- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] i2c: tegra: Do not mark ACPI devices as irq safe
by Yuan Can 25 Sep '24

25 Sep '24

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.48 commit 6861faf4232e4b78878f2de1ed3ee324ddae2287 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJB CVE: CVE-2024-45029 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 14d069d92951a3e150c0a81f2ca3b93e54da913b upstream. On ACPI machines, the tegra i2c module encounters an issue due to a mutex being called inside a spinlock. This leads to the following bug: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585 ... Call trace: __might_sleep __mutex_lock_common mutex_lock_nested acpi_subsys_runtime_resume rpm_resume tegra_i2c_xfer The problem arises because during __pm_runtime_resume(), the spinlock &dev->power.lock is acquired before rpm_resume() is called. Later, rpm_resume() invokes acpi_subsys_runtime_resume(), which relies on mutexes, triggering the error. To address this issue, devices on ACPI are now marked as not IRQ-safe, considering the dependency of acpi_subsys_runtime_resume() on mutexes. Fixes: bd2fdedbf2ba ("i2c: tegra: Add the ACPI support") Cc: <stable(a)vger.kernel.org> # v5.17+ Co-developed-by: Michael van der Westhuizen <rmikey(a)meta.com> Signed-off-by: Michael van der Westhuizen <rmikey(a)meta.com> Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Dmitry Osipenko <digetx(a)gmail.com> Reviewed-by: Andy Shevchenko <andy(a)kernel.org> Signed-off-by: Andi Shyti <andi.shyti(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/i2c/busses/i2c-tegra.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c index 920d5a8cbf4c..91be04b534fe 100644 --- a/drivers/i2c/busses/i2c-tegra.c +++ b/drivers/i2c/busses/i2c-tegra.c @@ -1804,9 +1804,9 @@ static int tegra_i2c_probe(struct platform_device *pdev) * domain. * * VI I2C device shouldn't be marked as IRQ-safe because VI I2C won't - * be used for atomic transfers. + * be used for atomic transfers. ACPI device is not IRQ safe also. */ - if (!IS_VI(i2c_dev)) + if (!IS_VI(i2c_dev) && !has_acpi_companion(i2c_dev->dev)) pm_runtime_irq_safe(i2c_dev->dev); pm_runtime_enable(i2c_dev->dev); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Input: MT - limit max slots
by Yuan Can 25 Sep '24

25 Sep '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.225 commit 05dd9aabd04f9b5eb04dab9bb83d8c3e982d7549 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZN CVE: CVE-2024-45008 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 99d3bf5f7377d42f8be60a6b9cb60fb0be34dceb upstream. syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible max slots, this patch chose 1024. Reported-by: syzbot <syzbot+0122fa359a69694395d5(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 Suggested-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/input/input-mt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c index 44fe6f2f063c..d0f8c31d7cc0 100644 --- a/drivers/input/input-mt.c +++ b/drivers/input/input-mt.c @@ -45,6 +45,9 @@ int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots, return 0; if (mt) return mt->num_slots != num_slots ? -EINVAL : 0; + /* Arbitrary limit for avoiding too large memory allocation. */ + if (num_slots > 1024) + return -EINVAL; mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL); if (!mt) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ALSA: line6: Fix racy access to midibuf
by Yuan Can 25 Sep '24

25 Sep '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.224 commit e7e7d2b180d8f297cea6db43ea72402fd33e1a29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ4 CVE: CVE-2024-44954 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 15b7a03205b31bc5623378c190d22b7ff60026f1 upstream. There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races. Reported-by: syzbot+78eccfb8b3c9a85fc6c5(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/00000000000000949c061df288c5@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20240805130129.10872-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: sound/usb/line6/driver.c [Fix context diff due to 6c764deba951 not merged] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/usb/line6/driver.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index 59faa5a9a714..1d5b41a21669 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -286,12 +286,14 @@ static void line6_data_received(struct urb *urb) { struct usb_line6 *line6 = (struct usb_line6 *)urb->context; struct midi_buffer *mb = &line6->line6midi->midibuf_in; + unsigned long flags; int done; if (urb->status == -ESHUTDOWN) return; if (line6->properties->capabilities & LINE6_CAP_CONTROL_MIDI) { + spin_lock_irqsave(&line6->line6midi->lock, flags); done = line6_midibuf_write(mb, urb->transfer_buffer, urb->actual_length); @@ -300,11 +302,14 @@ static void line6_data_received(struct urb *urb) dev_dbg(line6->ifcdev, "%d %d buffer overflow - message skipped\n", done, urb->actual_length); } + spin_unlock_irqrestore(&line6->line6midi->lock, flags); for (;;) { + spin_lock_irqsave(&line6->line6midi->lock, flags); done = line6_midibuf_read(mb, line6->buffer_message, LINE6_MIDI_MESSAGE_MAXLEN); + spin_unlock_irqrestore(&line6->line6midi->lock, flags); if (done <= 0) break; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix missing cleanup on rollforward recovery error
by Zeng Heng 25 Sep '24

25 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.226 commit 07e4dc2fe000ab008bcfe90be4324ef56b5b4355 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYB6 CVE: CVE-2024-46781 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5787fcaab9eb5930f5378d6a1dd03d916d146622 upstream. In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug. It turned out that if data recovery was performed using partial logs created by dsync writes, but an error occurred before starting the log writer to create a recovered checkpoint, the inodes whose data had been recovered were left in the ns_dirty_files list of the nilfs object and were not freed. Fix this issue by cleaning up inodes that have read the recovery data if the recovery routine fails midway before the log writer starts. Link: https://lkml.kernel.org/r/20240810065242.3701-1-konishi.ryusuke@gmail.com Fixes: 0f3e1c7f23f8 ("nilfs2: recovery functions") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c index 188b8cc52e2b..33c4a97519de 100644 --- a/fs/nilfs2/recovery.c +++ b/fs/nilfs2/recovery.c @@ -708,6 +708,33 @@ static void nilfs_finish_roll_forward(struct the_nilfs *nilfs, brelse(bh); } +/** + * nilfs_abort_roll_forward - cleaning up after a failed rollforward recovery + * @nilfs: nilfs object + */ +static void nilfs_abort_roll_forward(struct the_nilfs *nilfs) +{ + struct nilfs_inode_info *ii, *n; + LIST_HEAD(head); + + /* Abandon inodes that have read recovery data */ + spin_lock(&nilfs->ns_inode_lock); + list_splice_init(&nilfs->ns_dirty_files, &head); + spin_unlock(&nilfs->ns_inode_lock); + if (list_empty(&head)) + return; + + set_nilfs_purging(nilfs); + list_for_each_entry_safe(ii, n, &head, i_dirty) { + spin_lock(&nilfs->ns_inode_lock); + list_del_init(&ii->i_dirty); + spin_unlock(&nilfs->ns_inode_lock); + + iput(&ii->vfs_inode); + } + clear_nilfs_purging(nilfs); +} + /** * nilfs_salvage_orphan_logs - salvage logs written after the latest checkpoint * @nilfs: nilfs object @@ -766,15 +793,19 @@ int nilfs_salvage_orphan_logs(struct the_nilfs *nilfs, if (unlikely(err)) { nilfs_err(sb, "error %d writing segment for recovery", err); - goto failed; + goto put_root; } nilfs_finish_roll_forward(nilfs, ri); } - failed: +put_root: nilfs_put_root(root); return err; + +failed: + nilfs_abort_roll_forward(nilfs); + goto put_root; } /** -- 2.25.1

2 1

[PATCH OLK-5.10] nilfs2: fix missing cleanup on rollforward recovery error
by Zeng Heng 25 Sep '24

25 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.226 commit 07e4dc2fe000ab008bcfe90be4324ef56b5b4355 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYB6 CVE: CVE-2024-46781 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5787fcaab9eb5930f5378d6a1dd03d916d146622 upstream. In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug. It turned out that if data recovery was performed using partial logs created by dsync writes, but an error occurred before starting the log writer to create a recovered checkpoint, the inodes whose data had been recovered were left in the ns_dirty_files list of the nilfs object and were not freed. Fix this issue by cleaning up inodes that have read the recovery data if the recovery routine fails midway before the log writer starts. Link: https://lkml.kernel.org/r/20240810065242.3701-1-konishi.ryusuke@gmail.com Fixes: 0f3e1c7f23f8 ("nilfs2: recovery functions") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c index 188b8cc52e2b..33c4a97519de 100644 --- a/fs/nilfs2/recovery.c +++ b/fs/nilfs2/recovery.c @@ -708,6 +708,33 @@ static void nilfs_finish_roll_forward(struct the_nilfs *nilfs, brelse(bh); } +/** + * nilfs_abort_roll_forward - cleaning up after a failed rollforward recovery + * @nilfs: nilfs object + */ +static void nilfs_abort_roll_forward(struct the_nilfs *nilfs) +{ + struct nilfs_inode_info *ii, *n; + LIST_HEAD(head); + + /* Abandon inodes that have read recovery data */ + spin_lock(&nilfs->ns_inode_lock); + list_splice_init(&nilfs->ns_dirty_files, &head); + spin_unlock(&nilfs->ns_inode_lock); + if (list_empty(&head)) + return; + + set_nilfs_purging(nilfs); + list_for_each_entry_safe(ii, n, &head, i_dirty) { + spin_lock(&nilfs->ns_inode_lock); + list_del_init(&ii->i_dirty); + spin_unlock(&nilfs->ns_inode_lock); + + iput(&ii->vfs_inode); + } + clear_nilfs_purging(nilfs); +} + /** * nilfs_salvage_orphan_logs - salvage logs written after the latest checkpoint * @nilfs: nilfs object @@ -766,15 +793,19 @@ int nilfs_salvage_orphan_logs(struct the_nilfs *nilfs, if (unlikely(err)) { nilfs_err(sb, "error %d writing segment for recovery", err); - goto failed; + goto put_root; } nilfs_finish_roll_forward(nilfs, ri); } - failed: +put_root: nilfs_put_root(root); return err; + +failed: + nilfs_abort_roll_forward(nilfs); + goto put_root; } /** -- 2.25.1

2 1

[PATCH OLK-6.6] efi/libstub: add checking validity of memory regions
by Cui GaoSheng 25 Sep '24

25 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IASWEC -------------------------------- Add checking validity of memory regions when memmap is enabled in cmdline, and print error logs when memory region is invalid. Fixes: 68684c9c9347 ("efi/libstub: arm64: Fix KASLR and memmap= collision") Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/firmware/efi/libstub/randomalloc.c | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/firmware/efi/libstub/randomalloc.c b/drivers/firmware/efi/libstub/randomalloc.c index 8e22b7a20439..e2b3f5758d39 100644 --- a/drivers/firmware/efi/libstub/randomalloc.c +++ b/drivers/firmware/efi/libstub/randomalloc.c @@ -107,6 +107,33 @@ static unsigned long cal_slots_avoid_overlap(efi_memory_desc_t *md, unsigned lon return total_slots; } +static void mem_check_memmaps(void) +{ + int i; + efi_status_t status; + unsigned long nr_pages; + unsigned long long start, end; + + for (i = 0; i < MAX_MEMMAP_REGIONS; i++) { + if (!mem_avoid[i].size) + continue; + start = round_down(mem_avoid[i].start, EFI_ALLOC_ALIGN); + end = round_up(mem_avoid[i].start + mem_avoid[i].size, EFI_ALLOC_ALIGN); + nr_pages = (end - start) / EFI_PAGE_SIZE; + + mem_avoid[i].start = start; + mem_avoid[i].size = end - start; + status = efi_bs_call(allocate_pages, EFI_ALLOCATE_ADDRESS, + EFI_LOADER_DATA, nr_pages, &mem_avoid[i].start); + if (status == EFI_SUCCESS) { + efi_free(mem_avoid[i].size, mem_avoid[i].start); + } else { + mem_avoid[i].size = 0; + efi_err("Failed to reserve memmap, index: %d, status: %lu\n", i, status); + } + } +} + void mem_avoid_memmap(char *str) { static int i; @@ -137,6 +164,7 @@ void mem_avoid_memmap(char *str) str = k; i++; } + mem_check_memmaps(); } void mem_avoid_mem_nokaslr(char *str) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: line6: Fix racy access to midibuf
by Yuan Can 25 Sep '24

