: ath10k: populate board data for WCN3990 drm/msm/dp: allow voltage swing / pre emphasis of 3 drm/mipi-dsi: use correct return type for the DSC functions clk: qcom: dispcc-sm8450: fix DisplayPort clocks clk: qcom: dispcc-sm6350: fix DisplayPort clocks clk: qcom: dispcc-sm8550: fix DisplayPort clocks usb: typec: ucsi: always register a link to USB PD device usb: typec: ucsi: simplify partner's PD caps registration dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x wifi: ath10k: fix QCOM_RPROC_COMMON dependency Dmitry Torokhov (1): Input: try trimming too long modalias strings Dongliang Mu (1): media: flexcop-usb: fix sanity check of bNumEndpoints Doug Berger (1): serial: 8250_bcm7271: use default_mux_rate if possible Douglas Anderson (3): drm/dp: Don't attempt AUX transfers when eDP panels are not powered drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD doesn't assert drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected Duoming Zhou (3): wifi: brcmfmac: pcie: handle randbuf allocation failure lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure um: Fix return value in ubd_init() Edward Liaw (1): selftests/kcmp: remove unused open mode Eric Biggers (5): KEYS: asymmetric: Add missing dependency on CRYPTO_SIG crypto: x86/nh-avx2 - add missing vzeroupper crypto: x86/sha256-avx2 - add missing vzeroupper crypto: x86/sha512-avx2 - add missing vzeroupper fsverity: use register_sysctl_init() to avoid kmemleak warning Eric Dumazet (8): tcp: avoid premature drops in tcp_add_backlog() net: give more chances to rcu in netdev_wait_allrefs_any() usb: aqc111: stop lying about skb->truesize net: usb: sr9700: stop lying about skb->truesize net: usb: smsc95xx: stop lying about skb->truesize af_packet: do not call packet_read_pending() from tpacket_destruct_skb() netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() net: fix __dst_negative_advice() race Eric Garver (1): netfilter: nft_fib: allow from forward/input without iif selector Eric Sandeen (1): openpromfs: finish conversion to the new mount API Eugen Hristev (1): media: mediatek: vcodec: fix possible unbalanced PM counter Fabio Estevam (4): media: dt-bindings: ovti,ov2680: Fix the power supply names media: ov2680: Clear the 'ret' variable on success media: ov2680: Allow probing if link-frequencies is absent media: ov2680: Do not fail if data-lanes property is absent Fedor Pchelkin (3): dma-mapping: benchmark: fix up kthread-related error handling dma-mapping: benchmark: fix node id validation dma-mapping: benchmark: handle NUMA_NO_NODE correctly Felix Fietkau (2): wifi: mt76: mt7603: fix tx queue of loopback packets wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset Felix Kuehling (1): drm/amdgpu: Update BO eviction priorities Fenglin Wu (1): Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation Filipe Manana (1): btrfs: fix leak of qgroup extent records after transaction abort Finn Thain (1): m68k: mac: Fix reboot hang on Mac IIci Florian Fainelli (1): net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled Florian Westphal (1): netfilter: tproxy: bail out if IP has been disabled on the device Frank Li (5): i3c: add actual_len in i3c_priv_xfer i3c: master: svc: rename read_len as actual_len i3c: master: svc: return actual transfer data len i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame i3c: master: svc: fix invalidate IBI type and miss call client IBI handler Frank van der Linden (2): mm/cma: drop incorrect alignment check in cma_init_reserved_mem mm/hugetlb: pass correct order_per_bit to cma_declare_contiguous_nid Friedrich Vock (1): bpf: Fix potential integer overflow in resolve_btfids Gabor Juhos (2): clk: qcom: clk-alpha-pll: remove invalid Stromer register offset clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs Gabriel Krisman Bertazi (2): io-wq: write next_work before dropping acct_lock udp: Avoid call to compute_score on multiple sites Gal Pressman (2): net/mlx5: Fix MTMP register capability offset in MCAM register net/mlx5e: Fix UDP GSO for encapsulated packets Gao Xiang (1): erofs: avoid allocating DEFLATE streams before mounting Geert Uytterhoeven (5): sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() printk: Let no_printk() use _printk() dev_printk: Add and use dev_no_printk() clk: renesas: r8a779a0: Fix CANFD parent clock dt-bindings: PCI: rcar-pci-host: Add missing IOMMU properties Geliang Tang (3): selftests/bpf: Fix umount cgroup2 error in test_sockmap selftests/bpf: Fix a fd leak in error paths in open_netns selftests: mptcp: add ms units for tc-netem delay Gerald Loacker (3): drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel Gerd Hoffmann (1): KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR in CPUID Guenter Roeck (3): mm/slub, kunit: Use inverted data to corrupt kmem cache Revert "sh: Handle calling csum_partial with misaligned data" hwmon: (shtc1) Fix property misspelling Guixiong Wei (1): x86/boot: Ignore relocations in .notes sections in walk_relocs() too Hailong.Liu (1): mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL Hangbin Liu (3): ipv6: sr: add missing seg6_local_exit ipv6: sr: fix incorrect unregister order ipv6: sr: fix invalid unregister error path Hannah Peuckmann (1): riscv: dts: starfive: visionfive 2: Remove non-existing TDM hardware Hannes Reinecke (1): nvme-tcp: add definitions for TLS cipher suites Hans Verkuil (6): media: cec: cec-adap: always cancel work in cec_transmit_msg_fh media: cec: cec-api: add locking in cec_release() media: cec: core: avoid recursive cec_claim_log_addrs media: cec: core: avoid confusing "transmit timed out" message media: mc: mark the media devnode as registered from the, start media: v4l2-core: hold videodev_lock until dev reg, finishes Hans de Goede (8): ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too iio: accel: mxc4005: Reset chip on probe() and resume() platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit() mmc: core: Add mmc_gpiod_set_cd_config() function mmc: sdhci-acpi: Sort DMI quirks alphabetically mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect GPIO on Asus T100TA Harald Freudenberger (2): s390/cpacf: Split and rework cpacf query functions s390/cpacf: Make use of invalid opcode produce a link error Hariprasad Kelam (1): Octeontx2-pf: Free send queue buffers incase of leaf to inner He Zhe (1): perf bench internals inject-build-id: Fix trap divide when collecting just one DSO Hechao Li (1): tcp: increase the default TCP scaling ratio Heiko Carstens (1): s390/vdso: Use standard stack frame layout Heiner Kallweit (1): Revert "r8169: don't try to disable interrupts if NAPI is, scheduled already" Helen Koike (2): drm/ci: uprev mesa version: fix container build & crosvm drm/ci: add subset-1-gfx to LAVA_TAGS and adjust shards Helge Deller (2): parisc: Define HAVE_ARCH_HUGETLB_UNMAPPED_AREA parisc: Define sigset_t in parisc uapi header Henry Wang (1): drivers/xen: Improve the late XenStore init protocol Herve Codina (1): net: lan966x: remove debugfs directory in probe() error path Himanshu Madhani (1): scsi: qla2xxx: Fix debugfs output for fw_resource_count Horatiu Vultur (3): net: micrel: Fix receiving the timestamp in the frame for lan8841 net: lan966x: Remove ptp traps in case the ptp is not enabled. net: micrel: Fix lan8841_config_intr after getting out of sleep mode Hsin-Te Yuan (2): drm/bridge: anx7625: Update audio status while detecting ASoC: mediatek: mt8192: fix register configuration for tdm Huacai Chen (1): LoongArch: Fix callchain parse error with kernel tracepoint events again Huai-Yuan Liu (1): ppdev: Add an error check in register_device Hugo Villeneuve (3): serial: sc16is7xx: add proper sched.h include for sched_set_fifo() serial: sc16is7xx: replace hardcoded divisor value with BIT() macro serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler INAGAKI Hiroshi (1): block: fix and simplify blkdevparts= cmdline parsing Ian Rogers (14): perf record: Delete session after stopping sideband thread perf record: Lazy load kernel symbols perf machine thread: Remove exited threads by default perf bench uprobe: Remove lib64 from libc.so.6 binary path perf docs: Document bpf event modifier perf ui browser: Don't save pointer to stack memory perf ui browser: Avoid SEGV on title perf report: Avoid SEGV in report__setup_sample_type() perf thread: Fixes to thread__new() related to initializing comm perf maps: Move symbol maps functions to maps.c libsubcmd: Fix parse-options memory leak perf stat: Don't display metric header for non-leader uncore events perf tools: Use pmus to describe type from attribute perf tools: Add/use PMU reverse lookup from config to name Igor Artemiev (1): wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class Ilpo Järvinen (2): PCI: Wait for Link Training==0 before starting Link retrain EDAC/igen6: Convert PCIBIOS_* return codes to errnos Ilya Leoshkevich (1): s390/bpf: Emit a barrier for BPF_FETCH instructions Irui Wang (1): media: mediatek: vcodec: add encoder power management helper functions Jack Yu (4): ASoC: rt722-sdca: modify channel number to support 4 channels ASoC: rt722-sdca: add headset microphone vrefo setting ASoC: rt715: add vendor clear control register ASoC: rt715-sdca: volume step modification Jacob Keller (2): Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI" ice: fix accounting if a VLAN already exists Jaegeuk Kim (3): f2fs: use BLKS_PER_SEG, BLKS_PER_SEC, and SEGS_PER_SEC f2fs: kill heap-based allocation f2fs: deprecate io_bits Jaewon Kim (1): clk: samsung: exynosautov9: fix wrong pll clock id value Jagan Teki (1): drm/bridge: Fix improper bridge init order with pre_enable_prev_first Jakub Kicinski (2): selftests: net: add missing config for amt.sh selftests: net: move amt to socat for better compatibility James Clark (6): perf tests: Make "test data symbol" more robust on Neoverse N1 perf tests: Apply attributes to all events in object code reading test perf test shell arm_coresight: Increase buffer size for Coresight basic tests perf symbols: Fix ownership of string in dso__load_vmlinux() perf test: Add a test for strcmp_cpuid_str() expression perf pmu: Move pmu__find_core_pmu() to pmus.c Jan Beulich (1): tpm_tis: Do *not* flush uninitialized work Jan Kara (2): ext4: avoid excessive credit estimate in ext4_tmpfile() udf: Remove GFP_NOFS allocation in udf_expand_file_adinicb() Jason Gunthorpe (1): IB/mlx5: Use __iowrite64_copy() for write combining stores Jens Axboe (1): io_uring: use the right type for work_llist empty check Jens Remus (1): s390/vdso: Generate unwind information for C modules Jiaxun Yang (2): LoongArch: Add all CPUs enabled by fdt to NUMA node 0 LoongArch: Override higher address bits in JUMP_VIRT_ADDR Jing Zhang (1): perf pmu: "Compat" supports regular expression matching identifiers Jiri Olsa (1): libbpf: Fix error message in attach_kprobe_multi Johan Hovold (4): dt-bindings: spmi: hisilicon,hisi-spmi-controller: fix binding references arm64: dts: qcom: qcs404: fix bluetooth device address arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP HID: i2c-hid: elan: fix reset suspend current leakage Johannes Berg (8): wifi: mac80211: don't use rate mask for scanning wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok() wifi: iwlwifi: mvm: allocate STA links only for active links wifi: iwlwifi: mvm: select STA mask only for active links wifi: iwlwifi: reconfigure TLC during HW restart wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask wifi: iwlwifi: mvm: init vif works only once um: vector: fix bpfflash parameter evaluation John Hubbard (2): selftests/binderfs: use the Makefile's rules, not Make's implicit rules selftests/resctrl: fix clang build failure: use LOCAL_HDRS John Kacur (1): rtla/timerlat: Fix histogram report when a cpu count is 0 Jonathan Cameron (1): iio: adc: stm32: Fixing err code to not indicate success Jorge Ramirez-Ortiz (1): mmc: core: Do not force a retune before RPMB switch Joshua Ashton (1): drm/amd/display: Set color_mgmt_changed to true on unsuspend Judith Mendez (6): mmc: sdhci_am654: Add tuning algorithm for delay chain mmc: sdhci_am654: Write ITAPDLY for DDR52 timing mmc: sdhci_am654: Add OTAP/ITAP delay enable mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock mmc: sdhci_am654: Fix ITAPDLY for HS400 timing watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin Juergen Gross (3): x86/pat: Introduce lookup_address_in_pgd_attr() x86/pat: Restructure _lookup_address_cpa() x86/pat: Fix W^X violation false-positives when running as Xen PV guest KaiLong Wang (1): f2fs: Clean up errors in segment.h Karthikeyan Ramasubramanian (1): platform/chrome: cros_ec: Handle events during suspend after resume completion Kees Cook (1): lkdtm: Disable CFI checking for perms functions Keith Busch (1): nvme-multipath: fix io accounting on failover Konrad Dybcio (1): interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment Konstantin Komarov (4): fs/ntfs3: Remove max link count info display during driver init fs/ntfs3: Taking DOS names into account during link counting fs/ntfs3: Fix case when index is reused during tree transformation fs/ntfs3: Break dir enumeration if directory contents error Krzysztof Kozlowski (7): regulator: qcom-refgen: fix module autoloading regulator: vqmmc-ipq4019: fix module autoloading dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios arm64: tegra: Correct Tegra132 I2C alias ARM: dts: samsung: smdkv310: fix keypad no-autorepeat ARM: dts: samsung: smdk4412: fix keypad no-autorepeat ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat Kuniyuki Iwashima (3): af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. af_unix: Annotate data-race around unix_sk(sk)->addr. af_unix: Read sk->sk_hash under bindlock during bind(). Kuppuswamy Sathyanarayanan (2): PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 Lad Prabhakar (1): clk: renesas: r9a07g043: Add clock and reset entry for PLIC Lancelot SIX (1): drm/amdkfd: Flush the process wq before creating a kfd_process Lang Yu (1): drm/amdkfd: handle duplicate BOs in reserve_bo_and_cond_vms Larysa Zaremba (1): ice: Interpret .set_channels() input differently Laurent Pinchart (4): firmware: raspberrypi: Use correct device for DMA mappings media: v4l2-subdev: Fix stream handling for crop API media: v4l2-subdev: Document and enforce .s_stream() requirements media: vsp1: Remove unbalanced .s_stream(0) calls Le Ma (1): drm/amdgpu: init microcode chip name from ip versions Leo Ma (1): drm/amd/display: Fix DC mode screen flickering on DCN321 Leon Romanovsky (1): RDMA/IPoIB: Fix format truncation compilation errors Li Ma (1): drm/amdgpu/atomfirmware: add intergrated info v2.3 table Li Zhijian (1): cxl/region: Fix cxlr_pmem leaks Lijo Lazar (1): drm/amd/pm: Restore config space after reset Linus Torvalds (2): x86/mm: Remove broken vsyscall emulation code from the page fault code epoll: be better about file lifetimes Linus Walleij (1): net: ethernet: cortina: Locking fixes Lorenzo Bianconi (1): wifi: mt76: mt7915: workaround too long expansion sparse warnings Luca Ceresoli (2): iio: accel: mxc4005: allow module autoloading via OF compatible Revert "drm/bridge: ti-sn65dsi83: Fix enable error path" Lucas Karpinski (1): selftests/net: synchronize udpgro tests' tx and rx connection Luke D. Jones (1): ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp MD Danish Anwar (1): net: ti: icssg-prueth: Fix start counter for ft1 filter Maher Sanalla (2): net/mlx5: Reload only IB representors upon lag disable/enable net/mlx5: Lag, do bond only if slaves agree on roce state Marc Dionne (1): afs: Don't cross .backup mountpoint from backup volume Marc Gonzalez (1): clk: qcom: mmcc-msm8998: fix venus clock issue Marc Zyngier (3): KVM: arm64: Fix AArch32 register narrowing on userspace write KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode KVM: arm64: AArch32: Fix spurious trapping of conditional instructions Marek Szyprowski (1): Input: cyapa - add missing input core locking to suspend/resume functions Marek Vasut (2): drm/lcdif: Do not disable clocks on already suspended hardware drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector Marijn Suijten (2): drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk drm/msm/dpu: Always flush the slave INTF on the CTL Mario Limonciello (2): drm/amd/display: Enable colorspace property for MST connectors drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms Martin K. Petersen (1): scsi: core: Handle devices which return an unusually large VPD page count Martin Kaiser (1): nfs: keep server info for remounts Masahiro Yamada (2): x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y kconfig: fix comparison to constant symbols, 'm', 'n' Masami Hiramatsu (Google) (1): selftests/ftrace: Fix BTFARG testcase to check fprobe is enabled correctly Mathieu Othacehe (1): net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 Matthew Bystrin (1): riscv: stacktrace: fixed walk_stackframe() Matthew Mirvish (1): bcache: fix variable length array abuse in btree_iter Matthew Wilcox (Oracle) (1): udf: Convert udf_expand_file_adinicb() to use a folio Matthias Schiffer (2): net: dsa: mv88e6xxx: Add support for model-specific pre- and post-reset handlers net: dsa: mv88e6xxx: Avoid EEPROM timeout without EEPROM on 88E6250-family switches Matthieu Baerts (NGI0) (4): mptcp: SO_KEEPALIVE: fix getsockopt support selftests: mptcp: simult flows: mark 'unbalanced' tests as flaky selftests: mptcp: join: mark 'fail' tests as flaky mptcp: fix full TCP keep-alive support Matti Vaittinen (5): regulator: irq_helpers: duplicate IRQ name watchdog: bd9576: Drop "always-running" property regulator: bd71828: Don't overwrite runtime voltages regulator: pickable ranges: don't always cache vsel regulator: tps6287x: Force writing VSEL bit Maulik Shah (1): soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request Maurizio Lombardi (2): nvmet-auth: return the error code to the nvmet_auth_host_hash() callers nvmet-auth: replace pr_debug() with pr_err() to report an error. Max Krummenacher (1): arm64: dts: ti: verdin-am62: Set memory size to 2gb Maxim Korotkov (1): mtd: rawnand: hynix: fixed typo Maxime Ripard (3): ARM: configs: sunxi: Enable DRM_DW_HDMI drm/sun4i: hdmi: Convert encoder to atomic drm/sun4i: hdmi: Move mode_set into enable Meenakshikumar Somasundaram (1): drm/amd/display: Allocate zero bw after bw alloc enable Michael Ellerman (1): selftests/mm: fix build warnings on ppc64 Michael Schmitz (1): m68k: Fix spinlock race in kernel thread creation Michael Walle (1): drm/bridge: tc358775: fix support for jeida-18 and jeida-24 Michal Schmidt (2): selftests/bpf: Fix pointer arithmetic in test_xdp_do_redirect bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Michal Simek (2): microblaze: Remove gcc flag for non existing early_printk.c file microblaze: Remove early printk call from cpuinfo-static.c Mickaël Salaün (1): kunit: Fix kthread reference Miguel Ojeda (1): kheaders: use `command -v` to test for existence of `cpio` Mike Gilbert (1): sparc: move struct termio to asm/termios.h Miklos Szeredi (1): ovl: remove upper umask handling from ovl_create_upper() Ming Lei (2): io_uring: fail NOP if non-zero op flags is passed in blk-cgroup: fix list corruption from resetting io stat Mohamed Ahmed (1): drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations Mukesh Ojha (1): firmware: qcom: scm: Fix __scm and waitq completion variable initialization Mukul Joshi (2): drm/amdkfd: Add VRAM accounting for SVM migration drm/amdgpu: Fix VRAM memory accounting Namhyung Kim (8): perf annotate: Get rid of duplicate --group option item perf annotate: Split branch stack cycles information out of 'struct annotation_line' perf annotate: Introduce global annotation_options perf report: Convert to the global annotation_options perf top: Convert to the global annotation_options perf annotate: Use global annotation_options perf annotate: Fix annotation_calc_lines() to pass correct address to get_srcline() perf/arm-dmc620: Fix lockdep assert in ->event_init() Namjae Jeon (2): ksmbd: avoid to send duplicate oplock break notifications ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect() Nandor Kracser (1): ksmbd: ignore trailing slashes in share paths Nathan Chancellor (2): media: mxl5xx: Move xpt structures off stack kbuild: Remove support for Clang's ThinLTO caching Nathan Lynch (1): powerpc/pseries/lparcfg: drop error message from guest name lookup Neha Malcom Francis (1): regulator: tps6594-regulator: Correct multi-phase configuration Neil Armstrong (2): phy: qcom: qmp-combo: fix duplicate return in qmp_v4_configure_dp_phy drm/meson: gate px_clk when setting rate Nikita Zhandarovich (1): wifi: ar5523: enable proper endpoint verification Nikolay Aleksandrov (1): selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval Nilay Shroff (2): nvme: find numa distance only if controller has valid numa id nvme: cancel pending I/O if nvme controller is in terminal state Nuno Sa (10): iio: adc: ad9467: use spi_get_device_match_data() iio: adc: ad9467: use chip_info variables instead of array iio: adc: adi-axi-adc: convert to regmap iio: buffer-dmaengine: export buffer alloc and free functions iio: add the IIO backend framework iio: adc: ad9467: convert to backend framework iio: adc: adi-axi-adc: move to backend framework iio: adc: adi-axi-adc: only error out in major version mismatch dt-bindings: adc: axi-adc: update bindings for backend framework dt-bindings: adc: axi-adc: add clocks property Nícolas F. R. A. Prado (9): drm/bridge: anx7625: Don't log an error when DSI host can't be found drm/bridge: icn6211: Don't log an error when DSI host can't be found drm/bridge: lt8912b: Don't log an error when DSI host can't be found drm/bridge: lt9611: Don't log an error when DSI host can't be found drm/bridge: lt9611uxc: Don't log an error when DSI host can't be found drm/bridge: tc358775: Don't log an error when DSI host can't be found drm/bridge: dpc3433: Don't log an error when DSI host can't be found drm/panel: novatek-nt35950: Don't log an error when DSI host can't be found clk: mediatek: pllfh: Don't log error for missing fhctl node Oleg Nesterov (1): sched/isolation: Fix boot crash when maxcpus < first housekeeping CPU Olga Kornievskaia (1): pNFS/filelayout: fixup pNfs allocation modes Oliver Upton (1): KVM: selftests: Add test for uaccesses to non-existent vgic-v2 CPUIF Or Har-Toov (2): RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent RDMA/mlx5: Adding remote atomic access flag to updatable flags Oswald Buddenhagen (1): ALSA: emu10k1: make E-MU FPGA writes potentially more reliable Pablo Neira Ayuso (2): netfilter: nft_payload: restore vlan q-in-q match support netfilter: nft_payload: skbuff vlan metadata mangle support Paolo Abeni (6): selftests: net: add more missing kernel config net: relax socket state check at accept time. mptcp: avoid some duplicate code in socket option handling mptcp: cleanup SOL_TCP handling selftests: net: included needed helper in the install targets selftests: net: more strict check in net_helper Parthiban Veerasooran (1): net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM Peter Colberg (2): fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor Peter Oberparleiter (1): s390/cio: fix tracepoint subchannel type field Peter Ujfalusi (4): ASoC: SOF: Intel: mtl: Correct rom_status_reg ASoC: SOF: Intel: lnl: Correct rom_status_reg ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed ASoC: SOF: Intel: mtl: Implement firmware boot state check Pierre-Louis Bossart (4): ASoC: da7219-aad: fix usage of device_get_named_child_node() ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection ASoC: SOF: Intel: pci-mtl: fix ARL-S definitions soundwire: cadence: fix invalid PDI offset Pin-yen Lin (1): serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup Ping-Ke Shih (2): wifi: rtw89: correct aSIFSTime for 6GHz band wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of firmware command Portia Stephens (1): cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations Pratyush Yadav (1): media: cadence: csi2rx: configure DPHY before starting source stream Prike Liang (1): drm/amdgpu: Fix the ring buffer size for queue VM flush Puranjay Mohan (3): bpf, x86: Fix PROBE_MEM runtime load check riscv, bpf: make some atomic operations fully ordered powerpc/bpf: enforce full ordering for ATOMIC operations with BPF_FETCH Rafał Miłecki (1): dt-bindings: pinctrl: mediatek: mt7622: fix array properties Rahul Rameshbabu (2): net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules net/mlx5e: Fix IPsec tunnel mode offload feature check Randy Dunlap (4): fbdev: sh7760fb: allow modular build counter: linux/counter.h: fix Excess kernel-doc description warning extcon: max8997: select IRQ_DOMAIN instead of depending on it media: sunxi: a83-mips-csi2: also select GENERIC_PHY Ranjani Sridharan (1): ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3 Ricardo Ribalda (2): media: radio-shark2: Avoid led_names truncations media: uvcvideo: Add quirk for Logitech Rally Bar Richard Fitzgerald (4): ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot() ASoC: cs35l56: Fix to ensure ASP1 registers match cache ALSA: hda: cs35l56: Initialize all ASP1 registers ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance Richard Kinder (1): wifi: mac80211: ensure beacon is non-S1G prior to extracting the beacon timestamp field Rob Herring (1): dt-bindings: rockchip: grf: Add missing type to 'pcie-phy' node Roberto Sassu (1): um: Add winch to winch_handlers before registering winch IRQ Roded Zats (1): enic: Validate length of nl attributes in enic_set_vf_port Rodrigo Siqueira (1): drm/amd/display: Add VCO speed parameter for DCN31 FPU Roger Pau Monne (1): xen/x86: add extra pages to unpopulated-alloc if available Romain Gantois (1): net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe() Russell King (Oracle) (1): net: sfp-bus: fix SFP mode detect from bitrate Ryosuke Yasuoka (2): nfc: nci: Fix uninit-value in nci_rx_work nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() Sagi Grimberg (3): nvmet-tcp: fix possible memory leak when tearing down a controller nvmet: fix nvme status code when namespace is disabled nvmet: fix ns enable/disable possible hang Sahil Siddiq (1): bpftool: Mount bpffs on provided dir instead of parent dir Sai Pavan Boddu (1): i2c: cadence: Avoid fifo clear after start Sakari Ailus (3): media: ipu3-cio2: Request IRQ earlier media: v4l: Don't turn on privacy LED if streamon fails media: v4l: async: Don't set notifier's V4L2 device if registering fails Sam Ravnborg (1): sparc64: Fix number of online CPUs Samasth Norway Ananda (1): perf daemon: Fix file leak in daemon_session__control Sean Christopherson (1): cpu: Ignore "mitigations" kernel parameter if CPU_MITIGATIONS=n Sean Young (1): pwm: Rename pwm_apply_state() to pwm_apply_might_sleep() Sebastian Urban (1): Bluetooth: compute LE flow credits based on recvbuf space Selvin Xavier (3): RDMA/bnxt_re: Update the HW interface definitions RDMA/bnxt_re: Adds MSN table capability for Gen P7 adapters RDMA/bnxt_re: Fix the sparse warnings Sergey Matyukevich (1): riscv: prevent pt_regs corruption for secondary idle threads Sergey Shtylyov (2): ata: pata_legacy: make legacy_exit() work again nfs: fix undefined behavior in nfs_block_bits() Shay Agroskin (1): net: ena: Fix redundant device NUMA node override Shay Drory (1): net/mlx5: Enable 4 ports multiport E-switch Shenghao Ding (3): ASoC: tas2781: Fix a warning reported by robot kernel test ASoC: tas2552: Add TX path for capturing AUDIO-OUT data ASoC: tas2781: Fix wrong loading calibrated data sequence Shengyu Qu (1): riscv: dts: starfive: Remove PMIC interrupt info for Visionfive 2 board Shrikanth Hegde (2): sched/fair: Add EAS checks before updating root_domain::overutilized powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp Shuah Khan (1): tools/latency-collector: Fix -Wformat-security compile warns Souradeep Chakrabarti (1): net: mana: Fix the extra HZ in mana_hwc_send_request Srinivas Pandruvada (3): platform/x86: ISST: Add Grand Ridge to HPM CPU list platform/x86/intel/tpmi: Handle error from tpmi_process_info() platform/x86/intel-uncore-freq: Don't present root domain on error Srinivasan Shanmugam (2): drm/amd/display: Fix potential index out of bounds in color transformation function drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode() Stefan Berger (1): crypto: ecdsa - Fix module auto-load on add-key Stefan Binding (1): ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config Steven Rostedt (1): ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value Steven Rostedt (Google) (7): eventfs: Do not differentiate the toplevel events directory eventfs: Create eventfs_root_inode to store dentry eventfs/tracing: Add callback for release of an eventfs_inode eventfs: Free all of the eventfs_inode after RCU eventfs: Have "events" directory get permissions from its parent eventfs: Keep the directories from having the same inode number as files tracefs: Clear EVENT_INODE flag in tracefs_drop_inode() Su Hui (1): wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() Sumanth Korikkar (1): s390/vdso64: filter out munaligned-symbols flag for vdso Sung Joon Kim (1): drm/amd/display: Disable seamless boot on 128b/132b encoding Suzuki K Poulose (4): coresight: etm4x: Do not hardcode IOMEM access for register restore coresight: etm4x: Do not save/restore Data trace control registers coresight: etm4x: Safe access for TRCQCLTR coresight: etm4x: Fix access to resource selector registers Sven Schnelle (1): s390/boot: Remove alt_stfle_fac_list from decompressor Swapnil Patel (1): drm/amd/display: Add dtbclk access to dcn315 Taehee Yoo (1): selftests: net: kill smcrouted in the cleanup logic in amt.sh Takashi Iwai (9): ALSA: jack: Use guard() for locking ALSA: core: Remove debugfs at disconnection ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion ALSA: seq: Don't clear bank selection at event -> UMP MIDI2 conversion ALSA: seq: Fix yet another spot for system message conversion ALSA: seq: ump: Fix swapped song position pointer data ALSA: ump: Don't clear bank selection after sending a program change ALSA: ump: Don't accept an invalid UMP protocol number ALSA: seq: Fix incorrect UMP type for system messages Thomas Haemmerle (1): iio: pressure: dps310: support negative temperature values Thomas Richter (1): perf stat: Do not fail on metrics on s390 z/VM systems Thomas Weißschuh (2): misc/pvpanic: deduplicate common code misc/pvpanic-pci: register attributes via pci_driver Thomas Zimmermann (2): fbdev: Provide I/O-memory helpers as module drm/fbdev-generic: Do not set physical framebuffer address Thorsten Blum (1): net: smc91x: Fix m68k kernel compilation for ColdFire CPU Tianchen Ding (1): selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 mounted without nsdelegate Tiwei Bie (3): um: Fix the -Wmissing-prototypes warning for __switch_mm um: Fix the -Wmissing-prototypes warning for get_thread_reg um: Fix the declaration of kasan_map_memory Tony Lindgren (2): drm/omapdrm: Fix console by implementing fb_dirty drm/omapdrm: Fix console with deferred ops Tristram Ha (1): net: dsa: microchip: fix RGMII error in KSZ DSA driver Tyler Hicks (Microsoft) (1): proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation Uros Bizjak (1): locking/atomic/x86: Correct the definition of __arch_try_cmpxchg128() Uwe Kleine-König (5): pwm: sti: Prepare removing pwm_chip from driver data pwm: sti: Simplify probe function using devm functions media: i2c: et8ek8: Don't strip remove function when driver is builtin leds: pwm: Disable PWM when going to suspend spi: stm32: Don't warn about spurious interrupts Valentin Obst (1): selftests: default to host arch for LLVM builds Vicki Pfau (1): Input: xpad - add support for ASUS ROG RAIKIRI Vidya Sagar (1): PCI: tegra194: Fix probe path for Endpoint mode Vignesh Raghavendra (1): mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel Vignesh Raman (1): drm/ci: update device type for volteer devices Ville Syrjälä (1): drm/edid: Parse topology block for all DispID structure v1.x Viresh Kumar (1): cpufreq: exit() callback is optional Vitalii Bursov (1): sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level Vitaly Chikunov (1): crypto: ecrdsa - Fix module auto-load on add_key Vladimir Oltean (2): net/sched: taprio: make q->picos_per_byte available to fill_sched_entry() net/sched: taprio: extend minimum interval restriction to entire cycle too Waiman Long (1): blk-cgroup: Properly propagate the iostat update up the hierarchy Wei Fang (1): net: fec: avoid lock evasion when reading pps_enable Wenjing Liu (1): drm/amd/display: Revert Remove pixle rate limit for subvp Wojciech Macek (1): drm/mediatek: dp: Fix mtk_dp_aux_transfer return value Wolfram Sang (2): dt-bindings: PCI: rcar-pci-host: Add optional regulators serial: sh-sci: protect invalidating RXDMA on shutdown Wu Bo (1): f2fs: fix block migration when section is not aligned to pow2 Xianwei Zhao (1): arm64: dts: meson: fix S4 power-controller node Xiaolei Wang (1): net:fec: Add fec_enet_deinit() Xingui Yang (1): scsi: libsas: Fix the failure of adding phy with zero-address to port Xu Yang (1): filemap: add helper mapping_max_folio_size() Yang Jihong (4): perf evlist: Add evlist__findnew_tracking_event() helper perf record: Move setting tracking events before record__init_thread_masks() perf evlist: Add perf_evlist__go_system_wide() helper perf sched timehist: Fix -g/--call-graph option failure Yang Li (1): rv: Update rv_en(dis)able_monitor doc to match kernel-doc Yang Xiwen (1): arm64: dts: hi3798cv200: fix the size of GICR Yong Zhi (1): ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails Yonghong Song (1): bpftool: Fix missing pids during link show Yu Kuai (1): md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING Yuanyuan Zhong (1): mm: /proc/pid/smaps_rollup: avoid skipping vma after getting mmap_lock again Yue Haibing (1): ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Yuri Karpov (1): scsi: hpsa: Fix allocation size for Scsi_Host private data Zenghui Yu (2): irqchip/alpine-msi: Fix off-by-one in allocation error path irqchip/loongson-pch-msi: Fix off-by-one on allocation error path Zhang Yi (1): ext4: remove the redundant folio_wait_stable() Zhipeng Lu (1): media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries Zhu Yanjun (3): null_blk: Fix missing mutex_destroy() at module removal RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() Zqiang (1): softirq: Fix suspicious RCU usage in __do_softirq() end.to.start (1): ASoC: acp: Support microphone from device Acer 315-24p gaoxingwang (1): net: ipv6: fix wrong start position when receive hop-by-hop fragment xu xin (1): net/ipv6: Fix route deleting failure when metric equals 0 .../admin-guide/kernel-parameters.txt | 3 + .../bindings/iio/adc/adi,axi-adc.yaml | 13 +- .../bindings/media/i2c/ovti,ov2680.yaml | 18 +- .../bindings/pci/rcar-pci-host.yaml | 14 + .../bindings/pci/rockchip,rk3399-pcie.yaml | 1 + .../phy/qcom,sc8280xp-qmp-ufs-phy.yaml | 16 +- .../bindings/phy/qcom,usb-snps-femto-v2.yaml | 4 +- .../pinctrl/mediatek,mt7622-pinctrl.yaml | 92 ++-- .../devicetree/bindings/soc/rockchip/grf.yaml | 1 + .../devicetree/bindings/sound/rt5645.txt | 6 + .../spmi/hisilicon,hisi-spmi-controller.yaml | 4 +- .../thermal/loongson,ls2k-thermal.yaml | 34 +- Documentation/driver-api/pwm.rst | 8 +- Documentation/filesystems/f2fs.rst | 6 +- MAINTAINERS | 10 +- Makefile | 5 +- .../boot/dts/samsung/exynos4210-smdkv310.dts | 2 +- .../boot/dts/samsung/exynos4412-origen.dts | 2 +- .../boot/dts/samsung/exynos4412-smdk4412.dts | 2 +- arch/arm/configs/sunxi_defconfig | 1 + arch/arm64/boot/dts/amlogic/meson-s4.dtsi | 13 +- .../arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 2 +- .../arm64/boot/dts/nvidia/tegra132-norrin.dts | 4 +- arch/arm64/boot/dts/nvidia/tegra132.dtsi | 2 +- arch/arm64/boot/dts/qcom/qcs404-evb.dtsi | 2 +- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +- arch/arm64/kvm/guest.c | 3 +- arch/arm64/kvm/hyp/aarch32.c | 18 +- arch/loongarch/include/asm/numa.h | 1 + arch/loongarch/include/asm/perf_event.h | 3 +- arch/loongarch/include/asm/stackframe.h | 2 +- arch/loongarch/kernel/perf_event.c | 2 +- arch/loongarch/kernel/smp.c | 5 +- arch/m68k/kernel/entry.S | 4 +- arch/m68k/mac/misc.c | 36 +- arch/microblaze/kernel/Makefile | 1 - arch/microblaze/kernel/cpu/cpuinfo-static.c | 2 +- arch/parisc/include/asm/page.h | 1 + arch/parisc/include/asm/signal.h | 12 - arch/parisc/include/uapi/asm/signal.h | 10 + arch/parisc/kernel/parisc_ksyms.c | 1 + arch/powerpc/include/asm/hvcall.h | 2 +- arch/powerpc/net/bpf_jit_comp32.c | 12 + arch/powerpc/net/bpf_jit_comp64.c | 12 + arch/powerpc/platforms/pseries/lpar.c | 6 +- arch/powerpc/platforms/pseries/lparcfg.c | 10 +- arch/powerpc/sysdev/fsl_msi.c | 2 + .../jh7110-starfive-visionfive-2.dtsi | 41 -- arch/riscv/kernel/cpu_ops_sbi.c | 2 +- arch/riscv/kernel/cpu_ops_spinwait.c | 3 +- arch/riscv/kernel/stacktrace.c | 20 +- arch/riscv/net/bpf_jit_comp64.c | 20 +- arch/s390/boot/startup.c | 1 - arch/s390/include/asm/cpacf.h | 109 ++++- arch/s390/include/asm/gmap.h | 2 +- arch/s390/include/asm/mmu.h | 5 + arch/s390/include/asm/mmu_context.h | 1 + arch/s390/include/asm/pgtable.h | 16 +- arch/s390/kernel/ipl.c | 10 +- arch/s390/kernel/setup.c | 2 +- arch/s390/kernel/vdso32/Makefile | 4 +- arch/s390/kernel/vdso64/Makefile | 5 +- arch/s390/kvm/kvm-s390.c | 4 +- arch/s390/mm/gmap.c | 165 +++++-- arch/s390/net/bpf_jit_comp.c | 8 +- arch/sh/kernel/kprobes.c | 7 +- arch/sh/lib/checksum.S | 67 +-- arch/sparc/include/asm/smp_64.h | 2 - arch/sparc/include/uapi/asm/termbits.h | 10 - arch/sparc/include/uapi/asm/termios.h | 9 + arch/sparc/kernel/prom_64.c | 4 +- arch/sparc/kernel/setup_64.c | 1 - arch/sparc/kernel/smp_64.c | 14 - arch/um/drivers/line.c | 14 +- arch/um/drivers/ubd_kern.c | 4 +- arch/um/drivers/vector_kern.c | 2 +- arch/um/include/asm/kasan.h | 1 - arch/um/include/asm/mmu.h | 2 - arch/um/include/asm/processor-generic.h | 1 - arch/um/include/shared/kern_util.h | 2 + arch/um/include/shared/skas/mm_id.h | 2 + arch/um/os-Linux/mem.c | 1 + arch/x86/Kconfig | 8 +- arch/x86/Kconfig.debug | 5 +- arch/x86/boot/compressed/head_64.S | 5 + arch/x86/crypto/nh-avx2-x86_64.S | 1 + arch/x86/crypto/sha256-avx2-asm.S | 1 + arch/x86/crypto/sha512-avx2-asm.S | 1 + arch/x86/entry/vsyscall/vsyscall_64.c | 28 +- arch/x86/include/asm/cmpxchg_64.h | 2 +- arch/x86/include/asm/pgtable_types.h | 2 + arch/x86/include/asm/processor.h | 1 - arch/x86/kernel/tsc_sync.c | 6 +- arch/x86/kvm/cpuid.c | 21 +- arch/x86/lib/x86-opcode-map.txt | 10 +- arch/x86/mm/fault.c | 33 +- arch/x86/mm/pat/set_memory.c | 68 ++- arch/x86/net/bpf_jit_comp.c | 57 ++- arch/x86/pci/mmconfig-shared.c | 40 +- arch/x86/purgatory/Makefile | 3 +- arch/x86/tools/relocs.c | 9 + arch/x86/um/shared/sysdep/archsetjmp.h | 7 + arch/x86/xen/enlighten.c | 33 ++ block/blk-cgroup.c | 77 +++- block/partitions/cmdline.c | 49 +- crypto/asymmetric_keys/Kconfig | 1 + crypto/ecdsa.c | 3 + crypto/ecrdsa.c | 1 + drivers/accel/ivpu/ivpu_job.c | 3 +- drivers/acpi/acpi_lpss.c | 1 + drivers/acpi/acpica/Makefile | 1 + drivers/acpi/resource.c | 12 + drivers/ata/pata_legacy.c | 8 +- drivers/base/base.h | 9 +- drivers/base/bus.c | 9 +- drivers/base/module.c | 42 +- drivers/block/null_blk/main.c | 3 + drivers/bluetooth/btqca.c | 4 +- drivers/char/ppdev.c | 21 +- drivers/char/tpm/tpm_tis_core.c | 3 +- drivers/clk/clk-renesas-pcie.c | 10 +- drivers/clk/mediatek/clk-mt8365-mm.c | 2 +- drivers/clk/mediatek/clk-pllfh.c | 2 +- drivers/clk/qcom/clk-alpha-pll.c | 3 +- drivers/clk/qcom/dispcc-sm6350.c | 11 +- drivers/clk/qcom/dispcc-sm8450.c | 20 +- drivers/clk/qcom/dispcc-sm8550.c | 20 +- drivers/clk/qcom/mmcc-msm8998.c | 8 + drivers/clk/renesas/r8a779a0-cpg-mssr.c | 2 +- drivers/clk/renesas/r9a07g043-cpg.c | 9 + drivers/clk/samsung/clk-exynosautov9.c | 8 +- drivers/cpufreq/amd-pstate.c | 2 +- drivers/cpufreq/brcmstb-avs-cpufreq.c | 5 +- drivers/cpufreq/cpufreq.c | 11 +- drivers/crypto/ccp/sp-platform.c | 14 +- drivers/cxl/core/region.c | 1 + drivers/cxl/core/trace.h | 4 +- drivers/dma-buf/st-dma-fence-chain.c | 12 +- drivers/dma-buf/st-dma-fence.c | 4 +- drivers/dma/idma64.c | 4 +- drivers/edac/igen6_edac.c | 4 +- drivers/extcon/Kconfig | 3 +- drivers/firmware/dmi-id.c | 7 +- drivers/firmware/efi/libstub/x86-stub.c | 28 +- drivers/firmware/qcom_scm.c | 10 +- drivers/firmware/raspberrypi.c | 7 +- drivers/fpga/dfl-pci.c | 3 + .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 5 +- .../gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 8 +- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 16 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 8 + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + .../display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 + .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 + .../display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 15 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 + .../amd/display/dc/dcn10/dcn10_cm_common.c | 5 + .../drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 2 + .../dc/link/protocols/link_dp_dpia_bw.c | 10 +- drivers/gpu/drm/amd/include/atomfirmware.h | 43 ++ .../drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 20 +- .../drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 25 ++ drivers/gpu/drm/bridge/analogix/anx7625.c | 15 +- drivers/gpu/drm/bridge/chipone-icn6211.c | 6 +- drivers/gpu/drm/bridge/lontium-lt8912b.c | 6 +- drivers/gpu/drm/bridge/lontium-lt9611.c | 6 +- drivers/gpu/drm/bridge/lontium-lt9611uxc.c | 6 +- drivers/gpu/drm/bridge/tc358775.c | 27 +- drivers/gpu/drm/bridge/ti-dlpc3433.c | 17 +- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 - drivers/gpu/drm/ci/build.yml | 1 + drivers/gpu/drm/ci/gitlab-ci.yml | 22 +- drivers/gpu/drm/ci/image-tags.yml | 2 +- drivers/gpu/drm/ci/lava-submit.sh | 2 +- drivers/gpu/drm/ci/test.yml | 27 +- drivers/gpu/drm/display/drm_dp_helper.c | 35 ++ drivers/gpu/drm/drm_bridge.c | 10 +- drivers/gpu/drm/drm_edid.c | 2 +- drivers/gpu/drm/drm_fbdev_generic.c | 1 - drivers/gpu/drm/drm_mipi_dsi.c | 6 +- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 4 +- .../gpu/drm/i915/display/intel_backlight.c | 6 +- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 + drivers/gpu/drm/i915/gt/intel_gt_ccs_mode.c | 2 +- drivers/gpu/drm/i915/gt/intel_gt_types.h | 8 + drivers/gpu/drm/i915/gt/selftest_migrate.c | 4 +- drivers/gpu/drm/i915/gt/uc/abi/guc_klvs_abi.h | 6 +- drivers/gpu/drm/i915/gvt/interrupt.c | 13 +- drivers/gpu/drm/mediatek/mtk_dp.c | 2 +- drivers/gpu/drm/meson/meson_dw_mipi_dsi.c | 7 + drivers/gpu/drm/meson/meson_vclk.c | 6 +- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 3 - drivers/gpu/drm/msm/dp/dp_aux.c | 20 + drivers/gpu/drm/msm/dp/dp_aux.h | 1 + drivers/gpu/drm/msm/dp/dp_ctrl.c | 6 +- drivers/gpu/drm/msm/dp/dp_display.c | 4 + drivers/gpu/drm/msm/dp/dp_link.c | 22 +- drivers/gpu/drm/msm/dp/dp_link.h | 14 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 10 +- drivers/gpu/drm/mxsfb/lcdif_drv.c | 6 +- drivers/gpu/drm/nouveau/nouveau_abi16.c | 12 + drivers/gpu/drm/nouveau/nouveau_bo.c | 44 +- drivers/gpu/drm/omapdrm/Kconfig | 2 +- drivers/gpu/drm/omapdrm/omap_fbdev.c | 40 +- drivers/gpu/drm/panel/panel-edp.c | 3 + drivers/gpu/drm/panel/panel-novatek-nt35950.c | 6 +- .../gpu/drm/panel/panel-samsung-atna33xc20.c | 24 +- drivers/gpu/drm/panel/panel-simple.c | 3 + .../gpu/drm/panel/panel-sitronix-st7789v.c | 16 +- drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 22 +- drivers/gpu/drm/solomon/ssd130x.c | 2 +- drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 47 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 2 + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 10 + drivers/hid/hid-mcp2221.c | 2 + drivers/hid/i2c-hid/i2c-hid-of-elan.c | 59 ++- drivers/hid/intel-ish-hid/ipc/pci-ish.c | 5 + drivers/hwmon/intel-m10-bmc-hwmon.c | 2 +- drivers/hwmon/pwm-fan.c | 8 +- drivers/hwmon/shtc1.c | 2 +- .../coresight/coresight-etm4x-core.c | 29 +- drivers/hwtracing/coresight/coresight-etm4x.h | 31 +- drivers/hwtracing/intel_th/pci.c | 5 + drivers/hwtracing/stm/core.c | 11 +- drivers/i2c/busses/i2c-cadence.c | 1 + drivers/i2c/busses/i2c-synquacer.c | 20 +- drivers/i3c/master/svc-i3c-master.c | 52 ++- drivers/iio/Kconfig | 9 + drivers/iio/Makefile | 1 + drivers/iio/accel/mxc4005.c | 76 ++++ drivers/iio/adc/Kconfig | 6 +- drivers/iio/adc/ad9467.c | 310 ++++++++----- drivers/iio/adc/adi-axi-adc.c | 408 +++++------------ drivers/iio/adc/stm32-adc.c | 1 + .../buffer/industrialio-buffer-dmaengine.c | 8 +- drivers/iio/industrialio-backend.c | 418 ++++++++++++++++++ drivers/iio/industrialio-core.c | 6 +- drivers/iio/pressure/dps310.c | 11 +- drivers/infiniband/core/cma.c | 4 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 57 ++- drivers/infiniband/hw/bnxt_re/ib_verbs.h | 7 + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 208 +++++---- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 34 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 19 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 4 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.h | 46 +- drivers/infiniband/hw/bnxt_re/roce_hsi.h | 67 ++- drivers/infiniband/hw/mlx5/mem.c | 8 +- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- drivers/infiniband/hw/mlx5/mr.c | 3 +- drivers/infiniband/sw/rxe/rxe_net.c | 12 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 6 +- drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 8 +- drivers/input/input.c | 104 ++++- drivers/input/joystick/xpad.c | 2 + drivers/input/misc/da7280.c | 4 +- drivers/input/misc/ims-pcu.c | 4 +- drivers/input/misc/pm8xxx-vibrator.c | 7 +- drivers/input/misc/pwm-beeper.c | 4 +- drivers/input/misc/pwm-vibra.c | 8 +- drivers/input/mouse/cyapa.c | 12 +- drivers/interconnect/qcom/qcm2290.c | 2 +- drivers/irqchip/irq-alpine-msi.c | 2 +- drivers/irqchip/irq-loongson-pch-msi.c | 2 +- drivers/leds/leds-pwm.c | 10 +- drivers/leds/rgb/leds-pwm-multicolor.c | 4 +- drivers/md/bcache/bset.c | 44 +- drivers/md/bcache/bset.h | 28 +- drivers/md/bcache/btree.c | 40 +- drivers/md/bcache/super.c | 5 +- drivers/md/bcache/sysfs.c | 2 +- drivers/md/bcache/writeback.c | 10 +- drivers/md/raid5.c | 15 +- drivers/media/cec/core/cec-adap.c | 24 +- drivers/media/cec/core/cec-api.c | 5 +- drivers/media/dvb-frontends/mxl5xx.c | 22 +- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 +- drivers/media/i2c/ov2680.c | 13 +- drivers/media/mc/mc-devnode.c | 5 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 10 +- drivers/media/pci/ngene/ngene-core.c | 4 +- drivers/media/platform/cadence/cdns-csi2rx.c | 26 +- .../mediatek/vcodec/encoder/mtk_vcodec_enc.c | 21 +- .../vcodec/encoder/mtk_vcodec_enc_pm.c | 20 + .../vcodec/encoder/mtk_vcodec_enc_pm.h | 3 +- .../mediatek/vcodec/encoder/venc_drv_if.c | 11 +- .../platform/renesas/rcar-vin/rcar-vin.h | 2 +- .../media/platform/renesas/vsp1/vsp1_pipe.c | 2 +- .../media/platform/renesas/vsp1/vsp1_rpf.c | 10 +- .../media/platform/renesas/vsp1/vsp1_rwpf.c | 8 +- .../media/platform/renesas/vsp1/vsp1_rwpf.h | 4 +- .../media/platform/renesas/vsp1/vsp1_wpf.c | 29 +- .../sunxi/sun8i-a83t-mipi-csi2/Kconfig | 1 + drivers/media/radio/radio-shark2.c | 2 +- drivers/media/rc/ir-rx51.c | 4 +- drivers/media/rc/pwm-ir-tx.c | 4 +- drivers/media/usb/b2c2/flexcop-usb.c | 2 +- drivers/media/usb/uvc/uvc_driver.c | 31 ++ drivers/media/usb/uvc/uvcvideo.h | 1 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-dev.c | 3 + drivers/media/v4l2-core/v4l2-subdev.c | 39 +- drivers/misc/lkdtm/Makefile | 2 +- drivers/misc/lkdtm/perms.c | 2 +- drivers/misc/pvpanic/pvpanic-mmio.c | 58 +-- drivers/misc/pvpanic/pvpanic-pci.c | 60 +-- drivers/misc/pvpanic/pvpanic.c | 76 +++- drivers/misc/pvpanic/pvpanic.h | 10 +- drivers/misc/vmw_vmci/vmci_guest.c | 10 +- drivers/mmc/core/host.c | 3 +- drivers/mmc/core/slot-gpio.c | 20 + drivers/mmc/host/sdhci-acpi.c | 61 ++- drivers/mmc/host/sdhci.c | 10 +- drivers/mmc/host/sdhci.h | 3 +- drivers/mmc/host/sdhci_am654.c | 205 ++++++--- drivers/mtd/mtdcore.c | 6 +- drivers/mtd/nand/raw/nand_hynix.c | 2 +- drivers/net/Makefile | 4 +- drivers/net/dsa/microchip/ksz_common.c | 2 +- drivers/net/dsa/mv88e6xxx/chip.c | 50 ++- drivers/net/dsa/mv88e6xxx/chip.h | 6 + drivers/net/dsa/mv88e6xxx/global1.c | 89 ++++ drivers/net/dsa/mv88e6xxx/global1.h | 2 + drivers/net/ethernet/amazon/ena/ena_com.c | 326 +++++--------- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 49 +- drivers/net/ethernet/amazon/ena/ena_eth_com.h | 15 +- drivers/net/ethernet/amazon/ena/ena_netdev.c | 32 +- drivers/net/ethernet/cisco/enic/enic_main.c | 12 + drivers/net/ethernet/cortina/gemini.c | 12 +- drivers/net/ethernet/freescale/enetc/enetc.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 10 + drivers/net/ethernet/freescale/fec_ptp.c | 14 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 19 +- .../net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 11 +- drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 3 - drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 56 +-- .../net/ethernet/marvell/octeontx2/nic/qos.c | 4 + .../mellanox/mlx5/core/en/xsk/setup.c | 6 +- .../mellanox/mlx5/core/en_accel/en_accel.h | 8 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 3 +- .../mellanox/mlx5/core/en_accel/ipsec_rxtx.h | 17 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_tx.c | 6 +- .../ethernet/mellanox/mlx5/core/esw/bridge.c | 2 +- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 4 +- .../mellanox/mlx5/core/eswitch_offloads.c | 28 +- .../net/ethernet/mellanox/mlx5/core/lag/lag.c | 18 +- .../ethernet/mellanox/mlx5/core/lag/mpesw.c | 18 +- .../ethernet/microchip/lan966x/lan966x_main.c | 12 +- .../net/ethernet/microsoft/mana/hw_channel.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_main.c | 9 +- drivers/net/ethernet/realtek/r8169_main.c | 6 +- drivers/net/ethernet/smsc/smc91x.h | 4 +- .../net/ethernet/ti/icssg/icssg_classifier.c | 2 +- drivers/net/ethernet/ti/icssg/icssg_prueth.c | 14 +- drivers/net/ipvlan/ipvlan_core.c | 4 +- drivers/net/phy/micrel.c | 14 +- drivers/net/phy/sfp-bus.c | 8 +- drivers/net/usb/aqc111.c | 8 +- drivers/net/usb/qmi_wwan.c | 3 + drivers/net/usb/smsc95xx.c | 26 +- drivers/net/usb/sr9700.c | 10 +- drivers/net/vxlan/vxlan_core.c | 4 - drivers/net/wireless/ath/ar5523/ar5523.c | 14 + drivers/net/wireless/ath/ath10k/Kconfig | 1 + drivers/net/wireless/ath/ath10k/core.c | 3 + drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 +- drivers/net/wireless/ath/ath10k/hw.h | 1 + drivers/net/wireless/ath/ath10k/targaddrs.h | 3 + drivers/net/wireless/ath/ath10k/wmi.c | 26 +- drivers/net/wireless/ath/ath11k/mac.c | 9 +- drivers/net/wireless/ath/ath12k/wmi.c | 2 +- drivers/net/wireless/ath/carl9170/tx.c | 3 +- .../broadcom/brcm80211/brcmfmac/pcie.c | 15 +- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 19 +- .../wireless/intel/iwlwifi/mvm/mld-mac80211.c | 9 +- .../net/wireless/intel/iwlwifi/mvm/mld-sta.c | 19 +- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 + drivers/net/wireless/marvell/mwl8k.c | 2 +- .../net/wireless/mediatek/mt76/mt7603/dma.c | 46 +- .../net/wireless/mediatek/mt76/mt7603/mac.c | 1 + .../wireless/mediatek/mt76/mt7915/debugfs.c | 6 +- .../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 25 +- .../wireless/realtek/rtlwifi/rtl8192de/phy.c | 4 +- .../wireless/realtek/rtlwifi/rtl8192de/trx.c | 21 +- .../wireless/realtek/rtlwifi/rtl8192de/trx.h | 79 +--- drivers/net/wireless/realtek/rtw89/mac80211.c | 2 +- drivers/net/wireless/realtek/rtw89/pci.c | 3 +- drivers/net/xen-netback/interface.c | 3 +- drivers/nvme/host/core.c | 23 +- drivers/nvme/host/multipath.c | 6 +- drivers/nvme/host/nvme.h | 22 + drivers/nvme/host/pci.c | 8 +- drivers/nvme/target/auth.c | 8 +- drivers/nvme/target/configfs.c | 20 + drivers/nvme/target/core.c | 5 +- drivers/nvme/target/nvmet.h | 1 + drivers/nvme/target/tcp.c | 11 +- drivers/pci/controller/dwc/pcie-tegra194.c | 3 + drivers/pci/pci.c | 2 +- drivers/pci/pcie/edr.c | 28 +- drivers/perf/arm_dmc620_pmu.c | 9 +- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 2 - drivers/pinctrl/qcom/pinctrl-sm7150.c | 20 +- drivers/platform/chrome/cros_ec.c | 16 +- .../intel/speed_select_if/isst_if_common.c | 1 + drivers/platform/x86/intel/tpmi.c | 7 +- .../uncore-frequency/uncore-frequency-tpmi.c | 7 + drivers/platform/x86/lenovo-yogabook.c | 2 +- drivers/platform/x86/thinkpad_acpi.c | 5 +- drivers/pwm/core.c | 18 +- drivers/pwm/pwm-sti.c | 46 +- drivers/pwm/pwm-twl-led.c | 2 +- drivers/pwm/pwm-vt8500.c | 2 +- drivers/pwm/sysfs.c | 10 +- drivers/regulator/bd71828-regulator.c | 58 +-- drivers/regulator/helpers.c | 43 +- drivers/regulator/irq_helpers.c | 3 + drivers/regulator/pwm-regulator.c | 4 +- drivers/regulator/qcom-refgen-regulator.c | 1 + drivers/regulator/tps6287x-regulator.c | 1 + drivers/regulator/tps6594-regulator.c | 16 +- drivers/regulator/vqmmc-ipq4019-regulator.c | 1 + drivers/s390/cio/trace.h | 2 +- drivers/scsi/bfa/bfad_debugfs.c | 4 +- drivers/scsi/hpsa.c | 2 +- drivers/scsi/libsas/sas_expander.c | 3 +- drivers/scsi/qla2xxx/qla_dfs.c | 2 +- drivers/scsi/scsi.c | 7 + drivers/soc/mediatek/mtk-cmdq-helper.c | 5 +- drivers/soc/qcom/cmd-db.c | 32 +- drivers/soc/qcom/pmic_glink.c | 26 +- drivers/soc/qcom/rpmh-rsc.c | 3 +- drivers/soundwire/cadence_master.c | 2 +- drivers/spi/spi-stm32.c | 2 +- drivers/spi/spi.c | 4 + drivers/staging/greybus/arche-apb-ctrl.c | 1 + drivers/staging/greybus/arche-platform.c | 9 +- drivers/staging/media/atomisp/pci/sh_css.c | 1 + drivers/thermal/qcom/tsens.c | 2 +- drivers/tty/n_gsm.c | 133 ++++-- drivers/tty/serial/8250/8250_bcm7271.c | 101 +++-- drivers/tty/serial/8250/8250_mtk.c | 8 +- drivers/tty/serial/max3100.c | 9 +- drivers/tty/serial/sc16is7xx.c | 27 +- drivers/tty/serial/sh-sci.c | 5 + drivers/ufs/core/ufs-mcq.c | 3 +- drivers/ufs/core/ufshcd.c | 6 +- drivers/ufs/host/cdns-pltfrm.c | 2 +- drivers/ufs/host/ufs-qcom.c | 7 +- drivers/ufs/host/ufs-qcom.h | 12 +- drivers/usb/fotg210/fotg210-core.c | 1 + drivers/usb/gadget/function/u_audio.c | 2 + drivers/usb/typec/ucsi/ucsi.c | 18 +- drivers/usb/usbip/usbip_common.h | 6 - drivers/video/backlight/lm3630a_bl.c | 2 +- drivers/video/backlight/lp855x_bl.c | 2 +- drivers/video/backlight/pwm_bl.c | 12 +- drivers/video/fbdev/Kconfig | 4 +- drivers/video/fbdev/core/Kconfig | 12 + drivers/video/fbdev/core/Makefile | 3 +- drivers/video/fbdev/core/fb_io_fops.c | 3 + drivers/video/fbdev/sh_mobile_lcdcfb.c | 2 +- drivers/video/fbdev/sis/init301.c | 3 +- drivers/video/fbdev/ssd1307fb.c | 2 +- drivers/watchdog/bd9576_wdt.c | 12 +- drivers/watchdog/rti_wdt.c | 34 +- drivers/watchdog/sa1100_wdt.c | 5 +- drivers/xen/xenbus/xenbus_probe.c | 36 +- fs/afs/mntpt.c | 5 + fs/btrfs/disk-io.c | 10 +- fs/dlm/ast.c | 14 + fs/dlm/dlm_internal.h | 1 + fs/dlm/user.c | 15 +- fs/erofs/decompressor_deflate.c | 55 +-- fs/eventpoll.c | 38 +- fs/ext4/inode.c | 3 - fs/ext4/mballoc.c | 1 + fs/ext4/namei.c | 2 +- fs/f2fs/checkpoint.c | 10 +- fs/f2fs/compress.c | 64 ++- fs/f2fs/data.c | 146 ++---- fs/f2fs/debug.c | 6 +- fs/f2fs/dir.c | 5 +- fs/f2fs/f2fs.h | 165 +++---- fs/f2fs/file.c | 123 +++--- fs/f2fs/gc.c | 117 ++--- fs/f2fs/inode.c | 6 + fs/f2fs/node.c | 6 +- fs/f2fs/node.h | 4 +- fs/f2fs/recovery.c | 2 +- fs/f2fs/segment.c | 244 +++++----- fs/f2fs/segment.h | 66 ++- fs/f2fs/super.c | 116 +---- fs/f2fs/sysfs.c | 6 +- fs/gfs2/aops.c | 36 +- fs/gfs2/bmap.c | 4 +- fs/gfs2/dir.c | 2 +- fs/gfs2/file.c | 2 +- fs/gfs2/glock.c | 61 ++- fs/gfs2/glops.c | 5 +- fs/gfs2/inode.c | 15 +- fs/gfs2/inode.h | 6 +- fs/gfs2/lock_dlm.c | 8 +- fs/gfs2/log.c | 21 +- fs/gfs2/meta_io.c | 9 +- fs/gfs2/ops_fstype.c | 27 +- fs/gfs2/quota.c | 8 +- fs/gfs2/recovery.c | 2 +- fs/gfs2/rgrp.c | 12 +- fs/gfs2/rgrp.h | 2 +- fs/gfs2/super.c | 10 +- fs/gfs2/sys.c | 2 +- fs/gfs2/trans.c | 2 +- fs/gfs2/util.c | 5 +- fs/gfs2/util.h | 15 +- fs/gfs2/xattr.c | 6 +- fs/nfs/filelayout/filelayout.c | 4 +- fs/nfs/fs_context.c | 9 +- fs/nfs/internal.h | 4 +- fs/nfs/nfs4proc.c | 2 +- fs/nfs/nfs4state.c | 12 +- fs/nilfs2/ioctl.c | 2 +- fs/ntfs3/dir.c | 1 + fs/ntfs3/index.c | 6 + fs/ntfs3/inode.c | 7 +- fs/ntfs3/record.c | 11 +- fs/ntfs3/super.c | 2 - fs/openpromfs/inode.c | 8 +- fs/overlayfs/dir.c | 3 - fs/proc/fd.c | 42 +- fs/proc/task_mmu.c | 9 +- fs/smb/server/mgmt/share_config.c | 6 +- fs/smb/server/oplock.c | 21 +- fs/smb/server/smb2pdu.c | 4 +- fs/tracefs/event_inode.c | 162 +++++-- fs/tracefs/inode.c | 33 +- fs/tracefs/internal.h | 9 +- fs/udf/inode.c | 27 +- fs/verity/init.c | 7 +- include/drm/display/drm_dp_helper.h | 6 + include/drm/drm_displayid.h | 1 - include/drm/drm_mipi_dsi.h | 6 +- include/linux/acpi.h | 2 +- include/linux/bitops.h | 1 + include/linux/counter.h | 1 - include/linux/cpu.h | 11 + include/linux/dev_printk.h | 25 +- include/linux/f2fs_fs.h | 6 - include/linux/fb.h | 4 + include/linux/fortify-string.h | 22 +- include/linux/i3c/device.h | 2 + include/linux/ieee80211.h | 2 +- include/linux/iio/adc/adi-axi-adc.h | 68 --- include/linux/iio/backend.h | 72 +++ include/linux/iio/buffer-dmaengine.h | 3 + include/linux/kthread.h | 1 + include/linux/mlx5/mlx5_ifc.h | 4 +- include/linux/mmc/slot-gpio.h | 1 + include/linux/nvme-tcp.h | 6 + include/linux/pagemap.h | 34 +- include/linux/printk.h | 2 +- include/linux/pwm.h | 28 +- include/linux/regulator/driver.h | 3 + include/linux/tracefs.h | 3 + include/media/cec.h | 1 + include/media/v4l2-subdev.h | 4 +- include/net/bluetooth/l2cap.h | 11 +- include/net/dst_ops.h | 2 +- include/net/mac80211.h | 3 + include/net/sock.h | 13 +- include/net/tcp.h | 5 +- include/soc/qcom/cmd-db.h | 10 +- include/sound/cs35l56.h | 1 + include/sound/soc-acpi-intel-match.h | 2 + include/sound/tas2781-dsp.h | 7 +- include/trace/events/asoc.h | 2 + include/uapi/drm/nouveau_drm.h | 21 + include/uapi/linux/bpf.h | 2 +- include/uapi/linux/user_events.h | 11 +- include/uapi/rdma/bnxt_re-abi.h | 10 + io_uring/io-wq.c | 13 +- io_uring/io_uring.h | 2 +- io_uring/nop.c | 2 + kernel/bpf/verifier.c | 6 +- kernel/cgroup/cpuset.c | 2 +- kernel/cpu.c | 14 +- kernel/debug/kdb/kdb_io.c | 78 ++-- kernel/dma/map_benchmark.c | 22 +- kernel/gen_kheaders.sh | 7 +- kernel/irq/manage.c | 15 +- kernel/kthread.c | 18 + kernel/sched/fair.c | 53 ++- kernel/sched/isolation.c | 7 +- kernel/sched/topology.c | 2 +- kernel/smpboot.c | 3 +- kernel/softirq.c | 12 +- kernel/trace/rv/rv.c | 2 + kernel/trace/trace_events.c | 12 + kernel/trace/trace_events_user.c | 213 ++++++--- lib/kunit/try-catch.c | 9 +- lib/slub_kunit.c | 2 +- lib/test_hmm.c | 8 +- mm/cma.c | 4 - mm/damon/core.c | 3 +- mm/hugetlb.c | 6 +- mm/kmsan/core.c | 15 +- mm/ksm.c | 6 +- mm/userfaultfd.c | 35 ++ mm/vmalloc.c | 5 +- net/bluetooth/l2cap_core.c | 56 ++- net/bluetooth/l2cap_sock.c | 91 +++- net/core/dev.c | 3 +- net/core/pktgen.c | 3 +- net/ipv4/af_inet.c | 4 +- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 + net/ipv4/route.c | 22 +- net/ipv4/tcp_ipv4.c | 13 +- net/ipv4/udp.c | 21 +- net/ipv6/reassembly.c | 2 +- net/ipv6/route.c | 34 +- net/ipv6/seg6.c | 5 +- net/ipv6/seg6_iptunnel.c | 11 +- net/ipv6/udp.c | 20 +- net/mac80211/mlme.c | 3 +- net/mac80211/rate.c | 6 +- net/mac80211/scan.c | 1 + net/mac80211/tx.c | 13 +- net/mptcp/protocol.h | 3 + net/mptcp/sockopt.c | 123 ++++-- net/netfilter/nfnetlink_queue.c | 2 + net/netfilter/nft_fib.c | 8 +- net/netfilter/nft_payload.c | 95 +++- net/nfc/nci/core.c | 18 +- net/openvswitch/actions.c | 6 + net/packet/af_packet.c | 3 +- net/qrtr/ns.c | 27 ++ net/sched/sch_taprio.c | 14 +- net/sunrpc/auth_gss/svcauth_gss.c | 12 +- net/sunrpc/clnt.c | 1 + net/sunrpc/svc.c | 2 - net/sunrpc/xprtrdma/verbs.c | 6 +- net/unix/af_unix.c | 47 +- net/wireless/trace.h | 4 +- net/xfrm/xfrm_policy.c | 11 +- scripts/kconfig/symbol.c | 6 +- sound/core/init.c | 9 +- sound/core/jack.c | 46 +- sound/core/seq/seq_ump_convert.c | 48 +- sound/core/ump.c | 7 + sound/core/ump_convert.c | 1 - sound/hda/intel-dsp-config.c | 27 +- sound/pci/emu10k1/io.c | 1 + sound/pci/hda/cs35l56_hda.c | 26 +- sound/pci/hda/patch_realtek.c | 5 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/cs35l41.c | 26 +- sound/soc/codecs/cs35l56-shared.c | 41 ++ sound/soc/codecs/cs35l56.c | 21 + sound/soc/codecs/cs42l43.c | 5 +- sound/soc/codecs/da7219-aad.c | 6 +- sound/soc/codecs/rt5645.c | 25 ++ sound/soc/codecs/rt715-sdca.c | 8 +- sound/soc/codecs/rt715-sdw.c | 1 + sound/soc/codecs/rt722-sdca.c | 27 +- sound/soc/codecs/rt722-sdca.h | 3 + sound/soc/codecs/tas2552.c | 15 +- sound/soc/codecs/tas2781-fmwlib.c | 109 ++--- sound/soc/codecs/tas2781-i2c.c | 4 +- sound/soc/intel/avs/boards/ssm4567.c | 1 - sound/soc/intel/avs/cldma.c | 2 +- sound/soc/intel/avs/path.c | 1 + sound/soc/intel/avs/probes.c | 14 +- sound/soc/intel/boards/bxt_da7219_max98357a.c | 1 + sound/soc/intel/boards/bxt_rt298.c | 1 + sound/soc/intel/boards/bytcr_rt5640.c | 14 +- sound/soc/intel/boards/glk_rt5682_max98357a.c | 2 + sound/soc/intel/boards/kbl_da7219_max98357a.c | 1 + sound/soc/intel/boards/kbl_da7219_max98927.c | 4 + sound/soc/intel/boards/kbl_rt5660.c | 1 + sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 + .../intel/boards/kbl_rt5663_rt5514_max98927.c | 1 + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 + .../soc/intel/boards/skl_nau88l25_max98357a.c | 1 + sound/soc/intel/boards/skl_rt286.c | 1 + sound/soc/intel/common/Makefile | 1 + .../intel/common/soc-acpi-intel-arl-match.c | 51 +++ sound/soc/kirkwood/kirkwood-dma.c | 3 + sound/soc/mediatek/mt8192/mt8192-dai-tdm.c | 4 +- sound/soc/sof/intel/hda.h | 1 + sound/soc/sof/intel/lnl.c | 3 +- sound/soc/sof/intel/lnl.h | 15 + sound/soc/sof/intel/mtl.c | 83 +++- sound/soc/sof/intel/mtl.h | 4 +- sound/soc/sof/intel/pci-mtl.c | 31 ++ sound/soc/sof/ipc3-pcm.c | 1 + sound/soc/sof/pcm.c | 13 +- sound/soc/sof/sof-audio.h | 2 + tools/arch/x86/intel_sdsi/intel_sdsi.c | 48 +- tools/arch/x86/lib/x86-opcode-map.txt | 10 +- tools/bpf/bpftool/common.c | 96 +++- tools/bpf/bpftool/iter.c | 2 +- tools/bpf/bpftool/main.h | 3 +- tools/bpf/bpftool/prog.c | 5 +- tools/bpf/bpftool/skeleton/pid_iter.bpf.c | 4 +- tools/bpf/bpftool/struct_ops.c | 2 +- tools/bpf/resolve_btfids/main.c | 2 +- tools/include/nolibc/stdlib.h | 2 +- tools/include/uapi/linux/bpf.h | 2 +- tools/lib/bpf/libbpf.c | 2 +- tools/lib/perf/evlist.c | 9 + tools/lib/perf/include/internal/evlist.h | 2 + tools/lib/subcmd/parse-options.c | 8 +- tools/perf/Documentation/perf-list.txt | 1 + tools/perf/arch/arm64/util/pmu.c | 6 +- tools/perf/bench/inject-buildid.c | 2 +- tools/perf/bench/uprobe.c | 2 +- tools/perf/builtin-annotate.c | 46 +- tools/perf/builtin-daemon.c | 4 +- tools/perf/builtin-inject.c | 6 + tools/perf/builtin-record.c | 74 ++-- tools/perf/builtin-report.c | 42 +- tools/perf/builtin-sched.c | 7 +- tools/perf/builtin-top.c | 44 +- .../arch/s390/cf_z16/transaction.json | 28 +- tools/perf/tests/attr/system-wide-dummy | 14 +- tools/perf/tests/attr/test-record-C0 | 4 +- tools/perf/tests/code-reading.c | 10 +- tools/perf/tests/expr.c | 31 +- tools/perf/tests/shell/test_arm_coresight.sh | 2 +- tools/perf/tests/workloads/datasym.c | 16 + tools/perf/ui/browser.c | 6 +- tools/perf/ui/browser.h | 2 +- tools/perf/ui/browsers/annotate.c | 8 +- tools/perf/ui/gtk/annotate.c | 6 +- tools/perf/ui/gtk/gtk.h | 2 - tools/perf/util/annotate.c | 190 ++++---- tools/perf/util/annotate.h | 32 +- tools/perf/util/event.c | 4 +- tools/perf/util/evlist.c | 18 + tools/perf/util/evlist.h | 1 + tools/perf/util/expr.c | 2 +- .../util/intel-pt-decoder/intel-pt-decoder.c | 2 + tools/perf/util/intel-pt.c | 2 + tools/perf/util/machine.c | 10 +- tools/perf/util/maps.c | 238 ++++++++++ tools/perf/util/maps.h | 12 + tools/perf/util/perf_event_attr_fprintf.c | 26 +- tools/perf/util/pmu.c | 48 +- tools/perf/util/pmu.h | 4 +- tools/perf/util/pmus.c | 20 +- tools/perf/util/probe-event.c | 1 + tools/perf/util/python.c | 10 + tools/perf/util/session.c | 5 + tools/perf/util/stat-display.c | 3 + tools/perf/util/symbol.c | 259 +---------- tools/perf/util/symbol.h | 1 - tools/perf/util/symbol_conf.h | 4 +- tools/perf/util/thread.c | 14 +- tools/perf/util/thread.h | 14 + tools/perf/util/top.h | 1 - tools/testing/selftests/bpf/network_helpers.c | 2 + .../bpf/prog_tests/xdp_do_redirect.c | 4 +- tools/testing/selftests/bpf/test_sockmap.c | 2 +- tools/testing/selftests/cgroup/cgroup_util.c | 8 +- tools/testing/selftests/cgroup/cgroup_util.h | 2 +- tools/testing/selftests/cgroup/test_core.c | 7 +- tools/testing/selftests/cgroup/test_cpu.c | 2 +- tools/testing/selftests/cgroup/test_cpuset.c | 2 +- tools/testing/selftests/cgroup/test_freezer.c | 2 +- tools/testing/selftests/cgroup/test_kill.c | 2 +- tools/testing/selftests/cgroup/test_kmem.c | 2 +- .../selftests/cgroup/test_memcontrol.c | 2 +- tools/testing/selftests/cgroup/test_zswap.c | 2 +- .../selftests/filesystems/binderfs/Makefile | 2 - .../test.d/dynevent/add_remove_btfarg.tc | 2 +- tools/testing/selftests/kcmp/kcmp_test.c | 2 +- .../testing/selftests/kvm/aarch64/vgic_init.c | 50 +++ tools/testing/selftests/lib.mk | 12 +- tools/testing/selftests/mm/compaction_test.c | 2 + tools/testing/selftests/mm/gup_test.c | 1 + tools/testing/selftests/mm/uffd-common.h | 1 + tools/testing/selftests/net/Makefile | 4 +- tools/testing/selftests/net/amt.sh | 20 +- tools/testing/selftests/net/config | 7 +- .../selftests/net/forwarding/bridge_igmp.sh | 6 +- .../selftests/net/forwarding/bridge_mld.sh | 6 +- .../testing/selftests/net/mptcp/mptcp_join.sh | 8 +- .../selftests/net/mptcp/simult_flows.sh | 10 +- tools/testing/selftests/net/net_helper.sh | 25 ++ tools/testing/selftests/net/udpgro.sh | 13 +- tools/testing/selftests/net/udpgro_bench.sh | 5 +- tools/testing/selftests/net/udpgro_frglist.sh | 5 +- .../testing/selftests/powerpc/dexcr/Makefile | 2 +- tools/testing/selftests/resctrl/Makefile | 4 +- .../syscall_user_dispatch/sud_test.c | 14 + .../tc-testing/tc-tests/qdiscs/taprio.json | 44 ++ tools/tracing/latency/latency-collector.c | 8 +- tools/tracing/rtla/src/timerlat_hist.c | 60 ++- 809 files changed, 8694 insertions(+), 5399 deletions(-) create mode 100644 drivers/iio/industrialio-backend.c delete mode 100644 include/linux/iio/adc/adi-axi-adc.h create mode 100644 include/linux/iio/backend.h create mode 100644 sound/soc/intel/common/soc-acpi-intel-arl-match.c create mode 100644 sound/soc/sof/intel/lnl.h create mode 100644 tools/testing/selftests/net/net_helper.sh -- 2.17.1