25 Sep '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.320 commit 643293b68fbb6c03f5e907736498da17d43f0d81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ4 CVE: CVE-2024-44954 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 15b7a03205b31bc5623378c190d22b7ff60026f1 upstream. There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races. Reported-by: syzbot+78eccfb8b3c9a85fc6c5(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/00000000000000949c061df288c5@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20240805130129.10872-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: sound/usb/line6/driver.c [Fix context diff due to 6c764deba951 not merged] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/usb/line6/driver.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index bbcb0d4d83ae..6baa1dfcd0cd 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -300,12 +300,14 @@ static void line6_data_received(struct urb *urb) { struct usb_line6 *line6 = (struct usb_line6 *)urb->context; struct midi_buffer *mb = &line6->line6midi->midibuf_in; + unsigned long flags; int done; if (urb->status == -ESHUTDOWN) return; if (line6->properties->capabilities & LINE6_CAP_CONTROL_MIDI) { + spin_lock_irqsave(&line6->line6midi->lock, flags); done = line6_midibuf_write(mb, urb->transfer_buffer, urb->actual_length); @@ -314,11 +316,14 @@ static void line6_data_received(struct urb *urb) dev_dbg(line6->ifcdev, "%d %d buffer overflow - message skipped\n", done, urb->actual_length); } + spin_unlock_irqrestore(&line6->line6midi->lock, flags); for (;;) { + spin_lock_irqsave(&line6->line6midi->lock, flags); done = line6_midibuf_read(mb, line6->buffer_message, LINE6_MIDI_MESSAGE_MAXLEN); + spin_unlock_irqrestore(&line6->line6midi->lock, flags); if (done == 0) break; -- 2.17.1

2 1

[PATCH OLK-6.6] nilfs2: fix missing cleanup on rollforward recovery error
by Zeng Heng 25 Sep '24

25 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v6.6.51 commit 9d8c3a585d564d776ee60d4aabec59b404be7403 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYB6 CVE: CVE-2024-46781 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5787fcaab9eb5930f5378d6a1dd03d916d146622 upstream. In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug. It turned out that if data recovery was performed using partial logs created by dsync writes, but an error occurred before starting the log writer to create a recovered checkpoint, the inodes whose data had been recovered were left in the ns_dirty_files list of the nilfs object and were not freed. Fix this issue by cleaning up inodes that have read the recovery data if the recovery routine fails midway before the log writer starts. Link: https://lkml.kernel.org/r/20240810065242.3701-1-konishi.ryusuke@gmail.com Fixes: 0f3e1c7f23f8 ("nilfs2: recovery functions") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c index a9b8d77c8c1d..ce30b51ac593 100644 --- a/fs/nilfs2/recovery.c +++ b/fs/nilfs2/recovery.c @@ -708,6 +708,33 @@ static void nilfs_finish_roll_forward(struct the_nilfs *nilfs, brelse(bh); } +/** + * nilfs_abort_roll_forward - cleaning up after a failed rollforward recovery + * @nilfs: nilfs object + */ +static void nilfs_abort_roll_forward(struct the_nilfs *nilfs) +{ + struct nilfs_inode_info *ii, *n; + LIST_HEAD(head); + + /* Abandon inodes that have read recovery data */ + spin_lock(&nilfs->ns_inode_lock); + list_splice_init(&nilfs->ns_dirty_files, &head); + spin_unlock(&nilfs->ns_inode_lock); + if (list_empty(&head)) + return; + + set_nilfs_purging(nilfs); + list_for_each_entry_safe(ii, n, &head, i_dirty) { + spin_lock(&nilfs->ns_inode_lock); + list_del_init(&ii->i_dirty); + spin_unlock(&nilfs->ns_inode_lock); + + iput(&ii->vfs_inode); + } + clear_nilfs_purging(nilfs); +} + /** * nilfs_salvage_orphan_logs - salvage logs written after the latest checkpoint * @nilfs: nilfs object @@ -766,15 +793,19 @@ int nilfs_salvage_orphan_logs(struct the_nilfs *nilfs, if (unlikely(err)) { nilfs_err(sb, "error %d writing segment for recovery", err); - goto failed; + goto put_root; } nilfs_finish_roll_forward(nilfs, ri); } - failed: +put_root: nilfs_put_root(root); return err; + +failed: + nilfs_abort_roll_forward(nilfs); + goto put_root; } /** -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/5] LTS patch backport
by Yuntao Liu 25 Sep '24

25 Sep '24

LTS patch backport Amit Daniel Kachhap (1): arm64: cpufeature: Fix the visibility of compat hwcaps Guanrui Huang (1): irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc James Morse (1): arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space Pali Rohár (1): irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 Yipeng Zou (1): irqchip/mbigen: Fix mbigen node address layout arch/arm64/kernel/cpufeature.c | 79 ++++++++++++++++++++++------- drivers/irqchip/irq-armada-370-xp.c | 4 ++ drivers/irqchip/irq-gic-v3-its.c | 2 - drivers/irqchip/irq-mbigen.c | 20 ++++++-- 4 files changed, 82 insertions(+), 23 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-1.0-LTS] perf/x86: Serialize set_attr_rdpmc()
by Luo Gengkun 25 Sep '24

25 Sep '24

mainline inclusion from mainline-v6.11-rc1 commit bb9bb45f746b0f9457de9c3fc4da143a6351bdc9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IASLM9 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Yue and Xingwei reported a jump label failure. It's caused by the lack of serialization in set_attr_rdpmc(): CPU0 CPU1 Assume: x86_pmu.attr_rdpmc == 0 if (val != x86_pmu.attr_rdpmc) { if (val == 0) ... else if (x86_pmu.attr_rdpmc == 0) static_branch_dec(&rdpmc_never_available_key); if (val != x86_pmu.attr_rdpmc) { if (val == 0) ... else if (x86_pmu.attr_rdpmc == 0) FAIL, due to imbalance ---> static_branch_dec(&rdpmc_never_available_key); The reported BUG() is a consequence of the above and of another bug in the jump label core code. The core code needs a separate fix, but that cannot prevent the imbalance problem caused by set_attr_rdpmc(). Prevent this by serializing set_attr_rdpmc() locally. Fixes: a66734297f78 ("perf/x86: Add /sys/devices/cpu/rdpmc=2 to allow rdpmc for all tasks") Closes: https://lore.kernel.org/r/CAEkJfYNzfW1vG=ZTMdz_Weoo=RXY1NDunbxnDaLyj8R4kEoE… Reported-by: Yue Sun <samsun1006219(a)gmail.com> Reported-by: Xingwei Lee <xrivendell7(a)gmail.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20240610124406.359476013@linutronix.de Conflicts: arch/x86/events/core.c [Using mutex_lock/mutex_unlock instead of guard] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index a8e97f717669..fec9f1d62c8f 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -2235,6 +2235,7 @@ static ssize_t set_attr_rdpmc(struct device *cdev, struct device_attribute *attr, const char *buf, size_t count) { + static DEFINE_MUTEX(rdpmc_mutex); unsigned long val; ssize_t ret; @@ -2248,6 +2249,8 @@ static ssize_t set_attr_rdpmc(struct device *cdev, if (x86_pmu.attr_rdpmc_broken) return -ENOTSUPP; + mutex_lock(&rdpmc_mutex); + if ((val == 2) != (x86_pmu.attr_rdpmc == 2)) { /* * Changing into or out of always available, aka @@ -2263,6 +2266,8 @@ static ssize_t set_attr_rdpmc(struct device *cdev, x86_pmu.attr_rdpmc = val; + mutex_unlock(&rdpmc_mutex); + return count; } -- 2.34.1

2 1

[PATCH OLK-5.10] perf/x86: Serialize set_attr_rdpmc()
by Luo Gengkun 25 Sep '24

25 Sep '24

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit bb9bb45f746b0f9457de9c3fc4da143a6351bdc9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAMTVO Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Yue and Xingwei reported a jump label failure. It's caused by the lack of serialization in set_attr_rdpmc(): CPU0 CPU1 Assume: x86_pmu.attr_rdpmc == 0 if (val != x86_pmu.attr_rdpmc) { if (val == 0) ... else if (x86_pmu.attr_rdpmc == 0) static_branch_dec(&rdpmc_never_available_key); if (val != x86_pmu.attr_rdpmc) { if (val == 0) ... else if (x86_pmu.attr_rdpmc == 0) FAIL, due to imbalance ---> static_branch_dec(&rdpmc_never_available_key); The reported BUG() is a consequence of the above and of another bug in the jump label core code. The core code needs a separate fix, but that cannot prevent the imbalance problem caused by set_attr_rdpmc(). Prevent this by serializing set_attr_rdpmc() locally. Fixes: a66734297f78 ("perf/x86: Add /sys/devices/cpu/rdpmc=2 to allow rdpmc for all tasks") Closes: https://lore.kernel.org/r/CAEkJfYNzfW1vG=ZTMdz_Weoo=RXY1NDunbxnDaLyj8R4kEoE… Reported-by: Yue Sun <samsun1006219(a)gmail.com> Reported-by: Xingwei Lee <xrivendell7(a)gmail.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20240610124406.359476013@linutronix.de Conflicts: arch/x86/events/core.c [Using mutex_lock/mutex_unlock instead of guard] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index abdc814162d5..283aa4602eb1 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -2529,6 +2529,7 @@ static ssize_t set_attr_rdpmc(struct device *cdev, struct device_attribute *attr, const char *buf, size_t count) { + static DEFINE_MUTEX(rdpmc_mutex); unsigned long val; ssize_t ret; @@ -2542,6 +2543,8 @@ static ssize_t set_attr_rdpmc(struct device *cdev, if (x86_pmu.attr_rdpmc_broken) return -ENOTSUPP; + mutex_lock(&rdpmc_mutex); + if (val != x86_pmu.attr_rdpmc) { /* * Changing into or out of never available or always available, @@ -2562,6 +2565,8 @@ static ssize_t set_attr_rdpmc(struct device *cdev, x86_pmu.attr_rdpmc = val; } + mutex_unlock(&rdpmc_mutex); + return count; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] mm: hwpoison: two more poison recovery
by Tong Tiangen 25 Sep '24

25 Sep '24

One more CoW path to support poison recorvery in do_cow_fault(), and the last copy_user_highpage() user is replaced to copy_mc_user_highpage() from copy_present_page() during fork to support poison recorvery too. Kefeng Wang (2): mm: support poison recovery from do_cow_fault() mm: support poison recovery from copy_present_page() mm/memory.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] blktrace: fix blktrace is disabled when CONFIG_BLK_DEBUG_FS is disabled
by Yu Kuai 25 Sep '24

25 Sep '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAGRKP CVE: NA ---------------------------------------- Commit 17ab4994ddcc ("block: create the request_queue debugfs_dir on registration") changed that "q->debugfs_dir" will always be created even if CONFIG_BLK_DEBUG_FS is disabled, in this case create the same dir in do_blk_trace_setup() will fail hence blktrace can't be used. Fix the problem by always use "q->debugfs_dir" for the whole bdev, and always create new debugfs_dir for partitions. Fixes: 17ab4994ddcc ("block: create the request_queue debugfs_dir on registration") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- kernel/trace/blktrace.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index 8310695efd3d..7295c4ee2425 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -553,18 +553,15 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, if (!bt->msg_data) goto err; -#ifdef CONFIG_BLK_DEBUG_FS /* - * When tracing whole make_request drivers (multiqueue) block devices, - * reuse the existing debugfs directory created by the block layer on - * init. For request-based block devices, all partitions block devices, + * When tracing the whole disk reuse the existing debugfs directory + * created by the block layer on init. For partitions block devices, * and scsi-generic block devices we create a temporary new debugfs * directory that will be removed once the trace ends. */ - if (q->mq_ops && bdev && bdev == bdev->bd_contains) + if (bdev && bdev == bdev->bd_contains) dir = q->debugfs_dir; else -#endif bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root); /* -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/4] LTS patch backport
by Yuntao Liu 25 Sep '24

25 Sep '24

LTS patch backport Guanrui Huang (1): irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc James Morse (1): arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space Pali Rohár (1): irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 Yipeng Zou (1): irqchip/mbigen: Fix mbigen node address layout arch/arm64/kernel/cpufeature.c | 37 ++++++++++++++++++++++------- drivers/irqchip/irq-armada-370-xp.c | 4 ++++ drivers/irqchip/irq-gic-v3-its.c | 2 -- drivers/irqchip/irq-mbigen.c | 20 ++++++++++++---- 4 files changed, 49 insertions(+), 14 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/5] A group of optimization and bug fix for numa-affinity
by Nanyong Sun 25 Sep '24

25 Sep '24

A group of optimization and bug fix for numa-affinity Nanyong Sun (5): mm: thp: support to control numa migration mm: numa-affinity: add helper numa_affinity_sampling_enabled() mm: numa-affinity: adapt for should_numa_migrate_memory mm: numa-affinity: adapt for task_numa_placement mm: numa-affinity: fix build error when !CONFIG_PROC_SYSCTL Documentation/admin-guide/mm/transhuge.rst | 8 ++++++ arch/arm64/Kconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/huge_mm.h | 13 +++++++++ include/linux/mem_sampling.h | 13 +++++++++ kernel/sched/fair.c | 30 ++++++++++++++------ mm/Kconfig | 10 +++++++ mm/huge_memory.c | 33 ++++++++++++++++++++++ mm/mem_sampling.c | 4 --- mm/migrate.c | 3 ++ 11 files changed, 105 insertions(+), 12 deletions(-) -- 2.33.0

2 6

[PATCH openEuler-1.0-LTS 0/4] LTS patchs packport
by Yuntao Liu 25 Sep '24

25 Sep '24

LTS patchs packport. Guanrui Huang (1): irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc James Morse (1): arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space Pali Rohár (1): irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 Yipeng Zou (1): irqchip/mbigen: Fix mbigen node address layout arch/arm64/kernel/cpufeature.c | 37 ++++++++++++++++++++++------- drivers/irqchip/irq-armada-370-xp.c | 4 ++++ drivers/irqchip/irq-gic-v3-its.c | 2 -- drivers/irqchip/irq-mbigen.c | 20 ++++++++++++---- 4 files changed, 49 insertions(+), 14 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10] [Backport] tools: move alignment-related macros to new <linux/align.h>
by Li Nan 25 Sep '24

25 Sep '24

From: Alexander Lobakin <aleksander.lobakin(a)intel.com> stable inclusion from stable-v5.10.225 commit 239b1cacceece336072a944b24ac1fcaac42de1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJ9 CVE: CVE-2024-45025 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 10a04ff09bcc39e0044190ffe9f00f998f13647c upstream. Currently, tools have *ALIGN*() macros scattered across the unrelated headers, as there are only 3 of them and they were added separately each time on an as-needed basis. Anyway, let's make it more consistent with the kernel headers and allow using those macros outside of the mentioned headers. Create <linux/align.h> inside the tools/ folder and include it where needed. Signed-off-by: Yury Norov <yury.norov(a)gmail.com> Signed-off-by: Alexander Lobakin <aleksander.lobakin(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- tools/include/linux/align.h | 12 ++++++++++++ tools/include/linux/bitmap.h | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 tools/include/linux/align.h diff --git a/tools/include/linux/align.h b/tools/include/linux/align.h new file mode 100644 index 000000000000..14e34ace80dd --- /dev/null +++ b/tools/include/linux/align.h @@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef _TOOLS_LINUX_ALIGN_H +#define _TOOLS_LINUX_ALIGN_H + +#include <uapi/linux/const.h> + +#define ALIGN(x, a) __ALIGN_KERNEL((x), (a)) +#define ALIGN_DOWN(x, a) __ALIGN_KERNEL((x) - ((a) - 1), (a)) +#define IS_ALIGNED(x, a) (((x) & ((typeof(x))(a) - 1)) == 0) + +#endif /* _TOOLS_LINUX_ALIGN_H */ diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h index 186f20dcdaa8..de45cad6cec1 100644 --- a/tools/include/linux/bitmap.h +++ b/tools/include/linux/bitmap.h @@ -3,6 +3,7 @@ #define _PERF_BITOPS_H #include <string.h> +#include <linux/align.h> #include <linux/bitops.h> #include <stdlib.h> #include <linux/kernel.h> @@ -166,7 +167,6 @@ static inline int bitmap_and(unsigned long *dst, const unsigned long *src1, #define BITMAP_MEM_ALIGNMENT (8 * sizeof(unsigned long)) #endif #define BITMAP_MEM_MASK (BITMAP_MEM_ALIGNMENT - 1) -#define IS_ALIGNED(x, a) (((x) & ((typeof(x))(a) - 1)) == 0) static inline int bitmap_equal(const unsigned long *src1, const unsigned long *src2, unsigned int nbits) -- 2.39.2

2 1

[PATCH OLK-6.6] efi/libstub: add checking validity of memory regions
by Cui GaoSheng 25 Sep '24

25 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IASWEC -------------------------------- Add checking validity of memory regions when memmap is enabled in cmdline, and print error logs when memory region is invalid. Fixes: 68684c9c9347 ("efi/libstub: arm64: Fix KASLR and memmap= collision") Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/firmware/efi/libstub/randomalloc.c | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/firmware/efi/libstub/randomalloc.c b/drivers/firmware/efi/libstub/randomalloc.c index 8e22b7a20439..e2b3f5758d39 100644 --- a/drivers/firmware/efi/libstub/randomalloc.c +++ b/drivers/firmware/efi/libstub/randomalloc.c @@ -107,6 +107,33 @@ static unsigned long cal_slots_avoid_overlap(efi_memory_desc_t *md, unsigned lon return total_slots; } +static void mem_check_memmaps(void) +{ + int i; + efi_status_t status; + unsigned long nr_pages; + unsigned long long start, end; + + for (i = 0; i < MAX_MEMMAP_REGIONS; i++) { + if (!mem_avoid[i].size) + continue; + start = round_down(mem_avoid[i].start, EFI_ALLOC_ALIGN); + end = round_up(mem_avoid[i].start + mem_avoid[i].size, EFI_ALLOC_ALIGN); + nr_pages = (end - start) / EFI_PAGE_SIZE; + + mem_avoid[i].start = start; + mem_avoid[i].size = end - start; + status = efi_bs_call(allocate_pages, EFI_ALLOCATE_ADDRESS, + EFI_LOADER_DATA, nr_pages, &mem_avoid[i].start); + if (status == EFI_SUCCESS) { + efi_free(mem_avoid[i].size, mem_avoid[i].start); + } else { + mem_avoid[i].size = 0; + efi_err("Failed to reserve memmap, index: %d, status: %lu\n", i, status); + } + } +} + void mem_avoid_memmap(char *str) { static int i; @@ -137,6 +164,7 @@ void mem_avoid_memmap(char *str) str = k; i++; } + mem_check_memmaps(); } void mem_avoid_mem_nokaslr(char *str) -- 2.34.1

2 1

[PATCH OLK-6.6] tools: move alignment-related macros to new <linux/align.h>
by Peng Zhang 25 Sep '24

25 Sep '24

From: Alexander Lobakin <aleksander.lobakin(a)intel.com> stable inclusion from stable-v6.6.48 commit a2081b8cabbead2393f3c27232f87ebc14bd70ff bugzilla: https://gitee.com/openeuler/kernel/issues/IAP55A Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 10a04ff09bcc39e0044190ffe9f00f998f13647c upstream. Currently, tools have *ALIGN*() macros scattered across the unrelated headers, as there are only 3 of them and they were added separately each time on an as-needed basis. Anyway, let's make it more consistent with the kernel headers and allow using those macros outside of the mentioned headers. Create <linux/align.h> inside the tools/ folder and include it where needed. Signed-off-by: Yury Norov <yury.norov(a)gmail.com> Signed-off-by: Alexander Lobakin <aleksander.lobakin(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- tools/include/linux/align.h | 12 ++++++++++++ tools/include/linux/bitmap.h | 2 +- tools/include/linux/mm.h | 5 +---- 3 files changed, 14 insertions(+), 5 deletions(-) create mode 100644 tools/include/linux/align.h diff --git a/tools/include/linux/align.h b/tools/include/linux/align.h new file mode 100644 index 000000000000..14e34ace80dd --- /dev/null +++ b/tools/include/linux/align.h @@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef _TOOLS_LINUX_ALIGN_H +#define _TOOLS_LINUX_ALIGN_H + +#include <uapi/linux/const.h> + +#define ALIGN(x, a) __ALIGN_KERNEL((x), (a)) +#define ALIGN_DOWN(x, a) __ALIGN_KERNEL((x) - ((a) - 1), (a)) +#define IS_ALIGNED(x, a) (((x) & ((typeof(x))(a) - 1)) == 0) + +#endif /* _TOOLS_LINUX_ALIGN_H */ diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h index 3fa30e8dd351..210c13b1b857 100644 --- a/tools/include/linux/bitmap.h +++ b/tools/include/linux/bitmap.h @@ -3,6 +3,7 @@ #define _TOOLS_LINUX_BITMAP_H #include <string.h> +#include <linux/align.h> #include <linux/bitops.h> #include <linux/find.h> #include <stdlib.h> @@ -127,7 +128,6 @@ static inline bool bitmap_and(unsigned long *dst, const unsigned long *src1, #define BITMAP_MEM_ALIGNMENT (8 * sizeof(unsigned long)) #endif #define BITMAP_MEM_MASK (BITMAP_MEM_ALIGNMENT - 1) -#define IS_ALIGNED(x, a) (((x) & ((typeof(x))(a) - 1)) == 0) static inline bool bitmap_equal(const unsigned long *src1, const unsigned long *src2, unsigned int nbits) diff --git a/tools/include/linux/mm.h b/tools/include/linux/mm.h index 7d73da098047..dc0fc7125bc3 100644 --- a/tools/include/linux/mm.h +++ b/tools/include/linux/mm.h @@ -2,8 +2,8 @@ #ifndef _TOOLS_LINUX_MM_H #define _TOOLS_LINUX_MM_H +#include <linux/align.h> #include <linux/mmzone.h> -#include <uapi/linux/const.h> #define PAGE_SHIFT 12 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT) @@ -11,9 +11,6 @@ #define PHYS_ADDR_MAX (~(phys_addr_t)0) -#define ALIGN(x, a) __ALIGN_KERNEL((x), (a)) -#define ALIGN_DOWN(x, a) __ALIGN_KERNEL((x) - ((a) - 1), (a)) - #define PAGE_ALIGN(addr) ALIGN(addr, PAGE_SIZE) #define __va(x) ((void *)((unsigned long)(x))) -- 2.25.1

2 1

[openeuler:OLK-6.6 2431/14103] vmlinux.o: warning: objtool: .text+0x0: unreachable instruction
by kernel test robot 25 Sep '24