1 717

[PATCH openEuler-22.03-LTS-SP1] PCI/ROM: Fix PCI ROM header check bug
by liwei 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEDJI -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 8fc9a4e911e3..766d4a33b174 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH OLK-5.10] PCI/ROM: Fix PCI ROM header check bug
by liwei 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEDJI -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 8fc9a4e911e3..766d4a33b174 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] filelock: fix uaf while fcntl/close race
by Long Li 29 Jul '24

29 Jul '24

This patch set fix uaf while fcntl/close race. Jann Horn (2): filelock: Remove locks reliably when fcntl/close race is detected filelock: Fix fcntl/close race recovery compat path fs/locks.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH v2 openEuler-1.0-LTS] PCI/ROM: Fix PCI ROM header check bug
by liwei 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEDJI -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 137bf0cee897..d7bae7a804c4 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH OLK-6.6] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index 118699fff2f9..27a8931647ea 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -86,8 +86,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] PCI/ROM: Fix PCI ROM header check bug
by liwei 29 Jul '24

29 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEAGS -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 137bf0cee897..d7bae7a804c4 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH OLK-5.10] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b7e1a2bdd7fb..727f3505280c 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -98,8 +98,11 @@ __releases(&journal->j_state_lock) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
by Baokun Li 29 Jul '24

29 Jul '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG7MT CVE: NA Reference: https://lore.kernel.org/all/20240718115336.2554501-1-libaokun@huaweicloud.c… ---------------------------------------- In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. But if an error occurs while executing jbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free space right away, we try other branches, and if j_committing_transaction is NULL (i.e., the tid is 0), we will get the following complain: ============================================ JBD2: I/O error when updating journal superblock for sdd-8. __jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available __jbd2_log_wait_for_space: no way to get more journal space in sdd-8 ------------[ cut here ]------------ WARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0 Modules linked in: CPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1 RIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0 Call Trace: <TASK> add_transaction_credits+0x5d1/0x5e0 start_this_handle+0x1ef/0x6a0 jbd2__journal_start+0x18b/0x340 ext4_dirty_inode+0x5d/0xb0 __mark_inode_dirty+0xe4/0x5d0 generic_update_time+0x60/0x70 [...] ============================================ So only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to clean up at the moment, continue to try to reclaim free space in other ways. Note that this fix relies on commit 6f6a6fda2945 ("jbd2: fix ocfs2 corrupt when updating journal superblock fails") to make jbd2_cleanup_journal_tail return the correct error code. Fixes: 8c3f25d8950c ("jbd2: don't give up looking for space so easily in __jbd2_log_wait_for_space") Cc: stable(a)kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c index b35f0b63baf0..ab6c0b9c5336 100644 --- a/fs/jbd2/checkpoint.c +++ b/fs/jbd2/checkpoint.c @@ -96,8 +96,11 @@ void __jbd2_log_wait_for_space(journal_t *journal) write_unlock(&journal->j_state_lock); if (chkpt) { jbd2_log_do_checkpoint(journal); - } else if (jbd2_cleanup_journal_tail(journal) == 0) { - /* We were able to recover space; yay! */ + } else if (jbd2_cleanup_journal_tail(journal) <= 0) { + /* + * We were able to recover space or the + * journal was aborted due to an error. + */ ; } else if (tid) { /* -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-40976
by Jinjiang Tu 29 Jul '24

29 Jul '24

fix CVE-2024-40976. Erico Nunes (2): drm/lima: add mask irq callback to gp and pp drm/lima: mask irqs in timeout path before hard reset drivers/gpu/drm/lima/lima_bcast.c | 12 ++++++++++++ drivers/gpu/drm/lima/lima_bcast.h | 3 +++ drivers/gpu/drm/lima/lima_gp.c | 8 ++++++++ drivers/gpu/drm/lima/lima_pp.c | 18 ++++++++++++++++++ drivers/gpu/drm/lima/lima_sched.c | 7 +++++++ drivers/gpu/drm/lima/lima_sched.h | 1 + 6 files changed, 49 insertions(+) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-40976
by Jinjiang Tu 29 Jul '24

29 Jul '24

fix CVE-2024-40976. Erico Nunes (2): drm/lima: add mask irq callback to gp and pp drm/lima: mask irqs in timeout path before hard reset drivers/gpu/drm/lima/lima_bcast.c | 12 ++++++++++++ drivers/gpu/drm/lima/lima_bcast.h | 3 +++ drivers/gpu/drm/lima/lima_gp.c | 8 ++++++++ drivers/gpu/drm/lima/lima_pp.c | 18 ++++++++++++++++++ drivers/gpu/drm/lima/lima_sched.c | 7 +++++++ drivers/gpu/drm/lima/lima_sched.h | 1 + 6 files changed, 49 insertions(+) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] bpf: Fix null-pointer-deref in resolve_prog_type()
by Tengda Wu 29 Jul '24

29 Jul '24

This patchset is going to fix null-pointer-deref in resolve_prog_type() for BPF_PROG_TYPE_EXT. `prog->aux->dst_prog` in resolve_prog_type() is assigned by `attach_prog_fd`, and would be NULL if `attach_prog_fd` is not provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call in this way will lead to null-pointer-deref. In last version we fix it by forcing `attach_prog_fd` non-empty at load time, which leads to libbpf_probe_prog_types() api broken. Currently, we fix it by just adding null check for EXT prog in resolve_prog_type() as the old way did. For the sake of safety, we compared the full test logs of selftest before and after applying these changes, and the results show that the two test logs were consistent. Tengda Wu (2): bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() include/linux/bpf_verifier.h | 2 +- tools/testing/selftests/bpf/verifier/calls.c | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] filelock: fix uaf while fcntl/close race
by Long Li 29 Jul '24

29 Jul '24

This patch set fix uaf while fcntl/close race. Jann Horn (2): filelock: Remove locks reliably when fcntl/close race is detected filelock: Fix fcntl/close race recovery compat path fs/locks.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/2] bpf: Fix null-pointer-deref in resolve_prog_type()
by Tengda Wu 29 Jul '24

29 Jul '24

This patchset is going to fix null-pointer-deref in resolve_prog_type() for BPF_PROG_TYPE_EXT. `prog->aux->dst_prog` in resolve_prog_type() is assigned by `attach_prog_fd`, and would be NULL if `attach_prog_fd` is not provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call in this way will lead to null-pointer-deref. In last version we fix it by forcing `attach_prog_fd` non-empty at load time, which leads to libbpf_probe_prog_types() api broken. Currently, we fix it by just adding null check for EXT prog in resolve_prog_type() as the old way did. For the sake of safety, we compared the full test logs of selftest before and after applying these changes, and the results show that the two test logs were consistent. Tengda Wu (2): bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() include/linux/bpf_verifier.h | 2 +- tools/testing/selftests/bpf/verifier/calls.c | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-wbt.c block/blk-wbt.h [Because commit 0bc65bd41dfd ("blk-wbt: move private information from blk-wbt.h to blk-wbt.c") has not been merged.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 14 +++++++------- block/blk-wbt.h | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 94b5eff0cd3a..16ca5e91f3aa 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -107,8 +107,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -461,7 +461,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) { @@ -479,13 +479,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((rw & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -618,8 +618,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(rwb, bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; diff --git a/block/blk-wbt.h b/block/blk-wbt.h index 58b36e019f9e..4bfecfb16246 100644 --- a/block/blk-wbt.h +++ b/block/blk-wbt.h @@ -14,7 +14,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -22,7 +22,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; -- 2.31.1

2 1

[PATCH OLK-5.10] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-wbt.c block/blk-wbt.h [Because commit 0bc65bd41dfd ("blk-wbt: move private information from blk-wbt.h to blk-wbt.c") has not been merged.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 14 +++++++------- block/blk-wbt.h | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 6a90d33e6f6a..fe01c63c9153 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -105,8 +105,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -459,7 +459,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) { @@ -477,13 +477,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((rw & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -560,8 +560,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(rwb, bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; diff --git a/block/blk-wbt.h b/block/blk-wbt.h index 824047c395ff..2e3417d2676c 100644 --- a/block/blk-wbt.h +++ b/block/blk-wbt.h @@ -14,7 +14,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -22,7 +22,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-wbt.c block/blk-wbt.h [Because commit 0bc65bd41dfd ("blk-wbt: move private information from blk-wbt.h to blk-wbt.c") has not been merged.] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 14 +++++++------- block/blk-wbt.h | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index 6a90d33e6f6a..fe01c63c9153 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -105,8 +105,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -459,7 +459,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) { @@ -477,13 +477,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((rw & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((rw & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -560,8 +560,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(rwb, bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; diff --git a/block/blk-wbt.h b/block/blk-wbt.h index 824047c395ff..2e3417d2676c 100644 --- a/block/blk-wbt.h +++ b/block/blk-wbt.h @@ -14,7 +14,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -22,7 +22,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; -- 2.31.1

2 1

[PATCH OLK-6.6] blk-wbt: don't throttle swap writes in direct reclaim
by Baokun Li 29 Jul '24

29 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 4e63aeb5d0101ddada36a2f64f048e2f9d2202fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8D5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Now we avoid throttling swap writes by determining whether the current process is kswapd (aka current_is_kswapd()), but swap writes can come from either kswapd or direct reclaim, so the swap writes from direct reclaim will still be throttled. When a process holds a lock to allocate a free page, and enters direct reclaim because there is no free memory, then it might trigger a hung due to the wbt throttling that causes other processes to fail to get the lock. Both kswapd and direct reclaim set the REQ_SWAP flag, so use REQ_SWAP instead of current_is_kswapd() to avoid throttling swap writes. Also renamed WBT_KSWAPD to WBT_SWAP and WBT_RWQ_KSWAPD to WBT_RWQ_SWAP. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240604030522.3686177-1-libaokun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-wbt.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/block/blk-wbt.c b/block/blk-wbt.c index f8fda9cf583e..296cdfea7c2a 100644 --- a/block/blk-wbt.c +++ b/block/blk-wbt.c @@ -36,7 +36,7 @@ enum wbt_flags { WBT_TRACKED = 1, /* write, tracked for throttling */ WBT_READ = 2, /* read */ - WBT_KSWAPD = 4, /* write, from kswapd */ + WBT_SWAP = 4, /* write, from swap_writepage() */ WBT_DISCARD = 8, /* discard */ WBT_NR_BITS = 4, /* number of bits */ @@ -44,7 +44,7 @@ enum wbt_flags { enum { WBT_RWQ_BG = 0, - WBT_RWQ_KSWAPD, + WBT_RWQ_SWAP, WBT_RWQ_DISCARD, WBT_NUM_RWQ, }; @@ -173,8 +173,8 @@ static bool wb_recent_wait(struct rq_wb *rwb) static inline struct rq_wait *get_rq_wait(struct rq_wb *rwb, enum wbt_flags wb_acct) { - if (wb_acct & WBT_KSWAPD) - return &rwb->rq_wait[WBT_RWQ_KSWAPD]; + if (wb_acct & WBT_SWAP) + return &rwb->rq_wait[WBT_RWQ_SWAP]; else if (wb_acct & WBT_DISCARD) return &rwb->rq_wait[WBT_RWQ_DISCARD]; @@ -529,7 +529,7 @@ static bool close_io(struct rq_wb *rwb) time_before(now, rwb->last_comp + HZ / 10); } -#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO) +#define REQ_HIPRIO (REQ_SYNC | REQ_META | REQ_PRIO | REQ_SWAP) static inline unsigned int get_limit(struct rq_wb *rwb, blk_opf_t opf) { @@ -540,13 +540,13 @@ static inline unsigned int get_limit(struct rq_wb *rwb, blk_opf_t opf) /* * At this point we know it's a buffered write. If this is - * kswapd trying to free memory, or REQ_SYNC is set, then + * swap trying to free memory, or REQ_SYNC is set, then * it's WB_SYNC_ALL writeback, and we'll use the max limit for * that. If the write is marked as a background write, then use * the idle limit, or go to normal if we haven't had competing * IO for a bit. */ - if ((opf & REQ_HIPRIO) || wb_recent_wait(rwb) || current_is_kswapd()) + if ((opf & REQ_HIPRIO) || wb_recent_wait(rwb)) limit = rwb->rq_depth.max_depth; else if ((opf & REQ_BACKGROUND) || close_io(rwb)) { /* @@ -623,8 +623,8 @@ static enum wbt_flags bio_to_wbt_flags(struct rq_wb *rwb, struct bio *bio) if (bio_op(bio) == REQ_OP_READ) { flags = WBT_READ; } else if (wbt_should_throttle(bio)) { - if (current_is_kswapd()) - flags |= WBT_KSWAPD; + if (bio->bi_opf & REQ_SWAP) + flags |= WBT_SWAP; if (bio_op(bio) == REQ_OP_DISCARD) flags |= WBT_DISCARD; flags |= WBT_TRACKED; -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-39471
by Wenyu Huang 29 Jul '24

29 Jul '24

Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Dan Carpenter (1): drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/3] fix CVE-2024-27010
by Zhengchao Shao 29 Jul '24

29 Jul '24

Fix CVE-2024-27010 Eric Dumazet (1): net/sched: Fix mirred deadlock on device recursion Johannes Berg (1): net/sched: initialize noop_qdisc owner Zhengchao Shao (1): net/sched: fix kabi change in struct Qdisc include/net/sch_generic.h | 2 +- net/core/dev.c | 6 ++++++ net/sched/sch_generic.c | 2 ++ 3 files changed, 9 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/2] CVE-2024-39471
by Wenyu Huang 29 Jul '24

29 Jul '24

Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Dan Carpenter (1): drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.34.1

2 6

[PATCH 0/2] filelock: fix uaf while fcntl/close race
by Long Li 29 Jul '24

29 Jul '24

This patch set fix uaf while fcntl/close race. Jann Horn (2): filelock: Remove locks reliably when fcntl/close race is detected filelock: Fix fcntl/close race recovery compat path fs/locks.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) -- 2.39.2

1 2

[PATCH openEuler-1.0-LTS] net/sched: initialize noop_qdisc owner
by Zhengchao Shao 29 Jul '24

29 Jul '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG4FI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket. Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc(). Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c0… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 18b587cf9db8..296052020afa 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -585,6 +585,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net/sched: initialize noop_qdisc owner
by Zhengchao Shao 29 Jul '24

29 Jul '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG4FI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket. Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc(). Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c0… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index ecdd9e83f2f4..fd66b13438bc 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -592,6 +592,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc); -- 2.34.1

2 1

[PATCH OLK-5.10] net/sched: initialize noop_qdisc owner
by Zhengchao Shao 29 Jul '24

29 Jul '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG4FI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket. Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc(). Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c0… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index a3e9dd348500..ec55f306ab2a 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -592,6 +592,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-39471
by Wenyu Huang 29 Jul '24

29 Jul '24

Bob Zhou (1): drm/amdgpu: add error handle to avoid out-of-bounds Dan Carpenter (1): drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] drm/radeon: fix UBSAN warning in kv_dpm.c
by Kaixiong Yu 29 Jul '24

29 Jul '24

From: Alex Deucher <alexander.deucher(a)amd.com> stable inclusion from stable-v4.19.317 commit 07e8f15fa16695cf4c90e89854e59af4a760055b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACR1V CVE: CVE-2024-40988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream. Adds bounds check for sumo_vid_mapping_entry. Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/gpu/drm/radeon/sumo_dpm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c index 1e4975f3374c..b9eb7e2d3352 100644 --- a/drivers/gpu/drm/radeon/sumo_dpm.c +++ b/drivers/gpu/drm/radeon/sumo_dpm.c @@ -1620,6 +1620,8 @@ void sumo_construct_vid_mapping_table(struct radeon_device *rdev, for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++) { if (table[i].ulSupportedSCLK != 0) { + if (table[i].usVoltageIndex >= SUMO_MAX_NUMBER_VOLTAGES) + continue; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit = -- 2.25.1

2 1

[PATCH OLK-5.10 00/12] mm: numa-affinity: support THP migration
by Nanyong Sun 29 Jul '24

29 Jul '24

1. Backport the patch series: mm: thp: use generic THP migration for NUMA hinting fault 2. Support THP migration in numa-affinity 3. Some minor optimizations Aneesh Kumar K.V (1): mm/migrate: fix NR_ISOLATED corruption on 64-bit Nanyong Sun (3): mm: fix KABI broken in struct vm_fault mm: numa-affinity: support THP migration mm: numa-affinity: delete the duplicate numa_migrate_prep Yang Shi (7): mm: memory: add orig_pmd to struct vm_fault mm: memory: make numa_migrate_prep() non-static mm: thp: refactor NUMA fault handling mm: migrate: account THP NUMA migration counters correctly mm: migrate: don't split THP for misplaced NUMA page mm: migrate: check mapcount for THP instead of refcount mm: thp: skip make PMD PROT_NONE if THP migration is not supported Ze Zuo (1): mm: numa-affinity: backport some migrate policy from AutoNuma include/linux/huge_mm.h | 9 +- include/linux/migrate.h | 23 ----- include/linux/mm.h | 8 +- mm/huge_memory.c | 157 +++++++++++------------------- mm/internal.h | 21 +--- mm/mem_sampling.c | 89 ++++++++++++++--- mm/memory.c | 31 +++--- mm/migrate.c | 205 +++++++++------------------------------- 8 files changed, 202 insertions(+), 341 deletions(-) -- 2.25.1

3 14

[PATCH v2 OLK-5.10 00/13] mm: numa-affinity: support THP migration
by Nanyong Sun 28 Jul '24

28 Jul '24

1. Backport the patch series: mm: thp: use generic THP migration for NUMA hinting fault 2. Support THP migration in numa-affinity 3. Some minor optimizations change from v1: backport one more "bugfix" patch(the last one) to avoid CI failed. Aneesh Kumar K.V (1): mm/migrate: fix NR_ISOLATED corruption on 64-bit Huang Ying (1): mm,do_huge_pmd_numa_page: remove unnecessary TLB flushing code Nanyong Sun (3): mm: fix KABI broken in struct vm_fault mm: numa-affinity: support THP migration mm: numa-affinity: delete the duplicate numa_migrate_prep Yang Shi (7): mm: memory: add orig_pmd to struct vm_fault mm: memory: make numa_migrate_prep() non-static mm: thp: refactor NUMA fault handling mm: migrate: account THP NUMA migration counters correctly mm: migrate: don't split THP for misplaced NUMA page mm: migrate: check mapcount for THP instead of refcount mm: thp: skip make PMD PROT_NONE if THP migration is not supported Ze Zuo (1): mm: numa-affinity: backport some migrate policy from AutoNuma include/linux/huge_mm.h | 9 +- include/linux/migrate.h | 23 ----- include/linux/mm.h | 8 +- mm/huge_memory.c | 167 +++++++++----------------------- mm/internal.h | 21 +--- mm/mem_sampling.c | 89 ++++++++++++++--- mm/memory.c | 31 +++--- mm/migrate.c | 205 +++++++++------------------------------- 8 files changed, 194 insertions(+), 359 deletions(-) -- 2.25.1

2 14

[openeuler:openEuler-1.0-LTS 11557/23376] drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_gro.o: warning: objtool: missing symbol for section .text
by kernel test robot 28 Jul '24

28 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0e54270d90f09583500ef61f20ffb02efafa8031 commit: 98cbed17790cdb1565119733aa422bab3b955d46 [11557/23376] net: hns3: place cae gro implementations in an independent file config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240728/202407281559.WpczUOhm-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240728/202407281559.WpczUOhm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407281559.WpczUOhm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_gro.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1889/10967] kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_sched_prio_load_balance_enabled' was not declared. Should it be static?
by kernel test robot 28 Jul '24

28 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b4a0c4baeb5af802ab07bb35e874446f0389901f commit: 89bf80a4d6d5ba852b9042480e0be23c2c4a628c [1889/10967] sched: Introduce priority load balance for qos scheduler config: loongarch-randconfig-r112-20240728 (https://download.01.org/0day-ci/archive/20240728/202407281041.HjAnBUAM-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240728/202407281041.HjAnBUAM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407281041.HjAnBUAM-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:144:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? >> kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_sched_prio_load_balance_enabled' was not declared. Should it be static? kernel/sched/fair.c:1271:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1271:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1271:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:12846:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12846:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12846:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5925:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5925:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:5925:22: sparse: struct task_struct * kernel/sched/fair.c:7998:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7998:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:7998:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8310:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8310:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8310:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8421:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8421:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8421:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8641:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8641:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8641:22: sparse: struct task_struct * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8999:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8999:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8999:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:10040:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:10040:40: sparse: expected struct sched_domain *child kernel/sched/fair.c:10040:40: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:10677:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:10677:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:10677:22: sparse: struct task_struct * kernel/sched/fair.c:12118:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12118:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12118:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:11775:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11775:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:11775:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12214:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12214:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12214:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:7214:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7214:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7214:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7220:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7220:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7220:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7227:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *sd @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:7227:28: sparse: expected struct sched_domain *sd kernel/sched/fair.c:7227:28: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:7235:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7235:17: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:7235:17: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2312:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2312:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2312:9: sparse: struct task_struct * kernel/sched/sched.h:2148:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2148:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2148:25: sparse: struct task_struct * kernel/sched/sched.h:2148:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2148:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2148:25: sparse: struct task_struct * vim +/sysctl_sched_prio_load_balance_enabled +151 kernel/sched/fair.c 149 150 #ifdef CONFIG_QOS_SCHED_PRIO_LB > 151 unsigned int sysctl_sched_prio_load_balance_enabled; 152 #endif 153 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 1e94b0d2faf96417b94f05cc073514c74aec2430
by kernel test robot 28 Jul '24