25 Sep '24

Hi Guo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d25e57f47750555950b12145f98d5168319e6712 commit: f04c0f3eb9b49427c273cd3e4d5a2ff895855b4b [2431/14103] make OPTIMIZE_INLINING config editable config: x86_64-buildonly-randconfig-001-20240925 (https://download.01.org/0day-ci/archive/20240925/202409251001.lPFg9jzv-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240925/202409251001.lPFg9jzv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409251001.lPFg9jzv-lkp@intel.com/ All warnings (new ones prefixed by >>): >> vmlinux.o: warning: objtool: .text+0x0: unreachable instruction vmlinux.o: warning: objtool: .text+0x40: unreachable instruction vmlinux.o: warning: objtool: .text+0x44: unreachable instruction vmlinux.o: warning: objtool: .text+0x49: unreachable instruction vmlinux.o: warning: objtool: .text+0x50: unreachable instruction vmlinux.o: warning: objtool: .text+0x57: unreachable instruction vmlinux.o: warning: objtool: .text+0x5c: unreachable instruction vmlinux.o: warning: objtool: .text+0x63: unreachable instruction vmlinux.o: warning: objtool: bad call to elf_init_reloc_text_sym() for data symbol .rodata objdump-func vmlinux.o .text: -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION ef5e9d0437237465f258a80a0d5d8e1e26872c7a
by kernel test robot 25 Sep '24

25 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: ef5e9d0437237465f258a80a0d5d8e1e26872c7a !11706 btrfs: replace BUG_ON() with error handling at update_ref_for_cow() Unverified Error/Warning (likely false positive, kindly check if interested): drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.o: warning: objtool: sss_tool_write_clp_reg() falls through to next function sss_tool_write_clp_data() drivers/platform/x86/intel_speed_select_if/isst_tpmi_core.c:100 isst_if_get_tpmi_instance_count() warn: potential spectre issue 'isst_common.sst_inst' [r] (local cap) drivers/platform/x86/intel_speed_select_if/isst_tpmi_core.c:1002 isst_if_get_perf_level_mask() warn: potential spectre issue 'power_domain_info->perf_levels' [r] drivers/platform/x86/intel_speed_select_if/isst_tpmi_core.c:104 isst_if_get_tpmi_instance_count() warn: possible spectre second half. 'sst_inst' drivers/platform/x86/intel_speed_select_if/isst_tpmi_core.c:584 isst_if_clos_assoc() warn: potential spectre issue 'isst_common.sst_inst' [r] drivers/platform/x86/intel_speed_select_if/isst_tpmi_core.c:586 isst_if_clos_assoc() warn: possible spectre second half. 'sst_inst' drivers/platform/x86/intel_speed_select_if/isst_tpmi_core.c:589 isst_if_clos_assoc() warn: potential spectre issue 'sst_inst->power_domain_info' [r] drivers/platform/x86/intel_speed_select_if/isst_tpmi_core.c:900 isst_if_get_perf_level_info() warn: potential spectre issue 'power_domain_info->perf_levels' [r] (local cap) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20240925 | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-004-20240925 | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-buildonly-randconfig-001-20240925 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20240925 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.o:warning:objtool:sss_tool_write_clp_reg-falls-through-to-next-function-sss_tool_write_clp_data() | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20240925 | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-004-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-005-20240925 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-kexec | |-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-001-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-002-20240925 | |-- drivers-usb-dwc2-core_intr.c:error:no-member-named-bus_suspended-in-struct-dwc2_hsotg | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-003-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-004-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-005-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-006-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-011-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-012-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-013-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-014-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-015-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-016-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-161-20240925 | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_root_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_root_table-procname | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_table-procname | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_clos_assoc()-warn:possible-spectre-second-half.-sst_inst | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_clos_assoc()-warn:potential-spectre-issue-isst_common.sst_inst-r | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_clos_assoc()-warn:potential-spectre-issue-sst_inst-power_domain_info-r | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_perf_level_info()-warn:potential-spectre-issue-power_domain_info-perf_levels-r-(local-cap) | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_perf_level_mask()-warn:potential-spectre-issue-power_domain_info-perf_levels-r | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_tpmi_instance_count()-warn:possible-spectre-second-half.-sst_inst | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_tpmi_instance_count()-warn:potential-spectre-issue-isst_common.sst_inst-r-(local-cap) | |-- fs-cifs-file.c-cifs_write_from_iter()-error:uninitialized-symbol-pagevec-. | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-func | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-kselftests | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 725m configs tested: 30 configs skipped: 128 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240925 gcc-14.1.0 arm64 randconfig-002-20240925 gcc-14.1.0 arm64 randconfig-003-20240925 clang-20 arm64 randconfig-004-20240925 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240925 clang-18 x86_64 buildonly-randconfig-002-20240925 clang-18 x86_64 buildonly-randconfig-003-20240925 gcc-12 x86_64 buildonly-randconfig-004-20240925 clang-18 x86_64 buildonly-randconfig-005-20240925 clang-18 x86_64 buildonly-randconfig-006-20240925 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240925 gcc-12 x86_64 randconfig-002-20240925 clang-18 x86_64 randconfig-003-20240925 gcc-12 x86_64 randconfig-004-20240925 gcc-12 x86_64 randconfig-005-20240925 clang-18 x86_64 randconfig-006-20240925 clang-18 x86_64 randconfig-011-20240925 clang-18 x86_64 randconfig-012-20240925 clang-18 x86_64 randconfig-013-20240925 clang-18 x86_64 randconfig-014-20240925 clang-18 x86_64 randconfig-015-20240925 clang-18 x86_64 randconfig-016-20240925 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/amd/display: Check denominator crb_pipes before used
by Yongqiang Liu 25 Sep '24

25 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v6.10.10 commit ede06d23392529b039cf7ac11b5875b047900f1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWUL CVE: CVE-2024-46772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ea79068d4073bf303f8203f2625af7d9185a1bc6 ] [WHAT & HOW] A denominator cannot be 0, and is checked before used. This fixes 2 DIVIDE_BY_ZERO issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c [Yongqiang: adaption for origin file] Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c b/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c index 127487ea3d7d..71e8bd675cd8 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c @@ -1751,7 +1751,7 @@ static int dcn315_populate_dml_pipes_from_context( bool split_required = pipe->stream->timing.pix_clk_100hz >= dcn_get_max_non_odm_pix_rate_100hz(&dc->dml.soc) || (pipe->plane_state && pipe->plane_state->src_rect.width > 5120); - if (remaining_det_segs > MIN_RESERVED_DET_SEGS) + if (remaining_det_segs > MIN_RESERVED_DET_SEGS && crb_pipes != 0) pipes[pipe_cnt].pipe.src.det_size_override += (remaining_det_segs - MIN_RESERVED_DET_SEGS) / crb_pipes + (crb_idx < (remaining_det_segs - MIN_RESERVED_DET_SEGS) % crb_pipes ? 1 : 0); if (pipes[pipe_cnt].pipe.src.det_size_override > 2 * DCN3_15_MAX_DET_SEGS) { -- 2.25.1

2 1

[PATCH OLK-6.6 v2 00/14] arm64/perf: Enable branch stack sampling
by Junhao He 25 Sep '24

25 Sep '24

This series enables perf branch stack sampling support on arm64 platform via a new arch feature called Branch Record Buffer Extension (BRBE). All the relevant register definitions could be accessed here. https://developer.arm.com/documentation/ddi0601/2021-12/AArch64-Registers This series applies on 6.10-rc3. Also this series is being hosted below for quick access, review and test. https://git.gitlab.arm.com/linux-arm/linux-anshuman.git (brbe_v18) - Anshuman ========== Perf Branch Stack Sampling Support (arm64 platforms) =========== Currently arm64 platform does not support perf branch stack sampling. Hence any event requesting for branch stack records i.e PERF_SAMPLE_BRANCH_STACK marked in event->attr.sample_type, will be rejected in armpmu_event_init(). static int armpmu_event_init(struct perf_event *event) { ........ /* does not support taken branch sampling */ if (has_branch_stack(event)) return -EOPNOTSUPP; ........ } $perf record -j any,u,k ls Error: cycles:P: PMU Hardware or event type doesn't support branch stack sampling. -------------------- CONFIG_ARM64_BRBE and FEAT_BRBE ---------------------- After this series, perf branch stack sampling feature gets enabled on arm64 platforms where FEAT_BRBE HW feature is supported, and CONFIG_ARM64_BRBE is also selected during build. Let's observe all all possible scenarios here. 1. Feature not built (!CONFIG_ARM64_BRBE): Falls back to the current behaviour i.e event gets rejected. 2. Feature built but HW not supported (CONFIG_ARM64_BRBE && !FEAT_BRBE): Falls back to the current behaviour i.e event gets rejected. 3. Feature built and HW supported (CONFIG_ARM64_BRBE && FEAT_BRBE): Platform supports branch stack sampling requests. Let's observe through a simple example here. $perf record -j any_call,u,k,save_type ls [Please refer perf-record man pages for all possible branch filter options] $perf report -------------------------- Snip ---------------------- # Overhead Command Source Shared Object Source Symbol Target Symbol Basic Block Cycles # ........ ....... .................... ............................................ ............................................ .................. # 3.52% ls [kernel.kallsyms] [k] sched_clock_noinstr [k] arch_counter_get_cntpct 16 3.52% ls [kernel.kallsyms] [k] sched_clock [k] sched_clock_noinstr 9 1.85% ls [kernel.kallsyms] [k] sched_clock_cpu [k] sched_clock 5 1.80% ls [kernel.kallsyms] [k] irqtime_account_irq [k] sched_clock_cpu 20 1.58% ls [kernel.kallsyms] [k] gic_handle_irq [k] generic_handle_domain_irq 19 1.58% ls [kernel.kallsyms] [k] call_on_irq_stack [k] gic_handle_irq 9 1.58% ls [kernel.kallsyms] [k] do_interrupt_handler [k] call_on_irq_stack 23 1.58% ls [kernel.kallsyms] [k] generic_handle_domain_irq [k] __irq_resolve_mapping 6 1.58% ls [kernel.kallsyms] [k] __irq_resolve_mapping [k] __rcu_read_lock 10 -------------------------- Snip ---------------------- $perf report -D | grep cycles -------------------------- Snip ---------------------- ..... 1: ffff800080dd3334 -> ffff800080dd759c 39 cycles P 0 IND_CALL ..... 2: ffff800080ffaea0 -> ffff800080ffb688 16 cycles P 0 IND_CALL ..... 3: ffff800080139918 -> ffff800080ffae64 9 cycles P 0 CALL ..... 4: ffff800080dd3324 -> ffff8000801398f8 7 cycles P 0 CALL ..... 5: ffff8000800f8548 -> ffff800080dd330c 21 cycles P 0 IND_CALL ..... 6: ffff8000800f864c -> ffff8000800f84ec 6 cycles P 0 CALL ..... 7: ffff8000800f86dc -> ffff8000800f8638 11 cycles P 0 CALL ..... 8: ffff8000800f86d4 -> ffff800081008630 16 cycles P 0 CALL -------------------------- Snip ---------------------- perf script and other tooling can also be applied on the captured perf.data Similarly branch stack sampling records can be collected via direct system call i.e perf_event_open() method after setting 'struct perf_event_attr' as required. event->attr.sample_type |= PERF_SAMPLE_BRANCH_STACK event->attr.branch_sample_type |= PERF_SAMPLE_BRANCH_<FILTER_1> | PERF_SAMPLE_BRANCH_<FILTER_2> | PERF_SAMPLE_BRANCH_<FILTER_3> | ............................... But all branch filters might not be supported on the platform. ----------------------- BRBE Branch Filters Support ----------------------- - Following branch filters are supported on arm64. PERF_SAMPLE_BRANCH_USER /* Branch privilege filters */ PERF_SAMPLE_BRANCH_KERNEL PERF_SAMPLE_BRANCH_HV PERF_SAMPLE_BRANCH_ANY /* Branch type filters */ PERF_SAMPLE_BRANCH_ANY_CALL PERF_SAMPLE_BRANCH_ANY_RETURN PERF_SAMPLE_BRANCH_IND_CALL PERF_SAMPLE_BRANCH_COND PERF_SAMPLE_BRANCH_IND_JUMP PERF_SAMPLE_BRANCH_CALL PERF_SAMPLE_BRANCH_NO_FLAGS /* Branch record flags */ PERF_SAMPLE_BRANCH_NO_CYCLES PERF_SAMPLE_BRANCH_TYPE_SAVE PERF_SAMPLE_BRANCH_HW_INDEX PERF_SAMPLE_BRANCH_PRIV_SAVE - Following branch filters are not supported on arm64. PERF_SAMPLE_BRANCH_ABORT_TX PERF_SAMPLE_BRANCH_IN_TX PERF_SAMPLE_BRANCH_NO_TX PERF_SAMPLE_BRANCH_CALL_STACK Events requesting above non-supported branch filters get rejected. --------------------------- Virtualisation support ------------------------ - No guest support -------------------------------- Testing --------------------------------- - Cross compiled for both arm64 and arm32 platforms - Passes all branch tests with 'perf test branch' on arm64 Changes in V18: - Changed BRBIDR0_EL1 register fields CC and FORMAT, updated the commit message - Replaced BRBIDR0_EL1_FORMAT_0 as BRBIDR0_EL1_FORMAT_FORMAT_0 in BRBE driver - Dropped ifdef CONFIG_ARM64_BRBE around __init_el2_brbe() - Updated in code comment around __init_el2_brbe() - Dropped the write up for EL2->EL1 transition, also moved up the EL3 write up - Unconditionally capture branch record type and privilege information - Scan valid branch stack events in armpmu_start() to create merged filter - Dropped branch_sample_type override in armv8pmu_branch_stack_add() - Dropped branch filter mismatch between PMU and event in read_branch_records() - Added SW filtering framework in read_branch_records() during filter mismatch - Added SW filtering for privilege modes - Used host_data_ptr() to access host_debug_state.brbcr_el1 register - Changed DEBUG_STATE_SAVE_BRBE to use BIT(7) - Reverted back iflags as u8 https://lore.kernel.org/all/20240405024639.1179064-1-anshuman.khandual@arm.… Changes in V17: - Added back Reviewed-by tags from Mark Brown - Updated the commit message regarding the field BRBINFx_EL1_TYPE_IMPDEF_TRAP_EL3 - Added leading 0s for all values as BRBIDR0_EL1.NUMREC is a 8 bit field - Added leading 0s for all values as BRBFCR_EL1.BANK is a 2 bit field - Reordered BRBCR_EL1/BRBCR_EL12/BRBCR_EL2 registers as per sysreg encodings - Renamed s/FIRST/BANK_0 and s/SECOND/BANK_1 in BRBFCR_EL1.BANK - Renamed s/UNCOND_DIRECT/DIRECT_UNCOND in BRBINFx_EL1.TYPE - Renamed s/COND_DIRECT/DIRECT_COND in BRBINFx_EL1.TYPE - Dropped __SYS_BRBINF/__SYS_BRBSRC/__SYS_BRBTGT and their expansions - Moved all existing BRBE registers from sysreg.h header to tools/sysreg format - Updated the commit message including about sys_insn_descs[] - Changed KVM to use existing SYS_BRBSRC/TGT/INF_EL1(n) format - Moved the BRBE instructions into sys_insn_descs[] array - ARM PMUV3 changes have been moved into the BRBE driver patch instead - Moved down branch_stack_add() in armpmu_add() after event's basic checks - Added new callbacks in struct arm_pmu e.g branch_stack_[init|add|del]() - Renamed struct arm_pmu callback branch_reset() as branch_stack_reset() - Dropped the comment in armpmu_event_init() - Renamed 'pmu_hw_events' elements from 'brbe_' to more generic 'branch_' - Separated out from the BRBE driver implementation patch - Dropped the comment in __init_el2_brbe() - Updated __init_el2_brbe() with BRBCR_EL2.MPRED requirements - Updated __init_el2_brbe() with __check_hvhe() constructs - Updated booting.rst regarding MPRED, MDCR_EL3 and fine grained control - Dropped Documentation/arch/arm64/brbe.rst - Renamed armv8pmu_branch_reset() as armv8pmu_branch_stack_reset() - Separated out booting.rst and EL2 boot requirements into a new patch - Dropped process_branch_aborts() completely - Added an warning if transaction states get detected unexpectedly - Dropped enum brbe_bank_idx from the driver - Defined armv8pmu_branch_stack_init/add/del() callbacks in the driver - Changed BRBE driver to use existing SYS_BRBSRC/TGT/INF_EL1(n) format - Dropped isb() call sites in __debug_[save|restore]_brbe() - Changed to [read|write]_sysreg_el1() accessors in __debug_[save|restore]_brbe() Changes in V16 https://lore.kernel.org/all/20240125094119.2542332-1-anshuman.khandual@arm.… - Updated BRBINFx_EL1.TYPE = 0b110000 as field IMPDEF_TRAP_EL3 - Updated BRBCR_ELx[9] as field FZPSS - Updated BRBINFINJ_EL1 to use sysreg field BRBINFx_EL1 - Added BRB_INF_SRC_TGT_EL1 macro for corresponding BRB_[INF|SRC|TGT] expansion - Renamed arm_brbe.h as arm_pmuv3_branch.h - Updated perf_sample_save_brstack()'s new argument requirements with NULL - Fixed typo (s/informations/information) in Documentation/arch/arm64/brbe.rst - Added SPDX-License-Identifier in Documentation/arch/arm64/brbe.rst - Added new PERF_SAMPLE_BRANCH_COUNTERS into BRBE_EXCLUDE_BRANCH_FILTERS - Dropped BRBFCR_EL1 and BRBCR_EL1 from enum vcpu_sysreg - Reverted back the KVM NVHE patch - use host_debug_state based 'brbcr_el1' element and dropped the previous dependency on Jame's coresight series Changes in V15: https://lore.kernel.org/all/20231201053906.1261704-1-anshuman.khandual@arm.… - Added a comment for armv8pmu_branch_probe() regarding single cpu probe - Added a text in brbe.rst regarding single cpu probe - Dropped runtime BRBE enable for setting DEBUG_STATE_SAVE_BRBE - Dropped zero_branch_stack based zero branch records mechanism - Replaced BRBFCR_EL1_DEFAULT_CONFIG with BRBFCR_EL1_CONFIG_MASK - Added BRBFCR_EL1_CONFIG_MASK masking in branch_type_to_brbfcr() - Moved BRBE helpers from arm_brbe.h into arm_brbe.c - Moved armv8_pmu_xxx() declaration inside arm_brbe.h for arm64 (CONFIG_ARM64_BRBE) - Moved armv8_pmu_xxx() stub definitions inside arm_brbe.h for arm32 (!CONFIG_ARM64_BRBE) - Included arm_brbe.h header both in arm_pmuv3.c and arm_brbe.c - Dropped BRBE custom pr_fmt() - Dropped CONFIG_PERF_EVENTS wrapping from header entries - Flush branch records when a cpu bound event follows a task bound event - Dropped BRBFCR_EL1 from __debug_save_brbe()/__debug_restore_brbe() - Always save the live SYS_BRBCR_EL1 in host context and then check if BRBE was enabled before resetting SYS_BRBCR_EL1 for the host Changes in V14: https://lore.kernel.org/all/20231114051329.327572-1-anshuman.khandual@arm.c… - This series has been reorganised as suggested during V13 - There are just eight patches now i.e 5 enablement and 3 perf branch tests - Fixed brackets problem in __SYS_BRBINFO/BRBSRC/BRBTGT() macros - Renamed the macro i.e s/__SYS_BRBINFO/__SYS_BRBINF/ - Renamed s/BRB_IALL/BRB_IALL_INSN and s/BRBE_INJ/BRB_INJ_INSN - Moved BRB_IALL_INSN and SYS_BRB_INSN instructions to sysreg patch - Changed E1BRE as ExBRE in sysreg fields inside BRBCR_ELx - Used BRBCR_ELx for defining all BRBCR_EL1, BRBCR_EL2, and BRBCR_EL12 (new) - Folded the following three patches into a single patch i.e [PATCH 3/8] drivers: perf: arm_pmu: Add new sched_task() callback arm64/perf: Add branch stack support in struct arm_pmu arm64/perf: Add branch stack support in struct pmu_hw_events arm64/perf: Add branch stack support in ARMV8 PMU arm64/perf: Add PERF_ATTACH_TASK_DATA to events with has_branch_stack() - All armv8pmu_branch_xxxx() stub definitions have been moved inside include/linux/perf/arm_pmuv3.h for easy access from both arm32 and arm64 - Added brbe_users, brbe_context and brbe_sample_type in struct pmu_hw_events - Added comments for all the above new elements in struct pmu_hw_events - Added branch_reset() and sched_task() callbacks - Changed and optimized branch records processing during a PMU IRQ - NO branch records get captured for event with mismatched brbe_sample_type - Branch record context is tracked from armpmu_del() & armpmu_add() - Branch record hardware is driven from armv8pmu_start() & armv8pmu_stop() - Dropped NULL check for 'pmu_ctx' inside armv8pmu_sched_task() - Moved down PERF_ATTACH_TASK_DATA assignment with a preceding comment - In conflicting branch sample type requests, first event takes precedence - Folded the following five patches from V13 into a single patch i.e [PATCH 4/8] arm64/perf: Enable branch stack events via FEAT_BRBE arm64/perf: Add struct brbe_regset helper functions arm64/perf: Implement branch records save on task sched out arm64/perf: Implement branch records save on PMU IRQ - Fixed the year in copyright statement - Added Documentation/arch/arm64/brbe.rst - Updated Documentation/arch/arm64/booting.rst (BRBCR_EL2.CC for EL1 entry) - Added __init_el2_brbe() which enables branch record cycle count support - Disabled EL2 traps in __init_el2_fgt() while accessing BRBE registers and executing instructions - Changed CONFIG_ARM64_BRBE user visible description - Fixed a typo in CONFIG_ARM64_BRBE config option description text - Added BUILD_BUG_ON() co-relating BRBE_BANK_MAX_ENTRIES and MAX_BRANCH_RECORDS - Dropped arm64_create_brbe_task_ctx_kmem_cache() - Moved down comment for PERF_SAMPLE_BRANCH_KERNEL in branch_type_to_brbcr() - Renamed BRBCR_ELx_DEFAULT_CONFIG as BRBCR_ELx_CONFIG_MASK - Replaced BRBCR_ELx_DEFAULT_TS with BRBCR_ELx_TS_MASK in BRBCR_ELx_CONFIG_MASK - Replaced BRBCR_ELx_E1BRE instances with BRBCR_ELx_ExBRE - Added BRBE specific branch stack sampling perf test patches into the series - Added a patch to prevent guest accesses into BRBE registers and instructions - Added a patch to save the BRBE host context in NVHE environment - Updated most commit messages Changes in V13: https://lore.kernel.org/all/20230711082455.215983-1-anshuman.khandual@arm.c… https://lore.kernel.org/all/20230622065351.1092893-1-anshuman.khandual@arm.