28 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 1e94b0d2faf96417b94f05cc073514c74aec2430 !10333 BMA: Fix DMA reset problem and change the version elapsed time: 731m configs tested: 35 configs skipped: 129 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240728 gcc-14.1.0 arm64 randconfig-002-20240728 clang-20 arm64 randconfig-003-20240728 gcc-14.1.0 arm64 randconfig-004-20240728 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 randconfig-014-20240727 gcc-10 x86_64 randconfig-015-20240727 gcc-12 x86_64 randconfig-016-20240727 gcc-10 x86_64 randconfig-071-20240727 gcc-13 x86_64 randconfig-072-20240727 gcc-13 x86_64 randconfig-073-20240727 gcc-8 x86_64 randconfig-074-20240727 gcc-8 x86_64 randconfig-075-20240727 clang-18 x86_64 randconfig-076-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 11551/23376] drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_checksum.o: warning: objtool: missing symbol for section .text
by kernel test robot 28 Jul '24

28 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0e54270d90f09583500ef61f20ffb02efafa8031 commit: cbfc331af49be9d450cdf64943af2167aa34e17b [11551/23376] net: hns3: split checksum's kernel cmd from hns3_cae_lib.c config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240728/202407280656.dQn0SLk3-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240728/202407280656.dQn0SLk3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407280656.dQn0SLk3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_checksum.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS b4a0c4baeb5af802ab07bb35e874446f0389901f
by kernel test robot 28 Jul '24

28 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b4a0c4baeb5af802ab07bb35e874446f0389901f !9533 net/mlx5: Add a timeout to acquire the command queue semaphore Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-defconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-002-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-003-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-002-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 723m configs tested: 40 configs skipped: 124 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 clang-20 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240727 gcc-14.1.0 loongarch randconfig-002-20240727 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 randconfig-014-20240727 gcc-10 x86_64 randconfig-015-20240727 gcc-12 x86_64 randconfig-016-20240727 gcc-10 x86_64 randconfig-071-20240727 gcc-13 x86_64 randconfig-072-20240727 gcc-13 x86_64 randconfig-073-20240727 gcc-8 x86_64 randconfig-074-20240727 gcc-8 x86_64 randconfig-075-20240727 clang-18 x86_64 randconfig-076-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 0e54270d90f09583500ef61f20ffb02efafa8031
by kernel test robot 28 Jul '24

28 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 0e54270d90f09583500ef61f20ffb02efafa8031 !10324 BMA: Fix iBMA bug and change Warning ids grouped by kconfigs: recent_errors |-- x86_64-buildonly-randconfig-002-20240727 | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-003-20240727 | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-004-20240727 | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-005-20240727 | |-- drivers-iommu-.tmp_amd_iommu_quirks.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_fd.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_hilink_param.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_irq.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_mac.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_port.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_promisc.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_qinfo.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_qos.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_qres.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_rss.o:warning:objtool:missing-symbol-for-section-.text | `-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_vlan.o:warning:objtool:missing-symbol-for-section-.text `-- x86_64-buildonly-randconfig-006-20240727 `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized elapsed time: 590m configs tested: 35 configs skipped: 129 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 gcc-14.1.0 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 randconfig-014-20240727 gcc-10 x86_64 randconfig-015-20240727 gcc-12 x86_64 randconfig-016-20240727 gcc-10 x86_64 randconfig-071-20240727 gcc-13 x86_64 randconfig-072-20240727 gcc-13 x86_64 randconfig-073-20240727 gcc-8 x86_64 randconfig-074-20240727 gcc-8 x86_64 randconfig-075-20240727 clang-18 x86_64 randconfig-076-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/5] fix CVE-2024-36479 for sp1
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Backport patch to fix CVE-2024-36479 for openEuler-22.03-LTS-SP1. Alexis Lothoré (1): fpga: bridge: properly initialize bridge device before populating children Marco Pagani (2): fpga: remove redundant checks for bridge ops fpga: bridge: add owner module and take its refcount Russ Weight (2): fpga: bridge: Rename dev to parent for parent device fpga: bridge: Use standard dev_release for class driver Documentation/driver-api/fpga/fpga-bridge.rst | 11 +- drivers/fpga/altera-fpga2sdram.c | 12 +- drivers/fpga/altera-freeze-bridge.c | 10 +- drivers/fpga/altera-hps2fpga.c | 12 +- drivers/fpga/dfl-fme-br.c | 10 +- drivers/fpga/fpga-bridge.c | 188 ++++++------------ drivers/fpga/xilinx-pr-decoupler.c | 13 +- include/linux/fpga/fpga-bridge.h | 34 +++- 8 files changed, 116 insertions(+), 174 deletions(-) -- 2.25.1

2 6

[PATCH OLK-5.10 0/5] fix CVE-2024-36479 for olk-5.10
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport patch to fix CVE-2024-36479. Alexis Lothoré (1): fpga: bridge: properly initialize bridge device before populating children Marco Pagani (2): fpga: remove redundant checks for bridge ops fpga: bridge: add owner module and take its refcount Russ Weight (2): fpga: bridge: Rename dev to parent for parent device fpga: bridge: Use standard dev_release for class driver Documentation/driver-api/fpga/fpga-bridge.rst | 11 +- drivers/fpga/altera-fpga2sdram.c | 12 +- drivers/fpga/altera-freeze-bridge.c | 10 +- drivers/fpga/altera-hps2fpga.c | 12 +- drivers/fpga/dfl-fme-br.c | 10 +- drivers/fpga/fpga-bridge.c | 188 ++++++------------ drivers/fpga/xilinx-pr-decoupler.c | 13 +- include/linux/fpga/fpga-bridge.h | 34 +++- 8 files changed, 116 insertions(+), 174 deletions(-) -- 2.25.1

2 6

[PATCH OLK-5.10 0/4] BMA: Fix DMA reset problem and change the version
by Li Nan 27 Jul '24

27 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. 2. Change the iBMA driver version. Wujiahai (4): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Change the version number. BMA/kbox_drv: Change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.27.0

2 5

[PATCH OLK-5.10 0/4] BMA: Fix DMA reset problem and change the version
by Li Nan 27 Jul '24

27 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. 2. Change the iBMA driver version. Wujiahai (4): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Change the version number. BMA/kbox_drv: Change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.27.0

2 5

[PATCH OLK-6.6] drm/amdgpu: add error handle to avoid out-of-bounds
by Wenyu Huang 27 Jul '24

27 Jul '24

From: Bob Zhou <bob.zhou(a)amd.com> stable inclusion from stable-v6.6.34 commit 5b0a3dc3e87821acb80e841b464d335aff242691 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AED CVE: CVE-2024-39471 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8b2faf1a4f3b6c748c0da36cda865a226534d520 upstream. if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL. Signed-off-by: Bob Zhou <bob.zhou(a)amd.com> Acked-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Le Ma <le.ma(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c index cd37f45e01a11..31d82b68053ec 100644 --- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c @@ -2031,6 +2031,9 @@ static int sdma_v4_0_process_trap_irq(struct amdgpu_device *adev, DRM_DEBUG("IH: SDMA trap\n"); instance = sdma_v4_0_irq_id_to_seq(entry->client_id); + if (instance < 0) + return instance; + switch (entry->ring_id) { case 0: amdgpu_fence_process(&adev->sdma.instance[instance].ring); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 11543/23370] drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qres.o: warning: objtool: missing symbol for section .text
by kernel test robot 27 Jul '24

27 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 365ea86d72567c1550e42ecf0e3f4521da9a5570 commit: ed046b8a9bc5f5836ece3a3efa29c54f0fc904e7 [11543/23370] net: hns3: rename hns3_cae's files and remove send_cmdq config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240727/202407271613.wxmYLLXu-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240727/202407271613.wxmYLLXu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407271613.wxmYLLXu-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:6:5: warning: no previous prototype for function 'hns3_get_qres_rx_value' [-Wmissing-prototypes] 6 | int hns3_get_qres_rx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:6:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6 | int hns3_get_qres_rx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:54:5: warning: no previous prototype for function 'hns3_get_qres_tx_value' [-Wmissing-prototypes] 54 | int hns3_get_qres_tx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:54:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 54 | int hns3_get_qres_tx_value(struct hns3_nic_priv *net_priv, int ring_id, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:100:6: warning: no previous prototype for function 'fill_queue_info' [-Wmissing-prototypes] 100 | void fill_queue_info(struct hns3_nic_priv *net_priv, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qres.c:100:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 100 | void fill_queue_info(struct hns3_nic_priv *net_priv, | ^ | static 3 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qres.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:6: warning: no previous prototype for function 'fill_port_info' [-Wmissing-prototypes] 19 | void fill_port_info(struct hclge_port_info *get_port_info_out, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 19 | void fill_port_info(struct hclge_port_info *get_port_info_out, | ^ | static 1 warning generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_port.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_hilink_param.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_irq.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qinfo.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_rss.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:5: warning: no previous prototype for function 'hclge_test_send_generic_cmd' [-Wmissing-prototypes] 20 | int hclge_test_send_generic_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 20 | int hclge_test_send_generic_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:5: warning: no previous prototype for function 'hclge_test_send_allocate_cmd' [-Wmissing-prototypes] 62 | int hclge_test_send_allocate_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 62 | int hclge_test_send_allocate_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:5: warning: no previous prototype for function 'hclge_test_send_key_cfg_cmd' [-Wmissing-prototypes] 100 | int hclge_test_send_key_cfg_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 100 | int hclge_test_send_key_cfg_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:5: warning: no previous prototype for function 'hclge_test_send_tcam_op_cmd' [-Wmissing-prototypes] 153 | int hclge_test_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | int hclge_test_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:5: warning: no previous prototype for function 'hclge_test_send_ad_op_cmd' [-Wmissing-prototypes] 224 | int hclge_test_send_ad_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 224 | int hclge_test_send_ad_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:5: warning: no previous prototype for function 'hclge_test_send_cnt_op_cmd' [-Wmissing-prototypes] 267 | int hclge_test_send_cnt_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 267 | int hclge_test_send_cnt_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^ | static 6 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_fd.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_mac.o: warning: objtool: missing symbol for section .text -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_vlan.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:19: warning: no previous prototype for function 'get_val_hdev' [-Wmissing-prototypes] 9 | struct hclge_dev *get_val_hdev(struct hns3_nic_priv *net_priv) | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 9 | struct hclge_dev *get_val_hdev(struct hns3_nic_priv *net_priv) | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:5: warning: no previous prototype for function 'hns3_cmd_rx_priv_wl_config' [-Wmissing-prototypes] 19 | int hns3_cmd_rx_priv_wl_config(struct hclge_dev *hdev, u16 tc, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 19 | int hns3_cmd_rx_priv_wl_config(struct hclge_dev *hdev, u16 tc, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:5: warning: no previous prototype for function 'hns3_cmd_common_thrd_config' [-Wmissing-prototypes] 89 | int hns3_cmd_common_thrd_config(struct hclge_dev *hdev, u16 tc, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 89 | int hns3_cmd_common_thrd_config(struct hclge_dev *hdev, u16 tc, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:5: warning: no previous prototype for function 'hns3_cmd_common_wl_config' [-Wmissing-prototypes] 161 | int hns3_cmd_common_wl_config(struct hclge_dev *hdev, u32 high, u32 low, u32 en) | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 161 | int hns3_cmd_common_wl_config(struct hclge_dev *hdev, u32 high, u32 low, u32 en) | ^ | static 4 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_qos.o: warning: objtool: missing symbol for section .text -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:5: warning: no previous prototype for function 'hns3_read_promisc_mode_cfg' [-Wmissing-prototypes] 6 | int hns3_read_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6 | int hns3_read_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ | static drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:5: warning: no previous prototype for function 'hns3_set_promisc_mode_cfg' [-Wmissing-prototypes] 44 | int hns3_set_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 44 | int hns3_set_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^ | static 2 warnings generated. >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_promisc.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] drm/amdgpu: add error handle to avoid out-of-bounds
by Wenyu Huang 27 Jul '24

27 Jul '24

From: Bob Zhou <bob.zhou(a)amd.com> stable inclusion from stable-v5.10.220 commit 8112fa72b7f139052843ff484130d6f97e9f052f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AED CVE: CVE-2024-39471 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8b2faf1a4f3b6c748c0da36cda865a226534d520 upstream. if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL. Signed-off-by: Bob Zhou <bob.zhou(a)amd.com> Acked-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Le Ma <le.ma(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c index dbcaef3f35da9..c54834ed8751e 100644 --- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c @@ -2073,6 +2073,9 @@ static int sdma_v4_0_process_trap_irq(struct amdgpu_device *adev, DRM_DEBUG("IH: SDMA trap\n"); instance = sdma_v4_0_irq_id_to_seq(entry->client_id); + if (instance < 0) + return instance; + switch (entry->ring_id) { case 0: amdgpu_fence_process(&adev->sdma.instance[instance].ring); -- 2.34.1

2 1

[PATCH OLK-6.6] mm/page_table_check: fix crash on ZONE_DEVICE
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Peter Xu <peterx(a)redhat.com> stable inclusion from stable-v6.6.36 commit 84d3549d54f5ff9fa3281257be3019386f51d1a0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACSUZ CVE: CVE-2024-40948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8bb592c2eca8fd2bc06db7d80b38da18da4a2f43 upstream. Not all pages may apply to pgtable check. One example is ZONE_DEVICE pages: they map PFNs directly, and they don't allocate page_ext at all even if there's struct page around. One may reference devm_memremap_pages(). When both ZONE_DEVICE and page-table-check enabled, then try to map some dax memories, one can trigger kernel bug constantly now when the kernel was trying to inject some pfn maps on the dax device: kernel BUG at mm/page_table_check.c:55! While it's pretty legal to use set_pxx_at() for ZONE_DEVICE pages for page fault resolutions, skip all the checks if page_ext doesn't even exist in pgtable checker, which applies to ZONE_DEVICE but maybe more. Link: https://lkml.kernel.org/r/20240605212146.994486-1-peterx@redhat.com Fixes: df4e817b7108 ("mm: page table check") Signed-off-by: Peter Xu <peterx(a)redhat.com> Reviewed-by: Pasha Tatashin <pasha.tatashin(a)soleen.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Reviewed-by: Alistair Popple <apopple(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/page_table_check.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/mm/page_table_check.c b/mm/page_table_check.c index af69c3c8f7c2..6363f93a47c6 100644 --- a/mm/page_table_check.c +++ b/mm/page_table_check.c @@ -71,6 +71,9 @@ static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt) page = pfn_to_page(pfn); page_ext = page_ext_get(page); + if (!page_ext) + return; + BUG_ON(PageSlab(page)); anon = PageAnon(page); @@ -108,6 +111,9 @@ static void page_table_check_set(unsigned long pfn, unsigned long pgcnt, page = pfn_to_page(pfn); page_ext = page_ext_get(page); + if (!page_ext) + return; + BUG_ON(PageSlab(page)); anon = PageAnon(page); @@ -138,7 +144,10 @@ void __page_table_check_zero(struct page *page, unsigned int order) BUG_ON(PageSlab(page)); page_ext = page_ext_get(page); - BUG_ON(!page_ext); + + if (!page_ext) + return; + for (i = 0; i < (1ul << order); i++) { struct page_table_check *ptc = get_page_table_check(page_ext); -- 2.25.1

2 1

[PATCH OLK-5.10] net/smc: enable smcrv1 when RNIC supports rocev2
by Zhengchao Shao 27 Jul '24

27 Jul '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAFYD8 ----------------------------------------- When the RNIC supports rocev2, smcrv1 can also be used to send and receive packets. Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/smc/smc_ib.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c index 2e0d7aeefc41..3e45bcc51cb4 100644 --- a/net/smc/smc_ib.c +++ b/net/smc/smc_ib.c @@ -201,8 +201,7 @@ int smc_ib_determine_gid(struct smc_ib_device *smcibdev, u8 ibport, if (!IS_ERR(ndev) && ((!vlan_id && !is_vlan_dev(ndev)) || (vlan_id && is_vlan_dev(ndev) && - vlan_dev_vlan_id(ndev) == vlan_id)) && - attr->gid_type == IB_GID_TYPE_ROCE) { + vlan_dev_vlan_id(ndev) == vlan_id))) { rcu_read_unlock(); if (gid) memcpy(gid, &attr->gid, SMC_GID_SIZE); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] NFC: port100: fix use-after-free in port100_send_complete
by Wupeng Ma 27 Jul '24

27 Jul '24

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v4.19.235 commit b1db33d4e54bc35d8db96ce143ea0ef92e23d58e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S9P CVE: CVE-2022-48857 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f80cfe2f26581f188429c12bd937eb905ad3ac7b ] Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_send_complete() accesses devm allocated memory which will be freed on probe failure. We should kill this urbs before returning an error from probe function to prevent reported use-after-free Fail log: BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670 ... Allocated by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 alloc_dr drivers/base/devres.c:116 [inline] devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823 devm_kzalloc include/linux/device.h:209 [inline] port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502 Freed by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] __cache_free mm/slab.c:3437 [inline] kfree+0xf8/0x2b0 mm/slab.c:3794 release_nodes+0x112/0x1a0 drivers/base/devres.c:501 devres_release_all+0x114/0x190 drivers/base/devres.c:530 really_probe+0x626/0xcc0 drivers/base/dd.c:670 Reported-and-tested-by: syzbot+16bcb127fb73baeecb14(a)syzkaller.appspotmail.com Fixes: 0347a6ab300a ("NFC: port100: Commands mechanism implementation") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Link: https://lore.kernel.org/r/20220308185007.6987-1-paskripkin@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/nfc/port100.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c index 60ae382f50da..08da712ad45f 100644 --- a/drivers/nfc/port100.c +++ b/drivers/nfc/port100.c @@ -1618,7 +1618,9 @@ static int port100_probe(struct usb_interface *interface, nfc_digital_free_device(dev->nfc_digital_dev); error: + usb_kill_urb(dev->in_urb); usb_free_urb(dev->in_urb); + usb_kill_urb(dev->out_urb); usb_free_urb(dev->out_urb); usb_put_dev(dev->udev); -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 2b2a7e656e24161c2ed8fbec4744b6f231431b7f
by kernel test robot 27 Jul '24

27 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2b2a7e656e24161c2ed8fbec4744b6f231431b7f !10316 sched: Add cfs_preferred_nid_init hook elapsed time: 731m configs tested: 35 configs skipped: 138 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 clang-20 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 randconfig-014-20240727 gcc-10 x86_64 randconfig-015-20240727 gcc-12 x86_64 randconfig-016-20240727 gcc-10 x86_64 randconfig-071-20240727 gcc-13 x86_64 randconfig-072-20240727 gcc-13 x86_64 randconfig-073-20240727 gcc-8 x86_64 randconfig-074-20240727 gcc-8 x86_64 randconfig-075-20240727 clang-18 x86_64 randconfig-076-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 06bfbb032512dd58dfe4598cca653d0021fea49a
by kernel test robot 27 Jul '24

27 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 06bfbb032512dd58dfe4598cca653d0021fea49a !9892 support for SMC-D loopback_lo feature Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-defconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-002-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-003-20240727 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-002-20240727 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 726m configs tested: 31 configs skipped: 134 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240727 clang-20 arm64 randconfig-002-20240727 gcc-14.1.0 arm64 randconfig-003-20240727 gcc-14.1.0 arm64 randconfig-004-20240727 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240727 gcc-14.1.0 loongarch randconfig-002-20240727 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240727 gcc-8 x86_64 buildonly-randconfig-002-20240727 gcc-13 x86_64 buildonly-randconfig-003-20240727 gcc-13 x86_64 buildonly-randconfig-004-20240727 gcc-13 x86_64 buildonly-randconfig-005-20240727 clang-18 x86_64 buildonly-randconfig-006-20240727 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240727 gcc-13 x86_64 randconfig-002-20240727 clang-18 x86_64 randconfig-003-20240727 clang-18 x86_64 randconfig-004-20240727 clang-18 x86_64 randconfig-005-20240727 gcc-13 x86_64 randconfig-006-20240727 clang-18 x86_64 randconfig-011-20240727 gcc-13 x86_64 randconfig-012-20240727 gcc-13 x86_64 randconfig-013-20240727 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 9458/23370] drivers/iommu/.tmp_amd_iommu_quirks.o: warning: objtool: missing symbol for section .text
by kernel test robot 27 Jul '24

27 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 365ea86d72567c1550e42ecf0e3f4521da9a5570 commit: fe2ee4839a7421367da12f5610e1b45c619fcbad [9458/23370] iommu/amd: Override wrong IVRS IOAPIC on Raven Ridge systems config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240727/202407271424.5G6KyQ0z-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240727/202407271424.5G6KyQ0z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407271424.5G6KyQ0z-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/iommu/.tmp_amd_iommu_quirks.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] kobject: Fix global-out-of-bounds in kobject_action_type()
by Xia Fukun 27 Jul '24

27 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9REGZ CVE: NA -------------------------------- The following c language code can trigger KASAN's global variable out-of-bounds access error in kobject_action_type(): int main() { int fd; char *filename = "/sys/block/ram12/uevent"; char str[86] = "offline"; int len = 86; fd = open(filename, O_WRONLY); if (fd == -1) { printf("open"); exit(1); } if (write(fd, str, len) == -1) { printf("write"); exit(1); } close(fd); return 0; } Function kobject_action_type() receives the input parameters buf and count, where count is the length of the string buf. In the use case we provided, count is 86, the count_first is 85. Buf points to a string with a length of 86, and its first seven characters are "offline". In line 87 of the code, kobject_actions[action] is the string "offline" with the length of 7,an out-of-boundary access will appear: kobject_actions[action][85]. Modify the judgment logic in line 87. If the length of the string kobject_actions[action] is greater than count_first(e.g. buf is "off", count is 3), continue the loop. Otherwise, the match is considered successful. This change means that our test case will be successfully parsed as an offline event and no out-of-bounds access error will occur. Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents") Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- lib/kobject_uevent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index 26d21339bef27..b5fc7b9ce197a 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -84,7 +84,7 @@ static int kobject_action_type(const char *buf, size_t count, for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) { if (strncmp(kobject_actions[action], buf, count_first) != 0) continue; - if (kobject_actions[action][count_first] != '\0') + if (strlen(kobject_actions[action]) > count_first) continue; if (args) *args = args_start; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/5] BMA: Fix iBMA bug and change
by Wang Hai 27 Jul '24

27 Jul '24

From: Wujiahai <wujiahai(a)huawei.com> 1. a low probability that iBMA cdev_veth driver causes softlockup problem 2. a low probability that iBMA veth driver causes soft interrupt loops 3. Change the iBMA driver version. 4. Resolved the problem that the DMA reset does not meet the expectation due to the mismatch between the register configuration and the communication transmission direction during DMA reset. Wujiahai (5): BMA/edma_drv: Fix DMA reset problem and change the version number. BMA/cdev_drv: Change the version number. BMA/veth_drv: Fix soft interrupt loops and change the version number BMA/kbox_drv: Change the version number. BMA/cdev_veth_drv: Fix softlockup problem .../net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../bma/cdev_veth_drv/virtual_cdev_eth_net.c | 14 ++++++++------ drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../net/ethernet/huawei/bma/edma_drv/edma_host.c | 4 ++-- .../ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c | 12 +++++++++++- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 7 files changed, 25 insertions(+), 13 deletions(-) -- 2.27.0

2 6

[PATCH OLK-6.6] media: i2c: et8ek8: Don't strip remove function when driver is builtin
by Wupeng Ma 26 Jul '24

26 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v6.6.33 commit c1a3803e5bb91c13e9ad582003e4288f67f06cd9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA74DQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 545b215736c5c4b354e182d99c578a472ac9bfce ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/et8ek8/et8ek8_driver.c b/drivers/media/i2c/et8ek8/et8ek8_driver.c index d6fc843f9368..0d6f0f8506f7 100644 --- a/drivers/media/i2c/et8ek8/et8ek8_driver.c +++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c @@ -1460,7 +1460,7 @@ static int et8ek8_probe(struct i2c_client *client) return ret; } -static void __exit et8ek8_remove(struct i2c_client *client) +static void et8ek8_remove(struct i2c_client *client) { struct v4l2_subdev *subdev = i2c_get_clientdata(client); struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev); @@ -1502,7 +1502,7 @@ static struct i2c_driver et8ek8_i2c_driver = { .of_match_table = et8ek8_of_table, }, .probe = et8ek8_probe, - .remove = __exit_p(et8ek8_remove), + .remove = et8ek8_remove, .id_table = et8ek8_id_table, }; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] media: i2c: et8ek8: Don't strip remove function when driver is builtin
by Wupeng Ma 26 Jul '24

26 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v6.6.33 commit c1a3803e5bb91c13e9ad582003e4288f67f06cd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S9P CVE: CVE-2024-38611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 545b215736c5c4b354e182d99c578a472ac9bfce ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/media/i2c/et8ek8/et8ek8_driver.c [Ma Wupeng: return val of et8ek8_remove lead to conflict] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/et8ek8/et8ek8_driver.c b/drivers/media/i2c/et8ek8/et8ek8_driver.c index 256acf73d5ea..4d7c4eac5e20 100644 --- a/drivers/media/i2c/et8ek8/et8ek8_driver.c +++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c @@ -1460,7 +1460,7 @@ static int et8ek8_probe(struct i2c_client *client) return ret; } -static int __exit et8ek8_remove(struct i2c_client *client) +static int et8ek8_remove(struct i2c_client *client) { struct v4l2_subdev *subdev = i2c_get_clientdata(client); struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev); @@ -1504,7 +1504,7 @@ static struct i2c_driver et8ek8_i2c_driver = { .of_match_table = et8ek8_of_table, }, .probe_new = et8ek8_probe, - .remove = __exit_p(et8ek8_remove), + .remove = et8ek8_remove, .id_table = et8ek8_id_table, }; -- 2.25.1

2 1

[PATCH OLK-5.10] media: i2c: et8ek8: Don't strip remove function when driver is builtin
by Wupeng Ma 26 Jul '24

26 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v6.6.33 commit c1a3803e5bb91c13e9ad582003e4288f67f06cd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S9P CVE: CVE-2024-38611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 545b215736c5c4b354e182d99c578a472ac9bfce ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/media/i2c/et8ek8/et8ek8_driver.c [Ma Wupeng: return val of et8ek8_remove lead to conflict] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/et8ek8/et8ek8_driver.c b/drivers/media/i2c/et8ek8/et8ek8_driver.c index 256acf73d5ea..4d7c4eac5e20 100644 --- a/drivers/media/i2c/et8ek8/et8ek8_driver.c +++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c @@ -1460,7 +1460,7 @@ static int et8ek8_probe(struct i2c_client *client) return ret; } -static int __exit et8ek8_remove(struct i2c_client *client) +static int et8ek8_remove(struct i2c_client *client) { struct v4l2_subdev *subdev = i2c_get_clientdata(client); struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev); @@ -1504,7 +1504,7 @@ static struct i2c_driver et8ek8_i2c_driver = { .of_match_table = et8ek8_of_table, }, .probe_new = et8ek8_probe, - .remove = __exit_p(et8ek8_remove), + .remove = et8ek8_remove, .id_table = et8ek8_id_table, }; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] thermal: Fix NULL pointer dereferences in of_thermal_ functions
by Liu Mingrui 26 Jul '24

26 Jul '24

From: Subbaraman Narayanamurthy <quic_subbaram(a)quicinc.com> stable inclusion from stable-v5.10.81 commit 6a315471cb6a07f651e1d3adc8962730f4fcccac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNF5 CVE: CVE-2021-47202 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 96cfe05051fd8543cdedd6807ec59a0e6c409195 upstream. of_parse_thermal_zones() parses the thermal-zones node and registers a thermal_zone device for each subnode. However, if a thermal zone is consuming a thermal sensor and that thermal sensor device hasn't probed yet, an attempt to set trip_point_*_temp for that thermal zone device can cause a NULL pointer dereference. Fix it. console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp ... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... Call trace: of_thermal_set_trip_temp+0x40/0xc4 trip_point_temp_store+0xc0/0x1dc dev_attr_store+0x38/0x88 sysfs_kf_write+0x64/0xc0 kernfs_fop_write_iter+0x108/0x1d0 vfs_write+0x2f4/0x368 ksys_write+0x7c/0xec __arm64_sys_write+0x20/0x30 el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc do_el0_svc+0x28/0xa0 el0_svc+0x14/0x24 el0_sync_handler+0x88/0xec el0_sync+0x1c0/0x200 While at it, fix the possible NULL pointer dereference in other functions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(), of_thermal_get_trend(). Suggested-by: David Collins <quic_collinsd(a)quicinc.com> Signed-off-by: Subbaraman Narayanamurthy <quic_subbaram(a)quicinc.com> Acked-by: Daniel Lezcano <daniel.lezcano(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/thermal/of-thermal.c Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/thermal/of-thermal.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c index 4f2816559205..856dce4d72e2 100644 --- a/drivers/thermal/of-thermal.c +++ b/drivers/thermal/of-thermal.c @@ -77,7 +77,7 @@ static int of_thermal_get_temp(struct thermal_zone_device *tz, { struct __thermal_zone *data = tz->devdata; - if (!data->ops->get_temp) + if (!data->ops || !data->ops->get_temp) return -EINVAL; return data->ops->get_temp(data->sensor_data, temp); @@ -174,6 +174,10 @@ static int of_thermal_set_emul_temp(struct thermal_zone_device *tz, { struct __thermal_zone *data = tz->devdata; + if (!data->ops || !data->ops->set_emul_temp) + return -EINVAL; + + return data->ops->set_emul_temp(data->sensor_data, temp); } @@ -182,7 +186,7 @@ static int of_thermal_get_trend(struct thermal_zone_device *tz, int trip, { struct __thermal_zone *data = tz->devdata; - if (!data->ops->get_trend) + if (!data->ops || !data->ops->get_trend) return -EINVAL; return data->ops->get_trend(data->sensor_data, trip, trend); @@ -310,7 +314,7 @@ static int of_thermal_set_trip_temp(struct thermal_zone_device *tz, int trip, if (trip >= data->ntrips || trip < 0) return -EDOM; - if (data->ops->set_trip_temp) { + if (data->ops && data->ops->set_trip_temp) { int ret; ret = data->ops->set_trip_temp(data->sensor_data, trip, temp); -- 2.25.1

2 1

[PATCH OLK-6.6] block: propagate partition scanning errors to the BLKRRPART ioctl
by Yu Kuai 26 Jul '24

26 Jul '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.9-rc5 commit 752863bddacab6b5c5164b1df8c8b2e3a175ee28 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAFS7F CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 4601b4b130de ("block: reopen the device in blkdev_reread_part") lost the propagation of I/O errors from the low-level read of the partition table to the user space caller of the BLKRRPART. Apparently some user space relies on, so restore the propagation. This isn't exactly pretty as other block device open calls explicitly do not are about these errors, so add a new BLK_OPEN_STRICT_SCAN to opt into the error propagation. Fixes: 4601b4b130de ("block: reopen the device in blkdev_reread_part") Reported-by: Saranya Muruganandam <saranyamohan(a)google.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Reviewed-by: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Link: https://lore.kernel.org/r/20240417144743.2277601-1-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- block/bdev.c | 29 +++++++++++++++++++---------- block/ioctl.c | 3 ++- include/linux/blkdev.h | 2 ++ 3 files changed, 23 insertions(+), 11 deletions(-) diff --git a/block/bdev.c b/block/bdev.c index 07e8e3686aea..3a4357e5aac6 100644 --- a/block/bdev.c +++ b/block/bdev.c @@ -648,6 +648,14 @@ static void blkdev_flush_mapping(struct block_device *bdev) bdev_write_inode(bdev); } +static void blkdev_put_whole(struct block_device *bdev) +{ + if (atomic_dec_and_test(&bdev->bd_openers)) + blkdev_flush_mapping(bdev); + if (bdev->bd_disk->fops->release) + bdev->bd_disk->fops->release(bdev->bd_disk); +} + static int blkdev_get_whole(struct block_device *bdev, blk_mode_t mode) { struct gendisk *disk = bdev->bd_disk; @@ -666,20 +674,21 @@ static int blkdev_get_whole(struct block_device *bdev, blk_mode_t mode) if (!atomic_read(&bdev->bd_openers)) set_init_blocksize(bdev); - if (test_bit(GD_NEED_PART_SCAN, &disk->state)) - bdev_disk_changed(disk, false); atomic_inc(&bdev->bd_openers); + if (test_bit(GD_NEED_PART_SCAN, &disk->state)) { + /* + * Only return scanning errors if we are called from contexts + * that explicitly want them, e.g. the BLKRRPART ioctl. + */ + ret = bdev_disk_changed(disk, false); + if (ret && (mode & BLK_OPEN_STRICT_SCAN)) { + blkdev_put_whole(bdev); + return ret; + } + } return 0; } -static void blkdev_put_whole(struct block_device *bdev) -{ - if (atomic_dec_and_test(&bdev->bd_openers)) - blkdev_flush_mapping(bdev); - if (bdev->bd_disk->fops->release) - bdev->bd_disk->fops->release(bdev->bd_disk); -} - static int blkdev_get_part(struct block_device *part, blk_mode_t mode) { struct gendisk *disk = part->bd_disk; diff --git a/block/ioctl.c b/block/ioctl.c index b7104fd80a46..808910231dc8 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -556,7 +556,8 @@ static int blkdev_common_ioctl(struct block_device *bdev, blk_mode_t mode, return -EACCES; if (bdev_is_partition(bdev)) return -EINVAL; - return disk_scan_partitions(bdev->bd_disk, mode); + return disk_scan_partitions(bdev->bd_disk, + mode | BLK_OPEN_STRICT_SCAN); case BLKTRACESTART: case BLKTRACESTOP: case BLKTRACETEARDOWN: diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index b114f4a32753..a41707b09d8d 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -129,6 +129,8 @@ typedef unsigned int __bitwise blk_mode_t; #define BLK_OPEN_WRITE_IOCTL ((__force blk_mode_t)(1 << 4)) /* open is exclusive wrt all other BLK_OPEN_WRITE opens to the device */ #define BLK_OPEN_RESTRICT_WRITES ((__force blk_mode_t)(1 << 5)) +/* return partition scanning errors */ +#define BLK_OPEN_STRICT_SCAN ((__force blk_mode_t)(1 << 6)) struct gendisk { /* -- 2.39.2

2 1

[PATCH OLK-6.6 0/3] improve dump_page() robustness
by Jinjiang Tu 26 Jul '24

26 Jul '24

Baolin Wang (1): fs: improve dump_mapping() robustness Matthew Wilcox (Oracle) (2): mm: add __dump_folio() mm: improve dumping of mapcount and page_type fs/inode.c | 3 +- include/linux/mm.h | 7 +++ include/linux/mmzone.h | 3 + mm/debug.c | 129 +++++++++++++++++++++++------------------ 4 files changed, 84 insertions(+), 58 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] sched: Add cfs_preferred_nid_init hook
by Hui Tang 26 Jul '24

26 Jul '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9GZAQ CVE: NA -------------------------------- Add cfs_preferred_nid_init hook for scheduler, allow user to init same numa_preferred_nid for multi threads of the process. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- include/linux/sched_hook_defs.h | 1 + kernel/fork.c | 15 +++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/include/linux/sched_hook_defs.h b/include/linux/sched_hook_defs.h index 0a871f728c85..de6451930d8a 100644 --- a/include/linux/sched_hook_defs.h +++ b/include/linux/sched_hook_defs.h @@ -14,3 +14,4 @@ BPF_SCHED_HOOK(int, -1, cfs_can_migrate_task, struct task_struct *p, struct sched_migrate_node *migrate_node) BPF_SCHED_HOOK(void, (void) 0, cfs_change_preferred_node, struct sched_preferred_node_ctx *ctx) +BPF_SCHED_HOOK(int, -1, cfs_preferred_nid_init, struct task_struct *tsk) diff --git a/kernel/fork.c b/kernel/fork.c index 12db99751381..dcf1f9c655d8 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -97,6 +97,7 @@ #include <linux/scs.h> #include <linux/io_uring.h> #include <linux/sched/mm.h> +#include <linux/bpf_sched.h> #ifdef CONFIG_QOS_SCHED_SMART_GRID #include <linux/sched/grid_qos.h> #endif @@ -2320,6 +2321,20 @@ static __latent_entropy struct task_struct *copy_process( p->tgid = p->pid; } +#if defined (CONFIG_SCHED_TASK_RELATIONSHIP) && defined(CONFIG_BPF_SCHED) + if (bpf_sched_enabled() && task_relationship_supported(p)) { + retval = bpf_sched_cfs_preferred_nid_init(p); + if (clone_flags & CLONE_THREAD) { + if (retval > 0) + p->numa_preferred_nid = + p->group_leader->numa_preferred_nid; + } else { + if (retval > 0 && retval <= nr_node_ids) + p->numa_preferred_nid = retval - 1; + } + } +#endif + p->nr_dirtied = 0; p->nr_dirtied_pause = 128 >> (PAGE_SHIFT - 10); p->dirty_paused_when = 0; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 8b18281a2579c411c950d3efa2ceb8c5325c2be2
by kernel test robot 26 Jul '24

26 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 8b18281a2579c411c950d3efa2ceb8c5325c2be2 !10249 fbdev: savage: Handle err return when savagefb_check_var failed Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-003-20240725 | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:NGBE_LINK_SPEED_10GB_FULL-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:NGBE_MAX_SENSORS-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:NGBE_TPR-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:implicit-declaration-of-function-create_proc_read_entry | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:invalid-use-of-undefined-type-struct-proc_dir_entry | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:warning:control-reaches-end-of-non-void-function | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:warning:no-previous-prototype-for-ngbe_del_proc_entries | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:warning:unused-variable-i | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:warning:unused-variable-link_speed | `-- drivers-net-ethernet-netswift-ngbe-ngbe_type.h:error:struct-ngbe_hw-has-no-member-named-ops |-- arm64-randconfig-004-20240725 | `-- drivers-mmc-host-phytium-sdci.c:error:lvalue-required-as-unary-operand |-- x86_64-buildonly-randconfig-005-20240725 | `-- drivers-acpi-acpi_watchdog.o:warning:objtool:missing-symbol-for-section-.text.unlikely `-- x86_64-buildonly-randconfig-006-20240725 `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized elapsed time: 722m configs tested: 34 configs skipped: 127 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240725 gcc-14.1.0 arm64 randconfig-002-20240725 gcc-14.1.0 arm64 randconfig-003-20240725 gcc-14.1.0 arm64 randconfig-004-20240725 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240725 clang-18 x86_64 buildonly-randconfig-002-20240725 clang-18 x86_64 buildonly-randconfig-003-20240725 clang-18 x86_64 buildonly-randconfig-004-20240725 clang-18 x86_64 buildonly-randconfig-005-20240725 gcc-13 x86_64 buildonly-randconfig-006-20240725 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240725 clang-18 x86_64 randconfig-002-20240725 clang-18 x86_64 randconfig-003-20240725 clang-18 x86_64 randconfig-004-20240725 clang-18 x86_64 randconfig-005-20240725 gcc-13 x86_64 randconfig-006-20240725 gcc-13 x86_64 randconfig-011-20240725 gcc-10 x86_64 randconfig-012-20240725 clang-18 x86_64 randconfig-013-20240725 gcc-13 x86_64 randconfig-014-20240725 gcc-13 x86_64 randconfig-015-20240725 clang-18 x86_64 randconfig-016-20240725 gcc-8 x86_64 randconfig-071-20240725 gcc-13 x86_64 randconfig-072-20240725 clang-18 x86_64 randconfig-073-20240725 gcc-8 x86_64 randconfig-074-20240725 clang-18 x86_64 randconfig-075-20240725 clang-18 x86_64 randconfig-076-20240725 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 2bb42acb87d456ca392f00f0b8a53f24fa6f0c6e
by kernel test robot 25 Jul '24

25 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2bb42acb87d456ca392f00f0b8a53f24fa6f0c6e !10253 fbdev: savage: Handle err return when savagefb_check_var failed elapsed time: 729m configs tested: 34 configs skipped: 127 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240725 clang-20 arm64 randconfig-002-20240725 clang-20 arm64 randconfig-003-20240725 gcc-14.1.0 arm64 randconfig-004-20240725 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240725 clang-18 x86_64 buildonly-randconfig-002-20240725 clang-18 x86_64 buildonly-randconfig-003-20240725 clang-18 x86_64 buildonly-randconfig-004-20240725 clang-18 x86_64 buildonly-randconfig-005-20240725 gcc-13 x86_64 buildonly-randconfig-006-20240725 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240725 clang-18 x86_64 randconfig-002-20240725 clang-18 x86_64 randconfig-003-20240725 clang-18 x86_64 randconfig-004-20240725 clang-18 x86_64 randconfig-005-20240725 gcc-13 x86_64 randconfig-006-20240725 gcc-13 x86_64 randconfig-011-20240725 gcc-10 x86_64 randconfig-012-20240725 clang-18 x86_64 randconfig-013-20240725 gcc-13 x86_64 randconfig-014-20240725 gcc-13 x86_64 randconfig-015-20240725 clang-18 x86_64 randconfig-016-20240725 gcc-8 x86_64 randconfig-071-20240725 gcc-13 x86_64 randconfig-072-20240725 clang-18 x86_64 randconfig-073-20240725 gcc-8 x86_64 randconfig-074-20240725 clang-18 x86_64 randconfig-075-20240725 clang-18 x86_64 randconfig-076-20240725 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 2857df6af1b0781edf606627cde70dc74ac1ab31
by kernel test robot 25 Jul '24

25 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 2857df6af1b0781edf606627cde70dc74ac1ab31 !10254 fbdev: savage: Handle err return when savagefb_check_var failed Warning ids grouped by kconfigs: recent_errors |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument `-- loongarch-randconfig-002-20240725 `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and elapsed time: 724m configs tested: 20 configs skipped: 124 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240725 clang-20 arm64 randconfig-002-20240725 clang-20 arm64 randconfig-003-20240725 gcc-14.1.0 arm64 randconfig-004-20240725 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240725 gcc-14.1.0 loongarch randconfig-002-20240725 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240725 clang-18 x86_64 buildonly-randconfig-002-20240725 clang-18 x86_64 buildonly-randconfig-003-20240725 clang-18 x86_64 buildonly-randconfig-004-20240725 clang-18 x86_64 buildonly-randconfig-005-20240725 gcc-13 x86_64 buildonly-randconfig-006-20240725 gcc-13 x86_64 defconfig gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] jfs: xattr: fix buffer overflow for invalid xattr
by Xia Fukun 25 Jul '24

25 Jul '24

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v6.10-rc1 commit 7c55b78818cfb732680c4a72ab270cc2d2ee3d0f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0FK CVE: CVE-2024-40902 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size, printing it out can cause an access off the end of the buffer. Fix this all up by properly restricting the size of the debug hex dump in the kernel log. Reported-by: syzbot+9dfe490c8176301c1d06(a)syzkaller.appspotmail.com Cc: Dave Kleikamp <shaggy(a)kernel.org> Link: https://lore.kernel.org/r/2024051433-slider-cloning-98f9@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/jfs/xattr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index a6797986b625..e8b12e708428 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -570,9 +570,11 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size) size_check: if (EALIST_SIZE(ea_buf->xattr) != ea_size) { + int size = min_t(int, EALIST_SIZE(ea_buf->xattr), ea_size); + printk(KERN_ERR "ea_get: invalid extended attribute\n"); print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1, - ea_buf->xattr, ea_size, 1); + ea_buf->xattr, size, 1); ea_release(inode, ea_buf); rc = -EIO; goto clean_up; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 0a1bad10c9f0f69fbd09f08348ff59f98231875a
by kernel test robot 25 Jul '24

25 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 0a1bad10c9f0f69fbd09f08348ff59f98231875a !10310 batman-adv: bypass empty buckets in batadv_purge_orig_ref() Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202407250304.iuUXdu7B-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:165:55: error: 'NGBE_TPR' undeclared (first use in this function); did you mean 'NGBE_ERR'? drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:166:1: warning: control reaches end of non-void function [-Wreturn-type] drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:364:13: warning: unused variable 'link_speed' [-Wunused-variable] drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:770:6: warning: no previous prototype for 'ngbe_del_proc_entries' [-Wmissing-prototypes] drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:779:25: error: 'NGBE_MAX_SENSORS' undeclared (first use in this function); did you mean 'NGBE_MAX_EITR'? drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:780:39: error: invalid use of undefined type 'struct proc_dir_entry' drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:82:14: error: 'NGBE_LINK_SPEED_10GB_FULL' undeclared (first use in this function); did you mean 'NGBE_LINK_SPEED_1GB_FULL'? drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:833:13: warning: unused variable 'i' [-Wunused-variable] drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:859:23: error: implicit declaration of function 'create_proc_read_entry' [-Werror=implicit-function-declaration] drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:40: error: 'struct ngbe_hw' has no member named 'ops' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-003-20240725 | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:NGBE_LINK_SPEED_10GB_FULL-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:NGBE_MAX_SENSORS-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:NGBE_TPR-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:implicit-declaration-of-function-create_proc_read_entry | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:error:invalid-use-of-undefined-type-struct-proc_dir_entry | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:warning:control-reaches-end-of-non-void-function | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:warning:no-previous-prototype-for-ngbe_del_proc_entries | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:warning:unused-variable-i | |-- drivers-net-ethernet-netswift-ngbe-ngbe_procfs.c:warning:unused-variable-link_speed | `-- drivers-net-ethernet-netswift-ngbe-ngbe_type.h:error:struct-ngbe_hw-has-no-member-named-ops |-- arm64-randconfig-004-20240725 | `-- drivers-mmc-host-phytium-sdci.c:error:lvalue-required-as-unary-operand `-- x86_64-buildonly-randconfig-006-20240725 `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized elapsed time: 729m configs tested: 28 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240725 gcc-14.1.0 arm64 randconfig-002-20240725 gcc-14.1.0 arm64 randconfig-003-20240725 gcc-14.1.0 arm64 randconfig-004-20240725 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240725 clang-18 x86_64 buildonly-randconfig-002-20240725 clang-18 x86_64 buildonly-randconfig-003-20240725 clang-18 x86_64 buildonly-randconfig-004-20240725 clang-18 x86_64 buildonly-randconfig-005-20240725 gcc-13 x86_64 buildonly-randconfig-006-20240725 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240725 clang-18 x86_64 randconfig-002-20240725 clang-18 x86_64 randconfig-003-20240725 clang-18 x86_64 randconfig-004-20240725 clang-18 x86_64 randconfig-005-20240725 gcc-13 x86_64 randconfig-006-20240725 gcc-13 x86_64 randconfig-011-20240725 gcc-10 x86_64 randconfig-012-20240725 clang-18 x86_64 randconfig-013-20240725 gcc-13 x86_64 randconfig-014-20240725 gcc-13 x86_64 randconfig-015-20240725 clang-18 x86_64 randconfig-016-20240725 gcc-8 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS c516c8ef905082317494ad56998c05d743334dd3
by kernel test robot 25 Jul '24

25 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c516c8ef905082317494ad56998c05d743334dd3 !10309 net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr elapsed time: 735m configs tested: 34 configs skipped: 126 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240724 gcc-14.1.0 arm64 randconfig-002-20240724 gcc-14.1.0 arm64 randconfig-003-20240724 gcc-14.1.0 arm64 randconfig-004-20240724 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240725 clang-18 x86_64 buildonly-randconfig-002-20240725 clang-18 x86_64 buildonly-randconfig-003-20240725 clang-18 x86_64 buildonly-randconfig-004-20240725 clang-18 x86_64 buildonly-randconfig-005-20240725 gcc-13 x86_64 buildonly-randconfig-006-20240725 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240725 clang-18 x86_64 randconfig-002-20240725 clang-18 x86_64 randconfig-003-20240725 clang-18 x86_64 randconfig-004-20240725 clang-18 x86_64 randconfig-005-20240725 gcc-13 x86_64 randconfig-006-20240725 gcc-13 x86_64 randconfig-011-20240725 gcc-10 x86_64 randconfig-012-20240725 clang-18 x86_64 randconfig-013-20240725 gcc-13 x86_64 randconfig-014-20240725 gcc-13 x86_64 randconfig-015-20240725 clang-18 x86_64 randconfig-016-20240725 gcc-8 x86_64 randconfig-071-20240725 gcc-13 x86_64 randconfig-072-20240725 clang-18 x86_64 randconfig-073-20240725 gcc-8 x86_64 randconfig-074-20240725 clang-18 x86_64 randconfig-075-20240725 clang-18 x86_64 randconfig-076-20240725 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 45c11497989a10c6aaba1cd66b27ec26110ade51
by kernel test robot 25 Jul '24

25 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 45c11497989a10c6aaba1cd66b27ec26110ade51 !10078 bpf: Set run context for rawtp test_run callback Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-randconfig-001-20240724 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-003-20240724 | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-004-20240724 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 722m configs tested: 38 configs skipped: 132 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240724 gcc-14.1.0 arm64 randconfig-002-20240724 gcc-14.1.0 arm64 randconfig-003-20240724 gcc-14.1.0 arm64 randconfig-004-20240724 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240724 gcc-14.1.0 loongarch randconfig-002-20240724 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240724 clang-18 x86_64 buildonly-randconfig-002-20240724 clang-18 x86_64 buildonly-randconfig-003-20240724 gcc-13 x86_64 buildonly-randconfig-004-20240724 clang-18 x86_64 buildonly-randconfig-005-20240724 clang-18 x86_64 buildonly-randconfig-006-20240724 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240724 clang-18 x86_64 randconfig-002-20240724 clang-18 x86_64 randconfig-003-20240724 clang-18 x86_64 randconfig-004-20240724 gcc-10 x86_64 randconfig-005-20240724 clang-18 x86_64 randconfig-006-20240724 gcc-13 x86_64 randconfig-011-20240724 clang-18 x86_64 randconfig-012-20240724 gcc-13 x86_64 randconfig-013-20240724 clang-18 x86_64 randconfig-014-20240724 clang-18 x86_64 randconfig-015-20240724 clang-18 x86_64 randconfig-016-20240724 clang-18 x86_64 randconfig-071-20240724 gcc-13 x86_64 randconfig-072-20240724 gcc-11 x86_64 randconfig-073-20240724 clang-18 x86_64 randconfig-074-20240724 gcc-13 x86_64 randconfig-075-20240724 gcc-13 x86_64 randconfig-076-20240724 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18554/23360] drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:82:14: error: 'NGBE_LINK_SPEED_10GB_FULL' undeclared; did you mean 'NGBE_LINK_SPEED_1GB_FULL'?
by kernel test robot 25 Jul '24

25 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0a1bad10c9f0f69fbd09f08348ff59f98231875a commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [18554/23360] net: ngbe: Add Netswift Giga NIC driver config: arm64-randconfig-003-20240725 (https://download.01.org/0day-ci/archive/20240725/202407250304.iuUXdu7B-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240725/202407250304.iuUXdu7B-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407250304.iuUXdu7B-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from include/linux/sctp.h:57, from drivers/net/ethernet/netswift/ngbe/ngbe.h:28, from drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:19: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe.h: In function 'ngbe_misc_isb': drivers/net/ethernet/netswift/ngbe/ngbe.h:764:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c: In function 'ngbe_portspeed': >> drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:82:14: error: 'NGBE_LINK_SPEED_10GB_FULL' undeclared (first use in this function); did you mean 'NGBE_LINK_SPEED_1GB_FULL'? 82 | case NGBE_LINK_SPEED_10GB_FULL: | ^~~~~~~~~~~~~~~~~~~~~~~~~ | NGBE_LINK_SPEED_1GB_FULL drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:82:14: note: each undeclared identifier is reported only once for each function it appears in drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c: In function 'ngbe_rxupacks': >> drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:165:55: error: 'NGBE_TPR' undeclared (first use in this function); did you mean 'NGBE_ERR'? 165 | return snprintf(page, count, "%d\n", rd32(hw, NGBE_TPR)); | ^~~~~~~~ | NGBE_ERR drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c: In function 'ngbe_linkstat': >> drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:364:13: warning: unused variable 'link_speed' [-Wunused-variable] 364 | u32 link_speed; | ^~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c: At top level: >> drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:770:6: warning: no previous prototype for 'ngbe_del_proc_entries' [-Wmissing-prototypes] 770 | void ngbe_del_proc_entries(struct ngbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c: In function 'ngbe_del_proc_entries': >> drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:779:25: error: 'NGBE_MAX_SENSORS' undeclared (first use in this function); did you mean 'NGBE_MAX_EITR'? 779 | for (i = 0; i < NGBE_MAX_SENSORS; i++) { | ^~~~~~~~~~~~~~~~ | NGBE_MAX_EITR >> drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:780:39: error: invalid use of undefined type 'struct proc_dir_entry' 780 | if (adapter->therm_dir[i] == NULL) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:780:21: error: invalid use of undefined type 'struct proc_dir_entry' 780 | if (adapter->therm_dir[i] == NULL) | ^~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c: In function 'ngbe_procfs_init': >> drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:859:23: error: implicit declaration of function 'create_proc_read_entry' [-Werror=implicit-function-declaration] 859 | if (!(create_proc_read_entry(ngbe_proc_entries[index].name, | ^~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/netswift/ngbe/ngbe.h:39: >> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:40: error: 'struct ngbe_hw' has no member named 'ops' 2761 | #define TCALL(hw, func, args...) (((hw)->func != NULL) \ | ^~ drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:869:14: note: in expansion of macro 'TCALL' 869 | if (!TCALL(&(adapter->hw), ops.init_thermal_sensor_thresh)) | ^~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2762:23: error: 'struct ngbe_hw' has no member named 'ops' 2762 | ? (hw)->func((hw), ##args) : NGBE_NOT_IMPLEMENTED) | ^~ drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:869:14: note: in expansion of macro 'TCALL' 869 | if (!TCALL(&(adapter->hw), ops.init_thermal_sensor_thresh)) | ^~~~~ >> drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:833:13: warning: unused variable 'i' [-Wunused-variable] 833 | int i; | ^ drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c: In function 'ngbe_rxupacks': >> drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c:166:1: warning: control reaches end of non-void function [-Wreturn-type] 166 | } | ^ cc1: some warnings being treated as errors vim +82 drivers/net/ethernet/netswift/ngbe/ngbe_procfs.c 64 65 static int ngbe_portspeed(char *page, char __always_unused **start, 66 off_t __always_unused off, int count, 67 int __always_unused *eof, void *data) 68 { 69 struct ngbe_adapter *adapter = (struct ngbe_adapter *)data; 70 int speed = 0; 71 72 if (adapter == NULL) 73 return snprintf(page, count, "error: no adapter\n"); 74 75 switch (adapter->link_speed) { 76 case NGBE_LINK_SPEED_100_FULL: 77 speed = 1; 78 break; 79 case NGBE_LINK_SPEED_1GB_FULL: 80 speed = 10; 81 break; > 82 case NGBE_LINK_SPEED_10GB_FULL: 83 speed = 100; 84 break; 85 default: 86 break; 87 } 88 return snprintf(page, count, "%d\n", speed); 89 } 90 91 static int ngbe_wqlflag(char *page, char __always_unused **start, 92 off_t __always_unused off, int count, 93 int __always_unused *eof, void *data) 94 { 95 struct ngbe_adapter *adapter = (struct ngbe_adapter *)data; 96 if (adapter == NULL) 97 return snprintf(page, count, "error: no adapter\n"); 98 99 return snprintf(page, count, "%d\n", adapter->wol); 100 } 101 102 static int ngbe_xflowctl(char *page, char __always_unused **start, 103 off_t __always_unused off, int count, 104 int __always_unused *eof, void *data) 105 { 106 struct ngbe_adapter *adapter = (struct ngbe_adapter *)data; 107 struct ngbe_hw *hw; 108 109 if (adapter == NULL) 110 return snprintf(page, count, "error: no adapter\n"); 111 112 hw = &adapter->hw; 113 if (hw == NULL) 114 return snprintf(page, count, "error: no hw data\n"); 115 116 return snprintf(page, count, "%d\n", hw->fc.current_mode); 117 } 118 119 static int ngbe_rxdrops(char *page, char __always_unused **start, 120 off_t __always_unused off, int count, 121 int __always_unused *eof, void *data) 122 { 123 struct ngbe_adapter *adapter = (struct ngbe_adapter *)data; 124 struct net_device_stats *net_stats; 125 126 if (adapter == NULL) 127 return snprintf(page, count, "error: no adapter\n"); 128 net_stats = procfs_get_stats(adapter->netdev); 129 if (net_stats == NULL) 130 return snprintf(page, count, "error: no net stats\n"); 131 132 return snprintf(page, count, "%lu\n", 133 net_stats->rx_dropped); 134 } 135 136 static int ngbe_rxerrors(char *page, char __always_unused **start, 137 off_t __always_unused off, int count, 138 int __always_unused *eof, void *data) 139 { 140 struct ngbe_adapter *adapter = (struct ngbe_adapter *)data; 141 struct net_device_stats *net_stats; 142 143 if (adapter == NULL) 144 return snprintf(page, count, "error: no adapter\n"); 145 net_stats = procfs_get_stats(adapter->netdev); 146 if (net_stats == NULL) 147 return snprintf(page, count, "error: no net stats\n"); 148 149 return snprintf(page, count, "%lu\n", net_stats->rx_errors); 150 } 151 152 static int ngbe_rxupacks(char *page, char __always_unused **start, 153 off_t __always_unused off, int count, 154 int __always_unused *eof, void *data) 155 { 156 struct ngbe_hw *hw; 157 struct ngbe_adapter *adapter = (struct ngbe_adapter *)data; 158 if (adapter == NULL) 159 return snprintf(page, count, "error: no adapter\n"); 160 161 hw = &adapter->hw; 162 if (hw == NULL) 163 return snprintf(page, count, "error: no hw data\n"); 164 > 165 return snprintf(page, count, "%d\n", rd32(hw, NGBE_TPR)); > 166 } 167 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf: Fix too early release of tcx_entry
by Liu Jian 24 Jul '24

24 Jul '24

From: Daniel Borkmann <daniel(a)iogearbox.net> stable inclusion from stable-v6.6.41 commit 230bb13650b0f186f540500fd5f5f7096a822a2a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADR5O CVE: CVE-2024-41010 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 1cb6f0bae50441f4b4b32a28315853b279c7404e ] Pedro Pinto and later independently also Hyunwoo Kim and Wongi Lee reported an issue that the tcx_entry can be released too early leading to a use after free (UAF) when an active old-style ingress or clsact qdisc with a shared tc block is later replaced by another ingress or clsact instance. Essentially, the sequence to trigger the UAF (one example) can be as follows: 1. A network namespace is created 2. An ingress qdisc is created. This allocates a tcx_entry, and &tcx_entry->miniq is stored in the qdisc's miniqp->p_miniq. At the same time, a tcf block with index 1 is created. 3. chain0 is attached to the tcf block. chain0 must be connected to the block linked to the ingress qdisc to later reach the function tcf_chain0_head_change_cb_del() which triggers the UAF. 4. Create and graft a clsact qdisc. This causes the ingress qdisc created in step 1 to be removed, thus freeing the previously linked tcx_entry: rtnetlink_rcv_msg() => tc_modify_qdisc() => qdisc_create() => clsact_init() [a] => qdisc_graft() => qdisc_destroy() => __qdisc_destroy() => ingress_destroy() [b] => tcx_entry_free() => kfree_rcu() // tcx_entry freed 5. Finally, the network namespace is closed. This registers the cleanup_net worker, and during the process of releasing the remaining clsact qdisc, it accesses the tcx_entry that was already freed in step 4, causing the UAF to occur: cleanup_net() => ops_exit_list() => default_device_exit_batch() => unregister_netdevice_many() => unregister_netdevice_many_notify() => dev_shutdown() => qdisc_put() => clsact_destroy() [c] => tcf_block_put_ext() => tcf_chain0_head_change_cb_del() => tcf_chain_head_change_item() => clsact_chain_head_change() => mini_qdisc_pair_swap() // UAF There are also other variants, the gist is to add an ingress (or clsact) qdisc with a specific shared block, then to replace that qdisc, waiting for the tcx_entry kfree_rcu() to be executed and subsequently accessing the current active qdisc's miniq one way or another. The correct fix is to turn the miniq_active boolean into a counter. What can be observed, at step 2 above, the counter transitions from 0->1, at step [a] from 1->2 (in order for the miniq object to remain active during the replacement), then in [b] from 2->1 and finally [c] 1->0 with the eventual release. The reference counter in general ranges from [0,2] and it does not need to be atomic since all access to the counter is protected by the rtnl mutex. With this in place, there is no longer a UAF happening and the tcx_entry is freed at the correct time. Fixes: e420bed02507 ("bpf: Add fd-based tcx multi-prog infra with link support") Reported-by: Pedro Pinto <xten(a)osec.io> Co-developed-by: Pedro Pinto <xten(a)osec.io> Signed-off-by: Pedro Pinto <xten(a)osec.io> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Hyunwoo Kim <v4bel(a)theori.io> Cc: Wongi Lee <qwerty(a)theori.io> Cc: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://lore.kernel.org/r/20240708133130.11609-1-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/tcx.h | 13 +++++++++---- net/sched/sch_ingress.c | 12 ++++++------ 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/include/net/tcx.h b/include/net/tcx.h index 264f147953ba..a0f78fd5cb28 100644 --- a/include/net/tcx.h +++ b/include/net/tcx.h @@ -13,7 +13,7 @@ struct mini_Qdisc; struct tcx_entry { struct mini_Qdisc __rcu *miniq; struct bpf_mprog_bundle bundle; - bool miniq_active; + u32 miniq_active; struct rcu_head rcu; }; @@ -129,11 +129,16 @@ static inline void tcx_skeys_dec(bool ingress) tcx_dec(); } -static inline void tcx_miniq_set_active(struct bpf_mprog_entry *entry, - const bool active) +static inline void tcx_miniq_inc(struct bpf_mprog_entry *entry) { ASSERT_RTNL(); - tcx_entry(entry)->miniq_active = active; + tcx_entry(entry)->miniq_active++; +} + +static inline void tcx_miniq_dec(struct bpf_mprog_entry *entry) +{ + ASSERT_RTNL(); + tcx_entry(entry)->miniq_active--; } static inline bool tcx_entry_is_active(struct bpf_mprog_entry *entry) diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c index a463a63192c3..8dde3548dc11 100644 --- a/net/sched/sch_ingress.c +++ b/net/sched/sch_ingress.c @@ -91,7 +91,7 @@ static int ingress_init(struct Qdisc *sch, struct nlattr *opt, entry = tcx_entry_fetch_or_create(dev, true, &created); if (!entry) return -ENOMEM; - tcx_miniq_set_active(entry, true); + tcx_miniq_inc(entry); mini_qdisc_pair_init(&q->miniqp, sch, &tcx_entry(entry)->miniq); if (created) tcx_entry_update(dev, entry, true); @@ -121,7 +121,7 @@ static void ingress_destroy(struct Qdisc *sch) tcf_block_put_ext(q->block, sch, &q->block_info); if (entry) { - tcx_miniq_set_active(entry, false); + tcx_miniq_dec(entry); if (!tcx_entry_is_active(entry)) { tcx_entry_update(dev, NULL, true); tcx_entry_free(entry); @@ -256,7 +256,7 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt, entry = tcx_entry_fetch_or_create(dev, true, &created); if (!entry) return -ENOMEM; - tcx_miniq_set_active(entry, true); + tcx_miniq_inc(entry); mini_qdisc_pair_init(&q->miniqp_ingress, sch, &tcx_entry(entry)->miniq); if (created) tcx_entry_update(dev, entry, true); @@ -275,7 +275,7 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt, entry = tcx_entry_fetch_or_create(dev, false, &created); if (!entry) return -ENOMEM; - tcx_miniq_set_active(entry, true); + tcx_miniq_inc(entry); mini_qdisc_pair_init(&q->miniqp_egress, sch, &tcx_entry(entry)->miniq); if (created) tcx_entry_update(dev, entry, false); @@ -301,7 +301,7 @@ static void clsact_destroy(struct Qdisc *sch) tcf_block_put_ext(q->egress_block, sch, &q->egress_block_info); if (ingress_entry) { - tcx_miniq_set_active(ingress_entry, false); + tcx_miniq_dec(ingress_entry); if (!tcx_entry_is_active(ingress_entry)) { tcx_entry_update(dev, NULL, true); tcx_entry_free(ingress_entry); @@ -309,7 +309,7 @@ static void clsact_destroy(struct Qdisc *sch) } if (egress_entry) { - tcx_miniq_set_active(egress_entry, false); + tcx_miniq_dec(egress_entry); if (!tcx_entry_is_active(egress_entry)) { tcx_entry_update(dev, NULL, false); tcx_entry_free(egress_entry); -- 2.34.1

2 1

[PATCH OLK-6.6] wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
by Yue Haibing 24 Jul '24

24 Jul '24

From: Nicolas Escande <nico.escande(a)gmail.com> stable inclusion from stable-v6.6.35 commit 63d5f89bb5664d60edbf8cf0df911aaae8ed96a4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAD6H2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b7d7f11a291830fdf69d3301075dd0fb347ced84 ] The hwmp code use objects of type mesh_preq_queue, added to a list in ieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath gets deleted, ex mesh interface is removed, the entries in that list will never get cleaned. Fix this by flushing all corresponding items of the preq_queue in mesh_path_flush_pending(). This should take care of KASAN reports like this: unreferenced object 0xffff00000668d800 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419552 (age 1836.444s) hex dump (first 32 bytes): 00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff ..........h..... 8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00 ....>........... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 unreferenced object 0xffff000009051f00 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419553 (age 1836.440s) hex dump (first 32 bytes): 90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff ..........h..... 36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff 6'.......Xy..... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol") Signed-off-by: Nicolas Escande <nico.escande(a)gmail.com> Link: https://msgid.link/20240528142605.1060566-1-nico.escande@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/mac80211/mesh_pathtbl.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c index 59f7264194ce..530581ba812b 100644 --- a/net/mac80211/mesh_pathtbl.c +++ b/net/mac80211/mesh_pathtbl.c @@ -1011,10 +1011,23 @@ void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata, */ void mesh_path_flush_pending(struct mesh_path *mpath) { + struct ieee80211_sub_if_data *sdata = mpath->sdata; + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; + struct mesh_preq_queue *preq, *tmp; struct sk_buff *skb; while ((skb = skb_dequeue(&mpath->frame_queue)) != NULL) mesh_path_discard_frame(mpath->sdata, skb); + + spin_lock_bh(&ifmsh->mesh_preq_queue_lock); + list_for_each_entry_safe(preq, tmp, &ifmsh->preq_queue.list, list) { + if (ether_addr_equal(mpath->dst, preq->dst)) { + list_del(&preq->list); + kfree(preq); + --ifmsh->preq_queue_len; + } + } + spin_unlock_bh(&ifmsh->mesh_preq_queue_lock); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] batman-adv: bypass empty buckets in batadv_purge_orig_ref()
by Liu Jian 24 Jul '24

24 Jul '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.317 commit 79636f636126775436a11ee9cf00a9253a33ac11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACS84 CVE: CVE-2024-40981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 40dc8ab605894acae1473e434944924a22cfaaa0 ] Many syzbot reports are pointing to soft lockups in batadv_purge_orig_ref() [1] Root cause is unknown, but we can avoid spending too much time there and perhaps get more interesting reports. [1] watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] Modules linked in: irq event stamp: 6182794 hardirqs last enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: bat_events batadv_purge_orig pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 sp : ffff800099007970 x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000 x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001 x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4 x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0 x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001 x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103 sp : ffff800093a17d30 x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4 x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002 x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000 x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396 x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001 x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003 x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0 x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49 cpuidle_idle_call kernel/sched/idle.c:170 [inline] do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410 secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272 __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404 Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/batman-adv/originator.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c index 1d295da3e342..c1ad1ae21eea 100644 --- a/net/batman-adv/originator.c +++ b/net/batman-adv/originator.c @@ -1358,6 +1358,8 @@ void batadv_purge_orig_ref(struct batadv_priv *bat_priv) /* for all origins... */ for (i = 0; i < hash->size; i++) { head = &hash->table[i]; + if (hlist_empty(head)) + continue; list_lock = &hash->list_locks[i]; spin_lock_bh(list_lock); -- 2.34.1

2 1

[PATCH OLK-5.10] net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
by Liu Jian 24 Jul '24

24 Jul '24

From: Miaoqian Lin <linmq006(a)gmail.com> mainline inclusion from mainline-v5.17-rc8 commit c9ffa3e2bc451816ce0295e40063514fabf2bd36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGT8 CVE: CVE-2022-48859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the refcount leak. Fixes: 501ef3066c89 ("net: marvell: prestera: Add driver for Prestera family ASIC devices") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/marvell/prestera/prestera_main.c [Did not backport 83216e3988cd1.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/marvell/prestera/prestera_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/marvell/prestera/prestera_main.c b/drivers/net/ethernet/marvell/prestera/prestera_main.c index f406f5b517b0..e1e251f84c7d 100644 --- a/drivers/net/ethernet/marvell/prestera/prestera_main.c +++ b/drivers/net/ethernet/marvell/prestera/prestera_main.c @@ -480,6 +480,7 @@ static int prestera_switch_set_base_mac_addr(struct prestera_switch *sw) eth_random_addr(sw->base_mac); dev_info(prestera_dev(sw), "using random base mac address\n"); } + of_node_put(np); return prestera_hw_switch_mac_set(sw, sw->base_mac); } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
by Liu Jian 24 Jul '24

24 Jul '24

From: Miaoqian Lin <linmq006(a)gmail.com> mainline inclusion from mainline-v5.17-rc8 commit c9ffa3e2bc451816ce0295e40063514fabf2bd36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGT8 CVE: CVE-2022-48859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the refcount leak. Fixes: 501ef3066c89 ("net: marvell: prestera: Add driver for Prestera family ASIC devices") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/marvell/prestera/prestera_main.c [Did not backport 83216e3988cd1.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/marvell/prestera/prestera_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/marvell/prestera/prestera_main.c b/drivers/net/ethernet/marvell/prestera/prestera_main.c index f406f5b517b0..e1e251f84c7d 100644 --- a/drivers/net/ethernet/marvell/prestera/prestera_main.c +++ b/drivers/net/ethernet/marvell/prestera/prestera_main.c @@ -480,6 +480,7 @@ static int prestera_switch_set_base_mac_addr(struct prestera_switch *sw) eth_random_addr(sw->base_mac); dev_info(prestera_dev(sw), "using random base mac address\n"); } + of_node_put(np); return prestera_hw_switch_mac_set(sw, sw->base_mac); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
by Yue Haibing 24 Jul '24

24 Jul '24

From: Nicolas Escande <nico.escande(a)gmail.com> stable inclusion from stable-v4.19.317 commit 377dbb220edc8421b7960691876c5b3bef62f89b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0PK CVE: CVE-2024-40942 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit b7d7f11a291830fdf69d3301075dd0fb347ced84 ] The hwmp code use objects of type mesh_preq_queue, added to a list in ieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath gets deleted, ex mesh interface is removed, the entries in that list will never get cleaned. Fix this by flushing all corresponding items of the preq_queue in mesh_path_flush_pending(). This should take care of KASAN reports like this: unreferenced object 0xffff00000668d800 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419552 (age 1836.444s) hex dump (first 32 bytes): 00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff ..........h..... 8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00 ....>........... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 unreferenced object 0xffff000009051f00 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419553 (age 1836.440s) hex dump (first 32 bytes): 90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff ..........h..... 36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff 6'.......Xy..... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol") Signed-off-by: Nicolas Escande <nico.escande(a)gmail.com> Link: https://msgid.link/20240528142605.1060566-1-nico.escande@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/mac80211/mesh_pathtbl.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c index ac1f5db52994..1d5626daddfa 100644 --- a/net/mac80211/mesh_pathtbl.c +++ b/net/mac80211/mesh_pathtbl.c @@ -739,10 +739,23 @@ void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata, */ void mesh_path_flush_pending(struct mesh_path *mpath) { + struct ieee80211_sub_if_data *sdata = mpath->sdata; + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; + struct mesh_preq_queue *preq, *tmp; struct sk_buff *skb; while ((skb = skb_dequeue(&mpath->frame_queue)) != NULL) mesh_path_discard_frame(mpath->sdata, skb); + + spin_lock_bh(&ifmsh->mesh_preq_queue_lock); + list_for_each_entry_safe(preq, tmp, &ifmsh->preq_queue.list, list) { + if (ether_addr_equal(mpath->dst, preq->dst)) { + list_del(&preq->list); + kfree(preq); + --ifmsh->preq_queue_len; + } + } + spin_unlock_bh(&ifmsh->mesh_preq_queue_lock); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mISDN: Fix memory leak in dsp_pipeline_build()
by Pu Lehui 24 Jul '24

24 Jul '24

From: Alexey Khoroshilov <khoroshilov(a)ispras.ru> mainline inclusion from mainline-v5.17-rc8 commit c6a502c2299941c8326d029cfc8a3bc8a4607ad5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGSF CVE: CVE-2022-48863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup variable contains NULL. Found by Linux Driver Verification project (linuxtesting.org) with SVACE. Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Fixes: 960366cf8dbb ("Add mISDN DSP") Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/isdn/mISDN/dsp_pipeline.c [The conflicts were due to not merge some unnecessary commit] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/isdn/mISDN/dsp_pipeline.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/isdn/mISDN/dsp_pipeline.c b/drivers/isdn/mISDN/dsp_pipeline.c index e72b4e73cd61..fb8153f1aff7 100644 --- a/drivers/isdn/mISDN/dsp_pipeline.c +++ b/drivers/isdn/mISDN/dsp_pipeline.c @@ -236,7 +236,7 @@ void dsp_pipeline_destroy(struct dsp_pipeline *pipeline) int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) { int incomplete = 0, found = 0; - char *dup, *tok, *name, *args; + char *dup, *next, *tok, *name, *args; struct dsp_element_entry *entry, *n; struct dsp_pipeline_entry *pipeline_entry; struct mISDN_dsp_element *elem; @@ -247,10 +247,10 @@ int dsp_pipeline_build(struct dsp_pipeline *pipeline, const char *cfg) if (!list_empty(&pipeline->list)) _dsp_pipeline_destroy(pipeline); - dup = kstrdup(cfg, GFP_ATOMIC); + dup = next = kstrdup(cfg, GFP_ATOMIC); if (!dup) return 0; - while ((tok = strsep(&dup, "|"))) { + while ((tok = strsep(&next, "|"))) { if (!strlen(tok)) continue; name = strsep(&tok, "("); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS WITH WARNING 9bfba2528a2aa14944ebc307632e8d93b929947d
by kernel test robot 24 Jul '24

24 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 9bfba2528a2aa14944ebc307632e8d93b929947d !10125 nvme-rdma: fix possible use-after-free in transport error_recovery work Warning: (recently discovered and may have been fixed) kernel/livepatch/core.c:75:16: warning: no previous prototype for function 'klp_check_patch_kprobed' [-Wmissing-prototypes] Unverified Warning (likely false positive, please contact us if interested): drivers/block/loop.c:1338 loop_set_status() warn: inconsistent returns '&loop_ctl_mutex'. Warning ids grouped by kconfigs: recent_errors |-- x86_64-buildonly-randconfig-001-20240724 | |-- drivers-scsi-huawei-hifc-unf_io_abnormal.o:warning:objtool:missing-symbol-for-section-.text | `-- drivers-scsi-huawei-hifc-unf_npiv.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-randconfig-073-20240521 | `-- kernel-livepatch-core.c:warning:no-previous-prototype-for-function-klp_check_patch_kprobed `-- x86_64-randconfig-161-20240430 `-- drivers-block-loop.c-loop_set_status()-warn:inconsistent-returns-loop_ctl_mutex-. elapsed time: 731m configs tested: 19 configs skipped: 139 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240724 gcc-14.1.0 arm64 randconfig-002-20240724 gcc-14.1.0 arm64 randconfig-003-20240724 gcc-14.1.0 arm64 randconfig-004-20240724 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240724 clang-18 x86_64 buildonly-randconfig-002-20240724 clang-18 x86_64 buildonly-randconfig-003-20240724 gcc-13 x86_64 buildonly-randconfig-004-20240724 clang-18 x86_64 buildonly-randconfig-005-20240724 clang-18 x86_64 buildonly-randconfig-006-20240724 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240724 clang-18 x86_64 randconfig-002-20240724 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS ba9f4e2064691aaa5bdbc0e8514f1aa7cb4d0ffc
by kernel test robot 24 Jul '24

24 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: ba9f4e2064691aaa5bdbc0e8514f1aa7cb4d0ffc !9780 ksmbd: fix wrong DataOffset validation of create context elapsed time: 725m configs tested: 35 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240724 gcc-14.1.0 arm64 randconfig-002-20240724 gcc-14.1.0 arm64 randconfig-003-20240724 gcc-14.1.0 arm64 randconfig-004-20240724 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240724 clang-18 x86_64 buildonly-randconfig-002-20240724 clang-18 x86_64 buildonly-randconfig-003-20240724 gcc-13 x86_64 buildonly-randconfig-004-20240724 clang-18 x86_64 buildonly-randconfig-005-20240724 clang-18 x86_64 buildonly-randconfig-006-20240724 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240724 clang-18 x86_64 randconfig-002-20240724 clang-18 x86_64 randconfig-003-20240724 clang-18 x86_64 randconfig-004-20240724 gcc-10 x86_64 randconfig-005-20240724 clang-18 x86_64 randconfig-006-20240724 gcc-13 x86_64 randconfig-011-20240724 clang-18 x86_64 randconfig-012-20240724 gcc-13 x86_64 randconfig-013-20240724 clang-18 x86_64 randconfig-014-20240724 clang-18 x86_64 randconfig-015-20240724 clang-18 x86_64 randconfig-016-20240724 clang-18 x86_64 randconfig-071-20240724 gcc-13 x86_64 randconfig-072-20240724 gcc-11 x86_64 randconfig-073-20240724 clang-18 x86_64 randconfig-074-20240724 gcc-13 x86_64 randconfig-075-20240724 gcc-13 x86_64 randconfig-076-20240724 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS e41736c067dfafe9852c82c3422860f0f70ab11f
by kernel test robot 24 Jul '24

24 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: e41736c067dfafe9852c82c3422860f0f70ab11f !9782 usb-storage: alauda: Check whether the media is initialized Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-randconfig-001-20240724 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-003-20240724 | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-004-20240724 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 720m configs tested: 14 configs skipped: 134 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240724 gcc-14.1.0 arm64 randconfig-002-20240724 gcc-14.1.0 arm64 randconfig-003-20240724 gcc-14.1.0 arm64 randconfig-004-20240724 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240724 gcc-14.1.0 loongarch randconfig-002-20240724 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 defconfig gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] netfilter: nf_tables: do not compare internal table flags on updates
by dinglongwei 23 Jul '24

23 Jul '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.214 commit fcf32a5bfcb8a57ac0ce717fcfa4d688c91f1005 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IS CVE: CVE-2024-27065 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139 ] Restore skipping transaction if table update does not modify flags. Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 3c98254f3a37..1a3bc800534d 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1116,7 +1116,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) if (flags & ~NFT_TABLE_F_DORMANT) return -EINVAL; - if (flags == ctx->table->flags) + if (flags == (ctx->table->flags & NFT_TABLE_F_MASK)) return 0; /* No dormant off/on/off/on games in single transaction */ -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] NFSD: Fix the behavior of READ near OFFSET_MAX
by Li Lingfeng 23 Jul '24

23 Jul '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v5.17-rc4 commit 0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADG80 CVE: CVE-2022-48827 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Dan Aloni reports: > Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to > the RPC read layers") on the client, a read of 0xfff is aligned up > to server rsize of 0x1000. > > As a result, in a test where the server has a file of size > 0x7fffffffffffffff, and the client tries to read from the offset > 0x7ffffffffffff000, the read causes loff_t overflow in the server > and it returns an NFS code of EINVAL to the client. The client as > a result indefinitely retries the request. The Linux NFS client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that status code for a READ. Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This behavior appears to be consistent with Solaris NFS servers. Note that NFSv3 and NFSv4 use u64 offset values on the wire. These must be converted to loff_t internally before use -- an implicit type cast is not adequate for this purpose. Otherwise VFS checks against sb->s_maxbytes do not work properly. Reported-by: Dan Aloni <dan.aloni(a)vastdata.com> Cc: stable(a)vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs3proc.c fs/nfsd/nfs4proc.c fs/nfsd/nfs4xdr.c [Commit be63bd2ac6bb("NFSD: Update READ3arg decoder to use struct xdr_stream") modified the method of initializing resp->count; Commit 5c4583b2b78e("nfsd: hook up nfs4_preprocess_stateid_op to the nfsd_file cache") remove rd_filp from nfsd4_read and remove the check of rd_tmp_file in nfsd4_encode_read; Commit 528b84934eb9("NFSD: Add READ_PLUS data support") add READ_PLUS data support.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs3proc.c | 11 ++++++++--- fs/nfsd/nfs4proc.c | 8 ++++++-- fs/nfsd/nfs4xdr.c | 5 +---- 3 files changed, 15 insertions(+), 9 deletions(-) diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c index c9cf46e0c040..2ac8f5912dfa 100644 --- a/fs/nfsd/nfs3proc.c +++ b/fs/nfsd/nfs3proc.c @@ -154,18 +154,23 @@ nfsd3_proc_read(struct svc_rqst *rqstp) struct nfsd3_readres *resp = rqstp->rq_resp; __be32 nfserr; u32 max_blocksize = svc_max_payload(rqstp); - unsigned long cnt = min(argp->count, max_blocksize); dprintk("nfsd: READ(3) %s %lu bytes at %Lu\n", SVCFH_fmt(&argp->fh), (unsigned long) argp->count, (unsigned long long) argp->offset); + argp->count = min_t(u32, argp->count, max_blocksize); + if (argp->offset > (u64)OFFSET_MAX) + argp->offset = (u64)OFFSET_MAX; + if (argp->offset + argp->count > (u64)OFFSET_MAX) + argp->count = (u64)OFFSET_MAX - argp->offset; + /* Obtain buffer pointer for payload. * 1 (status) + 22 (post_op_attr) + 1 (count) + 1 (eof) * + 1 (xdr opaque byte count) = 26 */ - resp->count = cnt; + resp->count = argp->count; svc_reserve_auth(rqstp, ((1 + NFS3_POST_OP_ATTR_WORDS + 3)<<2) + resp->count +4); fh_copy(&resp->fh, &argp->fh); @@ -175,7 +180,7 @@ nfsd3_proc_read(struct svc_rqst *rqstp) &resp->count); if (nfserr == 0) { struct inode *inode = d_inode(resp->fh.fh_dentry); - resp->eof = nfsd_eof_on_read(cnt, resp->count, argp->offset, + resp->eof = nfsd_eof_on_read(resp->count, resp->count, argp->offset, inode->i_size); } diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 1c3e6de6bcba..8bb0b6d2ea4e 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -760,12 +760,16 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, __be32 status; read->rd_filp = NULL; - if (read->rd_offset >= OFFSET_MAX) - return nfserr_inval; trace_nfsd_read_start(rqstp, &cstate->current_fh, read->rd_offset, read->rd_length); + read->rd_length = min_t(u32, read->rd_length, svc_max_payload(rqstp)); + if (read->rd_offset > (u64)OFFSET_MAX) + read->rd_offset = (u64)OFFSET_MAX; + if (read->rd_offset + read->rd_length > (u64)OFFSET_MAX) + read->rd_length = (u64)OFFSET_MAX - read->rd_offset; + /* * If we do a zero copy read, then a client will see read data * that reflects the state of the file *after* performing the diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index db0beefe65ec..7dae38d21041 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -3595,11 +3595,8 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr, } xdr_commit_encode(xdr); - maxcount = svc_max_payload(resp->rqstp); - maxcount = min_t(unsigned long, maxcount, + maxcount = min_t(unsigned long, read->rd_length, (xdr->buf->buflen - xdr->buf->len)); - maxcount = min_t(unsigned long, maxcount, read->rd_length); - if (read->rd_tmp_file) ra = nfsd_init_raparms(file); -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 1696/23347] drivers/usb/roles/class.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 23 Jul '24

23 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8d2f09e210f079f53eb6c1ba1ef639d73a17d61b commit: bb87eff0e698d6e312b435f482d4b0b5672b11d0 [1696/23347] usb: roles: Add a description for the class to Kconfig config: x86_64-buildonly-randconfig-005-20240723 (https://download.01.org/0day-ci/archive/20240723/202407232033.iAaUwu3f-lkp@…) compiler: gcc-12 (Ubuntu 12.3.0-9ubuntu2) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240723/202407232033.iAaUwu3f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407232033.iAaUwu3f-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/usb/roles/class.c:12: include/linux/module.h:133:13: warning: 'init_module' specifies less restrictive attribute than its target 'usb_roles_init': 'cold' [-Wmissing-attributes] 133 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/module.h:116:41: note: in expansion of macro 'module_init' 116 | #define subsys_initcall(fn) module_init(fn) | ^~~~~~~~~~~ drivers/usb/roles/class.c:303:1: note: in expansion of macro 'subsys_initcall' 303 | subsys_initcall(usb_roles_init); | ^~~~~~~~~~~~~~~ drivers/usb/roles/class.c:298:19: note: 'init_module' target declared here 298 | static int __init usb_roles_init(void) | ^~~~~~~~~~~~~~ include/linux/module.h:139:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'usb_roles_exit': 'cold' [-Wmissing-attributes] 139 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ drivers/usb/roles/class.c:309:1: note: in expansion of macro 'module_exit' 309 | module_exit(usb_roles_exit); | ^~~~~~~~~~~ drivers/usb/roles/class.c:305:20: note: 'cleanup_module' target declared here 305 | static void __exit usb_roles_exit(void) | ^~~~~~~~~~~~~~ >> drivers/usb/roles/class.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v2 openEuler-22.03-LTS-SP1] usb-storage: alauda: Check whether the media is initialized
by Jinjiang Tu 23 Jul '24

23 Jul '24

From: Shichao Lai <shichaorai(a)gmail.com> mainline inclusion from mainline-v6.10-rc4 commit 16637fea001ab3c8df528a8995b3211906165a30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6YQV CVE: CVE-2024-38619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). - Add a member "media_initialized" to struct alauda_info. - Change a condition in alauda_check_media() to ensure the first initialization. - Add an error check for the return value of alauda_init_media(). Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support") Reported-by: xingwei lee <xrivendell7(a)gmail.com> Reported-by: yue sun <samsun1006219(a)gmail.com> Reviewed-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Shichao Lai <shichaorai(a)gmail.com> Link: https://lore.kernel.org/r/20240526012745.2852061-1-shichaorai@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/storage/alauda.c [Due to LTS commit fe7c3a445d22 is not merged, the rc variable is not defined.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/storage/alauda.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c index 20b857e97e60..fd487f047b89 100644 --- a/drivers/usb/storage/alauda.c +++ b/drivers/usb/storage/alauda.c @@ -105,6 +105,8 @@ struct alauda_info { unsigned char sense_key; unsigned long sense_asc; /* additional sense code */ unsigned long sense_ascq; /* additional sense code qualifier */ + + bool media_initialized; }; #define short_pack(lsb,msb) ( ((u16)(lsb)) | ( ((u16)(msb))<<8 ) ) @@ -453,6 +455,7 @@ static int alauda_check_media(struct us_data *us) { struct alauda_info *info = (struct alauda_info *) us->extra; unsigned char status[2]; + int rc; alauda_get_media_status(us, status); @@ -468,11 +471,12 @@ static int alauda_check_media(struct us_data *us) } /* Check for media change */ - if (status[0] & 0x08) { + if (status[0] & 0x08 || !info->media_initialized) { usb_stor_dbg(us, "Media change detected\n"); alauda_free_maps(&MEDIA_INFO(us)); - alauda_init_media(us); - + rc = alauda_init_media(us); + if (rc == USB_STOR_TRANSPORT_GOOD) + info->media_initialized = true; info->sense_key = UNIT_ATTENTION; info->sense_asc = 0x28; info->sense_ascq = 0x00; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-27065
by dinglongwei 23 Jul '24

23 Jul '24

Pablo Neira Ayuso (3): netfilter: nftables: update table flags from the commit phase netfilter: nf_tables: fix table flag updates netfilter: nf_tables: do not compare internal table flags on updates include/net/netfilter/nf_tables.h | 3 -- include/uapi/linux/netfilter/nf_tables.h | 1 + net/netfilter/nf_tables_api.c | 60 ++++++++++++++++-------- 3 files changed, 42 insertions(+), 22 deletions(-) -- 2.17.1

2 4

[PATCH OLK-5.10 0/1] arm64/sme: Always exit sme_alloc() early with existing storage
by Lin Yujun 23 Jul '24

23 Jul '24

*** BLURB HERE *** Mark Brown (1): [Backport] arm64/sme: Always exit sme_alloc() early with existing storage arch/arm64/kernel/fpsimd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/6] mm: add THP support for SPE based autonuma
by Nanyong Sun 23 Jul '24

23 Jul '24

添加THP支持，并补充部分原生numa balance策略控制 Ze Zuo (6): mm: thp: refactor migrate_misplaced_page for thp migrate mm: migrate: account THP NUMA migration counters correctly mm: migrate: don't split THP for misplaced NUMA page mm: migrate: Skip spe access migration for Shared THP with Multiple Mappings mm: migrate: THP are supported in NUMA balancing under hardware sampling mm: migrate: backport some migrate policy judge mm/mem_sampling.c | 75 +++++++++++++++++++++++++++++++++++++++++++++-- mm/migrate.c | 51 +++++++++++++++++++++++++++----- 2 files changed, 116 insertions(+), 10 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2023-52679
by dinglongwei 23 Jul '24

23 Jul '24

Christian A. Ehrhardt (2): of: Fix double free in of_parse_phandle_with_args_map of: unittest: Fix compile in the non-dynamic case Geert Uytterhoeven (1): of: unittest: Fix of_count_phandle_with_args() expected value message drivers/of/base.c | 1 + drivers/of/unittest-data/tests-phandle.dtsi | 10 ++- drivers/of/unittest.c | 80 +++++++++++++-------- 3 files changed, 59 insertions(+), 32 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-1.0-LTS 0/2] Backport dvb-usb bugfix
by Zheng Yejian 23 Jul '24

23 Jul '24

Greg Kroah-Hartman (1): USB: move snd_usb_pipe_sanity_check into the USB core Zheng Yejian (1): media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control() drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++++++++++++++++++++--- drivers/usb/core/urb.c | 31 +++++++++++++++------ include/linux/usb.h | 1 + 3 files changed, 55 insertions(+), 12 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-6.6 7645/10903] drivers/net/ethernet/yunsilicon/xsc/net/main.c:2628:14: error: no member named 'physfn' in 'struct pci_dev'
by kernel test robot 23 Jul '24

23 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b156200a7f2f34854751d767d9fa40f81be9f05c commit: 601fb01dc16f747534b866610743d95830b6655e [7645/10903] drivers: support for xsc drivers from Yunsilicon Technology config: arm64-randconfig-004-20240723 (https://download.01.org/0day-ci/archive/20240723/202407231343.3uTyW1i0-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240723/202407231343.3uTyW1i0-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407231343.3uTyW1i0-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/net/ethernet/yunsilicon/xsc/pci/main.c:6: drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1732:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:136:4: warning: no previous prototype for function 'xsc_devid_to_pcie_no' [-Wmissing-prototypes] u8 xsc_devid_to_pcie_no(int dev_id) ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:136:1: note: declare 'static' if the function is not intended to be used outside of this translation unit u8 xsc_devid_to_pcie_no(int dev_id) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:288:5: warning: no previous prototype for function 'xsc_priv_init' [-Wmissing-prototypes] int xsc_priv_init(struct xsc_core_device *dev) ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:288:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_priv_init(struct xsc_core_device *dev) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:302:5: warning: no previous prototype for function 'xsc_dev_res_init' [-Wmissing-prototypes] int xsc_dev_res_init(struct xsc_core_device *dev) ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:302:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_dev_res_init(struct xsc_core_device *dev) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:321:6: warning: no previous prototype for function 'xsc_dev_res_cleanup' [-Wmissing-prototypes] void xsc_dev_res_cleanup(struct xsc_core_device *dev) ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:321:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_dev_res_cleanup(struct xsc_core_device *dev) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:327:6: warning: no previous prototype for function 'xsc_init_reg_addr' [-Wmissing-prototypes] void xsc_init_reg_addr(struct xsc_core_device *dev) ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:327:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_init_reg_addr(struct xsc_core_device *dev) ^ static >> drivers/net/ethernet/yunsilicon/xsc/pci/main.c:412:8: error: call to undeclared function 'pci_request_region'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] err = pci_request_region(pdev, bar_num, name); ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:412:8: note: did you mean 'pci_request_regions'? include/linux/pci.h:2048:19: note: 'pci_request_regions' declared here static inline int pci_request_regions(struct pci_dev *dev, const char *res_name) ^ >> drivers/net/ethernet/yunsilicon/xsc/pci/main.c:454:2: error: call to undeclared function 'pci_release_region'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] pci_release_region(pdev, bar_num); ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:454:2: note: did you mean 'pci_release_regions'? include/linux/pci.h:2050:20: note: 'pci_release_regions' declared here static inline void pci_release_regions(struct pci_dev *dev) { } ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:475:2: error: call to undeclared function 'pci_release_region'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] pci_release_region(pdev, dev->bar_num); ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:518:5: warning: no previous prototype for function 'xsc_reset_function_resource' [-Wmissing-prototypes] int xsc_reset_function_resource(struct xsc_core_device *dev) ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:518:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_reset_function_resource(struct xsc_core_device *dev) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:612:19: error: no member named 'physfn' in 'struct pci_dev' if (!dev->pdev->physfn) { ~~~~~~~~~ ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:718:5: warning: no previous prototype for function 'xsc_load_one' [-Wmissing-prototypes] int xsc_load_one(struct xsc_core_device *dev, bool boot) ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:718:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_load_one(struct xsc_core_device *dev, bool boot) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/main.c:796:5: warning: no previous prototype for function 'xsc_unload_one' [-Wmissing-prototypes] int xsc_unload_one(struct xsc_core_device *dev, bool cleanup) ^ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:796:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_unload_one(struct xsc_core_device *dev, bool cleanup) ^ static 9 warnings and 4 errors generated. -- In file included from drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:16: In file included from drivers/net/ethernet/yunsilicon/xsc/common/driver.h:18: drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1732:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:913:17: error: call to undeclared function 'dma_pool_alloc'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] mailbox->buf = dma_pool_alloc(xdev->cmd.pool, flags, ^ drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:913:17: note: did you mean 'mempool_alloc'? include/linux/mempool.h:57:14: note: 'mempool_alloc' declared here extern void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask) __malloc; ^ >> drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:913:15: error: incompatible integer to pointer conversion assigning to 'void *' from 'int' [-Wint-conversion] mailbox->buf = dma_pool_alloc(xdev->cmd.pool, flags, ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:929:2: error: call to undeclared function 'dma_pool_free'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] dma_pool_free(xdev->cmd.pool, mailbox->buf, mailbox->dma); ^ drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:929:2: note: did you mean 'mempool_free'? include/linux/mempool.h:58:13: note: 'mempool_free' declared here extern void mempool_free(void *element, mempool_t *pool); ^ >> drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:1846:14: error: call to undeclared function 'dma_pool_create'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] cmd->pool = dma_pool_create("xsc_cmd", &xdev->pdev->dev, size, align, 0); ^ drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:1846:14: note: did you mean 'mempool_create'? include/linux/mempool.h:49:19: note: 'mempool_create' declared here extern mempool_t *mempool_create(int min_nr, mempool_alloc_t *alloc_fn, ^ >> drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:1846:12: error: incompatible integer to pointer conversion assigning to 'struct dma_pool *' from 'int' [-Wint-conversion] cmd->pool = dma_pool_create("xsc_cmd", &xdev->pdev->dev, size, align, 0); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:2015:2: error: call to undeclared function 'dma_pool_destroy'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] dma_pool_destroy(cmd->pool); ^ drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:2015:2: note: did you mean 'mempool_destroy'? include/linux/mempool.h:56:13: note: 'mempool_destroy' declared here extern void mempool_destroy(mempool_t *pool); ^ drivers/net/ethernet/yunsilicon/xsc/pci/cmd2.c:2036:2: error: call to undeclared function 'dma_pool_destroy'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] dma_pool_destroy(cmd->pool); ^ 1 warning and 7 errors generated. -- In file included from drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:11: In file included from drivers/net/ethernet/yunsilicon/xsc/common/driver.h:18: drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1732:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:558:2: error: call to undeclared function 'pci_free_irq_vectors'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] pci_free_irq_vectors(dev->pdev); ^ drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:558:2: note: did you mean 'pci_alloc_irq_vectors'? include/linux/pci.h:2100:1: note: 'pci_alloc_irq_vectors' declared here pci_alloc_irq_vectors(struct pci_dev *dev, unsigned int min_vecs, ^ drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:616:2: error: call to undeclared function 'pci_free_irq_vectors'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] pci_free_irq_vectors(dev->pdev); ^ drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:721:5: warning: no previous prototype for function 'xsc_request_irq_for_cmdq' [-Wmissing-prototypes] int xsc_request_irq_for_cmdq(struct xsc_core_device *dev, u8 vecidx) ^ drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:721:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_request_irq_for_cmdq(struct xsc_core_device *dev, u8 vecidx) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:734:6: warning: no previous prototype for function 'xsc_free_irq_for_cmdq' [-Wmissing-prototypes] void xsc_free_irq_for_cmdq(struct xsc_core_device *dev) ^ drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:734:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_free_irq_for_cmdq(struct xsc_core_device *dev) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:756:5: warning: no previous prototype for function 'xsc_request_irq_for_event' [-Wmissing-prototypes] int xsc_request_irq_for_event(struct xsc_core_device *dev) ^ drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:756:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_request_irq_for_event(struct xsc_core_device *dev) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:767:6: warning: no previous prototype for function 'xsc_free_irq_for_event' [-Wmissing-prototypes] void xsc_free_irq_for_event(struct xsc_core_device *dev) ^ drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:767:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_free_irq_for_event(struct xsc_core_device *dev) ^ static drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:773:5: warning: no previous prototype for function 'xsc_cmd_enable_msix' [-Wmissing-prototypes] int xsc_cmd_enable_msix(struct xsc_core_device *xdev) ^ drivers/net/ethernet/yunsilicon/xsc/pci/pci_irq.c:773:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_cmd_enable_msix(struct xsc_core_device *xdev) ^ static 6 warnings and 2 errors generated. -- ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1707:6: warning: no previous prototype for function 'xsc_eth_deactivate_priv_channels' [-Wmissing-prototypes] void xsc_eth_deactivate_priv_channels(struct xsc_adapter *adapter) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1707:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_eth_deactivate_priv_channels(struct xsc_adapter *adapter) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1850:5: warning: no previous prototype for function 'xsc_eth_change_link_status' [-Wmissing-prototypes] int xsc_eth_change_link_status(struct xsc_adapter *adapter) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1850:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_eth_change_link_status(struct xsc_adapter *adapter) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1907:6: warning: no previous prototype for function 'xsc_eth_event_handler' [-Wmissing-prototypes] void xsc_eth_event_handler(void *arg) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1907:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_eth_event_handler(void *arg) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1915:5: warning: no previous prototype for function 'xsc_eth_enable_nic_hca' [-Wmissing-prototypes] int xsc_eth_enable_nic_hca(struct xsc_adapter *adapter) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1915:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_eth_enable_nic_hca(struct xsc_adapter *adapter) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1977:5: warning: no previous prototype for function 'xsc_eth_disable_nic_hca' [-Wmissing-prototypes] int xsc_eth_disable_nic_hca(struct xsc_adapter *adapter) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1977:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_eth_disable_nic_hca(struct xsc_adapter *adapter) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2010:6: warning: no previous prototype for function 'xsc_eth_rss_params_change' [-Wmissing-prototypes] void xsc_eth_rss_params_change(struct xsc_adapter *adapter, u32 change, void *modify) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2010:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_eth_rss_params_change(struct xsc_adapter *adapter, u32 change, void *modify) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2318:6: warning: no previous prototype for function 'xsc_build_default_indir_rqt' [-Wmissing-prototypes] void xsc_build_default_indir_rqt(u32 *indirection_rqt, int len, ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2318:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_build_default_indir_rqt(u32 *indirection_rqt, int len, ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2416:5: warning: no previous prototype for function 'xsc_eth_nic_mtu_changed' [-Wmissing-prototypes] int xsc_eth_nic_mtu_changed(struct xsc_adapter *priv) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2416:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_eth_nic_mtu_changed(struct xsc_adapter *priv) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2479:5: warning: no previous prototype for function 'xsc_set_vf_mac' [-Wmissing-prototypes] int xsc_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2479:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2496:5: warning: no previous prototype for function 'xsc_get_vf_config' [-Wmissing-prototypes] int xsc_get_vf_config(struct net_device *dev, ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2496:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_get_vf_config(struct net_device *dev, ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2512:5: warning: no previous prototype for function 'set_feature_rxcsum' [-Wmissing-prototypes] int set_feature_rxcsum(struct net_device *netdev, bool enable) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2512:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int set_feature_rxcsum(struct net_device *netdev, bool enable) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2564:5: warning: no previous prototype for function 'xsc_eth_set_features' [-Wmissing-prototypes] int xsc_eth_set_features(struct net_device *netdev, netdev_features_t features) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2564:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_eth_set_features(struct net_device *netdev, netdev_features_t features) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2581:5: warning: no previous prototype for function 'xsc_select_queue' [-Wmissing-prototypes] u16 xsc_select_queue(struct net_device *dev, struct sk_buff *skb, ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2581:1: note: declare 'static' if the function is not intended to be used outside of this translation unit u16 xsc_select_queue(struct net_device *dev, struct sk_buff *skb, ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2590:10: warning: variable 'txq_ix' is uninitialized when used here [-Wuninitialized] return txq_ix; ^~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2584:12: note: initialize the variable 'txq_ix' to silence this warning int txq_ix, up = 0; ^ = 0 >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:2628:14: error: no member named 'physfn' in 'struct pci_dev' if (!pdev->physfn) ~~~~ ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2630:35: error: no member named 'physfn' in 'struct pci_dev' pf_xdev = pci_get_drvdata(pdev->physfn); ~~~~ ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2769:24: warning: no previous prototype for function 'xsc_tirc_get_default_config' [-Wmissing-prototypes] struct xsc_tirc_config xsc_tirc_get_default_config(enum xsc_traffic_types tt) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2769:1: note: declare 'static' if the function is not intended to be used outside of this translation unit struct xsc_tirc_config xsc_tirc_get_default_config(enum xsc_traffic_types tt) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2774:6: warning: no previous prototype for function 'xsc_build_rss_params' [-Wmissing-prototypes] void xsc_build_rss_params(struct xsc_rss_params *rss_params, u16 num_channels) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2774:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_build_rss_params(struct xsc_rss_params *rss_params, u16 num_channels) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2792:6: warning: no previous prototype for function 'xsc_eth_build_nic_params' [-Wmissing-prototypes] void xsc_eth_build_nic_params(struct xsc_adapter *adapter, u32 ch_num, u32 tc_num) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2792:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_eth_build_nic_params(struct xsc_adapter *adapter, u32 ch_num, u32 tc_num) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2814:6: warning: no previous prototype for function 'xsc_eth_build_nic_netdev' [-Wmissing-prototypes] void xsc_eth_build_nic_netdev(struct xsc_adapter *adapter) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2814:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void xsc_eth_build_nic_netdev(struct xsc_adapter *adapter) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2885:5: warning: no previous prototype for function 'xsc_eth_create_xdev_resources' [-Wmissing-prototypes] int xsc_eth_create_xdev_resources(struct xsc_core_device *xdev) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2885:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_eth_create_xdev_resources(struct xsc_core_device *xdev) ^ static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2906:5: warning: no previous prototype for function 'xsc_eth_init_nic_rx' [-Wmissing-prototypes] int xsc_eth_init_nic_rx(struct xsc_adapter *adapter) ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2906:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int xsc_eth_init_nic_rx(struct xsc_adapter *adapter) ^ static 47 warnings and 2 errors generated. vim +2628 drivers/net/ethernet/yunsilicon/xsc/net/main.c 2614 2615 static int xsc_get_phys_port_name(struct net_device *dev, 2616 char *buf, size_t len) 2617 { 2618 struct xsc_adapter *adapter = netdev_priv(dev); 2619 struct xsc_core_device *xdev = adapter->xdev; 2620 struct xsc_core_device *pf_xdev; 2621 struct net_device *pf_netdev; 2622 struct pci_dev *pdev = xdev->pdev; 2623 int ret = len; 2624 2625 if (!pdev) 2626 return -EOPNOTSUPP; 2627 if (!xsc_core_is_pf(xdev)) { > 2628 if (!pdev->physfn) 2629 return -EOPNOTSUPP; 2630 pf_xdev = pci_get_drvdata(pdev->physfn); 2631 if (!pf_xdev || !pf_xdev->netdev) 2632 return -EOPNOTSUPP; 2633 pf_netdev = (struct net_device *)pf_xdev->netdev; 2634 ret = snprintf(buf, len, "%s_%d", 2635 pf_netdev->name, xdev->vf_id); 2636 } else { 2637 return -EOPNOTSUPP; 2638 } 2639 if (ret >= len) 2640 return -EOPNOTSUPP; 2641 2642 return 0; 2643 } 2644 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 v6 00/10] CVE-2024-26979
by Pu Lehui 23 Jul '24