… - Added branch callback stubs for aarch32 pmuv3 based platforms - Updated the comments for capture_brbe_regset() - Deleted the comments in __read_brbe_regset() - Reversed the arguments order in capture_brbe_regset() and brbe_branch_save() - Fixed BRBE_BANK[0|1]_IDX_MAX indices comparison in armv8pmu_branch_read() - Fixed BRBE_BANK[0|1]_IDX_MAX indices comparison in capture_brbe_regset() Changes in V12: https://lore.kernel.org/all/20230615133239.442736-1-anshuman.khandual@arm.c… - Replaced branch types with complete DIRECT/INDIRECT prefixes/suffixes - Replaced branch types with complete INSN/ALIGN prefixes/suffixes - Replaced return branch types as simple RET/ERET - Replaced time field GST_PHYSICAL as GUEST_PHYSICAL - Added 0 padding for BRBIDR0_EL1.NUMREC enum values - Dropped helper arm_pmu_branch_stack_supported() - Renamed armv8pmu_branch_valid() as armv8pmu_branch_attr_valid() - Separated perf_task_ctx_cache setup from arm_pmu private allocation - Collected changes to branch_records_alloc() in a single patch [5/10] - Reworked and cleaned up branch_records_alloc() - Reworked armv8pmu_branch_read() with new loop iterations in patch [6/10] - Reworked capture_brbe_regset() with new loop iterations in patch [8/10] - Updated the comment in branch_type_to_brbcr() - Fixed the comment before stitch_stored_live_entries() - Fixed BRBINFINJ_EL1 definition for VALID_FULL enum field - Factored out helper __read_brbe_regset() from capture_brbe_regset() - Dropped the helper copy_brbe_regset() - Simplified stitch_stored_live_entries() with memcpy(), memmove() - Reworked armv8pmu_probe_pmu() to bail out early with !probe.present - Rework brbe_attributes_probe() without 'struct brbe_hw_attr' - Dropped 'struct brbe_hw_attr' argument from capture_brbe_regset() - Dropped 'struct brbe_hw_attr' argument from brbe_branch_save() - Dropped arm_pmu->private and added arm_pmu->reg_trbidr instead Changes in V11: https://lore.kernel.org/all/20230531040428.501523-1-anshuman.khandual@arm.c… - Fixed the crash for per-cpu events without event->pmu_ctx->task_ctx_data Changes in V10: https://lore.kernel.org/all/20230517022410.722287-1-anshuman.khandual@arm.c… - Rebased the series on v6.4-rc2 - Moved ARMV8 PMUV3 changes inside drivers/perf/arm_pmuv3.c - Moved BRBE driver changes inside drivers/perf/arm_brbe.[c|h] - Moved the WARN_ON() inside the if condition in armv8pmu_handle_irq() Changes in V9: https://lore.kernel.org/all/20230315051444.1683170-1-anshuman.khandual@arm.… - Fixed build problem with has_branch_stack() in arm64 header - BRBINF_EL1 definition has been changed from 'Sysreg' to 'SysregFields' - Renamed all BRBINF_EL1 call sites as BRBINFx_EL1 - Dropped static const char branch_filter_error_msg[] - Implemented a positive list check for BRBE supported perf branch filters - Added a comment in armv8pmu_handle_irq() - Implemented per-cpu allocation for struct branch_record records - Skipped looping through bank 1 if an invalid record is detected in bank 0 - Added comment in armv8pmu_branch_read() explaining prohibited region etc - Added comment warning about erroneously marking transactions as aborted - Replaced the first argument (perf_branch_entry) in capture_brbe_flags() - Dropped the last argument (idx) in capture_brbe_flags() - Dropped the brbcr argument from capture_brbe_flags() - Used perf_sample_save_brstack() to capture branch records for perf_sample_data - Added comment explaining rationale for setting BRBCR_EL1_FZP for user only traces - Dropped BRBE prohibited state mechanism while in armv8pmu_branch_read() - Implemented event task context based branch records save mechanism Changes in V8: https://lore.kernel.org/all/20230123125956.1350336-1-anshuman.khandual@arm.… - Replaced arm_pmu->features as arm_pmu->has_branch_stack, updated its helper - Added a comment and line break before arm_pmu->private element - Added WARN_ON_ONCE() in helpers i.e armv8pmu_branch_[read|valid|enable|disable]() - Dropped comments in armv8pmu_enable_event() and armv8pmu_disable_event() - Replaced open bank encoding in BRBFCR_EL1 with SYS_FIELD_PREP() - Changed brbe_hw_attr->brbe_version from 'bool' to 'int' - Updated pr_warn() as pr_warn_once() with values in brbe_get_perf_[type|priv]() - Replaced all pr_warn_once() as pr_debug_once() in armv8pmu_branch_valid() - Added a comment in branch_type_to_brbcr() for the BRBCR_EL1 privilege settings - Modified the comment related to BRBINFx_EL1.LASTFAILED in capture_brbe_flags() - Modified brbe_get_perf_entry_type() as brbe_set_perf_entry_type() - Renamed brbe_valid() as brbe_record_is_complete() - Renamed brbe_source() as brbe_record_is_source_only() - Renamed brbe_target() as brbe_record_is_target_only() - Inverted checks for !brbe_record_is_[target|source]_only() for info capture - Replaced 'fetch' with 'get' in all helpers that extract field value - Dropped 'static int brbe_current_bank' optimization in select_brbe_bank() - Dropped select_brbe_bank_index() completely, added capture_branch_entry() - Process captured branch entries in two separate loops one for each BRBE bank - Moved branch_records_alloc() inside armv8pmu_probe_pmu() - Added a forward declaration for the helper has_branch_stack() - Added new callbacks armv8pmu_private_alloc() and armv8pmu_private_free() - Updated armv8pmu_probe_pmu() to allocate the private structure before SMP call Changes in V7: https://lore.kernel.org/all/20230105031039.207972-1-anshuman.khandual@arm.c… - Folded [PATCH 7/7] into [PATCH 3/7] which enables branch stack sampling event - Defined BRBFCR_EL1_BRANCH_FILTERS, BRBCR_EL1_DEFAULT_CONFIG in the header - Defined BRBFCR_EL1_DEFAULT_CONFIG in the header - Updated BRBCR_EL1_DEFAULT_CONFIG with BRBCR_EL1_FZP - Defined BRBCR_EL1_DEFAULT_TS in the header - Updated BRBCR_EL1_DEFAULT_CONFIG with BRBCR_EL1_DEFAULT_TS - Moved BRBCR_EL1_DEFAULT_CONFIG check inside branch_type_to_brbcr() - Moved down BRBCR_EL1_CC, BRBCR_EL1_MPRED later in branch_type_to_brbcr() - Also set BRBE in paused state in armv8pmu_branch_disable() - Dropped brbe_paused(), set_brbe_paused() helpers - Extracted error string via branch_filter_error_msg[] for armv8pmu_branch_valid() - Replaced brbe_v1p1 with brbe_version in struct brbe_hw_attr - Added valid_brbe_[cc, format, version]() helpers - Split a separate brbe_attributes_probe() from armv8pmu_branch_probe() - Capture event->attr.branch_sample_type earlier in armv8pmu_branch_valid() - Defined enum brbe_bank_idx with possible values for BRBE bank indices - Changed armpmu->hw_attr into armpmu->private - Added missing space in stub definition for armv8pmu_branch_valid() - Replaced both kmalloc() with kzalloc() - Added BRBE_BANK_MAX_ENTRIES - Updated comment for capture_brbe_flags() - Updated comment for struct brbe_hw_attr - Dropped space after type cast in couple of places - Replaced inverse with negation for testing BRBCR_EL1_FZP in armv8pmu_branch_read() - Captured cpuc->branches->branch_entries[idx] in a local variable - Dropped saved_priv from armv8pmu_branch_read() - Reorganize PERF_SAMPLE_BRANCH_NO_[CYCLES|NO_FLAGS] related configuration - Replaced with FIELD_GET() and FIELD_PREP() wherever applicable - Replaced BRBCR_EL1_TS_PHYSICAL with BRBCR_EL1_TS_VIRTUAL - Moved valid_brbe_nr(), valid_brbe_cc(), valid_brbe_format(), valid_brbe_version() select_brbe_bank(), select_brbe_bank_index() helpers inside the C implementation - Reorganized brbe_valid_nr() and dropped the pr_warn() message - Changed probe sequence in brbe_attributes_probe() - Added 'brbcr' argument into capture_brbe_flags() to ascertain correct state - Disable BRBE before disabling the PMU event counter - Enable PERF_SAMPLE_BRANCH_HV filters when is_kernel_in_hyp_mode() - Guard armv8pmu_reset() & armv8pmu_sched_task() with arm_pmu_branch_stack_supported() Changes in V6: https://lore.kernel.org/linux-arm-kernel/20221208084402.863310-1-anshuman.k… - Restore the exception level privilege after reading the branch records - Unpause the buffer after reading the branch records - Decouple BRBCR_EL1_EXCEPTION/ERTN from perf event privilege level - Reworked BRBE implementation and branch stack sampling support on arm pmu - BRBE implementation is now part of overall ARMV8 PMU implementation - BRBE implementation moved from drivers/perf/ to inside arch/arm64/kernel/ - CONFIG_ARM_BRBE_PMU renamed as CONFIG_ARM64_BRBE in arch/arm64/Kconfig - File moved - drivers/perf/arm_pmu_brbe.c -> arch/arm64/kernel/brbe.c - File moved - drivers/perf/arm_pmu_brbe.h -> arch/arm64/kernel/brbe.h - BRBE name has been dropped from struct arm_pmu and struct hw_pmu_events - BRBE name has been abstracted out as 'branches' in arm_pmu and hw_pmu_events - BRBE name has been abstracted out as 'branches' in ARMV8 PMU implementation - Added sched_task() callback into struct arm_pmu - Added 'hw_attr' into struct arm_pmu encapsulating possible PMU HW attributes - Dropped explicit attributes brbe_(v1p1, nr, cc, format) from struct arm_pmu - Dropped brbfcr, brbcr, registers scratch area from struct hw_pmu_events - Dropped brbe_users, brbe_context tracking in struct hw_pmu_events - Added 'features' tracking into struct arm_pmu with ARM_PMU_BRANCH_STACK flag - armpmu->hw_attr maps into 'struct brbe_hw_attr' inside BRBE implementation - Set ARM_PMU_BRANCH_STACK in 'arm_pmu->features' after successful BRBE probe - Added armv8pmu_branch_reset() inside armv8pmu_branch_enable() - Dropped brbe_supported() as events will be rejected via ARM_PMU_BRANCH_STACK - Dropped set_brbe_disabled() as well - Reformated armv8pmu_branch_valid() warnings while rejecting unsupported events Changes in V5: https://lore.kernel.org/linux-arm-kernel/20221107062514.2851047-1-anshuman.… - Changed BRBCR_EL1.VIRTUAL from 0b1 to 0b01 - Changed BRBFCR_EL1.EnL into BRBFCR_EL1.EnI - Changed config ARM_BRBE_PMU from 'tristate' to 'bool' Changes in V4: https://lore.kernel.org/all/20221017055713.451092-1-anshuman.khandual@arm.c… - Changed ../tools/sysreg declarations as suggested - Set PERF_SAMPLE_BRANCH_STACK in data.sample_flags - Dropped perfmon_capable() check in armpmu_event_init() - s/pr_warn_once/pr_info in armpmu_event_init() - Added brbe_format element into struct pmu_hw_events - Changed v1p1 as brbe_v1p1 in struct pmu_hw_events - Dropped pr_info() from arm64_pmu_brbe_probe(), solved LOCKDEP warning Changes in V3: https://lore.kernel.org/all/20220929075857.158358-1-anshuman.khandual@arm.c… - Moved brbe_stack from the stack and now dynamically allocated - Return PERF_BR_PRIV_UNKNOWN instead of -1 in brbe_fetch_perf_priv() - Moved BRBIDR0, BRBCR, BRBFCR registers and fields into tools/sysreg - Created dummy BRBINF_EL1 field definitions in tools/sysreg - Dropped ARMPMU_EVT_PRIV framework which cached perfmon_capable() - Both exception and exception return branche records are now captured only if the event has PERF_SAMPLE_BRANCH_KERNEL which would already been checked in generic perf via perf_allow_kernel() Changes in V2: https://lore.kernel.org/all/20220908051046.465307-1-anshuman.khandual@arm.c… - Dropped branch sample filter helpers consolidation patch from this series - Added new hw_perf_event.flags element ARMPMU_EVT_PRIV to cache perfmon_capable() - Use cached perfmon_capable() while configuring BRBE branch record filters Changes in V1: https://lore.kernel.org/linux-arm-kernel/20220613100119.684673-1-anshuman.k… - Added CONFIG_PERF_EVENTS wrapper for all branch sample filter helpers - Process new perf branch types via PERF_BR_EXTEND_ABI Changes in RFC V2: https://lore.kernel.org/linux-arm-kernel/20220412115455.293119-1-anshuman.k… - Added branch_sample_priv() while consolidating other branch sample filter helpers - Changed all SYS_BRBXXXN_EL1 register definition encodings per Marc - Changed the BRBE driver as per proposed BRBE related perf ABI changes (V5) - Added documentation for struct arm_pmu changes, updated commit message - Updated commit message for BRBE detection infrastructure patch - PERF_SAMPLE_BRANCH_KERNEL gets checked during arm event init (outside the driver) - Branch privilege state capture mechanism has now moved inside the driver Changes in RFC V1: https://lore.kernel.org/all/1642998653-21377-1-git-send-email-anshuman.khan… Anshuman Khandual (6): arm64/sysreg: Add BRBE registers and fields KVM: arm64: Explicitly handle BRBE traps as UNDEFINED drivers: perf: arm_pmu: Add infrastructure for branch stack sampling arm64/boot: Enable EL2 requirements for BRBE drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE KVM: arm64: nvhe: Disable branch generation in nVHE guests James Clark (3): perf: test: Speed up running brstack test on an Arm model perf: test: Remove empty lines from branch filter test output perf: test: Extend branch stack sampling test for Arm64 BRBE Junhao He (1): arm64/perf: Enable branch stack sampling Marc Zyngier (2): KVM: arm64: nv: Drop VCPU_HYP_CONTEXT flag KVM: arm64: Fix TRFCR_EL1/PMSCR_EL1 access in hVHE mode Miguel Luis (2): arm64: Add missing _EL12 encodings arm64: Add missing _EL2 encodings Documentation/arch/arm64/booting.rst | 21 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/el2_setup.h | 87 +- arch/arm64/include/asm/kvm_host.h | 5 +- arch/arm64/include/asm/sysreg.h | 55 +- arch/arm64/kvm/debug.c | 5 + arch/arm64/kvm/hyp/nvhe/debug-sr.c | 43 +- arch/arm64/kvm/hyp/vhe/switch.c | 7 +- arch/arm64/kvm/sys_regs.c | 56 ++ arch/arm64/tools/sysreg | 131 +++ drivers/perf/Kconfig | 11 + drivers/perf/Makefile | 1 + drivers/perf/arm_brbe.c | 1198 ++++++++++++++++++++++++ drivers/perf/arm_pmu.c | 42 +- drivers/perf/arm_pmuv3.c | 160 +++- drivers/perf/arm_pmuv3_branch.h | 83 ++ include/linux/perf/arm_pmu.h | 37 +- tools/perf/tests/builtin-test.c | 1 + tools/perf/tests/shell/test_brstack.sh | 57 +- tools/perf/tests/tests.h | 1 + tools/perf/tests/workloads/Build | 2 + tools/perf/tests/workloads/traploop.c | 39 + 22 files changed, 2007 insertions(+), 36 deletions(-) create mode 100644 drivers/perf/arm_brbe.c create mode 100644 drivers/perf/arm_pmuv3_branch.h create mode 100644 tools/perf/tests/workloads/traploop.c -- 2.33.0