23 Jul '24

Christian König (5): drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap drm/ttm: make ttm_bo_unpin more defensive drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Guchun Chen (1): drm/ttm: check null pointer before accessing when swapping Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Wang Hai (1): drm/ttm: Fix kabi breakage in struct ttm_buffer_object Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_bo.c | 16 +++- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- include/drm/ttm/ttm_bo_api.h | 28 +++++++ 22 files changed, 175 insertions(+), 121 deletions(-) -- 2.34.1

2 11

[PATCH OLK-5.10 v6 00/10] CVE-2024-26979
by Pu Lehui 23 Jul '24

23 Jul '24

Christian König (5): drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap drm/ttm: make ttm_bo_unpin more defensive drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Guchun Chen (1): drm/ttm: check null pointer before accessing when swapping Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Wang Hai (1): drm/ttm: Fix kabi breakage in struct ttm_buffer_object Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_bo.c | 16 +++- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- include/drm/ttm/ttm_bo_api.h | 28 +++++++ 22 files changed, 175 insertions(+), 121 deletions(-) -- 2.34.1

2 11

[PATCH openEuler-22.03-LTS-SP1 v5 0/8] CVE-2024-26979
by Pu Lehui 23 Jul '24

23 Jul '24

Christian König (4): drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Wang Hai (1): drm/ttm: Fix kabi breakage in struct ttm_buffer_object Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_bo.c | 15 +++- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- include/drm/ttm/ttm_bo_api.h | 26 ++++++ 22 files changed, 172 insertions(+), 121 deletions(-) -- 2.34.1

2 9

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 8d2f09e210f079f53eb6c1ba1ef639d73a17d61b
by kernel test robot 23 Jul '24

23 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 8d2f09e210f079f53eb6c1ba1ef639d73a17d61b !9917 powerpc/pseries: Enforce hcall result buffer validity and size Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202407230136.x5FmFlxg-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202407230549.TmLejsNZ-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/spi/spi.c:2040:7: error: implicit declaration of function 'gpiod_count'; did you mean 'cpuid_count'? [-Werror=implicit-function-declaration] drivers/spi/spi.c:2064:11: error: implicit declaration of function 'devm_gpiod_get_index'; did you mean 'devm_gpio_free'? [-Werror=implicit-function-declaration] drivers/spi/spi.c:2065:14: error: 'GPIOD_ASIS' undeclared (first use in this function); did you mean 'GPIOF_IN'? drivers/spi/spi.c:2068:12: error: implicit declaration of function 'desc_to_gpio'; did you mean 'irq_to_gpio'? [-Werror=implicit-function-declaration] Error/Warning ids grouped by kconfigs: recent_errors |-- x86_64-buildonly-randconfig-002-20240723 | |-- drivers-thermal-intel_powerclamp.o:warning:objtool:missing-symbol-for-section-.text.unlikely | `-- net-ipv6-icmp.o:warning:objtool:missing-symbol-for-section-.text.unlikely |-- x86_64-buildonly-randconfig-003-20240723 | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-005-20240723 | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized `-- x86_64-randconfig-001-20240722 |-- drivers-spi-spi.c:error:GPIOD_ASIS-undeclared-(first-use-in-this-function) |-- drivers-spi-spi.c:error:implicit-declaration-of-function-desc_to_gpio |-- drivers-spi-spi.c:error:implicit-declaration-of-function-devm_gpiod_get_index `-- drivers-spi-spi.c:error:implicit-declaration-of-function-gpiod_count elapsed time: 729m configs tested: 36 configs skipped: 138 tested configs: arm64 alldefconfig gcc-14.1.0 arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240723 gcc-14.1.0 arm64 randconfig-002-20240723 gcc-14.1.0 arm64 randconfig-003-20240723 gcc-14.1.0 arm64 randconfig-004-20240723 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240723 gcc-10 x86_64 buildonly-randconfig-002-20240723 gcc-10 x86_64 buildonly-randconfig-003-20240723 gcc-12 x86_64 buildonly-randconfig-004-20240723 gcc-8 x86_64 buildonly-randconfig-005-20240723 gcc-12 x86_64 buildonly-randconfig-006-20240723 gcc-10 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240723 clang-18 x86_64 randconfig-002-20240723 clang-18 x86_64 randconfig-003-20240723 clang-18 x86_64 randconfig-004-20240723 clang-18 x86_64 randconfig-005-20240723 clang-18 x86_64 randconfig-006-20240723 clang-18 x86_64 randconfig-011-20240723 gcc-12 x86_64 randconfig-012-20240723 clang-18 x86_64 randconfig-013-20240723 gcc-13 x86_64 randconfig-014-20240723 gcc-13 x86_64 randconfig-015-20240723 gcc-10 x86_64 randconfig-016-20240723 clang-18 x86_64 randconfig-071-20240723 gcc-13 x86_64 randconfig-072-20240723 gcc-13 x86_64 randconfig-073-20240723 clang-18 x86_64 randconfig-074-20240723 gcc-13 x86_64 randconfig-075-20240723 clang-18 x86_64 randconfig-076-20240723 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v4 0/8] CVE-2024-26979
by Pu Lehui 23 Jul '24

23 Jul '24

Christian König (4): drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Wang Hai (1): drm/ttm: Fix kabi breakage in struct ttm_buffer_object Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_bo.c | 15 +++- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- include/drm/ttm/ttm_bo_api.h | 26 ++++++ 22 files changed, 172 insertions(+), 121 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-22.03-LTS-SP1 v4 0/8] CVE-2024-26979
by Pu Lehui 23 Jul '24

23 Jul '24

Christian König (4): drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Wang Hai (1): drm/ttm: Fix kabi breakage in struct ttm_buffer_object Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_bo.c | 15 +++- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- include/drm/ttm/ttm_bo_api.h | 26 ++++++ 22 files changed, 172 insertions(+), 121 deletions(-) -- 2.34.1

2 9

[PATCH OLK-6.6 0/3] CVE-2024-36979
by Yuan Can 23 Jul '24

23 Jul '24

Nikolay Aleksandrov (3): net: bridge: mst: fix vlan use-after-free net: bridge: mst: fix suspicious rcu usage in br_mst_set_state net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state net/bridge/br_mst.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-22.03-LTS-SP1 v3 0/8] CVE-2024-26979
by Pu Lehui 23 Jul '24

23 Jul '24

Christian König (4): drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Wang Hai (1): drm/ttm: Fix kabi breakage in struct ttm_buffer_object Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_bo.c | 15 +++- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- include/drm/ttm/ttm_bo_api.h | 26 ++++++ 22 files changed, 172 insertions(+), 121 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10 v3 0/8] CVE-2024-26979
by Pu Lehui 23 Jul '24

23 Jul '24

Christian König (4): drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Wang Hai (1): drm/ttm: Fix kabi breakage in struct ttm_buffer_object Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_bo.c | 15 +++- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- include/drm/ttm/ttm_bo_api.h | 26 ++++++ 22 files changed, 172 insertions(+), 121 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-22.03-LTS-SP1] netfilter: nf_tables: do not compare internal table flags on updates
by dinglongwei 23 Jul '24

23 Jul '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.214 commit fcf32a5bfcb8a57ac0ce717fcfa4d688c91f1005 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IS CVE: CVE-2024-27065 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139 ] Restore skipping transaction if table update does not modify flags. Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/netfilter/nf_tables_api.c [Context conflicts] Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 6105149b9e1a..91e206a15259 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1069,7 +1069,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) if (flags & ~NFT_TABLE_F_DORMANT) return -EINVAL; - if (flags == ctx->table->flags) + if (flags == (ctx->table->flags & NFT_TABLE_F_MASK)) return 0; trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2 0/2] CVE-2022-48816
by Liu Jian 23 Jul '24

23 Jul '24

CVE-2022-48816 NeilBrown (1): SUNRPC: lock against ->sock changing during sysfs read Trond Myklebust (1): SUNRPC: Do not dereference non-socket transports in sysfs include/linux/sunrpc/xprt.h | 3 +++ include/linux/sunrpc/xprtsock.h | 1 - net/sunrpc/xprtsock.c | 33 ++++++++++++++++++++++++++++++--- 3 files changed, 33 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 v2 0/8] CVE-2024-26979
by Pu Lehui 23 Jul '24

23 Jul '24

Christian König (4): drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Wang Hai (1): drm/ttm: Fix kabi breakage in struct ttm_buffer_object Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_bo.c | 15 +++- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- include/drm/ttm/ttm_bo_api.h | 26 ++++++ 22 files changed, 172 insertions(+), 121 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-22.03-LTS-SP1 v2 0/8] CVE-2024-26979
by Pu Lehui 23 Jul '24

23 Jul '24

Christian König (4): drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Wang Hai (1): drm/ttm: Fix kabi breakage in struct ttm_buffer_object Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_bo.c | 15 +++- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- include/drm/ttm/ttm_bo_api.h | 26 ++++++ 22 files changed, 172 insertions(+), 121 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10 v2 0/2] CVE-2022-48816
by Liu Jian 23 Jul '24

23 Jul '24

CVE-2022-48816 NeilBrown (1): SUNRPC: lock against ->sock changing during sysfs read Trond Myklebust (1): SUNRPC: Do not dereference non-socket transports in sysfs include/linux/sunrpc/xprt.h | 3 +++ include/linux/sunrpc/xprtsock.h | 1 - net/sunrpc/xprtsock.c | 33 ++++++++++++++++++++++++++++++--- 3 files changed, 33 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] usb-storage: alauda: Check whether the media is initialized
by Jinjiang Tu 23 Jul '24

23 Jul '24

From: Shichao Lai <shichaorai(a)gmail.com> mainline inclusion from mainline-v6.10-rc4 commit 16637fea001ab3c8df528a8995b3211906165a30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6YQV CVE: CVE-2024-38619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). - Add a member "media_initialized" to struct alauda_info. - Change a condition in alauda_check_media() to ensure the first initialization. - Add an error check for the return value of alauda_init_media(). Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support") Reported-by: xingwei lee <xrivendell7(a)gmail.com> Reported-by: yue sun <samsun1006219(a)gmail.com> Reviewed-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Shichao Lai <shichaorai(a)gmail.com> Link: https://lore.kernel.org/r/20240526012745.2852061-1-shichaorai@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/storage/alauda.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c index dcc4778d1ae9..17fe35083f04 100644 --- a/drivers/usb/storage/alauda.c +++ b/drivers/usb/storage/alauda.c @@ -105,6 +105,8 @@ struct alauda_info { unsigned char sense_key; unsigned long sense_asc; /* additional sense code */ unsigned long sense_ascq; /* additional sense code qualifier */ + + bool media_initialized; }; #define short_pack(lsb,msb) ( ((u16)(lsb)) | ( ((u16)(msb))<<8 ) ) @@ -476,11 +478,12 @@ static int alauda_check_media(struct us_data *us) } /* Check for media change */ - if (status[0] & 0x08) { + if (status[0] & 0x08 || !info->media_initialized) { usb_stor_dbg(us, "Media change detected\n"); alauda_free_maps(&MEDIA_INFO(us)); - alauda_init_media(us); - + rc = alauda_init_media(us); + if (rc == USB_STOR_TRANSPORT_GOOD) + info->media_initialized = true; info->sense_key = UNIT_ATTENTION; info->sense_asc = 0x28; info->sense_ascq = 0x00; -- 2.25.1

2 1

[PATCH OLK-5.10] usb-storage: alauda: Check whether the media is initialized
by Jinjiang Tu 23 Jul '24

23 Jul '24

From: Shichao Lai <shichaorai(a)gmail.com> mainline inclusion from mainline-v6.10-rc4 commit 16637fea001ab3c8df528a8995b3211906165a30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6YQV CVE: CVE-2024-38619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). - Add a member "media_initialized" to struct alauda_info. - Change a condition in alauda_check_media() to ensure the first initialization. - Add an error check for the return value of alauda_init_media(). Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support") Reported-by: xingwei lee <xrivendell7(a)gmail.com> Reported-by: yue sun <samsun1006219(a)gmail.com> Reviewed-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Shichao Lai <shichaorai(a)gmail.com> Link: https://lore.kernel.org/r/20240526012745.2852061-1-shichaorai@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/storage/alauda.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c index dcc4778d1ae9..17fe35083f04 100644 --- a/drivers/usb/storage/alauda.c +++ b/drivers/usb/storage/alauda.c @@ -105,6 +105,8 @@ struct alauda_info { unsigned char sense_key; unsigned long sense_asc; /* additional sense code */ unsigned long sense_ascq; /* additional sense code qualifier */ + + bool media_initialized; }; #define short_pack(lsb,msb) ( ((u16)(lsb)) | ( ((u16)(msb))<<8 ) ) @@ -476,11 +478,12 @@ static int alauda_check_media(struct us_data *us) } /* Check for media change */ - if (status[0] & 0x08) { + if (status[0] & 0x08 || !info->media_initialized) { usb_stor_dbg(us, "Media change detected\n"); alauda_free_maps(&MEDIA_INFO(us)); - alauda_init_media(us); - + rc = alauda_init_media(us); + if (rc == USB_STOR_TRANSPORT_GOOD) + info->media_initialized = true; info->sense_key = UNIT_ATTENTION; info->sense_asc = 0x28; info->sense_ascq = 0x00; -- 2.25.1

2 1

[PATCH OLK-6.6] net: bridge: mst: fix vlan use-after-free
by Yuan Can 23 Jul '24

23 Jul '24

From: Nikolay Aleksandrov <razor(a)blackwall.org> mainline inclusion from mainline-v6.10-rc1 commit 3a7c1661ae1383364cd6092d851f5e5da64d476b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S78 CVE: CVE-2024-36979 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 3a7c1661ae1383364cd6092d851f5e5da64d476b ] syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are not accessing freed memory by making br_mst_vlan_set_state use rcu read lock. [1] WARNING: suspicious RCU usage 6.9.0-rc6-syzkaller #0 Not tainted ----------------------------- net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage! ... stack backtrace: CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h:1599 [inline] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246 Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") Reported-by: syzbot+fa04eb8a56fd923fc5d8(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fa04eb8a56fd923fc5d8 Signed-off-by: Nikolay Aleksandrov <razor(a)blackwall.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- net/bridge/br_mst.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c index ee680adcee17..3c66141d34d6 100644 --- a/net/bridge/br_mst.c +++ b/net/bridge/br_mst.c @@ -78,7 +78,7 @@ static void br_mst_vlan_set_state(struct net_bridge_port *p, struct net_bridge_v { struct net_bridge_vlan_group *vg = nbp_vlan_group(p); - if (v->state == state) + if (br_vlan_get_state(v) == state) return; br_vlan_set_state(v, state); @@ -100,11 +100,12 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, }; struct net_bridge_vlan_group *vg; struct net_bridge_vlan *v; - int err; + int err = 0; + rcu_read_lock(); vg = nbp_vlan_group(p); if (!vg) - return 0; + goto out; /* MSTI 0 (CST) state changes are notified via the regular * SWITCHDEV_ATTR_ID_PORT_STP_STATE. @@ -112,17 +113,20 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, if (msti) { err = switchdev_port_attr_set(p->dev, &attr, extack); if (err && err != -EOPNOTSUPP) - return err; + goto out; } - list_for_each_entry(v, &vg->vlan_list, vlist) { + err = 0; + list_for_each_entry_rcu(v, &vg->vlan_list, vlist) { if (v->brvlan->msti != msti) continue; br_mst_vlan_set_state(p, v, state); } - return 0; +out: + rcu_read_unlock(); + return err; } static void br_mst_vlan_sync_state(struct net_bridge_vlan *pv, u16 msti) -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] net: ieee802154: at86rf230: Stop leaking skb's
by Zhengchao Shao 23 Jul '24

23 Jul '24

From: Miquel Raynal <miquel.raynal(a)bootlin.com> stable inclusion from stable-v4.19.231 commit 6312f6a53fd3ea38125dcaca5e3c9aa7d8a60cf7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADG4I CVE: CVE-2022-48794 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9 ] Upon error the ieee802154_xmit_complete() helper is not called. Only ieee802154_wake_queue() is called manually. In the Tx case we then leak the skb structure. Free the skb structure upon error before returning when appropriate. As the 'is_tx = 0' cannot be moved in the complete handler because of a possible race between the delay in switching to STATE_RX_AACK_ON and a new interrupt, we introduce an intermediate 'was_tx' boolean just for this purpose. There is no Fixes tag applying here, many changes have been made on this area and the issue kind of always existed. Suggested-by: Alexander Aring <alex.aring(a)gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Acked-by: Alexander Aring <aahringo(a)redhat.com> Link: https://lore.kernel.org/r/20220125121426.848337-4-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt <stefan(a)datenfreihafen.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ieee802154/at86rf230.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c index 3d9e91579866..1bc09b6c308f 100644 --- a/drivers/net/ieee802154/at86rf230.c +++ b/drivers/net/ieee802154/at86rf230.c @@ -108,6 +108,7 @@ struct at86rf230_local { unsigned long cal_timeout; bool is_tx; bool is_tx_from_off; + bool was_tx; u8 tx_retry; struct sk_buff *tx_skb; struct at86rf230_state_change tx; @@ -351,7 +352,11 @@ at86rf230_async_error_recover_complete(void *context) if (ctx->free) kfree(ctx); - ieee802154_wake_queue(lp->hw); + if (lp->was_tx) { + lp->was_tx = 0; + dev_kfree_skb_any(lp->tx_skb); + ieee802154_wake_queue(lp->hw); + } } static void @@ -360,7 +365,11 @@ at86rf230_async_error_recover(void *context) struct at86rf230_state_change *ctx = context; struct at86rf230_local *lp = ctx->lp; - lp->is_tx = 0; + if (lp->is_tx) { + lp->was_tx = 1; + lp->is_tx = 0; + } + at86rf230_async_state_change(lp, ctx, STATE_RX_AACK_ON, at86rf230_async_error_recover_complete); } -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD SUCCESS 55840856d646155a61b61b78b058eeffbe5c3dca
by kernel test robot 23 Jul '24

23 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 55840856d646155a61b61b78b058eeffbe5c3dca !10160 fix CVE-2024-40915 Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-defconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-001-20240722 | `-- WARNING:modpost:vmlinux:section-mismatch-in-reference:arm_smmu_device_probe-(section:.text)-arm_smmu_v3_plat_info-(section:.init.data) |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240722 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-002-20240722 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 728m configs tested: 34 configs skipped: 134 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240722 clang-19 arm64 randconfig-002-20240722 clang-19 arm64 randconfig-003-20240722 clang-15 arm64 randconfig-004-20240722 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240722 gcc-14.1.0 loongarch randconfig-002-20240722 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240723 gcc-10 x86_64 buildonly-randconfig-002-20240723 gcc-10 x86_64 buildonly-randconfig-003-20240723 gcc-12 x86_64 buildonly-randconfig-004-20240723 gcc-8 x86_64 buildonly-randconfig-005-20240723 gcc-12 x86_64 buildonly-randconfig-006-20240723 gcc-10 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240723 clang-18 x86_64 randconfig-002-20240723 clang-18 x86_64 randconfig-003-20240723 clang-18 x86_64 randconfig-004-20240723 clang-18 x86_64 randconfig-005-20240723 clang-18 x86_64 randconfig-006-20240723 clang-18 x86_64 randconfig-011-20240723 gcc-12 x86_64 randconfig-012-20240723 clang-18 x86_64 randconfig-013-20240723 gcc-13 x86_64 randconfig-014-20240723 gcc-13 x86_64 randconfig-015-20240723 gcc-10 x86_64 randconfig-071-20240723 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 8557/23347] drivers/thermal/intel_powerclamp.o: warning: objtool: missing symbol for section .text.unlikely
by kernel test robot 23 Jul '24

23 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8d2f09e210f079f53eb6c1ba1ef639d73a17d61b commit: 775947c125d5bd6e00e0dcf9d12c57fd5d44d07f [8557/23347] asm-generic: fix -Wtype-limits compiler warnings config: x86_64-buildonly-randconfig-002-20240723 (https://download.01.org/0day-ci/archive/20240723/202407230549.TmLejsNZ-lkp@…) compiler: gcc-10 (Ubuntu 10.5.0-1ubuntu1) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240723/202407230549.TmLejsNZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407230549.TmLejsNZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/thermal/intel_powerclamp.o: warning: objtool: missing symbol for section .text.unlikely -- >> net/ipv6/icmp.o: warning: objtool: missing symbol for section .text.unlikely -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1505/23347] drivers/spi/spi.c:2040:7: error: implicit declaration of function 'gpiod_count'; did you mean 'cpuid_count'?
by kernel test robot 23 Jul '24

23 Jul '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8d2f09e210f079f53eb6c1ba1ef639d73a17d61b commit: 708663738592c63da3c851ed86ce6c084409f6c8 [1505/23347] spi: add ACPI support for SPI controller chip select lines(cs-gpios) config: x86_64-randconfig-001-20240722 (https://download.01.org/0day-ci/archive/20240723/202407230136.x5FmFlxg-lkp@…) compiler: gcc-8 (Ubuntu 8.4.0-3ubuntu2) 8.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240723/202407230136.x5FmFlxg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407230136.x5FmFlxg-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/spi/spi.c: In function '__spi_register_controller': >> drivers/spi/spi.c:2040:7: error: implicit declaration of function 'gpiod_count'; did you mean 'cpuid_count'? [-Werror=implicit-function-declaration] nb = gpiod_count(&ctlr->dev, "cs"); ^~~~~~~~~~~ cpuid_count >> drivers/spi/spi.c:2064:11: error: implicit declaration of function 'devm_gpiod_get_index'; did you mean 'devm_gpio_free'? [-Werror=implicit-function-declaration] desc = devm_gpiod_get_index(&ctlr->dev, "cs", ^~~~~~~~~~~~~~~~~~~~ devm_gpio_free >> drivers/spi/spi.c:2065:14: error: 'GPIOD_ASIS' undeclared (first use in this function); did you mean 'GPIOF_IN'? i, GPIOD_ASIS); ^~~~~~~~~~ GPIOF_IN drivers/spi/spi.c:2065:14: note: each undeclared identifier is reported only once for each function it appears in >> drivers/spi/spi.c:2068:12: error: implicit declaration of function 'desc_to_gpio'; did you mean 'irq_to_gpio'? [-Werror=implicit-function-declaration] cs[i] = desc_to_gpio(desc); ^~~~~~~~~~~~ irq_to_gpio drivers/spi/spi.c: In function 'spi_unregister_controller': drivers/spi/spi.c:2306:6: warning: variable 'dummy' set but not used [-Wunused-but-set-variable] int dummy; ^~~~~ cc1: some warnings being treated as errors vim +2040 drivers/spi/spi.c 2033 2034 static int __spi_register_controller(struct spi_controller *ctlr) 2035 { 2036 int nb, i, *cs; 2037 struct device_node *np = ctlr->dev.of_node; 2038 struct gpio_desc *desc; 2039 > 2040 nb = gpiod_count(&ctlr->dev, "cs"); 2041 ctlr->num_chipselect = max_t(int, nb, ctlr->num_chipselect); 2042 2043 /* Return error only for an incorrectly formed cs-gpios property */ 2044 if (nb == 0 || nb == -ENOENT) 2045 return 0; 2046 else if (nb < 0) 2047 return nb; 2048 2049 cs = devm_kcalloc(&ctlr->dev, ctlr->num_chipselect, sizeof(int), 2050 GFP_KERNEL); 2051 ctlr->cs_gpios = cs; 2052 2053 if (!ctlr->cs_gpios) 2054 return -ENOMEM; 2055 2056 for (i = 0; i < ctlr->num_chipselect; i++) 2057 cs[i] = -ENOENT; 2058 2059 if (IS_ENABLED(CONFIG_OF) && np) { 2060 for (i = 0; i < nb; i++) 2061 cs[i] = of_get_named_gpio(np, "cs-gpios", i); 2062 } else if (IS_ENABLED(CONFIG_ACPI) && ACPI_HANDLE(&ctlr->dev)) { 2063 for (i = 0; i < nb; i++) { > 2064 desc = devm_gpiod_get_index(&ctlr->dev, "cs", > 2065 i, GPIOD_ASIS); 2066 if (IS_ERR(desc)) 2067 continue; > 2068 cs[i] = desc_to_gpio(desc); 2069 } 2070 } 2071 return 0; 2072 } 2073 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/3] *** SUBJECT HERE ***
by dinglongwei 23 Jul '24

23 Jul '24

*** BLURB HERE *** Christian A. Ehrhardt (2): of: Fix double free in of_parse_phandle_with_args_map of: unittest: Fix compile in the non-dynamic case Geert Uytterhoeven (1): of: unittest: Fix of_count_phandle_with_args() expected value message drivers/of/base.c | 1 + drivers/of/unittest-data/tests-phandle.dtsi | 10 ++- drivers/of/unittest.c | 80 +++++++++++++-------- 3 files changed, 59 insertions(+), 32 deletions(-) -- 2.17.1

2 4

[PATCH OLK-6.6] HID: core: remove unnecessary WARN_ON() in implement()
by Wang Hai 22 Jul '24

22 Jul '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v6.6.35 commit 30f76bc468b9b2cbbd5d3eb482661e3e4798893f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD00R CVE: CVE-2024-39509 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4aa2dcfbad538adf7becd0034a3754e1bd01b2b5 ] Syzkaller hit a warning [1] in a call to implement() when trying to write a value into a field of smaller size in an output report. Since implement() already has a warn message printed out with the help of hid_warn() and value in question gets trimmed with: ... value &= m; ... WARN_ON may be considered superfluous. Remove it to suppress future syzkaller triggers. [1] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 implement drivers/hid/hid-core.c:1451 [inline] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 Modules linked in: CPU: 0 PID: 5084 Comm: syz-executor424 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:implement drivers/hid/hid-core.c:1451 [inline] RIP: 0010:hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 ... Call Trace: <TASK> __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline] usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636 hiddev_ioctl+0x138b/0x1f00 drivers/hid/usbhid/hiddev.c:726 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Fixes: 95d1c8951e5b ("HID: simplify implement() a bit") Reported-by: <syzbot+5186630949e3c55f0799(a)syzkaller.appspotmail.com> Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/hid/hid-core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index e0181218ad85..85ddeb13a3fa 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1448,7 +1448,6 @@ static void implement(const struct hid_device *hid, u8 *report, hid_warn(hid, "%s() called with too large value %d (n: %d)! (%s)\n", __func__, value, n, current->comm); - WARN_ON(1); value &= m; } } -- 2.17.1

2 1

[PATCH OLK-6.6] ptp: fix integer overflow in max_vclocks_store
by Wang Hai 22 Jul '24

22 Jul '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.36 commit 666e934d749e50a37f3796caaf843a605f115b6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0AS CVE: CVE-2024-40994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 81d23d2a24012e448f651e007fac2cfd20a45ce0 ] On 32bit systems, the "4 * max" multiply can overflow. Use kcalloc() to do the allocation to prevent this. Fixes: 44c494c8e30e ("ptp: track available ptp vclocks information") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Wojciech Drewek <wojciech.drewek(a)intel.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Reviewed-by: Heng Qi <hengqi(a)linux.alibaba.com> Link: https://lore.kernel.org/r/ee8110ed-6619-4bd7-9024-28c1f2ac24f4@moroto.mount… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/ptp/ptp_sysfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c index 34ea5c16123a..aefc06ae5d09 100644 --- a/drivers/ptp/ptp_sysfs.c +++ b/drivers/ptp/ptp_sysfs.c @@ -294,8 +294,7 @@ static ssize_t max_vclocks_store(struct device *dev, if (max < ptp->n_vclocks) goto out; - size = sizeof(int) * max; - vclock_index = kzalloc(size, GFP_KERNEL); + vclock_index = kcalloc(max, sizeof(int), GFP_KERNEL); if (!vclock_index) { err = -ENOMEM; goto out; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] HID: core: remove unnecessary WARN_ON() in implement()
by Wang Hai 22 Jul '24

22 Jul '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v5.10.221 commit 33f6832798dd3297317901cc1db556ac3ae80c24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD00R CVE: CVE-2024-39509 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4aa2dcfbad538adf7becd0034a3754e1bd01b2b5 ] Syzkaller hit a warning [1] in a call to implement() when trying to write a value into a field of smaller size in an output report. Since implement() already has a warn message printed out with the help of hid_warn() and value in question gets trimmed with: ... value &= m; ... WARN_ON may be considered superfluous. Remove it to suppress future syzkaller triggers. [1] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 implement drivers/hid/hid-core.c:1451 [inline] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 Modules linked in: CPU: 0 PID: 5084 Comm: syz-executor424 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:implement drivers/hid/hid-core.c:1451 [inline] RIP: 0010:hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 ... Call Trace: <TASK> __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline] usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636 hiddev_ioctl+0x138b/0x1f00 drivers/hid/usbhid/hiddev.c:726 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Fixes: 95d1c8951e5b ("HID: simplify implement() a bit") Reported-by: <syzbot+5186630949e3c55f0799(a)syzkaller.appspotmail.com> Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/hid/hid-core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 2f512814a111..6474aa50931c 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1429,7 +1429,6 @@ static void implement(const struct hid_device *hid, u8 *report, hid_warn(hid, "%s() called with too large value %d (n: %d)! (%s)\n", __func__, value, n, current->comm); - WARN_ON(1); value &= m; } } -- 2.17.1

2 1

[PATCH OLK-5.10] HID: core: remove unnecessary WARN_ON() in implement()
by Wang Hai 22 Jul '24

22 Jul '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v5.10.221 commit 33f6832798dd3297317901cc1db556ac3ae80c24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD00R CVE: CVE-2024-39509 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4aa2dcfbad538adf7becd0034a3754e1bd01b2b5 ] Syzkaller hit a warning [1] in a call to implement() when trying to write a value into a field of smaller size in an output report. Since implement() already has a warn message printed out with the help of hid_warn() and value in question gets trimmed with: ... value &= m; ... WARN_ON may be considered superfluous. Remove it to suppress future syzkaller triggers. [1] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 implement drivers/hid/hid-core.c:1451 [inline] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 Modules linked in: CPU: 0 PID: 5084 Comm: syz-executor424 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:implement drivers/hid/hid-core.c:1451 [inline] RIP: 0010:hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 ... Call Trace: <TASK> __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline] usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636 hiddev_ioctl+0x138b/0x1f00 drivers/hid/usbhid/hiddev.c:726 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Fixes: 95d1c8951e5b ("HID: simplify implement() a bit") Reported-by: <syzbot+5186630949e3c55f0799(a)syzkaller.appspotmail.com> Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/hid/hid-core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 476967ab6294..5281d693b32d 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1446,7 +1446,6 @@ static void implement(const struct hid_device *hid, u8 *report, hid_warn(hid, "%s() called with too large value %d (n: %d)! (%s)\n", __func__, value, n, current->comm); - WARN_ON(1); value &= m; } } -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] HID: core: remove unnecessary WARN_ON() in implement()
by Wang Hai 22 Jul '24

22 Jul '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v5.10.221 commit 33f6832798dd3297317901cc1db556ac3ae80c24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD00R CVE: CVE-2024-39509 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4aa2dcfbad538adf7becd0034a3754e1bd01b2b5 ] Syzkaller hit a warning [1] in a call to implement() when trying to write a value into a field of smaller size in an output report. Since implement() already has a warn message printed out with the help of hid_warn() and value in question gets trimmed with: ... value &= m; ... WARN_ON may be considered superfluous. Remove it to suppress future syzkaller triggers. [1] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 implement drivers/hid/hid-core.c:1451 [inline] WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 Modules linked in: CPU: 0 PID: 5084 Comm: syz-executor424 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:implement drivers/hid/hid-core.c:1451 [inline] RIP: 0010:hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863 ... Call Trace: <TASK> __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline] usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636 hiddev_ioctl+0x138b/0x1f00 drivers/hid/usbhid/hiddev.c:726 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Fixes: 95d1c8951e5b ("HID: simplify implement() a bit") Reported-by: <syzbot+5186630949e3c55f0799(a)syzkaller.appspotmail.com> Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/hid/hid-core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index e70ac6d16ea8..4b12809b5a3b 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1241,7 +1241,6 @@ static void implement(const struct hid_device *hid, u8 *report, hid_warn(hid, "%s() called with too large value %d (n: %d)! (%s)\n", __func__, value, n, current->comm); - WARN_ON(1); value &= m; } } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/5] CVE-2024-26979
by Pu Lehui 22 Jul '24

22 Jul '24

Christian König (2): drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- 19 files changed, 133 insertions(+), 117 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10 0/5] CVE-2024-26979
by Pu Lehui 22 Jul '24

22 Jul '24

Christian König (2): drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 Lee Jones (1): drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' Zack Rusin (2): drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++++++++++++------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 ++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 ++- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +----------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- 19 files changed, 133 insertions(+), 117 deletions(-) -- 2.34.1

2 6

[PATCH] net: bridge: mst: fix vlan use-after-free
by Yuan Can 22 Jul '24

22 Jul '24

From: Nikolay Aleksandrov <razor(a)blackwall.org> mainline inclusion from mainline-v6.10-rc1 commit 3a7c1661ae1383364cd6092d851f5e5da64d476b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S78 CVE: CVE-2024-36979 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 3a7c1661ae1383364cd6092d851f5e5da64d476b ] syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are not accessing freed memory by making br_mst_vlan_set_state use rcu read lock. [1] WARNING: suspicious RCU usage 6.9.0-rc6-syzkaller #0 Not tainted ----------------------------- net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage! ... stack backtrace: CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nbp_vlan_group net/bridge/br_private.h:1599 [inline] br_mst_set_state+0x1ea/0x650 net/bridge/br_mst.c:105 br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47 br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1844 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2429 run_timer_base kernel/time/timer.c:2438 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2448 __do_softirq+0x2c6/0x980 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:lock_acquire+0x264/0x550 kernel/locking/lockdep.c:5758 Code: 2b 00 74 08 4c 89 f7 e8 ba d1 84 00 f6 44 24 61 02 0f 85 85 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25 RSP: 0018:ffffc90013657100 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 1ffff920026cae2c RCX: 0000000000000001 RDX: dffffc0000000000 RSI: ffffffff8bcaca00 RDI: ffffffff8c1eaa60 RBP: ffffc90013657260 R08: ffffffff92efe507 R09: 1ffffffff25dfca0 R10: dffffc0000000000 R11: fffffbfff25dfca1 R12: 1ffff920026cae28 R13: dffffc0000000000 R14: ffffc90013657160 R15: 0000000000000246 Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") Reported-by: syzbot+fa04eb8a56fd923fc5d8(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fa04eb8a56fd923fc5d8 Signed-off-by: Nikolay Aleksandrov <razor(a)blackwall.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- net/bridge/br_mst.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c index ee680adcee17..3c66141d34d6 100644 --- a/net/bridge/br_mst.c +++ b/net/bridge/br_mst.c @@ -78,7 +78,7 @@ static void br_mst_vlan_set_state(struct net_bridge_port *p, struct net_bridge_v { struct net_bridge_vlan_group *vg = nbp_vlan_group(p); - if (v->state == state) + if (br_vlan_get_state(v) == state) return; br_vlan_set_state(v, state); @@ -100,11 +100,12 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, }; struct net_bridge_vlan_group *vg; struct net_bridge_vlan *v; - int err; + int err = 0; + rcu_read_lock(); vg = nbp_vlan_group(p); if (!vg) - return 0; + goto out; /* MSTI 0 (CST) state changes are notified via the regular * SWITCHDEV_ATTR_ID_PORT_STP_STATE. @@ -112,17 +113,20 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, if (msti) { err = switchdev_port_attr_set(p->dev, &attr, extack); if (err && err != -EOPNOTSUPP) - return err; + goto out; } - list_for_each_entry(v, &vg->vlan_list, vlist) { + err = 0; + list_for_each_entry_rcu(v, &vg->vlan_list, vlist) { if (v->brvlan->msti != msti) continue; br_mst_vlan_set_state(p, v, state); } - return 0; +out: + rcu_read_unlock(); + return err; } static void br_mst_vlan_sync_state(struct net_bridge_vlan *pv, u16 msti) -- 2.17.1

1 0

[PATCH openEuler-22.03-LTS-SP1] USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
by Jinjiang Tu 22 Jul '24

22 Jul '24

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v5.10.221 commit c0747d76eb05542b5d49f67069b64ef5ff732c6c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACQYO CVE: CVE-2024-40904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 22f00812862564b314784167a89f27b444f82a46 upstream. The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driver's immediate resubmission of interrupt URBs with -EPROTO status combined with the dummy-hcd emulation to cause a CPU lockup: cdc_wdm 1-1:1.0: nonzero urb status received: -71 cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor782:6625] CPU#0 Utilization every 4s during lockup: #1: 98% system, 0% softirq, 3% hardirq, 0% idle #2: 98% system, 0% softirq, 3% hardirq, 0% idle #3: 98% system, 0% softirq, 3% hardirq, 0% idle #4: 98% system, 0% softirq, 3% hardirq, 0% idle #5: 98% system, 1% softirq, 3% hardirq, 0% idle Modules linked in: irq event stamp: 73096 hardirqs last enabled at (73095): [<ffff80008037bc00>] console_emit_next_record kernel/printk/printk.c:2935 [inline] hardirqs last enabled at (73095): [<ffff80008037bc00>] console_flush_all+0x650/0xb74 kernel/printk/printk.c:2994 hardirqs last disabled at (73096): [<ffff80008af10b00>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (73096): [<ffff80008af10b00>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (73048): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (73048): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582 softirqs last disabled at (73043): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588 CPU: 0 PID: 6625 Comm: syz-executor782 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Testing showed that the problem did not occur if the two error messages -- the first two lines above -- were removed; apparently adding material to the kernel log takes a surprisingly large amount of time. In any case, the best approach for preventing these lockups and to avoid spamming the log with thousands of error messages per second is to ratelimit the two dev_err() calls. Therefore we replace them with dev_err_ratelimited(). Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Suggested-by: Greg KH <gregkh(a)linuxfoundation.org> Reported-and-tested-by: syzbot+5f996b83575ef4058638(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/00000000000073d54b061a6a1c65@google.com/ Reported-and-tested-by: syzbot+1b2abad17596ad03dcff(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/000000000000f45085061aa9b37e@google.com/ Fixes: 9908a32e94de ("USB: remove err() macro from usb class drivers") Link: https://lore.kernel.org/linux-usb/40dfa45b-5f21-4eef-a8c1-51a2f320e267@rowl… Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/29855215-52f5-4385-b058-91f42c2bee18@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/class/cdc-wdm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c index 80332b6a1963..aa91d561a0ac 100644 --- a/drivers/usb/class/cdc-wdm.c +++ b/drivers/usb/class/cdc-wdm.c @@ -252,14 +252,14 @@ static void wdm_int_callback(struct urb *urb) dev_err(&desc->intf->dev, "Stall on int endpoint\n"); goto sw; /* halt is cleared in work */ default: - dev_err(&desc->intf->dev, + dev_err_ratelimited(&desc->intf->dev, "nonzero urb status received: %d\n", status); break; } } if (urb->actual_length < sizeof(struct usb_cdc_notification)) { - dev_err(&desc->intf->dev, "wdm_int_callback - %d bytes\n", + dev_err_ratelimited(&desc->intf->dev, "wdm_int_callback - %d bytes\n", urb->actual_length); goto exit; } -- 2.25.1

2 2

[PATCH OLK-5.10] USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
by Jinjiang Tu 22 Jul '24

22 Jul '24

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v5.10.221 commit c0747d76eb05542b5d49f67069b64ef5ff732c6c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACQYO CVE: CVE-2024-40904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 22f00812862564b314784167a89f27b444f82a46 upstream. The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driver's immediate resubmission of interrupt URBs with -EPROTO status combined with the dummy-hcd emulation to cause a CPU lockup: cdc_wdm 1-1:1.0: nonzero urb status received: -71 cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor782:6625] CPU#0 Utilization every 4s during lockup: #1: 98% system, 0% softirq, 3% hardirq, 0% idle #2: 98% system, 0% softirq, 3% hardirq, 0% idle #3: 98% system, 0% softirq, 3% hardirq, 0% idle #4: 98% system, 0% softirq, 3% hardirq, 0% idle #5: 98% system, 1% softirq, 3% hardirq, 0% idle Modules linked in: irq event stamp: 73096 hardirqs last enabled at (73095): [<ffff80008037bc00>] console_emit_next_record kernel/printk/printk.c:2935 [inline] hardirqs last enabled at (73095): [<ffff80008037bc00>] console_flush_all+0x650/0xb74 kernel/printk/printk.c:2994 hardirqs last disabled at (73096): [<ffff80008af10b00>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (73096): [<ffff80008af10b00>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (73048): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (73048): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582 softirqs last disabled at (73043): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588 CPU: 0 PID: 6625 Comm: syz-executor782 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Testing showed that the problem did not occur if the two error messages -- the first two lines above -- were removed; apparently adding material to the kernel log takes a surprisingly large amount of time. In any case, the best approach for preventing these lockups and to avoid spamming the log with thousands of error messages per second is to ratelimit the two dev_err() calls. Therefore we replace them with dev_err_ratelimited(). Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Suggested-by: Greg KH <gregkh(a)linuxfoundation.org> Reported-and-tested-by: syzbot+5f996b83575ef4058638(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/00000000000073d54b061a6a1c65@google.com/ Reported-and-tested-by: syzbot+1b2abad17596ad03dcff(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/000000000000f45085061aa9b37e@google.com/ Fixes: 9908a32e94de ("USB: remove err() macro from usb class drivers") Link: https://lore.kernel.org/linux-usb/40dfa45b-5f21-4eef-a8c1-51a2f320e267@rowl… Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/29855215-52f5-4385-b058-91f42c2bee18@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/class/cdc-wdm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c index 80332b6a1963..aa91d561a0ac 100644 --- a/drivers/usb/class/cdc-wdm.c +++ b/drivers/usb/class/cdc-wdm.c @@ -252,14 +252,14 @@ static void wdm_int_callback(struct urb *urb) dev_err(&desc->intf->dev, "Stall on int endpoint\n"); goto sw; /* halt is cleared in work */ default: - dev_err(&desc->intf->dev, + dev_err_ratelimited(&desc->intf->dev, "nonzero urb status received: %d\n", status); break; } } if (urb->actual_length < sizeof(struct usb_cdc_notification)) { - dev_err(&desc->intf->dev, "wdm_int_callback - %d bytes\n", + dev_err_ratelimited(&desc->intf->dev, "wdm_int_callback - %d bytes\n", urb->actual_length); goto exit; } -- 2.25.1

2 1

[PATCH OLK-6.6] mm: filemap: optimize semantic when thp_exec_enabled is set to 3
by Nanyong Sun 22 Jul '24

22 Jul '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAEOV4 CVE: NA -------------------------------- When thp_exec_enabled is set to 3, try PMD mapping THP first, if failed, then try mTHP like cont-64K on ARM64. The previous implementation use hugepage_madvise() in try_enable_file_exec_thp() and it will always set VM_HUGEPAGE to vm_flags, so we lost this semantic, let's check PMD_ORDER by thp_vma_allowable_order() to correct the semantic. And now the khugepaged_enter_vma() step in hugepage_madvise() is missing, this is OK because the process is already entered in khugepaged after this commit 613bec092fe7 ("mm: mmap: register suitable readonly file vmas for khugepaged"). Signed-off-by: Nanyong Sun <sunnanyong(a)huawei.com> --- mm/filemap.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mm/filemap.c b/mm/filemap.c index d3c813429bf2..4dd8fe6ffa05 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -3159,8 +3159,12 @@ static inline void try_enable_file_exec_thp(struct vm_area_struct *vma, if (file->f_op->get_unmapped_area != thp_get_unmapped_area) return; - if (file_exec_thp_enabled()) - hugepage_madvise(vma, vm_flags, MADV_HUGEPAGE); + if (!file_exec_thp_enabled()) + return; + + if (thp_vma_allowable_order(vma, *vm_flags, TVA_ENFORCE_SYSFS, + PMD_ORDER)) + *vm_flags |= VM_HUGEPAGE; } static inline bool file_exec_can_enable_mthp(struct address_space *mapping, -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
by Zheng Yejian 22 Jul '24

22 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEPSH Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Infinite log printing occurs during fuzz test: rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ... ... dvb-usb: schedule remote query interval to 100 msecs. dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ... dvb-usb: bulk message failed: -22 (1/0) dvb-usb: bulk message failed: -22 (1/0) dvb-usb: bulk message failed: -22 (1/0) ... dvb-usb: bulk message failed: -22 (1/0) Looking into the codes, there is a loop in dvb_usb_read_remote_control(), that is in rc_core_dvb_usb_remote_init() create a work that will call dvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), see following code snippet: rc_core_dvb_usb_remote_init() { ... INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control); schedule_delayed_work(&d->rc_query_work, msecs_to_jiffies(rc_interval)); ... } dvb_usb_read_remote_control() { ... err = d->props.rc.core.rc_query(d); if (err) err(...) // Did not return even if query failed schedule_delayed_work(&d->rc_query_work, msecs_to_jiffies(rc_interval)); } When the infinite log printing occurs, the query callback 'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to the failure of finding a valid 'generic_bulk_ctrl_endpoint' in usb_bulk_msg(), see following code snippet: cxusb_rc_query() { cxusb_ctrl_msg() { dvb_usb_generic_rw() { ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint),...); if (ret) err("bulk message failed: %d (%d/%d)",ret,wlen,actlen); ... } ... } By analyzing the corresponding USB descriptor, it shows that the bNumEndpoints is 0 in its interface descriptor, but the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this 'invalid' USB device should be rejected before it calls into dvb_usb_read_remote_control(). To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. And as Sean suggested, the same check and clear halts should be done for 'generic_bulk_ctrl_endpoint_response'. So introduce dvb_usb_check_bulk_endpoint() to do it for both of them. Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Zheng Yejian <zhengyejian(a)huaweicloud.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++++++++++++++++++++--- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index 61439c8f33ca..8b52a9743057 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -23,11 +23,40 @@ static int dvb_usb_force_pid_filter_usage; module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); +static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) +{ + if (endpoint) { + int ret; + + ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); + if (ret) + return ret; + ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); + if (ret) + return ret; + } + return 0; +} + +static void dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint) +{ + if (endpoint) { + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); + } +} + static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) { struct dvb_usb_adapter *adap; int ret, n, o; + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); + if (ret) + return ret; + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); + if (ret) + return ret; for (n = 0; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d; @@ -103,10 +132,8 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) * when reloading the driver w/o replugging the device * sometimes a timeout occurs, this helps */ - if (d->props.generic_bulk_ctrl_endpoint != 0) { - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); - } + dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint); + dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response); return 0; -- 2.25.1

2 1

[PATCH OLK-5.10] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
by Zheng Yejian 22 Jul '24

22 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEPSH Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Infinite log printing occurs during fuzz test: rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ... ... dvb-usb: schedule remote query interval to 100 msecs. dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ... dvb-usb: bulk message failed: -22 (1/0) dvb-usb: bulk message failed: -22 (1/0) dvb-usb: bulk message failed: -22 (1/0) ... dvb-usb: bulk message failed: -22 (1/0) Looking into the codes, there is a loop in dvb_usb_read_remote_control(), that is in rc_core_dvb_usb_remote_init() create a work that will call dvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), see following code snippet: rc_core_dvb_usb_remote_init() { ... INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control); schedule_delayed_work(&d->rc_query_work, msecs_to_jiffies(rc_interval)); ... } dvb_usb_read_remote_control() { ... err = d->props.rc.core.rc_query(d); if (err) err(...) // Did not return even if query failed schedule_delayed_work(&d->rc_query_work, msecs_to_jiffies(rc_interval)); } When the infinite log printing occurs, the query callback 'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to the failure of finding a valid 'generic_bulk_ctrl_endpoint' in usb_bulk_msg(), see following code snippet: cxusb_rc_query() { cxusb_ctrl_msg() { dvb_usb_generic_rw() { ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint),...); if (ret) err("bulk message failed: %d (%d/%d)",ret,wlen,actlen); ... } ... } By analyzing the corresponding USB descriptor, it shows that the bNumEndpoints is 0 in its interface descriptor, but the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this 'invalid' USB device should be rejected before it calls into dvb_usb_read_remote_control(). To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. And as Sean suggested, the same check and clear halts should be done for 'generic_bulk_ctrl_endpoint_response'. So introduce dvb_usb_check_bulk_endpoint() to do it for both of them. Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Zheng Yejian <zhengyejian(a)huaweicloud.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++++++++++++++++++++--- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index 58eea8ab5477..6cf6d08cc4ec 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -23,11 +23,40 @@ static int dvb_usb_force_pid_filter_usage; module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); +static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) +{ + if (endpoint) { + int ret; + + ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); + if (ret) + return ret; + ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); + if (ret) + return ret; + } + return 0; +} + +static void dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint) +{ + if (endpoint) { + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); + } +} + static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) { struct dvb_usb_adapter *adap; int ret, n, o; + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); + if (ret) + return ret; + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); + if (ret) + return ret; for (n = 0; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d; @@ -103,10 +132,8 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) * when reloading the driver w/o replugging the device * sometimes a timeout occurs, this helps */ - if (d->props.generic_bulk_ctrl_endpoint != 0) { - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); - } + dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint); + dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response); return 0; -- 2.25.1

2 1

[PATCH OLK-6.6] batman-adv: bypass empty buckets in batadv_purge_orig_ref()
by Liu Jian 22 Jul '24

22 Jul '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.36 commit 2685008a5f9a636434a8508419cee8158a2f52c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACS84 CVE: CVE-2024-40981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 40dc8ab605894acae1473e434944924a22cfaaa0 ] Many syzbot reports are pointing to soft lockups in batadv_purge_orig_ref() [1] Root cause is unknown, but we can avoid spending too much time there and perhaps get more interesting reports. [1] watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] Modules linked in: irq event stamp: 6182794 hardirqs last enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: bat_events batadv_purge_orig pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 sp : ffff800099007970 x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000 x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001 x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4 x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0 x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001 x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103 sp : ffff800093a17d30 x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4 x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002 x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000 x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396 x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001 x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003 x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0 x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49 cpuidle_idle_call kernel/sched/idle.c:170 [inline] do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410 secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272 __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404 Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/batman-adv/originator.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c index 34903df4fe93..dafef3a78ad5 100644 --- a/net/batman-adv/originator.c +++ b/net/batman-adv/originator.c @@ -1238,6 +1238,8 @@ void batadv_purge_orig_ref(struct batadv_priv *bat_priv) /* for all origins... */ for (i = 0; i < hash->size; i++) { head = &hash->table[i]; + if (hlist_empty(head)) + continue; list_lock = &hash->list_locks[i]; spin_lock_bh(list_lock); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] batman-adv: bypass empty buckets in batadv_purge_orig_ref()
by Liu Jian 22 Jul '24

22 Jul '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.10-rc1 commit 40dc8ab605894acae1473e434944924a22cfaaa0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACS84 CVE: CVE-2024-40981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Many syzbot reports are pointing to soft lockups in batadv_purge_orig_ref() [1] Root cause is unknown, but we can avoid spending too much time there and perhaps get more interesting reports. [1] watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] Modules linked in: irq event stamp: 6182794 hardirqs last enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: bat_events batadv_purge_orig pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 sp : ffff800099007970 x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000 x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001 x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4 x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0 x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001 x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103 sp : ffff800093a17d30 x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4 x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002 x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000 x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396 x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001 x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003 x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0 x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49 cpuidle_idle_call kernel/sched/idle.c:170 [inline] do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410 secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272 __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404 Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/batman-adv/originator.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c index 2d38a09459bb..3b2a3759efd6 100644 --- a/net/batman-adv/originator.c +++ b/net/batman-adv/originator.c @@ -1285,6 +1285,8 @@ void batadv_purge_orig_ref(struct batadv_priv *bat_priv) /* for all origins... */ for (i = 0; i < hash->size; i++) { head = &hash->table[i]; + if (hlist_empty(head)) + continue; list_lock = &hash->list_locks[i]; spin_lock_bh(list_lock); -- 2.34.1

2 1

[PATCH OLK-5.10] batman-adv: bypass empty buckets in batadv_purge_orig_ref()
by Liu Jian 22 Jul '24

22 Jul '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.10-rc1 commit 40dc8ab605894acae1473e434944924a22cfaaa0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACS84 CVE: CVE-2024-40981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Many syzbot reports are pointing to soft lockups in batadv_purge_orig_ref() [1] Root cause is unknown, but we can avoid spending too much time there and perhaps get more interesting reports. [1] watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] Modules linked in: irq event stamp: 6182794 hardirqs last enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: bat_events batadv_purge_orig pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 sp : ffff800099007970 x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000 x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001 x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4 x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0 x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001 x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103 sp : ffff800093a17d30 x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4 x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002 x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000 x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396 x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001 x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003 x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0 x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49 cpuidle_idle_call kernel/sched/idle.c:170 [inline] do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410 secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272 __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404 Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/batman-adv/originator.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c index 2d38a09459bb..3b2a3759efd6 100644 --- a/net/batman-adv/originator.c +++ b/net/batman-adv/originator.c @@ -1285,6 +1285,8 @@ void batadv_purge_orig_ref(struct batadv_priv *bat_priv) /* for all origins... */ for (i = 0; i < hash->size; i++) { head = &hash->table[i]; + if (hlist_empty(head)) + continue; list_lock = &hash->list_locks[i]; spin_lock_bh(list_lock); -- 2.34.1

2 1

[PATCH OLK-6.6] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
by Zheng Yejian 22 Jul '24

22 Jul '24

mainline inclusion from mainline-v6.11-rc1 commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEPSH Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Infinite log printing occurs during fuzz test: rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ... ... dvb-usb: schedule remote query interval to 100 msecs. dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ... dvb-usb: bulk message failed: -22 (1/0) dvb-usb: bulk message failed: -22 (1/0) dvb-usb: bulk message failed: -22 (1/0) ... dvb-usb: bulk message failed: -22 (1/0) Looking into the codes, there is a loop in dvb_usb_read_remote_control(), that is in rc_core_dvb_usb_remote_init() create a work that will call dvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), see following code snippet: rc_core_dvb_usb_remote_init() { ... INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control); schedule_delayed_work(&d->rc_query_work, msecs_to_jiffies(rc_interval)); ... } dvb_usb_read_remote_control() { ... err = d->props.rc.core.rc_query(d); if (err) err(...) // Did not return even if query failed schedule_delayed_work(&d->rc_query_work, msecs_to_jiffies(rc_interval)); } When the infinite log printing occurs, the query callback 'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to the failure of finding a valid 'generic_bulk_ctrl_endpoint' in usb_bulk_msg(), see following code snippet: cxusb_rc_query() { cxusb_ctrl_msg() { dvb_usb_generic_rw() { ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint),...); if (ret) err("bulk message failed: %d (%d/%d)",ret,wlen,actlen); ... } ... } By analyzing the corresponding USB descriptor, it shows that the bNumEndpoints is 0 in its interface descriptor, but the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this 'invalid' USB device should be rejected before it calls into dvb_usb_read_remote_control(). To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. And as Sean suggested, the same check and clear halts should be done for 'generic_bulk_ctrl_endpoint_response'. So introduce dvb_usb_check_bulk_endpoint() to do it for both of them. Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Zheng Yejian <zhengyejian(a)huaweicloud.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++++++++++++++++++++--- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index fbf58012becd..22d83ac18eb7 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -23,11 +23,40 @@ static int dvb_usb_force_pid_filter_usage; module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); +static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) +{ + if (endpoint) { + int ret; + + ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); + if (ret) + return ret; + ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); + if (ret) + return ret; + } + return 0; +} + +static void dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint) +{ + if (endpoint) { + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); + } +} + static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) { struct dvb_usb_adapter *adap; int ret, n, o; + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); + if (ret) + return ret; + ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); + if (ret) + return ret; for (n = 0; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d; @@ -103,10 +132,8 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) * when reloading the driver w/o replugging the device * sometimes a timeout occurs, this helps */ - if (d->props.generic_bulk_ctrl_endpoint != 0) { - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); - } + dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint); + dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response); return 0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
by Liu Shixin 22 Jul '24

22 Jul '24

From: Li RongQing <lirongqing(a)baidu.com> stable inclusion from stable-v6.6.36 commit faa35db78b058a2ab6e074ee283f69fa398c36a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACZX7 CVE: CVE-2024-40956 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e3215deca4520773cd2b155bed164c12365149a7 ] Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The descriptor is freed via idxd_desc_complete() and there's a slight chance may cause issue for the list iterator when the descriptor is reused by another thread without it being deleted from the list. Fixes: 16e19e11228b ("dmaengine: idxd: Fix list corruption in description completion") Signed-off-by: Li RongQing <lirongqing(a)baidu.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Reviewed-by: Fenghua Yu <fenghua.yu(a)intel.com> Link: https://lore.kernel.org/r/20240603012444.11902-1-lirongqing@baidu.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/dma/idxd/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c index aa314ebec587..4a3eb96b8199 100644 --- a/drivers/dma/idxd/irq.c +++ b/drivers/dma/idxd/irq.c @@ -454,11 +454,13 @@ static void irq_process_work_list(struct idxd_irq_entry *irq_entry) spin_unlock(&irq_entry->list_lock); - list_for_each_entry(desc, &flist, list) { + list_for_each_entry_safe(desc, n, &flist, list) { /* * Check against the original status as ABORT is software defined * and 0xff, which DSA_COMP_STATUS_MASK can mask out. */ + list_del(&desc->list); + if (unlikely(desc->completion->status == IDXD_COMP_DESC_ABORT)) { idxd_dma_complete_txd(desc, IDXD_COMPLETE_ABORT, true); continue; -- 2.25.1

2 1

[PATCH OLK-5.10] dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
by Liu Shixin 22 Jul '24

22 Jul '24

From: Li RongQing <lirongqing(a)baidu.com> stable inclusion from stable-v6.6.36 commit faa35db78b058a2ab6e074ee283f69fa398c36a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACZX7 CVE: CVE-2024-40956 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e3215deca4520773cd2b155bed164c12365149a7 ] Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The descriptor is freed via idxd_desc_complete() and there's a slight chance may cause issue for the list iterator when the descriptor is reused by another thread without it being deleted from the list. Fixes: 16e19e11228b ("dmaengine: idxd: Fix list corruption in description completion") Signed-off-by: Li RongQing <lirongqing(a)baidu.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Reviewed-by: Fenghua Yu <fenghua.yu(a)intel.com> Link: https://lore.kernel.org/r/20240603012444.11902-1-lirongqing@baidu.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/dma/idxd/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c index aa314ebec587..4a3eb96b8199 100644 --- a/drivers/dma/idxd/irq.c +++ b/drivers/dma/idxd/irq.c @@ -454,11 +454,13 @@ static void irq_process_work_list(struct idxd_irq_entry *irq_entry) spin_unlock(&irq_entry->list_lock); - list_for_each_entry(desc, &flist, list) { + list_for_each_entry_safe(desc, n, &flist, list) { /* * Check against the original status as ABORT is software defined * and 0xff, which DSA_COMP_STATUS_MASK can mask out. */ + list_del(&desc->list); + if (unlikely(desc->completion->status == IDXD_COMP_DESC_ABORT)) { idxd_dma_complete_txd(desc, IDXD_COMPLETE_ABORT, true); continue; -- 2.25.1

2 1

[PATCH OLK-6.6] fbdev: savage: Handle err return when savagefb_check_var failed
by heyujie 22 Jul '24

22 Jul '24

From: Cai Xinchen <caixinchen1(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit 6ad959b6703e2c4c5d7af03b4cfd5ff608036339 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0KC CVE: CVE-2024-39475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zero error. However the function savagefb_probe doesn't handle the error return of savagefb_check_var. When pixclock is 0, it will cause divide-by-zero error. Fixes: 04e5eac8f3ab ("fbdev: savage: Error out if pixclock equals zero") Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/video/fbdev/savage/savagefb_driver.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c index 4ba5cd55e5a5..205ccbe8f172 100644 --- a/drivers/video/fbdev/savage/savagefb_driver.c +++ b/drivers/video/fbdev/savage/savagefb_driver.c @@ -2276,7 +2276,10 @@ static int savagefb_probe(struct pci_dev *dev, const struct pci_device_id *id) if (info->var.xres_virtual > 0x1000) info->var.xres_virtual = 0x1000; #endif - savagefb_check_var(&info->var, info); + err = savagefb_check_var(&info->var, info); + if (err) + goto failed; + savagefb_set_fix(info); /* -- 2.34.1

2 1

[PATCH OLK-5.10] fbdev: savage: Handle err return when savagefb_check_var failed
by heyujie 22 Jul '24

22 Jul '24

From: Cai Xinchen <caixinchen1(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit 6ad959b6703e2c4c5d7af03b4cfd5ff608036339 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0KC CVE: CVE-2024-39475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zero error. However the function savagefb_probe doesn't handle the error return of savagefb_check_var. When pixclock is 0, it will cause divide-by-zero error. Fixes: 04e5eac8f3ab ("fbdev: savage: Error out if pixclock equals zero") Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/video/fbdev/savage/savagefb_driver.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c index 94ebd8af50cf..224d7c8146a9 100644 --- a/drivers/video/fbdev/savage/savagefb_driver.c +++ b/drivers/video/fbdev/savage/savagefb_driver.c @@ -2271,7 +2271,10 @@ static int savagefb_probe(struct pci_dev *dev, const struct pci_device_id *id) if (info->var.xres_virtual > 0x1000) info->var.xres_virtual = 0x1000; #endif - savagefb_check_var(&info->var, info); + err = savagefb_check_var(&info->var, info); + if (err) + goto failed; + savagefb_set_fix(info); /* -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] fbdev: savage: Handle err return when savagefb_check_var failed
by heyujie 22 Jul '24

22 Jul '24

From: Cai Xinchen <caixinchen1(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit 6ad959b6703e2c4c5d7af03b4cfd5ff608036339 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0KC CVE: CVE-2024-39475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zero error. However the function savagefb_probe doesn't handle the error return of savagefb_check_var. When pixclock is 0, it will cause divide-by-zero error. Fixes: 04e5eac8f3ab ("fbdev: savage: Error out if pixclock equals zero") Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/video/fbdev/savage/savagefb_driver.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c index 94ebd8af50cf..224d7c8146a9 100644 --- a/drivers/video/fbdev/savage/savagefb_driver.c +++ b/drivers/video/fbdev/savage/savagefb_driver.c @@ -2271,7 +2271,10 @@ static int savagefb_probe(struct pci_dev *dev, const struct pci_device_id *id) if (info->var.xres_virtual > 0x1000) info->var.xres_virtual = 0x1000; #endif - savagefb_check_var(&info->var, info); + err = savagefb_check_var(&info->var, info); + if (err) + goto failed; + savagefb_set_fix(info); /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sctp: fix kernel-infoleak for SCTP sockets
by Liu Jian 22 Jul '24

22 Jul '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.235 commit 2d8fa3fdf4542a2174a72d92018f488d65d848c5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGSH CVE: CVE-2022-48855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 633593a808980f82d251d0ca89730d8bb8b0220c ] syzbot reported a kernel infoleak [1] of 4 bytes. After analysis, it turned out r->idiag_expires is not initialized if inet_sctp_diag_fill() calls inet_diag_msg_common_fill() Make sure to clear idiag_timer/idiag_retrans/idiag_expires and let inet_diag_msg_sctpasoc_fill() fill them again if needed. [1] BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:154 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668 instrument_copy_to_user include/linux/instrumented.h:121 [inline] copyout lib/iov_iter.c:154 [inline] _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668 copy_to_iter include/linux/uio.h:162 [inline] simple_copy_to_iter+0xf3/0x140 net/core/datagram.c:519 __skb_datagram_iter+0x2d5/0x11b0 net/core/datagram.c:425 skb_copy_datagram_iter+0xdc/0x270 net/core/datagram.c:533 skb_copy_datagram_msg include/linux/skbuff.h:3696 [inline] netlink_recvmsg+0x669/0x1c80 net/netlink/af_netlink.c:1977 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] __sys_recvfrom+0x795/0xa10 net/socket.c:2097 __do_sys_recvfrom net/socket.c:2115 [inline] __se_sys_recvfrom net/socket.c:2111 [inline] __x64_sys_recvfrom+0x19d/0x210 net/socket.c:2111 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3247 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4975 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1158 [inline] netlink_dump+0x3e5/0x16c0 net/netlink/af_netlink.c:2248 __netlink_dump_start+0xcf8/0xe90 net/netlink/af_netlink.c:2373 netlink_dump_start include/linux/netlink.h:254 [inline] inet_diag_handler_cmd+0x2e7/0x400 net/ipv4/inet_diag.c:1341 sock_diag_rcv_msg+0x24a/0x620 netlink_rcv_skb+0x40c/0x7e0 net/netlink/af_netlink.c:2494 sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:277 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x1093/0x1360 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x14d9/0x1720 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] sock_write_iter+0x594/0x690 net/socket.c:1061 do_iter_readv_writev+0xa7f/0xc70 do_iter_write+0x52c/0x1500 fs/read_write.c:851 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Bytes 68-71 of 2508 are uninitialized Memory access of size 2508 starts at ffff888114f9b000 Data copied to user address 00007f7fe09ff2e0 CPU: 1 PID: 3478 Comm: syz-executor306 Not tainted 5.17.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: syzbot <syzkaller(a)googlegroups.com> Cc: Vlad Yasevich <vyasevich(a)gmail.com> Cc: Neil Horman <nhorman(a)tuxdriver.com> Cc: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Reviewed-by: Xin Long <lucien.xin(a)gmail.com> Link: https://lore.kernel.org/r/20220310001145.297371-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sctp/diag.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/net/sctp/diag.c b/net/sctp/diag.c index 0a9db0a7f423..5f10984bf0f5 100644 --- a/net/sctp/diag.c +++ b/net/sctp/diag.c @@ -76,10 +76,6 @@ static void inet_diag_msg_sctpasoc_fill(struct inet_diag_msg *r, r->idiag_timer = SCTP_EVENT_TIMEOUT_T3_RTX; r->idiag_retrans = asoc->rtx_data_chunks; r->idiag_expires = jiffies_to_msecs(t3_rtx->expires - jiffies); - } else { - r->idiag_timer = 0; - r->idiag_retrans = 0; - r->idiag_expires = 0; } } @@ -159,13 +155,14 @@ static int inet_sctp_diag_fill(struct sock *sk, struct sctp_association *asoc, r = nlmsg_data(nlh); BUG_ON(!sk_fullsock(sk)); + r->idiag_timer = 0; + r->idiag_retrans = 0; + r->idiag_expires = 0; if (asoc) { inet_diag_msg_sctpasoc_fill(r, sk, asoc); } else { inet_diag_msg_common_fill(r, sk); r->idiag_state = sk->sk_state; - r->idiag_timer = 0; - r->idiag_retrans = 0; } if (inet_diag_msg_attrs_fill(sk, skb, r, ext, user_ns, net_admin)) -- 2.34.1

2 1

[PATCH OLK-6.6] mm: filemap: optimize semantic when thp_exec_enabled is set to 3
by Nanyong Sun 22 Jul '24

22 Jul '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAEOV4 CVE: NA -------------------------------- When thp_exec_enabled is set to 3, try PMD mapping THP first, if failed, then try mTHP like cont-64K on ARM64. The previous implementaion use hugepage_madvise() in try_enable_file_exec_thp and it will always set vm_flags |= VM_HUGEPAGE so we lost this semantic. Replace it as thp_vma_allowable_order(,,,PMD_ORDER) to implement the right semantic. And now the khugepaged_enter_vma() step in hugepage_madvise() is missing, this is OK because the process is already entered in khugepaged after this commit 613bec092fe7 ("mm: mmap: register suitable readonly file vmas for khugepaged") Signed-off-by: Nanyong Sun <sunnanyong(a)huawei.com> --- mm/filemap.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mm/filemap.c b/mm/filemap.c index d3c813429bf2..4dd8fe6ffa05 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -3159,8 +3159,12 @@ static inline void try_enable_file_exec_thp(struct vm_area_struct *vma, if (file->f_op->get_unmapped_area != thp_get_unmapped_area) return; - if (file_exec_thp_enabled()) - hugepage_madvise(vma, vm_flags, MADV_HUGEPAGE); + if (!file_exec_thp_enabled()) + return; + + if (thp_vma_allowable_order(vma, *vm_flags, TVA_ENFORCE_SYSFS, + PMD_ORDER)) + *vm_flags |= VM_HUGEPAGE; } static inline bool file_exec_can_enable_mthp(struct address_space *mapping, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] fbdev: savage: Handle err return when savagefb_check_var failed
by heyujie 22 Jul '24

22 Jul '24

From: Cai Xinchen <caixinchen1(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit 6ad959b6703e2c4c5d7af03b4cfd5ff608036339 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0KC CVE: CVE-2024-39475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zero error. However the function savagefb_probe doesn't handle the error return of savagefb_check_var. When pixclock is 0, it will cause divide-by-zero error. Fixes: 04e5eac8f3ab ("fbdev: savage: Error out if pixclock equals zero") Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/video/fbdev/savage/savagefb_driver.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c index d9eafdb89cea..68e15420d26b 100644 --- a/drivers/video/fbdev/savage/savagefb_driver.c +++ b/drivers/video/fbdev/savage/savagefb_driver.c @@ -2271,7 +2271,10 @@ static int savagefb_probe(struct pci_dev *dev, const struct pci_device_id *id) if (info->var.xres_virtual > 0x1000) info->var.xres_virtual = 0x1000; #endif - savagefb_check_var(&info->var, info); + err = savagefb_check_var(&info->var, info); + if (err) + goto failed; + savagefb_set_fix(info); /* -- 2.34.1

2 1

[PATCH OLK-6.6] ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
by Yu Liao 22 Jul '24

22 Jul '24

From: Rand Deeb <rand.sec96(a)gmail.com> mainline inclusion from mainline-v6.10-rc1 commit 789c17185fb0f39560496c2beab9b57ce1d0cbe7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD028 CVE: CVE-2024-40982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ssb_device_uevent() function first attempts to convert the 'dev' pointer to 'struct ssb_device *'. However, it mistakenly dereferences 'dev' before performing the NULL check, potentially leading to a NULL pointer dereference if 'dev' is NULL. To fix this issue, move the NULL check before dereferencing the 'dev' pointer, ensuring that the pointer is valid before attempting to use it. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rand Deeb <rand.sec96(a)gmail.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240306123028.164155-1-rand.sec96@gmail.com --- drivers/ssb/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c index ab080cf26c9f..0c736d51566d 100644 --- a/drivers/ssb/main.c +++ b/drivers/ssb/main.c @@ -341,11 +341,13 @@ static int ssb_bus_match(struct device *dev, struct device_driver *drv) static int ssb_device_uevent(const struct device *dev, struct kobj_uevent_env *env) { - const struct ssb_device *ssb_dev = dev_to_ssb_dev(dev); + const struct ssb_device *ssb_dev; if (!dev) return -ENODEV; + ssb_dev = dev_to_ssb_dev(dev); + return add_uevent_var(env, "MODALIAS=ssb:v%04Xid%04Xrev%02X", ssb_dev->id.vendor, ssb_dev->id.coreid, -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
by Yu Liao 22 Jul '24

22 Jul '24

mainline inclusion from mainline-v6.10-rc1 commit 789c17185fb0f39560496c2beab9b57ce1d0cbe7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD028 CVE: CVE-2024-40982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ssb_device_uevent() function first attempts to convert the 'dev' pointer to 'struct ssb_device *'. However, it mistakenly dereferences 'dev' before performing the NULL check, potentially leading to a NULL pointer dereference if 'dev' is NULL. To fix this issue, move the NULL check before dereferencing the 'dev' pointer, ensuring that the pointer is valid before attempting to use it. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rand Deeb <rand.sec96(a)gmail.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240306123028.164155-1-rand.sec96@gmail.com Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/ssb/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c index 0a26984acb2c..1b4ce17998c0 100644 --- a/drivers/ssb/main.c +++ b/drivers/ssb/main.c @@ -340,11 +340,13 @@ static int ssb_bus_match(struct device *dev, struct device_driver *drv) static int ssb_device_uevent(struct device *dev, struct kobj_uevent_env *env) { - struct ssb_device *ssb_dev = dev_to_ssb_dev(dev); + struct ssb_device *ssb_dev; if (!dev) return -ENODEV; + ssb_dev = dev_to_ssb_dev(dev); + return add_uevent_var(env, "MODALIAS=ssb:v%04Xid%04Xrev%02X", ssb_dev->id.vendor, ssb_dev->id.coreid, -- 2.33.0

2 1

[PATCH OLK-5.10] ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
by Yu Liao 22 Jul '24

22 Jul '24

mainline inclusion from mainline-v6.10-rc1 commit 789c17185fb0f39560496c2beab9b57ce1d0cbe7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD028 CVE: CVE-2024-40982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ssb_device_uevent() function first attempts to convert the 'dev' pointer to 'struct ssb_device *'. However, it mistakenly dereferences 'dev' before performing the NULL check, potentially leading to a NULL pointer dereference if 'dev' is NULL. To fix this issue, move the NULL check before dereferencing the 'dev' pointer, ensuring that the pointer is valid before attempting to use it. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rand Deeb <rand.sec96(a)gmail.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240306123028.164155-1-rand.sec96@gmail.com Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/ssb/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c index 0a26984acb2c..1b4ce17998c0 100644 --- a/drivers/ssb/main.c +++ b/drivers/ssb/main.c @@ -340,11 +340,13 @@ static int ssb_bus_match(struct device *dev, struct device_driver *drv) static int ssb_device_uevent(struct device *dev, struct kobj_uevent_env *env) { - struct ssb_device *ssb_dev = dev_to_ssb_dev(dev); + struct ssb_device *ssb_dev; if (!dev) return -ENODEV; + ssb_dev = dev_to_ssb_dev(dev); + return add_uevent_var(env, "MODALIAS=ssb:v%04Xid%04Xrev%02X", ssb_dev->id.vendor, ssb_dev->id.coreid, -- 2.33.0

2 1

[PATCH OLK-5.10] Bluetooth: hci_core: Fix leaking sent_cmd skb
by Liu Jian 22 Jul '24

22 Jul '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v5.17-rc7 commit dd3b1dc3dd050f1f47cd13e300732852414270f8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGRH CVE: CVE-2022-48844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- sent_cmd memory is not freed before freeing hci_dev causing it to leak it contents. Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org> Conflicts: net/bluetooth/hci_core.c [Only backport e04480920d1ee. Did not backport 58ce6d5b271ab, e61fbee7be4b.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index b9cf5bc9364c..18aae3d8b59d 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3902,6 +3902,7 @@ void hci_cleanup_dev(struct hci_dev *hdev) hci_dev_unlock(hdev); ida_simple_remove(&hci_index_ida, hdev->id); + kfree_skb(hdev->sent_cmd); } /* Suspend HCI device */ -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: hci_core: Fix leaking sent_cmd skb
by Liu Jian 22 Jul '24

22 Jul '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v5.17-rc7 commit dd3b1dc3dd050f1f47cd13e300732852414270f8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGRH CVE: CVE-2022-48844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- sent_cmd memory is not freed before freeing hci_dev causing it to leak it contents. Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org> Conflicts: net/bluetooth/hci_core.c [Only backport e04480920d1ee. Did not backport 58ce6d5b271ab, e61fbee7be4b.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 2227b5abc988..3bcb5c760b26 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3898,6 +3898,7 @@ void hci_cleanup_dev(struct hci_dev *hdev) hci_dev_unlock(hdev); ida_simple_remove(&hci_index_ida, hdev->id); + kfree_skb(hdev->sent_cmd); } /* Suspend HCI device */ -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] SUNRPC: lock against ->sock changing during sysfs read
by Liu Jian 22 Jul '24

22 Jul '24

From: NeilBrown <neilb(a)suse.de> mainline inclusion from mainline-v5.17-rc4 commit b49ea673e119f59c71645e2f65b3ccad857c90ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADG5L CVE: CVE-2022-48816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ->sock can be set to NULL asynchronously unless ->recv_mutex is held. So it is important to hold that mutex. Otherwise a sysfs read can trigger an oops. Commit 17f09d3f619a ("SUNRPC: Check if the xprt is connected before handling sysfs reads") appears to attempt to fix this problem, but it only narrows the race window. Fixes: 17f09d3f619a ("SUNRPC: Check if the xprt is connected before handling sysfs reads") Fixes: a8482488a7d6 ("SUNRPC query transport's source port") Signed-off-by: NeilBrown <neilb(a)suse.de> Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Conflicts: net/sunrpc/sysfs.c [Did not backport e44773daf851d.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/xprtsock.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 0666f981618a..8d9a27b25ca5 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -1676,7 +1676,12 @@ static int xs_get_srcport(struct sock_xprt *transport) unsigned short get_srcport(struct rpc_xprt *xprt) { struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt); - return xs_sock_getport(sock->sock); + unsigned short ret = 0; + mutex_lock(&sock->recv_mutex); + if (sock->sock) + ret = xs_sock_getport(sock->sock); + mutex_unlock(&sock->recv_mutex); + return ret; } EXPORT_SYMBOL(get_srcport); -- 2.34.1

2 1

[PATCH OLK-5.10] SUNRPC: lock against ->sock changing during sysfs read
by Liu Jian 22 Jul '24

22 Jul '24

From: NeilBrown <neilb(a)suse.de> mainline inclusion from mainline-v5.17-rc4 commit b49ea673e119f59c71645e2f65b3ccad857c90ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADG5L CVE: CVE-2022-48816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ->sock can be set to NULL asynchronously unless ->recv_mutex is held. So it is important to hold that mutex. Otherwise a sysfs read can trigger an oops. Commit 17f09d3f619a ("SUNRPC: Check if the xprt is connected before handling sysfs reads") appears to attempt to fix this problem, but it only narrows the race window. Fixes: 17f09d3f619a ("SUNRPC: Check if the xprt is connected before handling sysfs reads") Fixes: a8482488a7d6 ("SUNRPC query transport's source port") Signed-off-by: NeilBrown <neilb(a)suse.de> Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Conflicts: net/sunrpc/sysfs.c [Did not backport e44773daf851d.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/xprtsock.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 0666f981618a..8d9a27b25ca5 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -1676,7 +1676,12 @@ static int xs_get_srcport(struct sock_xprt *transport) unsigned short get_srcport(struct rpc_xprt *xprt) { struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt); - return xs_sock_getport(sock->sock); + unsigned short ret = 0; + mutex_lock(&sock->recv_mutex); + if (sock->sock) + ret = xs_sock_getport(sock->sock); + mutex_unlock(&sock->recv_mutex); + return ret; } EXPORT_SYMBOL(get_srcport); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
by Jinjiang Tu 22 Jul '24

22 Jul '24

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v4.19.317 commit 217d1f44fff560b3995a685a60aa66e55a7f0f56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACQYO CVE: CVE-2024-40904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 22f00812862564b314784167a89f27b444f82a46 upstream. The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driver's immediate resubmission of interrupt URBs with -EPROTO status combined with the dummy-hcd emulation to cause a CPU lockup: cdc_wdm 1-1:1.0: nonzero urb status received: -71 cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor782:6625] CPU#0 Utilization every 4s during lockup: #1: 98% system, 0% softirq, 3% hardirq, 0% idle #2: 98% system, 0% softirq, 3% hardirq, 0% idle #3: 98% system, 0% softirq, 3% hardirq, 0% idle #4: 98% system, 0% softirq, 3% hardirq, 0% idle #5: 98% system, 1% softirq, 3% hardirq, 0% idle Modules linked in: irq event stamp: 73096 hardirqs last enabled at (73095): [<ffff80008037bc00>] console_emit_next_record kernel/printk/printk.c:2935 [inline] hardirqs last enabled at (73095): [<ffff80008037bc00>] console_flush_all+0x650/0xb74 kernel/printk/printk.c:2994 hardirqs last disabled at (73096): [<ffff80008af10b00>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (73096): [<ffff80008af10b00>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (73048): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (73048): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582 softirqs last disabled at (73043): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588 CPU: 0 PID: 6625 Comm: syz-executor782 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Testing showed that the problem did not occur if the two error messages -- the first two lines above -- were removed; apparently adding material to the kernel log takes a surprisingly large amount of time. In any case, the best approach for preventing these lockups and to avoid spamming the log with thousands of error messages per second is to ratelimit the two dev_err() calls. Therefore we replace them with dev_err_ratelimited(). Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Suggested-by: Greg KH <gregkh(a)linuxfoundation.org> Reported-and-tested-by: syzbot+5f996b83575ef4058638(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/00000000000073d54b061a6a1c65@google.com/ Reported-and-tested-by: syzbot+1b2abad17596ad03dcff(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/000000000000f45085061aa9b37e@google.com/ Fixes: 9908a32e94de ("USB: remove err() macro from usb class drivers") Link: https://lore.kernel.org/linux-usb/40dfa45b-5f21-4eef-a8c1-51a2f320e267@rowl… Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/29855215-52f5-4385-b058-91f42c2bee18@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/usb/class/cdc-wdm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c index b8a1fdefb515..45d1760c85a9 100644 --- a/drivers/usb/class/cdc-wdm.c +++ b/drivers/usb/class/cdc-wdm.c @@ -249,14 +249,14 @@ static void wdm_int_callback(struct urb *urb) dev_err(&desc->intf->dev, "Stall on int endpoint\n"); goto sw; /* halt is cleared in work */ default: - dev_err(&desc->intf->dev, + dev_err_ratelimited(&desc->intf->dev, "nonzero urb status received: %d\n", status); break; } } if (urb->actual_length < sizeof(struct usb_cdc_notification)) { - dev_err(&desc->intf->dev, "wdm_int_callback - %d bytes\n", + dev_err_ratelimited(&desc->intf->dev, "wdm_int_callback - %d bytes\n", urb->actual_length); goto exit; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/5] CVE-2024-41007
by Zhengchao Shao 22 Jul '24

22 Jul '24

Fix CVE-2024-41007 Eric Dumazet (3): tcp: refactor tcp_retransmit_timer() tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() tcp: avoid too many retransmit packets Menglong Dong (1): net: tcp: fix unexcepted socket die when snd_wnd is 0 Neal Cardwell (1): tcp: fix incorrect undo caused by DSACK of TLP retransmit net/ipv4/tcp_input.c | 11 ++++++++++- net/ipv4/tcp_timer.c | 45 ++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 51 insertions(+), 5 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-1.0-LTS] scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
by Zeng Heng 22 Jul '24

22 Jul '24

From: John Garry <john.garry(a)huawei.com> mainline inclusion from mainline-v5.17-rc3 commit df7abcaa1246e2537ab4016077b5443bb3c09378 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADFXU CVE: CVE-2022-48792 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently a use-after-free may occur if a sas_task is aborted by the upper layer before we handle the I/O completion in mpi_ssp_completion() or mpi_sata_completion(). In this case, the following are the two steps in handling those I/O completions: - Call complete() to inform the upper layer handler of completion of the I/O. - Release driver resources associated with the sas_task in pm8001_ccb_task_free() call. When complete() is called, the upper layer may free the sas_task. As such, we should not touch the associated sas_task afterwards, but we do so in the pm8001_ccb_task_free() call. Fix by swapping the complete() and pm8001_ccb_task_free() calls ordering. Link: https://lore.kernel.org/r/1643289172-165636-4-git-send-email-john.garry@hua… Reviewed-by: Damien Le Moal <damien.lemoal(a)opensource.wdc.com> Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: John Garry <john.garry(a)huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/scsi/pm8001/pm80xx_hwi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c index 327992fbb553..f5ac76b8c864 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.c +++ b/drivers/scsi/pm8001/pm80xx_hwi.c @@ -1792,9 +1792,9 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb) "task 0x%p done with io_status 0x%x resp 0x%x " "stat 0x%x but aborted by upper layer!\n", t, status, ts->resp, ts->stat)); + pm8001_ccb_task_free(pm8001_ha, t, ccb, tag); if (t->slow_task) complete(&t->slow_task->completion); - pm8001_ccb_task_free(pm8001_ha, t, ccb, tag); } else { spin_unlock_irqrestore(&t->task_state_lock, flags); pm8001_ccb_task_free(pm8001_ha, t, ccb, tag); @@ -2382,9 +2382,9 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb) pm8001_printk("task 0x%p done with io_status 0x%x" " resp 0x%x stat 0x%x but aborted by upper layer!\n", t, status, ts->resp, ts->stat)); + pm8001_ccb_task_free(pm8001_ha, t, ccb, tag); if (t->slow_task) complete(&t->slow_task->completion); - pm8001_ccb_task_free(pm8001_ha, t, ccb, tag); } else { spin_unlock_irqrestore(&t->task_state_lock, flags); pm8001_ccb_task_free_done(pm8001_ha, t, ccb, tag); -- 2.25.1

2 1

[PATCH OLK-6.6] ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
by Zheng Zucheng 22 Jul '24

22 Jul '24

From: Joseph Qi <joseph.qi(a)linux.alibaba.com> stable inclusion from stable-v6.6.35 commit d0184a375ee797eb657d74861ba0935b6e405c62 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0SQ CVE: CVE-2024-40951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 685d03c3795378fca6a1b3d43581f7f1a3fc095f upstream. bdev->bd_super has been removed and commit 8887b94d9322 change the usage from bdev->bd_super to b_assoc_map->host->i_sb. Since ocfs2 hasn't set bh->b_assoc_map, it will trigger NULL pointer dereference when calling into ocfs2_abort_trigger(). Actually this was pointed out in history, see commit 74e364ad1b13. But I've made a mistake when reviewing commit 8887b94d9322 and then re-introduce this regression. Since we cannot revive bdev in buffer head, so fix this issue by initializing all types of ocfs2 triggers when fill super, and then get the specific ocfs2 trigger from ocfs2_caching_info when access journal. [joseph.qi(a)linux.alibaba.com: v2] Link: https://lkml.kernel.org/r/20240602112045.1112708-1-joseph.qi@linux.alibaba.… Link: https://lkml.kernel.org/r/20240530110630.3933832-2-joseph.qi@linux.alibaba.… Fixes: 8887b94d9322 ("ocfs2: stop using bdev->bd_super for journal error logging") Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Heming Zhao <heming.zhao(a)suse.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> [6.6+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- fs/ocfs2/journal.c | 182 +++++++++++++++++++++++++-------------------- fs/ocfs2/ocfs2.h | 27 +++++++ fs/ocfs2/super.c | 4 +- 3 files changed, 131 insertions(+), 82 deletions(-) diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c index ce215565d061..72529f541082 100644 --- a/fs/ocfs2/journal.c +++ b/fs/ocfs2/journal.c @@ -479,12 +479,6 @@ int ocfs2_allocate_extend_trans(handle_t *handle, int thresh) return status; } - -struct ocfs2_triggers { - struct jbd2_buffer_trigger_type ot_triggers; - int ot_offset; -}; - static inline struct ocfs2_triggers *to_ocfs2_trigger(struct jbd2_buffer_trigger_type *triggers) { return container_of(triggers, struct ocfs2_triggers, ot_triggers); @@ -548,85 +542,76 @@ static void ocfs2_db_frozen_trigger(struct jbd2_buffer_trigger_type *triggers, static void ocfs2_abort_trigger(struct jbd2_buffer_trigger_type *triggers, struct buffer_head *bh) { + struct ocfs2_triggers *ot = to_ocfs2_trigger(triggers); + mlog(ML_ERROR, "ocfs2_abort_trigger called by JBD2. bh = 0x%lx, " "bh->b_blocknr = %llu\n", (unsigned long)bh, (unsigned long long)bh->b_blocknr); - ocfs2_error(bh->b_assoc_map->host->i_sb, + ocfs2_error(ot->sb, "JBD2 has aborted our journal, ocfs2 cannot continue\n"); } -static struct ocfs2_triggers di_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_dinode, i_check), -}; - -static struct ocfs2_triggers eb_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_extent_block, h_check), -}; - -static struct ocfs2_triggers rb_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_refcount_block, rf_check), -}; - -static struct ocfs2_triggers gd_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_group_desc, bg_check), -}; - -static struct ocfs2_triggers db_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_db_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, -}; +static void ocfs2_setup_csum_triggers(struct super_block *sb, + enum ocfs2_journal_trigger_type type, + struct ocfs2_triggers *ot) +{ + BUG_ON(type >= OCFS2_JOURNAL_TRIGGER_COUNT); -static struct ocfs2_triggers xb_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_xattr_block, xb_check), -}; + switch (type) { + case OCFS2_JTR_DI: + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_dinode, i_check); + break; + case OCFS2_JTR_EB: + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_extent_block, h_check); + break; + case OCFS2_JTR_RB: + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_refcount_block, rf_check); + break; + case OCFS2_JTR_GD: + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_group_desc, bg_check); + break; + case OCFS2_JTR_DB: + ot->ot_triggers.t_frozen = ocfs2_db_frozen_trigger; + break; + case OCFS2_JTR_XB: + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_xattr_block, xb_check); + break; + case OCFS2_JTR_DQ: + ot->ot_triggers.t_frozen = ocfs2_dq_frozen_trigger; + break; + case OCFS2_JTR_DR: + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_dx_root_block, dr_check); + break; + case OCFS2_JTR_DL: + ot->ot_triggers.t_frozen = ocfs2_frozen_trigger; + ot->ot_offset = offsetof(struct ocfs2_dx_leaf, dl_check); + break; + case OCFS2_JTR_NONE: + /* To make compiler happy... */ + return; + } -static struct ocfs2_triggers dq_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_dq_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, -}; + ot->ot_triggers.t_abort = ocfs2_abort_trigger; + ot->sb = sb; +} -static struct ocfs2_triggers dr_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_dx_root_block, dr_check), -}; +void ocfs2_initialize_journal_triggers(struct super_block *sb, + struct ocfs2_triggers triggers[]) +{ + enum ocfs2_journal_trigger_type type; -static struct ocfs2_triggers dl_triggers = { - .ot_triggers = { - .t_frozen = ocfs2_frozen_trigger, - .t_abort = ocfs2_abort_trigger, - }, - .ot_offset = offsetof(struct ocfs2_dx_leaf, dl_check), -}; + for (type = OCFS2_JTR_DI; type < OCFS2_JOURNAL_TRIGGER_COUNT; type++) + ocfs2_setup_csum_triggers(sb, type, &triggers[type]); +} static int __ocfs2_journal_access(handle_t *handle, struct ocfs2_caching_info *ci, @@ -708,56 +693,91 @@ static int __ocfs2_journal_access(handle_t *handle, int ocfs2_journal_access_di(handle_t *handle, struct ocfs2_caching_info *ci, struct buffer_head *bh, int type) { - return __ocfs2_journal_access(handle, ci, bh, &di_triggers, type); + struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci)); + + return __ocfs2_journal_access(handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DI], + type); } int ocfs2_journal_access_eb(handle_t *handle, struct ocfs2_caching_info *ci, struct buffer_head *bh, int type) { - return __ocfs2_journal_access(handle, ci, bh, &eb_triggers, type); + struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci)); + + return __ocfs2_journal_access(handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_EB], + type); } int ocfs2_journal_access_rb(handle_t *handle, struct ocfs2_caching_info *ci, struct buffer_head *bh, int type) { - return __ocfs2_journal_access(handle, ci, bh, &rb_triggers, + struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci)); + + return __ocfs2_journal_access(handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_RB], type); } int ocfs2_journal_access_gd(handle_t *handle, struct ocfs2_caching_info *ci, struct buffer_head *bh, int type) { - return __ocfs2_journal_access(handle, ci, bh, &gd_triggers, type); + struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci)); + + return __ocfs2_journal_access(handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_GD], + type); } int ocfs2_journal_access_db(handle_t *handle, struct ocfs2_caching_info *ci, struct buffer_head *bh, int type) { - return __ocfs2_journal_access(handle, ci, bh, &db_triggers, type); + struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci)); + + return __ocfs2_journal_access(handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DB], + type); } int ocfs2_journal_access_xb(handle_t *handle, struct ocfs2_caching_info *ci, struct buffer_head *bh, int type) { - return __ocfs2_journal_access(handle, ci, bh, &xb_triggers, type); + struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci)); + + return __ocfs2_journal_access(handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_XB], + type); } int ocfs2_journal_access_dq(handle_t *handle, struct ocfs2_caching_info *ci, struct buffer_head *bh, int type) { - return __ocfs2_journal_access(handle, ci, bh, &dq_triggers, type); + struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci)); + + return __ocfs2_journal_access(handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DQ], + type); } int ocfs2_journal_access_dr(handle_t *handle, struct ocfs2_caching_info *ci, struct buffer_head *bh, int type) { - return __ocfs2_journal_access(handle, ci, bh, &dr_triggers, type); + struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci)); + + return __ocfs2_journal_access(handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DR], + type); } int ocfs2_journal_access_dl(handle_t *handle, struct ocfs2_caching_info *ci, struct buffer_head *bh, int type) { - return __ocfs2_journal_access(handle, ci, bh, &dl_triggers, type); + struct ocfs2_super *osb = OCFS2_SB(ocfs2_metadata_cache_get_super(ci)); + + return __ocfs2_journal_access(handle, ci, bh, + &osb->s_journal_triggers[OCFS2_JTR_DL], + type); } int ocfs2_journal_access(handle_t *handle, struct ocfs2_caching_info *ci, diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h index a503c553bab2..8fe826143d7b 100644 --- a/fs/ocfs2/ocfs2.h +++ b/fs/ocfs2/ocfs2.h @@ -284,6 +284,30 @@ enum ocfs2_mount_options #define OCFS2_OSB_ERROR_FS 0x0004 #define OCFS2_DEFAULT_ATIME_QUANTUM 60 +struct ocfs2_triggers { + struct jbd2_buffer_trigger_type ot_triggers; + int ot_offset; + struct super_block *sb; +}; + +enum ocfs2_journal_trigger_type { + OCFS2_JTR_DI, + OCFS2_JTR_EB, + OCFS2_JTR_RB, + OCFS2_JTR_GD, + OCFS2_JTR_DB, + OCFS2_JTR_XB, + OCFS2_JTR_DQ, + OCFS2_JTR_DR, + OCFS2_JTR_DL, + OCFS2_JTR_NONE /* This must be the last entry */ +}; + +#define OCFS2_JOURNAL_TRIGGER_COUNT OCFS2_JTR_NONE + +void ocfs2_initialize_journal_triggers(struct super_block *sb, + struct ocfs2_triggers triggers[]); + struct ocfs2_journal; struct ocfs2_slot_info; struct ocfs2_recovery_map; @@ -351,6 +375,9 @@ struct ocfs2_super struct ocfs2_journal *journal; unsigned long osb_commit_interval; + /* Journal triggers for checksum */ + struct ocfs2_triggers s_journal_triggers[OCFS2_JOURNAL_TRIGGER_COUNT]; + struct delayed_work la_enable_wq; /* diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c index 1259fe02cd53..cfc093937a17 100644 --- a/fs/ocfs2/super.c +++ b/fs/ocfs2/super.c @@ -1075,9 +1075,11 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent) debugfs_create_file("fs_state", S_IFREG|S_IRUSR, osb->osb_debug_root, osb, &ocfs2_osb_debug_fops); - if (ocfs2_meta_ecc(osb)) + if (ocfs2_meta_ecc(osb)) { + ocfs2_initialize_journal_triggers(sb, osb->s_journal_triggers); ocfs2_blockcheck_stats_debugfs_install( &osb->osb_ecc_stats, osb->osb_debug_root); + } status = ocfs2_mount_volume(sb); if (status < 0) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] fix CVE-2024-41007
by Zhengchao Shao 22 Jul '24