2 15

[PATCH openEuler-22.03-LTS-SP1] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 25 Sep '24

25 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://lore.kernel.org/lkml/20240828154338.754746-1-david.fernandez.gonzal… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] sch/netem: fix use after free in netem_dequeue
by Wang Liang 25 Sep '24

25 Sep '24

From: Stephen Hemminger <stephen(a)networkplumber.org> stable inclusion from stable-v5.10.226 commit 98c75d76187944296068d685dfd8a1e9fd8c4fdc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX29 CVE: CVE-2024-46800 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a upstream. If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails") Commands to trigger KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF Fixes: 50612537e9ab ("netem: fix classful handling") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Stephen Hemminger <stephen(a)networkplumber.org> Link: https://patch.msgid.link/20240901182438.4992-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_netem.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index b72b308fe406..8321ab36357c 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -722,11 +722,10 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) err = qdisc_enqueue(skb, q->qdisc, &to_free); kfree_skb_list(to_free); - if (err != NET_XMIT_SUCCESS && - net_xmit_drop_count(err)) { - qdisc_qstats_drop(sch); - qdisc_tree_reduce_backlog(sch, 1, - pkt_len); + if (err != NET_XMIT_SUCCESS) { + if (net_xmit_drop_count(err)) + qdisc_qstats_drop(sch); + qdisc_tree_reduce_backlog(sch, 1, pkt_len); } goto tfifo_dequeue; } -- 2.34.1

2 1

[PATCH OLK-5.10] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 25 Sep '24

25 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://lore.kernel.org/lkml/20240828154338.754746-1-david.fernandez.gonzal… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-6.6] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 25 Sep '24

25 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://lore.kernel.org/lkml/20240828154338.754746-1-david.fernandez.gonzal… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sch/netem: fix use after free in netem_dequeue
by Wang Liang 25 Sep '24

25 Sep '24

From: Stephen Hemminger <stephen(a)networkplumber.org> stable inclusion from stable-v4.19.322 commit f0bddb4de043399f16d1969dad5ee5b984a64e7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX29 CVE: CVE-2024-46800 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a upstream. If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails") Commands to trigger KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF Fixes: 50612537e9ab ("netem: fix classful handling") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Stephen Hemminger <stephen(a)networkplumber.org> Link: https://patch.msgid.link/20240901182438.4992-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_netem.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index 95832934e965..8e33bcd69edd 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -697,11 +697,10 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) err = qdisc_enqueue(skb, q->qdisc, &to_free); kfree_skb_list(to_free); - if (err != NET_XMIT_SUCCESS && - net_xmit_drop_count(err)) { - qdisc_qstats_drop(sch); - qdisc_tree_reduce_backlog(sch, 1, - pkt_len); + if (err != NET_XMIT_SUCCESS) { + if (net_xmit_drop_count(err)) + qdisc_qstats_drop(sch); + qdisc_tree_reduce_backlog(sch, 1, pkt_len); } goto tfifo_dequeue; } -- 2.34.1

2 1

[openeuler:OLK-6.6 13560/14103] include/linux/psp-hygon.h:257:1: error: conflicting types for 'vpsp_try_do_cmd'
by kernel test robot 25 Sep '24

25 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d25e57f47750555950b12145f98d5168319e6712 commit: 3ce4cb81ef2b148f6c830c7debb4405e26cded1c [13560/14103] drivers/crypto/ccp: support TKM run on CSV config: x86_64-buildonly-randconfig-006-20240925 (https://download.01.org/0day-ci/archive/20240925/202409250819.8xNdiVIP-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240925/202409250819.8xNdiVIP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409250819.8xNdiVIP-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/x86/kvm/svm/svm.c:25: >> include/linux/psp-hygon.h:257:1: error: conflicting types for 'vpsp_try_do_cmd' 257 | vpsp_try_do_cmd(int cmd, phys_addr_t phy_addr, | ^ include/linux/psp-hygon.h:253:1: note: previous definition is here 253 | vpsp_try_do_cmd(uint32_t vid, int cmd, | ^ include/linux/psp-hygon.h:285:5: warning: no previous prototype for function 'psp_register_cmd_notifier' [-Wmissing-prototypes] 285 | int psp_register_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^ include/linux/psp-hygon.h:285:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 285 | int psp_register_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^ | static include/linux/psp-hygon.h:286:5: warning: no previous prototype for function 'psp_unregister_cmd_notifier' [-Wmissing-prototypes] 286 | int psp_unregister_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^ include/linux/psp-hygon.h:286:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 286 | int psp_unregister_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^ | static 2 warnings and 1 error generated. vim +/vpsp_try_do_cmd +257 include/linux/psp-hygon.h 247 248 static inline int 249 vpsp_try_get_result(uint8_t prio, 250 uint32_t index, phys_addr_t phy_addr, struct vpsp_ret *psp_ret) { return -ENODEV; } 251 252 static inline int 253 vpsp_try_do_cmd(uint32_t vid, int cmd, 254 void *data, struct vpsp_ret *psp_ret) { return -ENODEV; } 255 256 static inline int > 257 vpsp_try_do_cmd(int cmd, phys_addr_t phy_addr, 258 struct vpsp_ret *psp_ret) { return -ENODEV; } 259 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13560/14103] drivers/crypto/ccp/hygon/vpsp.c:91: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
by kernel test robot 25 Sep '24

25 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d25e57f47750555950b12145f98d5168319e6712 commit: 3ce4cb81ef2b148f6c830c7debb4405e26cded1c [13560/14103] drivers/crypto/ccp: support TKM run on CSV config: x86_64-rhel-8.3 (https://download.01.org/0day-ci/archive/20240925/202409250631.b3SgU0xM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240925/202409250631.b3SgU0xM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409250631.b3SgU0xM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/vpsp.c:91: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copy the guest data to the host kernel buffer >> drivers/crypto/ccp/hygon/vpsp.c:294: warning: Cannot understand * @brief Directly convert the gpa address into hpa and forward it to PSP, on line 294 - I thought it was a doc line >> drivers/crypto/ccp/hygon/vpsp.c:381: warning: Cannot understand * @brief copy data in gpa to host memory and send it to psp for processing. on line 381 - I thought it was a doc line vim +91 drivers/crypto/ccp/hygon/vpsp.c 89 90 /** > 91 * Copy the guest data to the host kernel buffer 92 * and record the host buffer address in 'hbuf'. 93 * This 'hbuf' is used to restore context information 94 * during asynchronous processing. 95 */ 96 static int kvm_pv_psp_cmd_pre_op(struct kvm_vpsp *vpsp, gpa_t data_gpa, 97 struct vpsp_hbuf_wrapper *hbuf) 98 { 99 int ret = 0; 100 void *data = NULL; 101 struct psp_cmdresp_head psp_head; 102 uint32_t data_size; 103 104 if (unlikely(vpsp->read_guest(vpsp->kvm, data_gpa, &psp_head, 105 sizeof(struct psp_cmdresp_head)))) 106 return -EFAULT; 107 108 data_size = psp_head.buf_size; 109 if (check_psp_mem_range(NULL, data_gpa, data_size)) 110 return -EFAULT; 111 112 data = kzalloc(data_size, GFP_KERNEL); 113 if (!data) 114 return -ENOMEM; 115 116 if (unlikely(vpsp->read_guest(vpsp->kvm, data_gpa, data, data_size))) { 117 ret = -EFAULT; 118 goto end; 119 } 120 121 hbuf->data = data; 122 hbuf->data_size = data_size; 123 124 end: 125 return ret; 126 } 127 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION a37b8248ed8becf3824d196a29847c2de17ad9a1
by kernel test robot 25 Sep '24

25 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: a37b8248ed8becf3824d196a29847c2de17ad9a1 !11722 Squashfs: sanity check symbolic link size Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | `-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20240924 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-002-20240924 | |-- drivers-tty-serial-sc16is7xx.c:warning:label-err_i2c-defined-but-not-used | |-- include-linux-uaccess.h:warning:ciov-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kmask-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:p-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:params-may-be-used-uninitialized |-- arm64-randconfig-003-20240924 | `-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay |-- arm64-randconfig-004-20240924 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- x86_64-buildonly-randconfig-001-20240925 | |-- arch-x86-kernel-unwind_orc.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-clk-renesas-rcar-gen3-cpg.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20240925 | |-- arch-x86-power-.tmp_cpu.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-gpio-gpio-phytium-core.c:warning:CONFIG_SMP-is-not-defined-evaluates-to | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20240925 | |-- drivers-i2c-busses-i2c-hisi.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-pci-hotplug-pciehp_core.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-004-20240925 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20240925 | |-- arch-x86-kernel-unwind_orc.o:warning:objtool:missing-symbol-for-section-.text | |-- arch-x86-power-cpu.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-scsi-scsi_logging.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-dir.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-group.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-sysfs-symlink.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-006-20240925 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-004-20240925 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-006-20240925 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-012-20240925 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-015-20240925 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-016-20240925 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-071-20240925 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity `-- x86_64-randconfig-161-20240924 `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity elapsed time: 728m configs tested: 31 configs skipped: 127 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240924 gcc-14.1.0 arm64 randconfig-002-20240924 gcc-14.1.0 arm64 randconfig-003-20240924 gcc-14.1.0 arm64 randconfig-004-20240924 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240925 clang-18 x86_64 buildonly-randconfig-002-20240925 clang-18 x86_64 buildonly-randconfig-003-20240925 gcc-12 x86_64 buildonly-randconfig-004-20240925 clang-18 x86_64 buildonly-randconfig-005-20240925 clang-18 x86_64 buildonly-randconfig-006-20240925 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240925 gcc-12 x86_64 randconfig-002-20240925 clang-18 x86_64 randconfig-003-20240925 gcc-12 x86_64 randconfig-004-20240925 gcc-12 x86_64 randconfig-005-20240925 clang-18 x86_64 randconfig-006-20240925 clang-18 x86_64 randconfig-011-20240925 clang-18 x86_64 randconfig-012-20240925 clang-18 x86_64 randconfig-013-20240925 clang-18 x86_64 randconfig-014-20240925 clang-18 x86_64 randconfig-015-20240925 clang-18 x86_64 randconfig-016-20240925 clang-18 x86_64 randconfig-071-20240925 gcc-12 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13559/14103] drivers/crypto/ccp/hygon/csv-dev.c:1009:5: warning: no previous prototype for 'vpsp_do_cmd'
by kernel test robot 25 Sep '24

25 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d25e57f47750555950b12145f98d5168319e6712 commit: 0195654dac59fc8953825bf947cd62040cc0c040 [13559/14103] drivers/crypto/ccp: remove multi-level pointers processing for vpsp config: x86_64-rhel-8.3 (https://download.01.org/0day-ci/archive/20240925/202409250431.vVzeCQ88-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240925/202409250431.vVzeCQ88-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409250431.vVzeCQ88-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/crypto/ccp/hygon/csv-dev.c:942:5: warning: no previous prototype for '__vpsp_do_cmd_locked' [-Wmissing-prototypes] 942 | int __vpsp_do_cmd_locked(uint32_t vid, int cmd, void *data, int *psp_ret) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/crypto/ccp/hygon/csv-dev.c:1009:5: warning: no previous prototype for 'vpsp_do_cmd' [-Wmissing-prototypes] 1009 | int vpsp_do_cmd(uint32_t vid, int cmd, void *data, int *psp_ret) | ^~~~~~~~~~~ vim +/vpsp_do_cmd +1009 drivers/crypto/ccp/hygon/csv-dev.c 1008 > 1009 int vpsp_do_cmd(uint32_t vid, int cmd, void *data, int *psp_ret) 1010 { 1011 int rc; 1012 int mutex_enabled = READ_ONCE(hygon_psp_hooks.psp_mutex_enabled); 1013 1014 if (is_vendor_hygon() && mutex_enabled) { 1015 if (psp_mutex_lock_timeout(&hygon_psp_hooks.psp_misc->data_pg_aligned->mb_mutex, 1016 PSP_MUTEX_TIMEOUT) != 1) { 1017 return -EBUSY; 1018 } 1019 } else { 1020 mutex_lock(hygon_psp_hooks.sev_cmd_mutex); 1021 } 1022 1023 rc = __vpsp_do_cmd_locked(vid, cmd, data, psp_ret); 1024 1025 if (is_vendor_hygon() && mutex_enabled) 1026 psp_mutex_unlock(&hygon_psp_hooks.psp_misc->data_pg_aligned->mb_mutex); 1027 else 1028 mutex_unlock(hygon_psp_hooks.sev_cmd_mutex); 1029 1030 return rc; 1031 } 1032 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13559/14103] drivers/crypto/ccp/hygon/csv-dev.c:1009:5: warning: no previous prototype for function 'vpsp_do_cmd'
by kernel test robot 25 Sep '24

25 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d25e57f47750555950b12145f98d5168319e6712 commit: 0195654dac59fc8953825bf947cd62040cc0c040 [13559/14103] drivers/crypto/ccp: remove multi-level pointers processing for vpsp config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20240925/202409250445.Ywn782u5-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240925/202409250445.Ywn782u5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409250445.Ywn782u5-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/crypto/ccp/hygon/csv-dev.c:942:5: warning: no previous prototype for function '__vpsp_do_cmd_locked' [-Wmissing-prototypes] 942 | int __vpsp_do_cmd_locked(uint32_t vid, int cmd, void *data, int *psp_ret) | ^ drivers/crypto/ccp/hygon/csv-dev.c:942:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 942 | int __vpsp_do_cmd_locked(uint32_t vid, int cmd, void *data, int *psp_ret) | ^ | static >> drivers/crypto/ccp/hygon/csv-dev.c:1009:5: warning: no previous prototype for function 'vpsp_do_cmd' [-Wmissing-prototypes] 1009 | int vpsp_do_cmd(uint32_t vid, int cmd, void *data, int *psp_ret) | ^ drivers/crypto/ccp/hygon/csv-dev.c:1009:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1009 | int vpsp_do_cmd(uint32_t vid, int cmd, void *data, int *psp_ret) | ^ | static 2 warnings generated. vim +/vpsp_do_cmd +1009 drivers/crypto/ccp/hygon/csv-dev.c 1008 > 1009 int vpsp_do_cmd(uint32_t vid, int cmd, void *data, int *psp_ret) 1010 { 1011 int rc; 1012 int mutex_enabled = READ_ONCE(hygon_psp_hooks.psp_mutex_enabled); 1013 1014 if (is_vendor_hygon() && mutex_enabled) { 1015 if (psp_mutex_lock_timeout(&hygon_psp_hooks.psp_misc->data_pg_aligned->mb_mutex, 1016 PSP_MUTEX_TIMEOUT) != 1) { 1017 return -EBUSY; 1018 } 1019 } else { 1020 mutex_lock(hygon_psp_hooks.sev_cmd_mutex); 1021 } 1022 1023 rc = __vpsp_do_cmd_locked(vid, cmd, data, psp_ret); 1024 1025 if (is_vendor_hygon() && mutex_enabled) 1026 psp_mutex_unlock(&hygon_psp_hooks.psp_misc->data_pg_aligned->mb_mutex); 1027 else 1028 mutex_unlock(hygon_psp_hooks.sev_cmd_mutex); 1029 1030 return rc; 1031 } 1032 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
by Long Li 24 Sep '24

24 Sep '24

From: Stefan Metzmacher <metze(a)samba.org> stable inclusion from stable-v6.6.48 commit a01859dd6aebf826576513850a3b05992809e9d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4DV CVE: CVE-2024-46686 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit c724b2ab6a46435b4e7d58ad2fbbdb7a318823cf upstream. This happens when called from SMB2_read() while using rdma and reaching the rdma_readwrite_threshold. Cc: stable(a)vger.kernel.org Fixes: a6559cc1d35d ("cifs: split out smb3_use_rdma_offload() helper") Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Stefan Metzmacher <metze(a)samba.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/client/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 61df8a5c6824..bf45b8652e58 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -4431,7 +4431,7 @@ smb2_new_read_req(void **buf, unsigned int *total_len, * If we want to do a RDMA write, fill in and append * smbd_buffer_descriptor_v1 to the end of read request */ - if (smb3_use_rdma_offload(io_parms)) { + if (rdata && smb3_use_rdma_offload(io_parms)) { struct smbd_buffer_descriptor_v1 *v1; bool need_invalidate = server->dialect == SMB30_PROT_ID; -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] arm64/mpam: Check mpam_detect_is_enabled() before accessing MPAM registers
by Zeng Heng 24 Sep '24

24 Sep '24

Zeng Heng (2): Revert "arm64: head.S: Initialise MPAM EL2 registers and disable traps" arm64/mpam: Check mpam_detect_is_enabled() before accessing MPAM registers arch/arm64/include/asm/cpufeature.h | 9 +++++++ arch/arm64/include/asm/el2_setup.h | 16 ------------ arch/arm64/kernel/cpufeature.c | 39 ++++++++++++++++++++++++++--- arch/arm64/kernel/cpuinfo.c | 1 + arch/arm64/kernel/mpam.c | 15 ++++++++--- 5 files changed, 56 insertions(+), 24 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] arm64/mpam: Check mpam_detect_is_enabled() before accessing MPAM registers
by Zeng Heng 24 Sep '24

24 Sep '24

Zeng Heng (2): Revert "arm64: head.S: Initialise MPAM EL2 registers and disable traps" arm64/mpam: Check mpam_detect_is_enabled() before accessing MPAM registers arch/arm64/include/asm/cpufeature.h | 9 +++++++ arch/arm64/include/asm/el2_setup.h | 16 ------------ arch/arm64/kernel/cpufeature.c | 39 ++++++++++++++++++++++++++--- arch/arm64/kernel/cpuinfo.c | 1 + arch/arm64/kernel/mpam.c | 15 ++++++++--- 5 files changed, 56 insertions(+), 24 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 00/13] arm64/perf: Enable branch stack sampling
by Junhao He 24 Sep '24

24 Sep '24

This series enables perf branch stack sampling support on arm64 platform via a new arch feature called Branch Record Buffer Extension (BRBE). All the relevant register definitions could be accessed here. https://developer.arm.com/documentation/ddi0601/2021-12/AArch64-Registers This series applies on 6.10-rc3. Also this series is being hosted below for quick access, review and test. https://git.gitlab.arm.com/linux-arm/linux-anshuman.git (brbe_v18) - Anshuman ========== Perf Branch Stack Sampling Support (arm64 platforms) =========== Currently arm64 platform does not support perf branch stack sampling. Hence any event requesting for branch stack records i.e PERF_SAMPLE_BRANCH_STACK marked in event->attr.sample_type, will be rejected in armpmu_event_init(). static int armpmu_event_init(struct perf_event *event) { ........ /* does not support taken branch sampling */ if (has_branch_stack(event)) return -EOPNOTSUPP; ........ } $perf record -j any,u,k ls Error: cycles:P: PMU Hardware or event type doesn't support branch stack sampling. -------------------- CONFIG_ARM64_BRBE and FEAT_BRBE ---------------------- After this series, perf branch stack sampling feature gets enabled on arm64 platforms where FEAT_BRBE HW feature is supported, and CONFIG_ARM64_BRBE is also selected during build. Let's observe all all possible scenarios here. 1. Feature not built (!CONFIG_ARM64_BRBE): Falls back to the current behaviour i.e event gets rejected. 2. Feature built but HW not supported (CONFIG_ARM64_BRBE && !FEAT_BRBE): Falls back to the current behaviour i.e event gets rejected. 3. Feature built and HW supported (CONFIG_ARM64_BRBE && FEAT_BRBE): Platform supports branch stack sampling requests. Let's observe through a simple example here. $perf record -j any_call,u,k,save_type ls [Please refer perf-record man pages for all possible branch filter options] $perf report -------------------------- Snip ---------------------- # Overhead Command Source Shared Object Source Symbol Target Symbol Basic Block Cycles # ........ ....... .................... ............................................ ............................................ .................. # 3.52% ls [kernel.kallsyms] [k] sched_clock_noinstr [k] arch_counter_get_cntpct 16 3.52% ls [kernel.kallsyms] [k] sched_clock [k] sched_clock_noinstr 9 1.85% ls [kernel