22 Jul '24

Fix CVE-2024-41007 Eric Dumazet (2): tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() tcp: avoid too many retransmit packets Menglong Dong (1): net: tcp: fix unexcepted socket die when snd_wnd is 0 net/ipv4/tcp_timer.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] ima: Avoid blocking in RCU read-side critical section
by GONG, Ruiqi 22 Jul '24

22 Jul '24

From: GUO Zihua <guozihua(a)huawei.com> stable inclusion from stable-v5.10.222 commit a6176a802c4bfb83bf7524591aa75f44a639a853 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0RL CVE: CVE-2024-40947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9a95c5bfbf02a0a7f5983280fe284a0ff0836c34 upstream. A panic happens in ima_match_policy: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 PGD 42f873067 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 5 PID: 1286325 Comm: kubeletmonit.sh Kdump: loaded Tainted: P Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 RIP: 0010:ima_match_policy+0x84/0x450 Code: 49 89 fc 41 89 cf 31 ed 89 44 24 14 eb 1c 44 39 7b 18 74 26 41 83 ff 05 74 20 48 8b 1b 48 3b 1d f2 b9 f4 00 0f 84 9c 01 00 00 <44> 85 73 10 74 ea 44 8b 6b 14 41 f6 c5 01 75 d4 41 f6 c5 02 74 0f RSP: 0018:ff71570009e07a80 EFLAGS: 00010207 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000200 RDX: ffffffffad8dc7c0 RSI: 0000000024924925 RDI: ff3e27850dea2000 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffabfce739 R10: ff3e27810cc42400 R11: 0000000000000000 R12: ff3e2781825ef970 R13: 00000000ff3e2785 R14: 000000000000000c R15: 0000000000000001 FS: 00007f5195b51740(0000) GS:ff3e278b12d40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000000626d24002 CR4: 0000000000361ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ima_get_action+0x22/0x30 process_measurement+0xb0/0x830 ? page_add_file_rmap+0x15/0x170 ? alloc_set_pte+0x269/0x4c0 ? prep_new_page+0x81/0x140 ? simple_xattr_get+0x75/0xa0 ? selinux_file_open+0x9d/0xf0 ima_file_check+0x64/0x90 path_openat+0x571/0x1720 do_filp_open+0x9b/0x110 ? page_counter_try_charge+0x57/0xc0 ? files_cgroup_alloc_fd+0x38/0x60 ? __alloc_fd+0xd4/0x250 ? do_sys_open+0x1bd/0x250 do_sys_open+0x1bd/0x250 do_syscall_64+0x5d/0x1d0 entry_SYSCALL_64_after_hwframe+0x65/0xca Commit c7423dbdbc9e ("ima: Handle -ESTALE returned by ima_filter_rule_match()") introduced call to ima_lsm_copy_rule within a RCU read-side critical section which contains kmalloc with GFP_KERNEL. This implies a possible sleep and violates limitations of RCU read-side critical sections on non-PREEMPT systems. Sleeping within RCU read-side critical section might cause synchronize_rcu() returning early and break RCU protection, allowing a UAF to happen. The root cause of this issue could be described as follows: | Thread A | Thread B | | |ima_match_policy | | | rcu_read_lock | |ima_lsm_update_rule | | | synchronize_rcu | | | | kmalloc(GFP_KERNEL)| | | sleep | ==> synchronize_rcu returns early | kfree(entry) | | | | entry = entry->next| ==> UAF happens and entry now becomes NULL (or could be anything). | | entry->action | ==> Accessing entry might cause panic. To fix this issue, we are converting all kmalloc that is called within RCU read-side critical section to use GFP_ATOMIC. Fixes: c7423dbdbc9e ("ima: Handle -ESTALE returned by ima_filter_rule_match()") Cc: stable(a)vger.kernel.org Signed-off-by: GUO Zihua <guozihua(a)huawei.com> Acked-by: John Johansen <john.johansen(a)canonical.com> Reviewed-by: Mimi Zohar <zohar(a)linux.ibm.com> Reviewed-by: Casey Schaufler <casey(a)schaufler-ca.com> [PM: fixed missing comment, long lines, !CONFIG_IMA_LSM_RULES case] Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 5 +++-- kernel/auditfilter.c | 5 +++-- security/apparmor/audit.c | 6 +++--- security/apparmor/include/audit.h | 2 +- security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_policy.c | 15 +++++++++------ security/security.c | 6 ++++-- security/selinux/include/audit.h | 4 +++- security/selinux/ss/services.c | 5 +++-- security/smack/smack_lsm.c | 4 +++- 11 files changed, 34 insertions(+), 22 deletions(-) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index d13631a5e908..3ef78d1d1c81 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -368,7 +368,7 @@ LSM_HOOK(int, 0, key_getsecurity, struct key *key, char **_buffer) #ifdef CONFIG_AUDIT LSM_HOOK(int, 0, audit_rule_init, u32 field, u32 op, char *rulestr, - void **lsmrule) + void **lsmrule, gfp_t gfp) LSM_HOOK(int, 0, audit_rule_known, struct audit_krule *krule) LSM_HOOK(int, 0, audit_rule_match, u32 secid, u32 field, u32 op, void *lsmrule) LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule) diff --git a/include/linux/security.h b/include/linux/security.h index e9b4b5410614..81fe4c470464 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1844,7 +1844,8 @@ static inline int security_key_getsecurity(struct key *key, char **_buffer) #ifdef CONFIG_AUDIT #ifdef CONFIG_SECURITY -int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule); +int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule, + gfp_t gfp); int security_audit_rule_known(struct audit_krule *krule); int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule); void security_audit_rule_free(void *lsmrule); @@ -1852,7 +1853,7 @@ void security_audit_rule_free(void *lsmrule); #else static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr, - void **lsmrule) + void **lsmrule, gfp_t gfp) { return 0; } diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 333b3bcfc545..a5b43f25609e 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -521,7 +521,8 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data, entry->rule.buflen += f_val; f->lsm_str = str; err = security_audit_rule_init(f->type, f->op, str, - (void **)&f->lsm_rule); + (void **)&f->lsm_rule, + GFP_KERNEL); /* Keep currently invalid fields around in case they * become valid after a policy reload. */ if (err == -EINVAL) { @@ -790,7 +791,7 @@ static inline int audit_dupe_lsm_field(struct audit_field *df, /* our own (refreshed) copy of lsm_rule */ ret = security_audit_rule_init(df->type, df->op, df->lsm_str, - (void **)&df->lsm_rule); + (void **)&df->lsm_rule, GFP_KERNEL); /* Keep currently invalid fields around in case they * become valid after a policy reload. */ if (ret == -EINVAL) { diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c index 704b0c895605..963df28584ee 100644 --- a/security/apparmor/audit.c +++ b/security/apparmor/audit.c @@ -173,7 +173,7 @@ void aa_audit_rule_free(void *vrule) } } -int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) +int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule, gfp_t gfp) { struct aa_audit_rule *rule; @@ -186,14 +186,14 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) return -EINVAL; } - rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL); + rule = kzalloc(sizeof(struct aa_audit_rule), gfp); if (!rule) return -ENOMEM; /* Currently rules are treated as coming from the root ns */ rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr, - GFP_KERNEL, true, false); + gfp, true, false); if (IS_ERR(rule->label)) { int err = PTR_ERR(rule->label); aa_audit_rule_free(rule); diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h index 18519a4eb67e..f325f1bef8d6 100644 --- a/security/apparmor/include/audit.h +++ b/security/apparmor/include/audit.h @@ -186,7 +186,7 @@ static inline int complain_error(int error) } void aa_audit_rule_free(void *vrule); -int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule); +int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule, gfp_t gfp); int aa_audit_rule_known(struct audit_krule *rule); int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule); diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 46afb6bef45b..855c158cc02a 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -411,7 +411,7 @@ static inline void ima_free_modsig(struct modsig *modsig) #else static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr, - void **lsmrule) + void **lsmrule, gfp_t gfp) { return -EINVAL; } diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 274f4c7c99f4..089aaec291b6 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -378,7 +378,8 @@ static void ima_free_rule(struct ima_rule_entry *entry) kfree(entry); } -static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry) +static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry, + gfp_t gfp) { struct ima_rule_entry *nentry; int i; @@ -387,7 +388,7 @@ static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry) * Immutable elements are copied over as pointers and data; only * lsm rules can change */ - nentry = kmemdup(entry, sizeof(*nentry), GFP_KERNEL); + nentry = kmemdup(entry, sizeof(*nentry), gfp); if (!nentry) return NULL; @@ -402,7 +403,8 @@ static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry) ima_filter_rule_init(nentry->lsm[i].type, Audit_equal, nentry->lsm[i].args_p, - &nentry->lsm[i].rule); + &nentry->lsm[i].rule, + gfp); if (!nentry->lsm[i].rule) pr_warn("rule for LSM \'%s\' is undefined\n", nentry->lsm[i].args_p); @@ -415,7 +417,7 @@ static int ima_lsm_update_rule(struct ima_rule_entry *entry) int i; struct ima_rule_entry *nentry; - nentry = ima_lsm_copy_rule(entry); + nentry = ima_lsm_copy_rule(entry, GFP_KERNEL); if (!nentry) return -ENOMEM; @@ -604,7 +606,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, } if (rc == -ESTALE && !rule_reinitialized) { - lsm_rule = ima_lsm_copy_rule(rule); + lsm_rule = ima_lsm_copy_rule(rule, GFP_ATOMIC); if (lsm_rule) { rule_reinitialized = true; goto retry; @@ -1058,7 +1060,8 @@ static int ima_lsm_rule_init(struct ima_rule_entry *entry, entry->lsm[lsm_rule].type = audit_type; result = ima_filter_rule_init(entry->lsm[lsm_rule].type, Audit_equal, entry->lsm[lsm_rule].args_p, - &entry->lsm[lsm_rule].rule); + &entry->lsm[lsm_rule].rule, + GFP_KERNEL); if (!entry->lsm[lsm_rule].rule) { pr_warn("rule for LSM \'%s\' is undefined\n", entry->lsm[lsm_rule].args_p); diff --git a/security/security.c b/security/security.c index 50c7f3d41fc5..f44cfbf8997d 100644 --- a/security/security.c +++ b/security/security.c @@ -2492,9 +2492,11 @@ int security_key_getsecurity(struct key *key, char **_buffer) #ifdef CONFIG_AUDIT -int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule) +int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule, + gfp_t gfp) { - return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule); + return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule, + gfp); } int security_audit_rule_known(struct audit_krule *krule) diff --git a/security/selinux/include/audit.h b/security/selinux/include/audit.h index 073a3d34a0d2..72af85ff96a4 100644 --- a/security/selinux/include/audit.h +++ b/security/selinux/include/audit.h @@ -18,12 +18,14 @@ * @op: the operater the rule uses * @rulestr: the text "target" of the rule * @rule: pointer to the new rule structure returned via this + * @gfp: GFP flag used for kmalloc * * Returns 0 if successful, -errno if not. On success, the rule structure * will be allocated internally. The caller must free this structure with * selinux_audit_rule_free() after use. */ -int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **rule); +int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **rule, + gfp_t gfp); /** * selinux_audit_rule_free - free an selinux audit rule structure. diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 31d631fa846e..91e5788ba3c0 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -3541,7 +3541,8 @@ void selinux_audit_rule_free(void *vrule) } } -int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) +int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule, + gfp_t gfp) { struct selinux_state *state = &selinux_state; struct selinux_policy *policy; @@ -3582,7 +3583,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) return -EINVAL; } - tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL); + tmprule = kzalloc(sizeof(struct selinux_audit_rule), gfp); if (!tmprule) return -ENOMEM; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index b36b8668f1f4..2961f84a54df 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4450,11 +4450,13 @@ static int smack_post_notification(const struct cred *w_cred, * @op: required testing operator (=, !=, >, <, ...) * @rulestr: smack label to be audited * @vrule: pointer to save our own audit rule representation + * @gfp: type of the memory for the allocation * * Prepare to audit cases where (@field @op @rulestr) is true. * The label to be audited is created if necessay. */ -static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) +static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule, + gfp_t gfp) { struct smack_known *skp; char **rule = (char **)vrule; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] fix CVE-2024-41007
by Zhengchao Shao 22 Jul '24

22 Jul '24

Fix CVE-2024-41007 Eric Dumazet (2): tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() tcp: avoid too many retransmit packets Menglong Dong (1): net: tcp: fix unexcepted socket die when snd_wnd is 0 net/ipv4/tcp_timer.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) -- 2.34.1

2 4

[PATCH OLK-6.6] [Backport] fpga: bridge: add owner module and take its refcount
by Wupeng Ma 22 Jul '24

22 Jul '24

From: Marco Pagani <marpagan(a)redhat.com> stable inclusion from stable-v6.6.33 commit d7c4081c54a1d4068de9440957303a76f9e5c95b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA74DQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1da11f822042eb6ef4b6064dc048f157a7852529 ] The current implementation of the fpga bridge assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer dereference while attempting to get the bridge if the parent device does not have a driver. To address this problem, add a module owner pointer to the fpga_bridge struct and use it to take the module's refcount. Modify the function for registering a bridge to take an additional owner module parameter and rename it to avoid conflicts. Use the old function name for a helper macro that automatically sets the module that registers the bridge as the owner. This ensures compatibility with existing low-level control modules and reduces the chances of registering a bridge without setting the owner. Also, update the documentation to keep it consistent with the new interface for registering an fpga bridge. Other changes: opportunistically move put_device() from __fpga_bridge_get() to fpga_bridge_get() and of_fpga_bridge_get() to improve code clarity since the bridge device is taken in these functions. Fixes: 21aeda950c5f ("fpga: add fpga bridge framework") Suggested-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Suggested-by: Xu Yilun <yilun.xu(a)intel.com> Reviewed-by: Russ Weight <russ.weight(a)linux.dev> Signed-off-by: Marco Pagani <marpagan(a)redhat.com> Acked-by: Xu Yilun <yilun.xu(a)intel.com> Link: https://lore.kernel.org/r/20240322171839.233864-1-marpagan@redhat.com Signed-off-by: Xu Yilun <yilun.xu(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- Documentation/driver-api/fpga/fpga-bridge.rst | 7 ++- drivers/fpga/fpga-bridge.c | 57 ++++++++++--------- include/linux/fpga/fpga-bridge.h | 10 +++- 3 files changed, 43 insertions(+), 31 deletions(-) diff --git a/Documentation/driver-api/fpga/fpga-bridge.rst b/Documentation/driver-api/fpga/fpga-bridge.rst index 604208534095..833f68fb0700 100644 --- a/Documentation/driver-api/fpga/fpga-bridge.rst +++ b/Documentation/driver-api/fpga/fpga-bridge.rst @@ -6,9 +6,12 @@ API to implement a new FPGA bridge * struct fpga_bridge - The FPGA Bridge structure * struct fpga_bridge_ops - Low level Bridge driver ops -* fpga_bridge_register() - Create and register a bridge +* __fpga_bridge_register() - Create and register a bridge * fpga_bridge_unregister() - Unregister a bridge +The helper macro ``fpga_bridge_register()`` automatically sets +the module that registers the FPGA bridge as the owner. + .. kernel-doc:: include/linux/fpga/fpga-bridge.h :functions: fpga_bridge @@ -16,7 +19,7 @@ API to implement a new FPGA bridge :functions: fpga_bridge_ops .. kernel-doc:: drivers/fpga/fpga-bridge.c - :functions: fpga_bridge_register + :functions: __fpga_bridge_register .. kernel-doc:: drivers/fpga/fpga-bridge.c :functions: fpga_bridge_unregister diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c index a024be2b84e2..83d35fbb8245 100644 --- a/drivers/fpga/fpga-bridge.c +++ b/drivers/fpga/fpga-bridge.c @@ -55,33 +55,26 @@ int fpga_bridge_disable(struct fpga_bridge *bridge) } EXPORT_SYMBOL_GPL(fpga_bridge_disable); -static struct fpga_bridge *__fpga_bridge_get(struct device *dev, +static struct fpga_bridge *__fpga_bridge_get(struct device *bridge_dev, struct fpga_image_info *info) { struct fpga_bridge *bridge; - int ret = -ENODEV; - bridge = to_fpga_bridge(dev); + bridge = to_fpga_bridge(bridge_dev); bridge->info = info; - if (!mutex_trylock(&bridge->mutex)) { - ret = -EBUSY; - goto err_dev; - } + if (!mutex_trylock(&bridge->mutex)) + return ERR_PTR(-EBUSY); - if (!try_module_get(dev->parent->driver->owner)) - goto err_ll_mod; + if (!try_module_get(bridge->br_ops_owner)) { + mutex_unlock(&bridge->mutex); + return ERR_PTR(-ENODEV); + } dev_dbg(&bridge->dev, "get\n"); return bridge; - -err_ll_mod: - mutex_unlock(&bridge->mutex); -err_dev: - put_device(dev); - return ERR_PTR(ret); } /** @@ -98,13 +91,18 @@ static struct fpga_bridge *__fpga_bridge_get(struct device *dev, struct fpga_bridge *of_fpga_bridge_get(struct device_node *np, struct fpga_image_info *info) { - struct device *dev; + struct fpga_bridge *bridge; + struct device *bridge_dev; - dev = class_find_device_by_of_node(&fpga_bridge_class, np); - if (!dev) + bridge_dev = class_find_device_by_of_node(&fpga_bridge_class, np); + if (!bridge_dev) return ERR_PTR(-ENODEV); - return __fpga_bridge_get(dev, info); + bridge = __fpga_bridge_get(bridge_dev, info); + if (IS_ERR(bridge)) + put_device(bridge_dev); + + return bridge; } EXPORT_SYMBOL_GPL(of_fpga_bridge_get); @@ -125,6 +123,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data) struct fpga_bridge *fpga_bridge_get(struct device *dev, struct fpga_image_info *info) { + struct fpga_bridge *bridge; struct device *bridge_dev; bridge_dev = class_find_device(&fpga_bridge_class, NULL, dev, @@ -132,7 +131,11 @@ struct fpga_bridge *fpga_bridge_get(struct device *dev, if (!bridge_dev) return ERR_PTR(-ENODEV); - return __fpga_bridge_get(bridge_dev, info); + bridge = __fpga_bridge_get(bridge_dev, info); + if (IS_ERR(bridge)) + put_device(bridge_dev); + + return bridge; } EXPORT_SYMBOL_GPL(fpga_bridge_get); @@ -146,7 +149,7 @@ void fpga_bridge_put(struct fpga_bridge *bridge) dev_dbg(&bridge->dev, "put\n"); bridge->info = NULL; - module_put(bridge->dev.parent->driver->owner); + module_put(bridge->br_ops_owner); mutex_unlock(&bridge->mutex); put_device(&bridge->dev); } @@ -316,18 +319,19 @@ static struct attribute *fpga_bridge_attrs[] = { ATTRIBUTE_GROUPS(fpga_bridge); /** - * fpga_bridge_register - create and register an FPGA Bridge device + * __fpga_bridge_register - create and register an FPGA Bridge device * @parent: FPGA bridge device from pdev * @name: FPGA bridge name * @br_ops: pointer to structure of fpga bridge ops * @priv: FPGA bridge private data + * @owner: owner module containing the br_ops * * Return: struct fpga_bridge pointer or ERR_PTR() */ struct fpga_bridge * -fpga_bridge_register(struct device *parent, const char *name, - const struct fpga_bridge_ops *br_ops, - void *priv) +__fpga_bridge_register(struct device *parent, const char *name, + const struct fpga_bridge_ops *br_ops, + void *priv, struct module *owner) { struct fpga_bridge *bridge; int id, ret; @@ -357,6 +361,7 @@ fpga_bridge_register(struct device *parent, const char *name, bridge->name = name; bridge->br_ops = br_ops; + bridge->br_ops_owner = owner; bridge->priv = priv; bridge->dev.groups = br_ops->groups; @@ -386,7 +391,7 @@ fpga_bridge_register(struct device *parent, const char *name, return ERR_PTR(ret); } -EXPORT_SYMBOL_GPL(fpga_bridge_register); +EXPORT_SYMBOL_GPL(__fpga_bridge_register); /** * fpga_bridge_unregister - unregister an FPGA bridge diff --git a/include/linux/fpga/fpga-bridge.h b/include/linux/fpga/fpga-bridge.h index 223da48a6d18..94c4edd047e5 100644 --- a/include/linux/fpga/fpga-bridge.h +++ b/include/linux/fpga/fpga-bridge.h @@ -45,6 +45,7 @@ struct fpga_bridge_info { * @dev: FPGA bridge device * @mutex: enforces exclusive reference to bridge * @br_ops: pointer to struct of FPGA bridge ops + * @br_ops_owner: module containing the br_ops * @info: fpga image specific information * @node: FPGA bridge list node * @priv: low level driver private date @@ -54,6 +55,7 @@ struct fpga_bridge { struct device dev; struct mutex mutex; /* for exclusive reference to bridge */ const struct fpga_bridge_ops *br_ops; + struct module *br_ops_owner; struct fpga_image_info *info; struct list_head node; void *priv; @@ -79,10 +81,12 @@ int of_fpga_bridge_get_to_list(struct device_node *np, struct fpga_image_info *info, struct list_head *bridge_list); +#define fpga_bridge_register(parent, name, br_ops, priv) \ + __fpga_bridge_register(parent, name, br_ops, priv, THIS_MODULE) struct fpga_bridge * -fpga_bridge_register(struct device *parent, const char *name, - const struct fpga_bridge_ops *br_ops, - void *priv); +__fpga_bridge_register(struct device *parent, const char *name, + const struct fpga_bridge_ops *br_ops, void *priv, + struct module *owner); void fpga_bridge_unregister(struct fpga_bridge *br); #endif /* _LINUX_FPGA_BRIDGE_H */ -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] fix CVE-2024-41007
by Zhengchao Shao 22 Jul '24

22 Jul '24

Fix CVE-2024-41007 Eric Dumazet (2): tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() tcp: avoid too many retransmit packets net/ipv4/tcp_timer.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] fix CVE-2024-41007
by Zhengchao Shao 22 Jul '24

22 Jul '24

Fix CVE-2024-41007. Eric Dumazet (2): tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() tcp: avoid too many retransmit packets net/ipv4/tcp_timer.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] ima: Fix use-after-free on a dentry's dname.name
by GONG, Ruiqi 22 Jul '24

22 Jul '24

From: Stefan Berger <stefanb(a)linux.ibm.com> mainline inclusion from mainline-v6.10-rc1 commit be84f32bb2c981ca670922e047cdde1488b233de category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0O1 CVE: CVE-2024-39494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ->d_name.name can change on rename and the earlier value can be freed; there are conditions sufficient to stabilize it (->d_lock on dentry, ->d_lock on its parent, ->i_rwsem exclusive on the parent's inode, rename_lock), but none of those are met at any of the sites. Take a stable snapshot of the name instead. Link: https://lore.kernel.org/all/20240202182732.GE2087318@ZenIV/ Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Stefan Berger <stefanb(a)linux.ibm.com> Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Conflicts: security/integrity/ima/ima_api.c [Just context conflicts.] Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- security/integrity/ima/ima_api.c | 16 ++++++++++++---- security/integrity/ima/ima_template_lib.c | 17 ++++++++++++++--- 2 files changed, 26 insertions(+), 7 deletions(-) diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index 6ecaf6834844..d383b47c2d5e 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -234,7 +234,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, { const char *audit_cause = "failed"; struct inode *inode = file_inode(file); - const char *filename = file->f_path.dentry->d_name.name; + struct name_snapshot filename; int result = 0; int length; void *tmpbuf; @@ -293,9 +293,13 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, if (file->f_flags & O_DIRECT) audit_cause = "failed(directio)"; + take_dentry_name_snapshot(&filename, file->f_path.dentry); + integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, - filename, "collect_data", audit_cause, - result, 0); + filename.name.name, "collect_data", + audit_cause, result, 0); + + release_dentry_name_snapshot(&filename); } return result; } @@ -416,6 +420,7 @@ void ima_audit_measurement(struct integrity_iint_cache *iint, */ const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf) { + struct name_snapshot filename; char *pathname = NULL; *pathbuf = __getname(); @@ -429,7 +434,10 @@ const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf) } if (!pathname) { - strlcpy(namebuf, path->dentry->d_name.name, NAME_MAX); + take_dentry_name_snapshot(&filename, path->dentry); + strscpy(namebuf, filename.name.name, NAME_MAX); + release_dentry_name_snapshot(&filename); + pathname = namebuf; } diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c index 90040fac150b..d49eeb9c87c7 100644 --- a/security/integrity/ima/ima_template_lib.c +++ b/security/integrity/ima/ima_template_lib.c @@ -386,7 +386,10 @@ static int ima_eventname_init_common(struct ima_event_data *event_data, bool size_limit) { const char *cur_filename = NULL; + struct name_snapshot filename; u32 cur_filename_len = 0; + bool snapshot = false; + int ret; BUG_ON(event_data->filename == NULL && event_data->file == NULL); @@ -399,7 +402,10 @@ static int ima_eventname_init_common(struct ima_event_data *event_data, } if (event_data->file) { - cur_filename = event_data->file->f_path.dentry->d_name.name; + take_dentry_name_snapshot(&filename, + event_data->file->f_path.dentry); + snapshot = true; + cur_filename = filename.name.name; cur_filename_len = strlen(cur_filename); } else /* @@ -408,8 +414,13 @@ static int ima_eventname_init_common(struct ima_event_data *event_data, */ cur_filename_len = IMA_EVENT_NAME_LEN_MAX; out: - return ima_write_template_field_data(cur_filename, cur_filename_len, - DATA_FMT_STRING, field_data); + ret = ima_write_template_field_data(cur_filename, cur_filename_len, + DATA_FMT_STRING, field_data); + + if (snapshot) + release_dentry_name_snapshot(&filename); + + return ret; } /* -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] staging: gdm724x: fix use after free in gdm_lte_rx()
by Zheng Zucheng 21 Jul '24

21 Jul '24

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v5.10.106 commit 6d9700b445098dbbce0caff4b8cfca214cf1e757 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGSJ CVE: CVE-2022-48851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fc7f750dc9d102c1ed7bbe4591f991e770c99033 upstream. The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len. Fixes: 61e121047645 ("staging: gdm7240: adding LTE USB driver") Cc: stable <stable(a)vger.kernel.org> Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/20220228074331.GA13685@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/staging/gdm724x/gdm_lte.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c index 3c2aab7a921e..fc64d3fed8b4 100644 --- a/drivers/staging/gdm724x/gdm_lte.c +++ b/drivers/staging/gdm724x/gdm_lte.c @@ -76,14 +76,15 @@ static void tx_complete(void *arg) static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type) { - int ret; + int ret, len; + len = skb->len + ETH_HLEN; ret = netif_rx_ni(skb); if (ret == NET_RX_DROP) { nic->stats.rx_dropped++; } else { nic->stats.rx_packets++; - nic->stats.rx_bytes += skb->len + ETH_HLEN; + nic->stats.rx_bytes += len; } return 0; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 3e36513da2c9286f7809293f49e229bb822dec55
by kernel test robot 21 Jul '24

21 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3e36513da2c9286f7809293f49e229bb822dec55 !10137 NFSD: Fix ia_size underflow elapsed time: 727m configs tested: 34 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240720 gcc-14.1.0 arm64 randconfig-002-20240720 gcc-14.1.0 arm64 randconfig-003-20240720 gcc-14.1.0 arm64 randconfig-004-20240720 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240720 clang-18 x86_64 buildonly-randconfig-002-20240720 gcc-13 x86_64 buildonly-randconfig-003-20240720 clang-18 x86_64 buildonly-randconfig-004-20240720 clang-18 x86_64 buildonly-randconfig-005-20240720 gcc-13 x86_64 buildonly-randconfig-006-20240720 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240720 clang-18 x86_64 randconfig-002-20240720 gcc-13 x86_64 randconfig-003-20240720 clang-18 x86_64 randconfig-004-20240720 clang-18 x86_64 randconfig-005-20240720 clang-18 x86_64 randconfig-006-20240720 gcc-13 x86_64 randconfig-011-20240720 gcc-13 x86_64 randconfig-012-20240720 clang-18 x86_64 randconfig-013-20240720 gcc-13 x86_64 randconfig-014-20240720 clang-18 x86_64 randconfig-015-20240720 gcc-13 x86_64 randconfig-016-20240720 gcc-13 x86_64 randconfig-071-20240720 clang-18 x86_64 randconfig-072-20240720 gcc-13 x86_64 randconfig-073-20240720 gcc-13 x86_64 randconfig-074-20240720 gcc-9 x86_64 randconfig-075-20240720 gcc-13 x86_64 randconfig-076-20240720 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 0cb6baf8db0ebcae5f155083f70760b040c66655
by kernel test robot 21 Jul '24

21 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 0cb6baf8db0ebcae5f155083f70760b040c66655 !10219 CVE-2024-35931 Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-randconfig-001-20240720 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-randconfig-001-20240720 | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-randconfig-002-20240720 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- x86_64-allyesconfig | `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device |-- x86_64-randconfig-072-20240720 | |-- arch-x86-kvm-svm-sev.c:error:lvalue-required-as-unary-operand | `-- arch-x86-kvm-svm-sev.c:error:struct-hygon_kvm_hooks_table-has-no-member-named-false `-- x86_64-randconfig-073-20240720 |-- arch-x86-kvm-svm-sev.c:error:lvalue-required-as-unary-operand `-- arch-x86-kvm-svm-sev.c:error:struct-hygon_kvm_hooks_table-has-no-member-named-false elapsed time: 721m configs tested: 38 configs skipped: 124 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240720 gcc-14.1.0 arm64 randconfig-002-20240720 clang-17 arm64 randconfig-003-20240720 gcc-14.1.0 arm64 randconfig-004-20240720 clang-19 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240720 gcc-14.1.0 loongarch randconfig-002-20240720 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240720 clang-18 x86_64 buildonly-randconfig-002-20240720 gcc-13 x86_64 buildonly-randconfig-003-20240720 clang-18 x86_64 buildonly-randconfig-004-20240720 clang-18 x86_64 buildonly-randconfig-005-20240720 gcc-13 x86_64 buildonly-randconfig-006-20240720 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240720 clang-18 x86_64 randconfig-002-20240720 gcc-13 x86_64 randconfig-003-20240720 clang-18 x86_64 randconfig-004-20240720 clang-18 x86_64 randconfig-005-20240720 clang-18 x86_64 randconfig-006-20240720 gcc-13 x86_64 randconfig-011-20240720 gcc-13 x86_64 randconfig-012-20240720 clang-18 x86_64 randconfig-013-20240720 gcc-13 x86_64 randconfig-014-20240720 clang-18 x86_64 randconfig-015-20240720 gcc-13 x86_64 randconfig-016-20240720 gcc-13 x86_64 randconfig-071-20240720 clang-18 x86_64 randconfig-072-20240720 gcc-13 x86_64 randconfig-073-20240720 gcc-13 x86_64 randconfig-074-20240720 gcc-9 x86_64 randconfig-075-20240720 gcc-13 x86_64 randconfig-076-20240720 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 3af93aaba7a41d14c705c3d5511e2b5313157be7
by kernel test robot 20 Jul '24

20 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 3af93aaba7a41d14c705c3d5511e2b5313157be7 !10135 ALSA: timer: Set lower bound of start tick time elapsed time: 726m configs tested: 34 configs skipped: 127 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240720 gcc-14.1.0 arm64 randconfig-002-20240720 clang-17 arm64 randconfig-003-20240720 gcc-14.1.0 arm64 randconfig-004-20240720 clang-19 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240720 clang-18 x86_64 buildonly-randconfig-002-20240720 gcc-13 x86_64 buildonly-randconfig-003-20240720 clang-18 x86_64 buildonly-randconfig-004-20240720 clang-18 x86_64 buildonly-randconfig-005-20240720 gcc-13 x86_64 buildonly-randconfig-006-20240720 gcc-13 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240720 clang-18 x86_64 randconfig-002-20240720 gcc-13 x86_64 randconfig-003-20240720 clang-18 x86_64 randconfig-004-20240720 clang-18 x86_64 randconfig-005-20240720 clang-18 x86_64 randconfig-006-20240720 gcc-13 x86_64 randconfig-011-20240720 gcc-13 x86_64 randconfig-012-20240720 clang-18 x86_64 randconfig-013-20240720 gcc-13 x86_64 randconfig-014-20240720 clang-18 x86_64 randconfig-015-20240720 gcc-13 x86_64 randconfig-016-20240720 gcc-13 x86_64 randconfig-071-20240720 clang-18 x86_64 randconfig-072-20240720 gcc-13 x86_64 randconfig-073-20240720 gcc-13 x86_64 randconfig-074-20240720 gcc-9 x86_64 randconfig-075-20240720 gcc-13 x86_64 randconfig-076-20240720 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] PCI/ROM: Fix PCI ROM header check bug
by liwei 20 Jul '24

20 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEAGS -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Fixes: d7ad2254fa7c ("[IA64] SN: Correct ROM resource length for BIOS copy") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index e18d3a4383ba..0fa6b3da63cc 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (!IS_ALIGNED((unsigned long)pds, 4)) { + pci_info(pdev, "Invalid PCI ROM header signature: PCIR %#06x\n", + readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] MIPS: smp: fill in sibling and core maps earlier
by liwei 20 Jul '24

20 Jul '24

From: Alexander Lobakin <alobakin(a)pm.me> mainline inclusion from mainline-v5.17-rc7 commit f2703def339c793674010cc9f01bfe4980231808 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGS6 CVE: CVE-2022-48845 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------- After enabling CONFIG_SCHED_CORE (landed during 5.14 cycle), 2-core 2-thread-per-core interAptiv (CPS-driven) started emitting the following: [ 0.025698] CPU1 revision is: 0001a120 (MIPS interAptiv (multi)) [ 0.048183] ------------[ cut here ]------------ [ 0.048187] WARNING: CPU: 1 PID: 0 at kernel/sched/core.c:6025 sched_core_cpu_starting+0x198/0x240 [ 0.048220] Modules linked in: [ 0.048233] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.17.0-rc3+ #35 b7b319f24073fd9a3c2aa7ad15fb7993eec0b26f [ 0.048247] Stack : 817f0000 00000004 327804c8 810eb050 00000000 00000004 00000000 c314fdd1 [ 0.048278] 830cbd64 819c0000 81800000 817f0000 83070bf4 00000001 830cbd08 00000000 [ 0.048307] 00000000 00000000 815fcbc4 00000000 00000000 00000000 00000000 00000000 [ 0.048334] 00000000 00000000 00000000 00000000 817f0000 00000000 00000000 817f6f34 [ 0.048361] 817f0000 818a3c00 817f0000 00000004 00000000 00000000 4dc33260 0018c933 [ 0.048389] ... [ 0.048396] Call Trace: [ 0.048399] [<8105a7bc>] show_stack+0x3c/0x140 [ 0.048424] [<8131c2a0>] dump_stack_lvl+0x60/0x80 [ 0.048440] [<8108b5c0>] __warn+0xc0/0xf4 [ 0.048454] [<8108b658>] warn_slowpath_fmt+0x64/0x10c [ 0.048467] [<810bd418>] sched_core_cpu_starting+0x198/0x240 [ 0.048483] [<810c6514>] sched_cpu_starting+0x14/0x80 [ 0.048497] [<8108c0f8>] cpuhp_invoke_callback_range+0x78/0x140 [ 0.048510] [<8108d914>] notify_cpu_starting+0x94/0x140 [ 0.048523] [<8106593c>] start_secondary+0xbc/0x280 [ 0.048539] [ 0.048543] ---[ end trace 0000000000000000 ]--- [ 0.048636] Synchronize counters for CPU 1: done. ...for each but CPU 0/boot. Basic debug printks right before the mentioned line say: [ 0.048170] CPU: 1, smt_mask: So smt_mask, which is sibling mask obviously, is empty when entering the function. This is critical, as sched_core_cpu_starting() calculates core-scheduling parameters only once per CPU start, and it's crucial to have all the parameters filled in at that moment (at least it uses cpu_smt_mask() which in fact is `&cpu_sibling_map[cpu]` on MIPS). A bit of debugging led me to that set_cpu_sibling_map() performing the actual map calculation, was being invocated after notify_cpu_start(), and exactly the latter function starts CPU HP callback round (sched_core_cpu_starting() is basically a CPU HP callback). While the flow is same on ARM64 (maps after the notifier, although before calling set_cpu_online()), x86 started calculating sibling maps earlier than starting the CPU HP callbacks in Linux 4.14 (see [0] for the reference). Neither me nor my brief tests couldn't find any potential caveats in calculating the maps right after performing delay calibration, but the WARN splat is now gone. The very same debug prints now yield exactly what I expected from them: [ 0.048433] CPU: 1, smt_mask: 0-1 [0] https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=7… Signed-off-by: Alexander Lobakin <alobakin(a)pm.me> Reviewed-by: Philippe Mathieu-Daudé <f4bug(a)amsat.org> Signed-off-by: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/mips/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c index d84b9066b465..7206a6977be9 100644 --- a/arch/mips/kernel/smp.c +++ b/arch/mips/kernel/smp.c @@ -372,6 +372,9 @@ asmlinkage void start_secondary(void) cpu = smp_processor_id(); cpu_data[cpu].udelay_val = loops_per_jiffy; + set_cpu_sibling_map(cpu); + set_cpu_core_map(cpu); + cpumask_set_cpu(cpu, &cpu_coherent_mask); notify_cpu_starting(cpu); @@ -383,9 +386,6 @@ asmlinkage void start_secondary(void) /* The CPU is running and counters synchronised, now mark it online */ set_cpu_online(cpu, true); - set_cpu_sibling_map(cpu); - set_cpu_core_map(cpu); - calculate_cpu_foreign_map(); /* -- 2.25.1

2 1

[openeuler:OLK-6.6 10543/10853] arch/x86/kvm/svm/sev.c:2200:24: error: 'struct hygon_kvm_hooks_table' has no member named 'false'
by kernel test robot 20 Jul '24

20 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b53be02fc76386cd434560ddfa8c5f5f908ced12 commit: 1c3b1095a26ed8bc1aa7ac3d4e8dd3e65964a74b [10543/10853] KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode config: x86_64-randconfig-072-20240720 (https://download.01.org/0day-ci/archive/20240720/202407201747.if3DROph-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240720/202407201747.if3DROph-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407201747.if3DROph-lkp@intel.com/ All errors (new ones prefixed by >>): arch/x86/kvm/svm/sev.c:2198:6: warning: no previous prototype for 'sev_install_hooks' [-Wmissing-prototypes] 2198 | void sev_install_hooks(void) | ^~~~~~~~~~~~~~~~~ arch/x86/kvm/svm/sev.c: In function 'sev_install_hooks': >> arch/x86/kvm/svm/sev.c:2200:24: error: 'struct hygon_kvm_hooks_table' has no member named 'false' 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ^ >> arch/x86/kvm/svm/sev.c:2200:39: error: lvalue required as unary '&' operand 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ^ vim +2200 arch/x86/kvm/svm/sev.c 2195 2196 #ifdef CONFIG_HYGON_CSV 2197 /* Code to set all of the function and vaiable pointers */ > 2198 void sev_install_hooks(void) 2199 { > 2200 hygon_kvm_hooks.sev_enabled = &sev_enabled; 2201 hygon_kvm_hooks.sev_issue_cmd = sev_issue_cmd; 2202 hygon_kvm_hooks.get_num_contig_pages = get_num_contig_pages; 2203 hygon_kvm_hooks.sev_pin_memory = sev_pin_memory; 2204 hygon_kvm_hooks.sev_unpin_memory = sev_unpin_memory; 2205 2206 hygon_kvm_hooks.sev_hooks_installed = true; 2207 } 2208 #endif 2209 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] cxl/region: Fix memregion leaks in devm_cxl_add_region()
by Pu Lehui 20 Jul '24

20 Jul '24

From: Li Zhijian <lizhijian(a)fujitsu.com> stable inclusion from stable-v6.6.35 commit d8316838aa0686da63a8be4194b7a17b0103ae4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD05U CVE: CVE-2024-40936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49ba7b515c4c0719b866d16f068e62d16a8a3dd1 ] Move the mode verification to __create_region() before allocating the memregion to avoid the memregion leaks. Fixes: 6e099264185d ("cxl/region: Add volatile region creation support") Signed-off-by: Li Zhijian <lizhijian(a)fujitsu.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Link: https://lore.kernel.org/r/20240507053421.456439-1-lizhijian@fujitsu.com Signed-off-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/cxl/core/region.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index e2a82ee4ff0c..6f06255012f0 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -2186,15 +2186,6 @@ static struct cxl_region *devm_cxl_add_region(struct cxl_root_decoder *cxlrd, struct device *dev; int rc; - switch (mode) { - case CXL_DECODER_RAM: - case CXL_DECODER_PMEM: - break; - default: - dev_err(&cxlrd->cxlsd.cxld.dev, "unsupported mode %d\n", mode); - return ERR_PTR(-EINVAL); - } - cxlr = cxl_region_alloc(cxlrd, id); if (IS_ERR(cxlr)) return cxlr; @@ -2245,6 +2236,15 @@ static struct cxl_region *__create_region(struct cxl_root_decoder *cxlrd, { int rc; + switch (mode) { + case CXL_DECODER_RAM: + case CXL_DECODER_PMEM: + break; + default: + dev_err(&cxlrd->cxlsd.cxld.dev, "unsupported mode %d\n", mode); + return ERR_PTR(-EINVAL); + } + rc = memregion_alloc(GFP_KERNEL); if (rc < 0) return ERR_PTR(rc); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: ufs: Fix a deadlock in the error handler
by Pu Lehui 20 Jul '24

20 Jul '24

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v5.17-rc1 commit 945c3cca05d78351bba29fa65d93834cb7934c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADG3U CVE: CVE-2021-47622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following deadlock has been observed on a test setup: - All tags allocated - The SCSI error handler calls ufshcd_eh_host_reset_handler() - ufshcd_eh_host_reset_handler() queues work that calls ufshcd_err_handler() - ufshcd_err_handler() locks up as follows: Workqueue: ufs_eh_wq_0 ufshcd_err_handler.cfi_jt Call trace: __switch_to+0x298/0x5d8 __schedule+0x6cc/0xa94 schedule+0x12c/0x298 blk_mq_get_tag+0x210/0x480 __blk_mq_alloc_request+0x1c8/0x284 blk_get_request+0x74/0x134 ufshcd_exec_dev_cmd+0x68/0x640 ufshcd_verify_dev_init+0x68/0x35c ufshcd_probe_hba+0x12c/0x1cb8 ufshcd_host_reset_and_restore+0x88/0x254 ufshcd_reset_and_restore+0xd0/0x354 ufshcd_err_handler+0x408/0xc58 process_one_work+0x24c/0x66c worker_thread+0x3e8/0xa4c kthread+0x150/0x1b4 ret_from_fork+0x10/0x30 Fix this lockup by making ufshcd_exec_dev_cmd() allocate a reserved request. Link: https://lore.kernel.org/r/20211203231950.193369-10-bvanassche@acm.org Tested-by: Bean Huo <beanhuo(a)micron.com> Reviewed-by: Adrian Hunter <adrian.hunter(a)intel.com> Reviewed-by: Bean Huo <beanhuo(a)micron.com> Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/ufs/ufshcd.c [The Conflicts were due to not backport some unnecessary patch] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/scsi/ufs/ufshcd.c | 52 +++++++++++---------------------------- drivers/scsi/ufs/ufshcd.h | 2 ++ 2 files changed, 16 insertions(+), 38 deletions(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 129c45c6bba5..3aa8a600e9a5 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -125,8 +125,9 @@ EXPORT_SYMBOL_GPL(ufshcd_dump_regs); enum { UFSHCD_MAX_CHANNEL = 0, UFSHCD_MAX_ID = 1, - UFSHCD_CMD_PER_LUN = 32, - UFSHCD_CAN_QUEUE = 32, + UFSHCD_NUM_RESERVED = 1, + UFSHCD_CMD_PER_LUN = 32 - UFSHCD_NUM_RESERVED, + UFSHCD_CAN_QUEUE = 32 - UFSHCD_NUM_RESERVED, }; /* UFSHCD states */ @@ -2046,6 +2047,7 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba) hba->nutrs = (hba->capabilities & MASK_TRANSFER_REQUESTS_SLOTS) + 1; hba->nutmrs = ((hba->capabilities & MASK_TASK_MANAGEMENT_REQUEST_SLOTS) >> 16) + 1; + hba->reserved_slot = hba->nutrs - 1; /* Read crypto capabilities */ err = ufshcd_hba_init_crypto_capabilities(hba); @@ -2774,31 +2776,16 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, static int ufshcd_exec_dev_cmd(struct ufs_hba *hba, enum dev_cmd_type cmd_type, int timeout) { - struct request_queue *q = hba->cmd_queue; - struct request *req; + const u32 tag = hba->reserved_slot; struct ufshcd_lrb *lrbp; int err; - int tag; struct completion wait; unsigned long flags; - down_read(&hba->clk_scaling_lock); + /* Protects use of hba->reserved_slot. */ + lockdep_assert_held(&hba->dev_cmd.lock); - /* - * Get free slot, sleep if slots are unavailable. - * Even though we use wait_event() which sleeps indefinitely, - * the maximum wait time is bounded by SCSI request timeout. - */ - req = blk_get_request(q, REQ_OP_DRV_OUT, 0); - if (IS_ERR(req)) { - err = PTR_ERR(req); - goto out_unlock; - } - tag = req->tag; - WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag)); - /* Set the timeout such that the SCSI error handler is not activated. */ - req->timeout = msecs_to_jiffies(2 * timeout); - blk_mq_start_request(req); + down_read(&hba->clk_scaling_lock); init_completion(&wait); lrbp = &hba->lrb[tag]; @@ -2822,8 +2809,6 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba, err ? "query_complete_err" : "query_complete"); out_put_tag: - blk_put_request(req); -out_unlock: up_read(&hba->clk_scaling_lock); return err; } @@ -6380,24 +6365,17 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba, enum dev_cmd_type cmd_type, enum query_opcode desc_op) { - struct request_queue *q = hba->cmd_queue; - struct request *req; + const u32 tag = hba->reserved_slot; struct ufshcd_lrb *lrbp; int err = 0; - int tag; struct completion wait; unsigned long flags; u8 upiu_flags; - down_read(&hba->clk_scaling_lock); + /* Protects use of hba->reserved_slot. */ + lockdep_assert_held(&hba->dev_cmd.lock); - req = blk_get_request(q, REQ_OP_DRV_OUT, 0); - if (IS_ERR(req)) { - err = PTR_ERR(req); - goto out_unlock; - } - tag = req->tag; - WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag)); + down_read(&hba->clk_scaling_lock); init_completion(&wait); lrbp = &hba->lrb[tag]; @@ -6474,8 +6452,6 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba, } } - blk_put_request(req); -out_unlock: up_read(&hba->clk_scaling_lock); return err; } @@ -9146,8 +9122,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) /* Configure LRB */ ufshcd_host_memory_configure(hba); - host->can_queue = hba->nutrs; - host->cmd_per_lun = hba->nutrs; + host->can_queue = hba->nutrs - UFSHCD_NUM_RESERVED; + host->cmd_per_lun = hba->nutrs - UFSHCD_NUM_RESERVED; host->max_id = UFSHCD_MAX_ID; host->max_lun = UFS_MAX_LUNS; host->max_channel = UFSHCD_MAX_CHANNEL; diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h index 35dd5197ccb9..160a6ef58942 100644 --- a/drivers/scsi/ufs/ufshcd.h +++ b/drivers/scsi/ufs/ufshcd.h @@ -634,6 +634,7 @@ struct ufs_hba_variant_params { * @capabilities: UFS Controller Capabilities * @nutrs: Transfer Request Queue depth supported by controller * @nutmrs: Task Management Queue depth supported by controller + * @reserved_slot: Used to submit device commands. Protected by @dev_cmd.lock. * @ufs_version: UFS Version to which controller complies * @vops: pointer to variant specific operations * @priv: pointer to variant specific private data @@ -719,6 +720,7 @@ struct ufs_hba { u32 capabilities; int nutrs; int nutmrs; + u32 reserved_slot; u32 ufs_version; const struct ufs_hba_variant_ops *vops; struct ufs_hba_variant_params *vps; -- 2.34.1

2 1

[PATCH OLK-5.10] scsi: ufs: Fix a deadlock in the error handler
by Pu Lehui 20 Jul '24

20 Jul '24

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v5.17-rc1 commit 945c3cca05d78351bba29fa65d93834cb7934c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADG3U CVE: CVE-2021-47622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following deadlock has been observed on a test setup: - All tags allocated - The SCSI error handler calls ufshcd_eh_host_reset_handler() - ufshcd_eh_host_reset_handler() queues work that calls ufshcd_err_handler() - ufshcd_err_handler() locks up as follows: Workqueue: ufs_eh_wq_0 ufshcd_err_handler.cfi_jt Call trace: __switch_to+0x298/0x5d8 __schedule+0x6cc/0xa94 schedule+0x12c/0x298 blk_mq_get_tag+0x210/0x480 __blk_mq_alloc_request+0x1c8/0x284 blk_get_request+0x74/0x134 ufshcd_exec_dev_cmd+0x68/0x640 ufshcd_verify_dev_init+0x68/0x35c ufshcd_probe_hba+0x12c/0x1cb8 ufshcd_host_reset_and_restore+0x88/0x254 ufshcd_reset_and_restore+0xd0/0x354 ufshcd_err_handler+0x408/0xc58 process_one_work+0x24c/0x66c worker_thread+0x3e8/0xa4c kthread+0x150/0x1b4 ret_from_fork+0x10/0x30 Fix this lockup by making ufshcd_exec_dev_cmd() allocate a reserved request. Link: https://lore.kernel.org/r/20211203231950.193369-10-bvanassche@acm.org Tested-by: Bean Huo <beanhuo(a)micron.com> Reviewed-by: Adrian Hunter <adrian.hunter(a)intel.com> Reviewed-by: Bean Huo <beanhuo(a)micron.com> Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/ufs/ufshcd.c [The Conflicts were due to not backport some unnecessary patch] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/scsi/ufs/ufshcd.c | 52 +++++++++++---------------------------- drivers/scsi/ufs/ufshcd.h | 2 ++ 2 files changed, 16 insertions(+), 38 deletions(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 129c45c6bba5..3aa8a600e9a5 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -125,8 +125,9 @@ EXPORT_SYMBOL_GPL(ufshcd_dump_regs); enum { UFSHCD_MAX_CHANNEL = 0, UFSHCD_MAX_ID = 1, - UFSHCD_CMD_PER_LUN = 32, - UFSHCD_CAN_QUEUE = 32, + UFSHCD_NUM_RESERVED = 1, + UFSHCD_CMD_PER_LUN = 32 - UFSHCD_NUM_RESERVED, + UFSHCD_CAN_QUEUE = 32 - UFSHCD_NUM_RESERVED, }; /* UFSHCD states */ @@ -2046,6 +2047,7 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba) hba->nutrs = (hba->capabilities & MASK_TRANSFER_REQUESTS_SLOTS) + 1; hba->nutmrs = ((hba->capabilities & MASK_TASK_MANAGEMENT_REQUEST_SLOTS) >> 16) + 1; + hba->reserved_slot = hba->nutrs - 1; /* Read crypto capabilities */ err = ufshcd_hba_init_crypto_capabilities(hba); @@ -2774,31 +2776,16 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, static int ufshcd_exec_dev_cmd(struct ufs_hba *hba, enum dev_cmd_type cmd_type, int timeout) { - struct request_queue *q = hba->cmd_queue; - struct request *req; + const u32 tag = hba->reserved_slot; struct ufshcd_lrb *lrbp; int err; - int tag; struct completion wait; unsigned long flags; - down_read(&hba->clk_scaling_lock); + /* Protects use of hba->reserved_slot. */ + lockdep_assert_held(&hba->dev_cmd.lock); - /* - * Get free slot, sleep if slots are unavailable. - * Even though we use wait_event() which sleeps indefinitely, - * the maximum wait time is bounded by SCSI request timeout. - */ - req = blk_get_request(q, REQ_OP_DRV_OUT, 0); - if (IS_ERR(req)) { - err = PTR_ERR(req); - goto out_unlock; - } - tag = req->tag; - WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag)); - /* Set the timeout such that the SCSI error handler is not activated. */ - req->timeout = msecs_to_jiffies(2 * timeout); - blk_mq_start_request(req); + down_read(&hba->clk_scaling_lock); init_completion(&wait); lrbp = &hba->lrb[tag]; @@ -2822,8 +2809,6 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba, err ? "query_complete_err" : "query_complete"); out_put_tag: - blk_put_request(req); -out_unlock: up_read(&hba->clk_scaling_lock); return err; } @@ -6380,24 +6365,17 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba, enum dev_cmd_type cmd_type, enum query_opcode desc_op) { - struct request_queue *q = hba->cmd_queue; - struct request *req; + const u32 tag = hba->reserved_slot; struct ufshcd_lrb *lrbp; int err = 0; - int tag; struct completion wait; unsigned long flags; u8 upiu_flags; - down_read(&hba->clk_scaling_lock); + /* Protects use of hba->reserved_slot. */ + lockdep_assert_held(&hba->dev_cmd.lock); - req = blk_get_request(q, REQ_OP_DRV_OUT, 0); - if (IS_ERR(req)) { - err = PTR_ERR(req); - goto out_unlock; - } - tag = req->tag; - WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag)); + down_read(&hba->clk_scaling_lock); init_completion(&wait); lrbp = &hba->lrb[tag]; @@ -6474,8 +6452,6 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba, } } - blk_put_request(req); -out_unlock: up_read(&hba->clk_scaling_lock); return err; } @@ -9146,8 +9122,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) /* Configure LRB */ ufshcd_host_memory_configure(hba); - host->can_queue = hba->nutrs; - host->cmd_per_lun = hba->nutrs; + host->can_queue = hba->nutrs - UFSHCD_NUM_RESERVED; + host->cmd_per_lun = hba->nutrs - UFSHCD_NUM_RESERVED; host->max_id = UFSHCD_MAX_ID; host->max_lun = UFS_MAX_LUNS; host->max_channel = UFSHCD_MAX_CHANNEL; diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h index 35dd5197ccb9..160a6ef58942 100644 --- a/drivers/scsi/ufs/ufshcd.h +++ b/drivers/scsi/ufs/ufshcd.h @@ -634,6 +634,7 @@ struct ufs_hba_variant_params { * @capabilities: UFS Controller Capabilities * @nutrs: Transfer Request Queue depth supported by controller * @nutmrs: Task Management Queue depth supported by controller + * @reserved_slot: Used to submit device commands. Protected by @dev_cmd.lock. * @ufs_version: UFS Version to which controller complies * @vops: pointer to variant specific operations * @priv: pointer to variant specific private data @@ -719,6 +720,7 @@ struct ufs_hba { u32 capabilities; int nutrs; int nutmrs; + u32 reserved_slot; u32 ufs_version; const struct ufs_hba_variant_ops *vops; struct ufs_hba_variant_params *vps; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-35931
by Liu Chuang 20 Jul '24

20 Jul '24

Fixing CVE-2024-35931 Asad Kamal (1): drm/amdgpu : Add hive ras recovery check Liu Chuang (1): drm/amdgpu: Fix kabi breakage in struct amdgpu_hive_info Stanley.Yang (1): drm/amdgpu: Skip do PCI error slot reset during RAS recovery drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 +++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h | 2 ++ 3 files changed, 25 insertions(+), 2 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] bpf: Fix overrunning reservations in ringbuf
by Pu Lehui 20 Jul '24

20 Jul '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v6.10-rc6 commit cfa1a2329a691ffd991fcf7248a57d752e712881 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADR59 CVE: CVE-2024-41009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumer_pos is the consumer counter to show which logical position the consumer consumed the data, and producer_pos which is the producer counter denoting the amount of data reserved by all producers. Each time a record is reserved, the producer that "owns" the record will successfully advance producer counter. In user space each time a record is read, the consumer of the data advanced the consumer counter once it finished processing. Both counters are stored in separate pages so that from user space, the producer counter is read-only and the consumer counter is read-write. One aspect that simplifies and thus speeds up the implementation of both producers and consumers is how the data area is mapped twice contiguously back-to-back in the virtual memory, allowing to not take any special measures for samples that have to wrap around at the end of the circular buffer data area, because the next page after the last data page would be first data page again, and thus the sample will still appear completely contiguous in virtual memory. Each record has a struct bpf_ringbuf_hdr { u32 len; u32 pg_off; } header for book-keeping the length and offset, and is inaccessible to the BPF program. Helpers like bpf_ringbuf_reserve() return `(void *)hdr + BPF_RINGBUF_HDR_SZ` for the BPF program to use. Bing-Jhong and Muhammad reported that it is however possible to make a second allocated memory chunk overlapping with the first chunk and as a result, the BPF program is now able to edit first chunk's header. For example, consider the creation of a BPF_MAP_TYPE_RINGBUF map with size of 0x4000. Next, the consumer_pos is modified to 0x3000 /before/ a call to bpf_ringbuf_reserve() is made. This will allocate a chunk A, which is in [0x0,0x3008], and the BPF program is able to edit [0x8,0x3008]. Now, lets allocate a chunk B with size 0x3000. This will succeed because consumer_pos was edited ahead of time to pass the `new_prod_pos - cons_pos > rb->mask` check. Chunk B will be in range [0x3008,0x6010], and the BPF program is able to edit [0x3010,0x6010]. Due to the ring buffer memory layout mentioned earlier, the ranges [0x0,0x4000] and [0x4000,0x8000] point to the same data pages. This means that chunk B at [0x4000,0x4008] is chunk A's header. bpf_ringbuf_submit() / bpf_ringbuf_discard() use the header's pg_off to then locate the bpf_ringbuf itself via bpf_ringbuf_restore_from_rec(). Once chunk B modified chunk A's header, then bpf_ringbuf_commit() refers to the wrong page and could cause a crash. Fix it by calculating the oldest pending_pos and check whether the range from the oldest outstanding record to the newest would span beyond the ring buffer size. If that is the case, then reject the request. We've tested with the ring buffer benchmark in BPF selftests (./benchs/run_bench_ringbufs.sh) before/after the fix and while it seems a bit slower on some benchmarks, it is still not significantly enough to matter. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Reported-by: Muhammad Ramdhan <ramdhan(a)starlabs.sg> Co-developed-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Co-developed-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20240621140828.18238-1-daniel@iogearbox.net Conflicts: kernel/bpf/ringbuf.c [The Conflicts were due to not merge commit 583c1f420173f] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/ringbuf.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index d6fbe17432ae..d21d4ba2eb39 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -44,6 +44,7 @@ struct bpf_ringbuf { */ unsigned long consumer_pos __aligned(PAGE_SIZE); unsigned long producer_pos __aligned(PAGE_SIZE); + unsigned long pending_pos; char data[] __aligned(PAGE_SIZE); }; @@ -145,6 +146,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) rb->mask = data_sz - 1; rb->consumer_pos = 0; rb->producer_pos = 0; + rb->pending_pos = 0; return rb; } @@ -323,9 +325,9 @@ bpf_ringbuf_restore_from_rec(struct bpf_ringbuf_hdr *hdr) static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) { - unsigned long cons_pos, prod_pos, new_prod_pos, flags; - u32 len, pg_off; + unsigned long cons_pos, prod_pos, new_prod_pos, pend_pos, flags; struct bpf_ringbuf_hdr *hdr; + u32 len, pg_off, tmp_size, hdr_len; if (unlikely(size > RINGBUF_MAX_RECORD_SZ)) return NULL; @@ -343,13 +345,29 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) spin_lock_irqsave(&rb->spinlock, flags); } + pend_pos = rb->pending_pos; prod_pos = rb->producer_pos; new_prod_pos = prod_pos + len; - /* check for out of ringbuf space by ensuring producer position - * doesn't advance more than (ringbuf_size - 1) ahead + while (pend_pos < prod_pos) { + hdr = (void *)rb->data + (pend_pos & rb->mask); + hdr_len = READ_ONCE(hdr->len); + if (hdr_len & BPF_RINGBUF_BUSY_BIT) + break; + tmp_size = hdr_len & ~BPF_RINGBUF_DISCARD_BIT; + tmp_size = round_up(tmp_size + BPF_RINGBUF_HDR_SZ, 8); + pend_pos += tmp_size; + } + rb->pending_pos = pend_pos; + + /* check for out of ringbuf space: + * - by ensuring producer position doesn't advance more than + * (ringbuf_size - 1) ahead + * - by ensuring oldest not yet committed record until newest + * record does not span more than (ringbuf_size - 1) */ - if (new_prod_pos - cons_pos > rb->mask) { + if (new_prod_pos - cons_pos > rb->mask || + new_prod_pos - pend_pos > rb->mask) { spin_unlock_irqrestore(&rb->spinlock, flags); return NULL; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Fix overrunning reservations in ringbuf
by Pu Lehui 20 Jul '24

20 Jul '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v6.10-rc6 commit cfa1a2329a691ffd991fcf7248a57d752e712881 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADR59 CVE: CVE-2024-41009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumer_pos is the consumer counter to show which logical position the consumer consumed the data, and producer_pos which is the producer counter denoting the amount of data reserved by all producers. Each time a record is reserved, the producer that "owns" the record will successfully advance producer counter. In user space each time a record is read, the consumer of the data advanced the consumer counter once it finished processing. Both counters are stored in separate pages so that from user space, the producer counter is read-only and the consumer counter is read-write. One aspect that simplifies and thus speeds up the implementation of both producers and consumers is how the data area is mapped twice contiguously back-to-back in the virtual memory, allowing to not take any special measures for samples that have to wrap around at the end of the circular buffer data area, because the next page after the last data page would be first data page again, and thus the sample will still appear completely contiguous in virtual memory. Each record has a struct bpf_ringbuf_hdr { u32 len; u32 pg_off; } header for book-keeping the length and offset, and is inaccessible to the BPF program. Helpers like bpf_ringbuf_reserve() return `(void *)hdr + BPF_RINGBUF_HDR_SZ` for the BPF program to use. Bing-Jhong and Muhammad reported that it is however possible to make a second allocated memory chunk overlapping with the first chunk and as a result, the BPF program is now able to edit first chunk's header. For example, consider the creation of a BPF_MAP_TYPE_RINGBUF map with size of 0x4000. Next, the consumer_pos is modified to 0x3000 /before/ a call to bpf_ringbuf_reserve() is made. This will allocate a chunk A, which is in [0x0,0x3008], and the BPF program is able to edit [0x8,0x3008]. Now, lets allocate a chunk B with size 0x3000. This will succeed because consumer_pos was edited ahead of time to pass the `new_prod_pos - cons_pos > rb->mask` check. Chunk B will be in range [0x3008,0x6010], and the BPF program is able to edit [0x3010,0x6010]. Due to the ring buffer memory layout mentioned earlier, the ranges [0x0,0x4000] and [0x4000,0x8000] point to the same data pages. This means that chunk B at [0x4000,0x4008] is chunk A's header. bpf_ringbuf_submit() / bpf_ringbuf_discard() use the header's pg_off to then locate the bpf_ringbuf itself via bpf_ringbuf_restore_from_rec(). Once chunk B modified chunk A's header, then bpf_ringbuf_commit() refers to the wrong page and could cause a crash. Fix it by calculating the oldest pending_pos and check whether the range from the oldest outstanding record to the newest would span beyond the ring buffer size. If that is the case, then reject the request. We've tested with the ring buffer benchmark in BPF selftests (./benchs/run_bench_ringbufs.sh) before/after the fix and while it seems a bit slower on some benchmarks, it is still not significantly enough to matter. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Reported-by: Muhammad Ramdhan <ramdhan(a)starlabs.sg> Co-developed-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Co-developed-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20240621140828.18238-1-daniel@iogearbox.net Conflicts: kernel/bpf/ringbuf.c [The Conflicts were due to not merge commit 583c1f420173f] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/ringbuf.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index d6fbe17432ae..d21d4ba2eb39 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -44,6 +44,7 @@ struct bpf_ringbuf { */ unsigned long consumer_pos __aligned(PAGE_SIZE); unsigned long producer_pos __aligned(PAGE_SIZE); + unsigned long pending_pos; char data[] __aligned(PAGE_SIZE); }; @@ -145,6 +146,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) rb->mask = data_sz - 1; rb->consumer_pos = 0; rb->producer_pos = 0; + rb->pending_pos = 0; return rb; } @@ -323,9 +325,9 @@ bpf_ringbuf_restore_from_rec(struct bpf_ringbuf_hdr *hdr) static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) { - unsigned long cons_pos, prod_pos, new_prod_pos, flags; - u32 len, pg_off; + unsigned long cons_pos, prod_pos, new_prod_pos, pend_pos, flags; struct bpf_ringbuf_hdr *hdr; + u32 len, pg_off, tmp_size, hdr_len; if (unlikely(size > RINGBUF_MAX_RECORD_SZ)) return NULL; @@ -343,13 +345,29 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) spin_lock_irqsave(&rb->spinlock, flags); } + pend_pos = rb->pending_pos; prod_pos = rb->producer_pos; new_prod_pos = prod_pos + len; - /* check for out of ringbuf space by ensuring producer position - * doesn't advance more than (ringbuf_size - 1) ahead + while (pend_pos < prod_pos) { + hdr = (void *)rb->data + (pend_pos & rb->mask); + hdr_len = READ_ONCE(hdr->len); + if (hdr_len & BPF_RINGBUF_BUSY_BIT) + break; + tmp_size = hdr_len & ~BPF_RINGBUF_DISCARD_BIT; + tmp_size = round_up(tmp_size + BPF_RINGBUF_HDR_SZ, 8); + pend_pos += tmp_size; + } + rb->pending_pos = pend_pos; + + /* check for out of ringbuf space: + * - by ensuring producer position doesn't advance more than + * (ringbuf_size - 1) ahead + * - by ensuring oldest not yet committed record until newest + * record does not span more than (ringbuf_size - 1) */ - if (new_prod_pos - cons_pos > rb->mask) { + if (new_prod_pos - cons_pos > rb->mask || + new_prod_pos - pend_pos > rb->mask) { spin_unlock_irqrestore(&rb->spinlock, flags); return NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Fix overrunning reservations in ringbuf
by Pu Lehui 20 Jul '24

20 Jul '24

From: Daniel Borkmann <daniel(a)iogearbox.net> stable inclusion from stable-v6.6.37 commit 511804ab701c0503b72eac08217eabfd366ba069 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADR59 CVE: CVE-2024-41009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cfa1a2329a691ffd991fcf7248a57d752e712881 ] The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumer_pos is the consumer counter to show which logical position the consumer consumed the data, and producer_pos which is the producer counter denoting the amount of data reserved by all producers. Each time a record is reserved, the producer that "owns" the record will successfully advance producer counter. In user space each time a record is read, the consumer of the data advanced the consumer counter once it finished processing. Both counters are stored in separate pages so that from user space, the producer counter is read-only and the consumer counter is read-write. One aspect that simplifies and thus speeds up the implementation of both producers and consumers is how the data area is mapped twice contiguously back-to-back in the virtual memory, allowing to not take any special measures for samples that have to wrap around at the end of the circular buffer data area, because the next page after the last data page would be first data page again, and thus the sample will still appear completely contiguous in virtual memory. Each record has a struct bpf_ringbuf_hdr { u32 len; u32 pg_off; } header for book-keeping the length and offset, and is inaccessible to the BPF program. Helpers like bpf_ringbuf_reserve() return `(void *)hdr + BPF_RINGBUF_HDR_SZ` for the BPF program to use. Bing-Jhong and Muhammad reported that it is however possible to make a second allocated memory chunk overlapping with the first chunk and as a result, the BPF program is now able to edit first chunk's header. For example, consider the creation of a BPF_MAP_TYPE_RINGBUF map with size of 0x4000. Next, the consumer_pos is modified to 0x3000 /before/ a call to bpf_ringbuf_reserve() is made. This will allocate a chunk A, which is in [0x0,0x3008], and the BPF program is able to edit [0x8,0x3008]. Now, lets allocate a chunk B with size 0x3000. This will succeed because consumer_pos was edited ahead of time to pass the `new_prod_pos - cons_pos > rb->mask` check. Chunk B will be in range [0x3008,0x6010], and the BPF program is able to edit [0x3010,0x6010]. Due to the ring buffer memory layout mentioned earlier, the ranges [0x0,0x4000] and [0x4000,0x8000] point to the same data pages. This means that chunk B at [0x4000,0x4008] is chunk A's header. bpf_ringbuf_submit() / bpf_ringbuf_discard() use the header's pg_off to then locate the bpf_ringbuf itself via bpf_ringbuf_restore_from_rec(). Once chunk B modified chunk A's header, then bpf_ringbuf_commit() refers to the wrong page and could cause a crash. Fix it by calculating the oldest pending_pos and check whether the range from the oldest outstanding record to the newest would span beyond the ring buffer size. If that is the case, then reject the request. We've tested with the ring buffer benchmark in BPF selftests (./benchs/run_bench_ringbufs.sh) before/after the fix and while it seems a bit slower on some benchmarks, it is still not significantly enough to matter. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Reported-by: Muhammad Ramdhan <ramdhan(a)starlabs.sg> Co-developed-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Co-developed-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20240621140828.18238-1-daniel@iogearbox.net Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/ringbuf.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index f045fde632e5..238d9b206bbd 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -51,7 +51,8 @@ struct bpf_ringbuf { * This prevents a user-space application from modifying the * position and ruining in-kernel tracking. The permissions of the * pages depend on who is producing samples: user-space or the - * kernel. + * kernel. Note that the pending counter is placed in the same + * page as the producer, so that it shares the same cache line. * * Kernel-producer * --------------- @@ -70,6 +71,7 @@ struct bpf_ringbuf { */ unsigned long consumer_pos __aligned(PAGE_SIZE); unsigned long producer_pos __aligned(PAGE_SIZE); + unsigned long pending_pos; char data[] __aligned(PAGE_SIZE); }; @@ -179,6 +181,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) rb->mask = data_sz - 1; rb->consumer_pos = 0; rb->producer_pos = 0; + rb->pending_pos = 0; return rb; } @@ -404,9 +407,9 @@ bpf_ringbuf_restore_from_rec(struct bpf_ringbuf_hdr *hdr) static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) { - unsigned long cons_pos, prod_pos, new_prod_pos, flags; - u32 len, pg_off; + unsigned long cons_pos, prod_pos, new_prod_pos, pend_pos, flags; struct bpf_ringbuf_hdr *hdr; + u32 len, pg_off, tmp_size, hdr_len; if (unlikely(size > RINGBUF_MAX_RECORD_SZ)) return NULL; @@ -424,13 +427,29 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) spin_lock_irqsave(&rb->spinlock, flags); } + pend_pos = rb->pending_pos; prod_pos = rb->producer_pos; new_prod_pos = prod_pos + len; - /* check for out of ringbuf space by ensuring producer position - * doesn't advance more than (ringbuf_size - 1) ahead + while (pend_pos < prod_pos) { + hdr = (void *)rb->data + (pend_pos & rb->mask); + hdr_len = READ_ONCE(hdr->len); + if (hdr_len & BPF_RINGBUF_BUSY_BIT) + break; + tmp_size = hdr_len & ~BPF_RINGBUF_DISCARD_BIT; + tmp_size = round_up(tmp_size + BPF_RINGBUF_HDR_SZ, 8); + pend_pos += tmp_size; + } + rb->pending_pos = pend_pos; + + /* check for out of ringbuf space: + * - by ensuring producer position doesn't advance more than + * (ringbuf_size - 1) ahead + * - by ensuring oldest not yet committed record until newest + * record does not span more than (ringbuf_size - 1) */ - if (new_prod_pos - cons_pos > rb->mask) { + if (new_prod_pos - cons_pos > rb->mask || + new_prod_pos - pend_pos > rb->mask) { spin_unlock_irqrestore(&rb->spinlock, flags); return NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-35931
by Liu Chuang 20 Jul '24

20 Jul '24

Fixing CVE-2024-35931 Asad Kamal (1): drm/amdgpu : Add hive ras recovery check Stanley.Yang (1): drm/amdgpu: Skip do PCI error slot reset during RAS recovery drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 ++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 +++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h | 1 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 10 +++++++++- 4 files changed, 31 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] cxl/region: Fix memregion leaks in devm_cxl_add_region()
by Pu Lehui 20 Jul '24

20 Jul '24

From: Li Zhijian <lizhijian(a)fujitsu.com> stable inclusion from stable-v6.6.35 commit d8316838aa0686da63a8be4194b7a17b0103ae4a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAD6H2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49ba7b515c4c0719b866d16f068e62d16a8a3dd1 ] Move the mode verification to __create_region() before allocating the memregion to avoid the memregion leaks. Fixes: 6e099264185d ("cxl/region: Add volatile region creation support") Signed-off-by: Li Zhijian <lizhijian(a)fujitsu.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Link: https://lore.kernel.org/r/20240507053421.456439-1-lizhijian@fujitsu.com Signed-off-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/cxl/core/region.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index e2a82ee4ff0c..6f06255012f0 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -2186,15 +2186,6 @@ static struct cxl_region *devm_cxl_add_region(struct cxl_root_decoder *cxlrd, struct device *dev; int rc; - switch (mode) { - case CXL_DECODER_RAM: - case CXL_DECODER_PMEM: - break; - default: - dev_err(&cxlrd->cxlsd.cxld.dev, "unsupported mode %d\n", mode); - return ERR_PTR(-EINVAL); - } - cxlr = cxl_region_alloc(cxlrd, id); if (IS_ERR(cxlr)) return cxlr; @@ -2245,6 +2236,15 @@ static struct cxl_region *__create_region(struct cxl_root_decoder *cxlrd, { int rc; + switch (mode) { + case CXL_DECODER_RAM: + case CXL_DECODER_PMEM: + break; + default: + dev_err(&cxlrd->cxlsd.cxld.dev, "unsupported mode %d\n", mode); + return ERR_PTR(-EINVAL); + } + rc = memregion_alloc(GFP_KERNEL); if (rc < 0) return ERR_PTR(rc); -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] CVE-2024-35931
by Liu Chuang 20 Jul '24

20 Jul '24

Fixing CVE-2024-35931 Asad Kamal (1): drm/amdgpu : Add hive ras recovery check Liu Chuang (1): drm/amdgpu: Fix kabi breakage in struct amdgpu_hive_info Stanley.Yang (1): drm/amdgpu: Skip do PCI error slot reset during RAS recovery drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 +++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h | 2 ++ 3 files changed, 25 insertions(+), 2 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/2] CVE-2024-35931
by Liu Chuang 20 Jul '24

20 Jul '24

Fixing CVE-2024-35931 Asad Kamal (1): drm/amdgpu : Add hive ras recovery check Stanley.Yang (1): drm/amdgpu: Skip do PCI error slot reset during RAS recovery drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 ++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 +++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h | 1 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 10 +++++++++- 4 files changed, 31 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-35931
by Liu Chuang 20 Jul '24

20 Jul '24

Fixing CVE-2024-35931 Asad Kamal (1): drm/amdgpu : Add hive ras recovery check Liu Chuang (1): drm/amdgpu: Fix kabi breakage in struct amdgpu_hive_info Stanley.Yang (1): drm/amdgpu: Skip do PCI error slot reset during RAS recovery drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 +++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h | 2 ++ 3 files changed, 25 insertions(+), 2 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/3] CVE-2024-35931
by Liu Chuang 20 Jul '24

20 Jul '24

Fixing CVE-2024-35931 Asad Kamal (1): drm/amdgpu : Add hive ras recovery check Liu Chuang (1): drm/amdgpu: Fix kabi breakage in struct amdgpu_hive_info Stanley.Yang (1): drm/amdgpu: Skip do PCI error slot reset during RAS recovery drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 +++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h | 2 ++ 3 files changed, 25 insertions(+), 2 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] net: mvpp2: clear BM pool before initialization
by Wang Hai 20 Jul '24

20 Jul '24

From: Jenishkumar Maheshbhai Patel <jpatel2(a)marvell.com> stable inclusion from stable-v5.10.210 commit 83f99138bf3b396f761600ab488054396fb5768f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9DC CVE: CVE-2024-35837 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9f538b415db862e74b8c5d3abbccfc1b2b6caa38 ] Register value persist after booting the kernel using kexec which results in kernel panic. Thus clear the BM pool registers before initialisation to fix the issue. Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") Signed-off-by: Jenishkumar Maheshbhai Patel <jpatel2(a)marvell.com> Reviewed-by: Maxime Chevallier <maxime.chevallier(a)bootlin.com> Link: https://lore.kernel.org/r/20240119035914.2595665-1-jpatel2@marvell.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- .../net/ethernet/marvell/mvpp2/mvpp2_main.c | 27 ++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c index 765ec3bc11ad..4bebab7a9bff 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c @@ -581,12 +581,38 @@ static int mvpp2_bm_pools_init(struct device *dev, struct mvpp2 *priv) return err; } +/* Cleanup pool before actual initialization in the OS */ +static void mvpp2_bm_pool_cleanup(struct mvpp2 *priv, int pool_id) +{ + unsigned int thread = mvpp2_cpu_to_thread(priv, get_cpu()); + u32 val; + int i; + + /* Drain the BM from all possible residues left by firmware */ + for (i = 0; i < MVPP2_BM_POOL_SIZE_MAX; i++) + mvpp2_thread_read(priv, thread, MVPP2_BM_PHY_ALLOC_REG(pool_id)); + + put_cpu(); + + /* Stop the BM pool */ + val = mvpp2_read(priv, MVPP2_BM_POOL_CTRL_REG(pool_id)); + val |= MVPP2_BM_STOP_MASK; + mvpp2_write(priv, MVPP2_BM_POOL_CTRL_REG(pool_id), val); +} + static int mvpp2_bm_init(struct device *dev, struct mvpp2 *priv) { enum dma_data_direction dma_dir = DMA_FROM_DEVICE; int i, err, poolnum = MVPP2_BM_POOLS_NUM; struct mvpp2_port *port; + if (priv->percpu_pools) + poolnum = mvpp2_get_nrxqs(priv) * 2; + + /* Clean up the pool state in case it contains stale state */ + for (i = 0; i < poolnum; i++) + mvpp2_bm_pool_cleanup(priv, i); + if (priv->percpu_pools) { for (i = 0; i < priv->port_count; i++) { port = priv->port_list[i]; @@ -596,7 +622,6 @@ static int mvpp2_bm_init(struct device *dev, struct mvpp2 *priv) } } - poolnum = mvpp2_get_nrxqs(priv) * 2; for (i = 0; i < poolnum; i++) { /* the pool in use */ int pn = i / (poolnum / 2); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] udp: do not accept non-tunnel GSO skbs landing in a tunnel
by Wang Hai 20 Jul '24

20 Jul '24

From: Antoine Tenart <atenart(a)kernel.org> stable inclusion from stable-v5.10.215 commit 3391b157780bbedf8ef9f202cbf10ee90bf6b0f8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG8X CVE: CVE-2024-35884 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3d010c8031e39f5fa1e8b13ada77e0321091011f ] When rx-udp-gro-forwarding is enabled UDP packets might be GROed when being forwarded. If such packets might land in a tunnel this can cause various issues and udp_gro_receive makes sure this isn't the case by looking for a matching socket. This is performed in udp4/6_gro_lookup_skb but only in the current netns. This is an issue with tunneled packets when the endpoint is in another netns. In such cases the packets will be GROed at the UDP level, which leads to various issues later on. The same thing can happen with rx-gro-list. We saw this with geneve packets being GROed at the UDP level. In such case gso_size is set; later the packet goes through the geneve rx path, the geneve header is pulled, the offset are adjusted and frag_list skbs are not adjusted with regard to geneve. When those skbs hit skb_fragment, it will misbehave. Different outcomes are possible depending on what the GROed skbs look like; from corrupted packets to kernel crashes. One example is a BUG_ON[1] triggered in skb_segment while processing the frag_list. Because gso_size is wrong (geneve header was pulled) skb_segment thinks there is "geneve header size" of data in frag_list, although it's in fact the next packet. The BUG_ON itself has nothing to do with the issue. This is only one of the potential issues. Looking up for a matching socket in udp_gro_receive is fragile: the lookup could be extended to all netns (not speaking about performances) but nothing prevents those packets from being modified in between and we could still not find a matching socket. It's OK to keep the current logic there as it should cover most cases but we also need to make sure we handle tunnel packets being GROed too early. This is done by extending the checks in udp_unexpected_gso: GSO packets lacking the SKB_GSO_UDP_TUNNEL/_CSUM bits and landing in a tunnel must be segmented. [1] kernel BUG at net/core/skbuff.c:4408! RIP: 0010:skb_segment+0xd2a/0xf70 __udp_gso_segment+0xaa/0x560 Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.") Fixes: 36707061d6ba ("udp: allow forwarding of plain (non-fraglisted) UDP GRO packets") Signed-off-by: Antoine Tenart <atenart(a)kernel.org> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/ipv4/udp_offload.c [commit 205c0514a5f6 was merged, which lead to context conflicts] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- include/linux/udp.h | 28 ++++++++++++++++++++++++++++ net/ipv4/udp.c | 7 +++++++ net/ipv4/udp_offload.c | 6 ++++-- net/ipv6/udp.c | 2 +- 4 files changed, 40 insertions(+), 3 deletions(-) diff --git a/include/linux/udp.h b/include/linux/udp.h index ae58ff3b6b5b..a220880019d6 100644 --- a/include/linux/udp.h +++ b/include/linux/udp.h @@ -131,6 +131,24 @@ static inline void udp_cmsg_recv(struct msghdr *msg, struct sock *sk, } } +DECLARE_STATIC_KEY_FALSE(udp_encap_needed_key); +#if IS_ENABLED(CONFIG_IPV6) +DECLARE_STATIC_KEY_FALSE(udpv6_encap_needed_key); +#endif + +static inline bool udp_encap_needed(void) +{ + if (static_branch_unlikely(&udp_encap_needed_key)) + return true; + +#if IS_ENABLED(CONFIG_IPV6) + if (static_branch_unlikely(&udpv6_encap_needed_key)) + return true; +#endif + + return false; +} + static inline bool udp_unexpected_gso(struct sock *sk, struct sk_buff *skb) { if (!skb_is_gso(skb)) @@ -142,6 +160,16 @@ static inline bool udp_unexpected_gso(struct sock *sk, struct sk_buff *skb) if (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST && !udp_sk(sk)->accept_udp_fraglist) return true; + /* GSO packets lacking the SKB_GSO_UDP_TUNNEL/_CSUM bits might still + * land in a tunnel as the socket check in udp_gro_receive cannot be + * foolproof. + */ + if (udp_encap_needed() && + READ_ONCE(udp_sk(sk)->encap_rcv) && + !(skb_shinfo(skb)->gso_type & + (SKB_GSO_UDP_TUNNEL | SKB_GSO_UDP_TUNNEL_CSUM))) + return true; + return false; } diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index beccdd959d10..d1f642f4a37f 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -592,6 +592,13 @@ static inline bool __udp_is_mcast_sock(struct net *net, struct sock *sk, } DEFINE_STATIC_KEY_FALSE(udp_encap_needed_key); +EXPORT_SYMBOL(udp_encap_needed_key); + +#if IS_ENABLED(CONFIG_IPV6) +DEFINE_STATIC_KEY_FALSE(udpv6_encap_needed_key); +EXPORT_SYMBOL(udpv6_encap_needed_key); +#endif + void udp_encap_enable(void) { static_branch_inc(&udp_encap_needed_key); diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index 0cdd356866ec..ed50a5f33302 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -512,8 +512,10 @@ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb, unsigned int off = skb_gro_offset(skb); int flush = 1; - /* we can do L4 aggregation only if the packet can't land in a tunnel - * otherwise we could corrupt the inner stream + /* We can do L4 aggregation only if the packet can't land in a tunnel + * otherwise we could corrupt the inner stream. Detecting such packets + * cannot be foolproof and the aggregation might still happen in some + * cases. Such packets should be caught in udp_unexpected_gso later. */ NAPI_GRO_CB(skb)->is_flist = 0; if (!sk || !udp_sk(sk)->gro_receive) { diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 08a2ceb6b999..83995db29358 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -451,7 +451,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, goto try_again; } -DEFINE_STATIC_KEY_FALSE(udpv6_encap_needed_key); +DECLARE_STATIC_KEY_FALSE(udpv6_encap_needed_key); void udpv6_encap_enable(void) { static_branch_inc(&udpv6_encap_needed_key); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2022-48865
by Zhengchao Shao 20 Jul '24

20 Jul '24

Fix CVE-2022-48865 Tung Nguyen (1): tipc: fix kernel panic when enabling bearer Tuong Lien (1): tipc: fix NULL pointer dereference in tipc_disc_rcv() net/tipc/bearer.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
by Kaixiong Yu 20 Jul '24

20 Jul '24

From: Junhao He <hejunhao3(a)huawei.com> stable inclusion from stable-v6.6.33 commit be1fa711e59c874d049f592aef1d4685bdd22bdf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SDT CVE: CVE-2024-38568 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e ] The perf tool allows users to create event groups through following cmd [1], but the driver does not check whether the array index is out of bounds when writing data to the event_group array. If the number of events in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the memory write overflow of event_group array occurs. Add array index check to fix the possible array out of bounds violation, and return directly when write new events are written to array bounds. There are 9 different events in an event_group. [1] perf stat -e '{pmu/event1/, ... ,pmu/event9/} Fixes: 66637ab137b4 ("drivers/perf: hisi: add driver for HNS3 PMU") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> Signed-off-by: Hao Chen <chenhao418(a)huawei.com> Acked-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Reviewed-by: Jijie Shao <shaojijie(a)huawei.com> Link: https://lore.kernel.org/r/20240425124627.13764-3-hejunhao3@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/perf/hisilicon/hns3_pmu.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/perf/hisilicon/hns3_pmu.c b/drivers/perf/hisilicon/hns3_pmu.c index 40edc4cfcc34..47c0de7671cc 100644 --- a/drivers/perf/hisilicon/hns3_pmu.c +++ b/drivers/perf/hisilicon/hns3_pmu.c @@ -1088,15 +1088,27 @@ static bool hns3_pmu_validate_event_group(struct perf_event *event) return false; for (num = 0; num < counters; num++) { + /* + * If we find a related event, then it's a valid group + * since we don't need to allocate a new counter for it. + */ if (hns3_pmu_cmp_event(event_group[num], sibling)) break; } + /* + * Otherwise it's a new event but if there's no available counter, + * fail the check since we cannot schedule all the events in + * the group simultaneously. + */ + if (num == HNS3_PMU_MAX_HW_EVENTS) + return false; + if (num == counters) event_group[counters++] = sibling; } - return counters <= HNS3_PMU_MAX_HW_EVENTS; + return true; } static u32 hns3_pmu_get_filter_condition(struct perf_event *event) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2022-48865
by Zhengchao Shao 20 Jul '24

20 Jul '24

Fix CVE-2022-48865. Tung Nguyen (1): tipc: fix kernel panic when enabling bearer Tuong Lien (1): tipc: fix NULL pointer dereference in tipc_disc_rcv() net/tipc/bearer.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] cxl/region: Fix memregion leaks in devm_cxl_add_region()
by Pu Lehui 20 Jul '24

20 Jul '24

From: Li Zhijian <lizhijian(a)fujitsu.com> stable inclusion from stable-v6.6.35 commit d8316838aa0686da63a8be4194b7a17b0103ae4a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAD6H2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49ba7b515c4c0719b866d16f068e62d16a8a3dd1 ] Move the mode verification to __create_region() before allocating the memregion to avoid the memregion leaks. Fixes: 6e099264185d ("cxl/region: Add volatile region creation support") Signed-off-by: Li Zhijian <lizhijian(a)fujitsu.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Link: https://lore.kernel.org/r/20240507053421.456439-1-lizhijian@fujitsu.com Signed-off-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/cxl/core/region.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index e2a82ee4ff0c..6f06255012f0 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -2186,15 +2186,6 @@ static struct cxl_region *devm_cxl_add_region(struct cxl_root_decoder *cxlrd, struct device *dev; int rc; - switch (mode) { - case CXL_DECODER_RAM: - case CXL_DECODER_PMEM: - break; - default: - dev_err(&cxlrd->cxlsd.cxld.dev, "unsupported mode %d\n", mode); - return ERR_PTR(-EINVAL); - } - cxlr = cxl_region_alloc(cxlrd, id); if (IS_ERR(cxlr)) return cxlr; @@ -2245,6 +2236,15 @@ static struct cxl_region *__create_region(struct cxl_root_decoder *cxlrd, { int rc; + switch (mode) { + case CXL_DECODER_RAM: + case CXL_DECODER_PMEM: + break; + default: + dev_err(&cxlrd->cxlsd.cxld.dev, "unsupported mode %d\n", mode); + return ERR_PTR(-EINVAL); + } + rc = memregion_alloc(GFP_KERNEL); if (rc < 0) return ERR_PTR(rc); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
by Zhengchao Shao 20 Jul '24

20 Jul '24

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.235 commit 6263f2eb93a85ad7df504daf0c341a7fb6bbe8a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGRU CVE: CVE-2022-48856 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 2ac5b58e645c66932438bb021cb5b52097ce70b0 ] The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. Fixes: 7349a74ea75c ("net: ethernet: gianfar_ethtool: get phc index through drvdata") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Jesse Brandeburg <jesse.brandeburg(a)intel.com> Reviewed-by: Claudiu Manoil <claudiu.manoil(a)nxp.com> Link: https://lore.kernel.org/r/20220310015313.14938-1-linmq006@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/freescale/gianfar_ethtool.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c index 395a5266ea30..0cddaaaf48aa 100644 --- a/drivers/net/ethernet/freescale/gianfar_ethtool.c +++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c @@ -1528,6 +1528,7 @@ static int gfar_get_ts_info(struct net_device *dev, ptp_node = of_find_compatible_node(NULL, NULL, "fsl,etsec-ptp"); if (ptp_node) { ptp_dev = of_find_device_by_node(ptp_node); + of_node_put(ptp_node); if (ptp_dev) ptp = platform_get_drvdata(ptp_dev); } -- 2.34.1

2 1

[PATCH v3 OLK-6.6] PCI/ROM: Fix PCI ROM header check bug
by liwei 19 Jul '24

19 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEAGS -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 8fc9a4e911e3..c9b416e62a87 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (pds & 0x3) { + pci_info(pdev, "Invalid PCI ROM header signature: \ + Pointer to Configuration Utility Code Header %#06x\n", readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH v2 OLK-6.6] PCI/ROM: Fix PCI ROM header check bug
by liwei 19 Jul '24

19 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEAGS -------------------------------- In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 8fc9a4e911e3..e6135d9875de 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (pds && 0x3) { + pci_info(pdev, "Invalid PCI ROM header signature: \ + Pointer to Configuration Utility Code Header %#06x\n", readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

2 1

[PATCH] PCI/ROM: Fix PCI ROM header check bug
by liwei 19 Jul '24

19 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAEAGS In UEFI Specification Version 2.8, describes that the PCIR data structure must start on a 4-byte boundary. Add checks to prevent vulnerabilities. Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/rom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c index 8fc9a4e911e3..e6135d9875de 100644 --- a/drivers/pci/rom.c +++ b/drivers/pci/rom.c @@ -98,6 +98,12 @@ static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, } /* get the PCI data structure and check its "PCIR" signature */ pds = image + readw(image + 24); + /* The PCIR data structure must begin on a 4-byte boundary */ + if (pds && 0x3) { + pci_info(pdev, "Invalid PCI ROM header signature: \ + Pointer to Configuration Utility Code Header %#06x\n", readw(image + 24)); + break; + } if (readl(pds) != 0x52494350) { pci_info(pdev, "Invalid PCI ROM data signature: expecting 0x52494350, got %#010x\n", readl(pds)); -- 2.25.1

1 0

[PATCH OLK-5.10] dma-mapping: benchmark: fix node id validation
by Kaixiong Yu 19 Jul '24

19 Jul '24

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v6.6.33 commit 34a816d8735f3924b74be8e5bf766ade1f3bd10b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7DBN CVE: CVE-2024-34777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1ff05e723f7ca30644b8ec3fb093f16312e408ad ] While validating node ids in map_benchmark_ioctl(), node_possible() may be provided with invalid argument outside of [0,MAX_NUMNODES-1] range leading to: BUG: KASAN: wild-memory-access in map_benchmark_ioctl (kernel/dma/map_benchmark.c:214) Read of size 8 at addr 1fffffff8ccb6398 by task dma_map_benchma/971 CPU: 7 PID: 971 Comm: dma_map_benchma Not tainted 6.9.0-rc6 #37 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117) kasan_report (mm/kasan/report.c:603) kasan_check_range (mm/kasan/generic.c:189) variable_test_bit (arch/x86/include/asm/bitops.h:227) [inline] arch_test_bit (arch/x86/include/asm/bitops.h:239) [inline] _test_bit at (include/asm-generic/bitops/instrumented-non-atomic.h:142) [inline] node_state (include/linux/nodemask.h:423) [inline] map_benchmark_ioctl (kernel/dma/map_benchmark.c:214) full_proxy_unlocked_ioctl (fs/debugfs/file.c:333) __x64_sys_ioctl (fs/ioctl.c:890) do_syscall_64 (arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Compare node ids with sane bounds first. NUMA_NO_NODE is considered a special valid case meaning that benchmarking kthreads won't be bound to a cpuset of a given node. Found by Linux Verification Center (linuxtesting.org). Fixes: 65789daa8087 ("dma-mapping: add benchmark support for streaming DMA APIs") Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Reviewed-by: Robin Murphy <robin.murphy(a)arm.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- kernel/dma/map_benchmark.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/dma/map_benchmark.c b/kernel/dma/map_benchmark.c index c2d225e1cd47..5c13c9352bb5 100644 --- a/kernel/dma/map_benchmark.c +++ b/kernel/dma/map_benchmark.c @@ -228,7 +228,8 @@ static long map_benchmark_ioctl(struct file *file, unsigned int cmd, } if (map->bparam.node != NUMA_NO_NODE && - !node_possible(map->bparam.node)) { + (map->bparam.node < 0 || map->bparam.node >= MAX_NUMNODES || + !node_possible(map->bparam.node))) { pr_err("invalid numa node\n"); return -EINVAL; } -- 2.25.1

2 1

[PATCH OLK-5.10] net: dsa: seville: register the mdiobus under devres
by Zhengchao Shao 19 Jul '24

19 Jul '24

From: Vladimir Oltean <vladimir.oltean(a)nxp.com> mainline inclusion from mainline-v5.17-rc4 commit bd488afc3b39e045ba71aab472233f2a78726e7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADFY0 CVE: CVE-2022-48814 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The Seville VSC9959 switch is a platform device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the seville switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The seville driver has a code structure that could accommodate both the mdiobus_unregister and mdiobus_free calls, but it has an external dependency upon mscc_miim_setup() from mdio-mscc-miim.c, which calls devm_mdiobus_alloc_size() on its behalf. So rather than restructuring that, and exporting yet one more symbol mscc_miim_teardown(), let's work with devres and replace of_mdiobus_register with the devres variant. When we use all-devres, we can ensure that devres doesn't free a still-registered bus (it either runs both callbacks, or none). Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") Signed-off-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Reviewed-by: Florian Fainelli <f.fainelli(a)gmail.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/dsa/ocelot/seville_vsc9953.c [The conflict occurs because the commit 5186c4a05b97("net: dsa: ocelot: seville: utilize of_mdiobus_register") is not merged] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/dsa/ocelot/seville_vsc9953.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/dsa/ocelot/seville_vsc9953.c b/drivers/net/dsa/ocelot/seville_vsc9953.c index 7026523f886c..81875e96096b 100644 --- a/drivers/net/dsa/ocelot/seville_vsc9953.c +++ b/drivers/net/dsa/ocelot/seville_vsc9953.c @@ -1092,7 +1092,7 @@ static int vsc9953_mdio_bus_alloc(struct ocelot *ocelot) snprintf(bus->id, MII_BUS_ID_SIZE, "%s-imdio", dev_name(dev)); /* Needed in order to initialize the bus mutex lock */ - rc = mdiobus_register(bus); + rc = devm_mdiobus_register(dev, bus); if (rc < 0) { dev_err(dev, "failed to register MDIO bus\n"); return rc; @@ -1144,7 +1144,8 @@ static void vsc9953_mdio_bus_free(struct ocelot *ocelot) mdio_device_free(pcs->mdio); lynx_pcs_destroy(pcs); } - mdiobus_unregister(felix->imdio); + + /* mdiobus_unregister and mdiobus_free handled by devres */ } static void vsc9953_xmit_template_populate(struct ocelot *ocelot, int port) -- 2.34.1

2 1

← Newer
1
...
24
25
26
27
28
29
30
...
82
Older →

Jump to page: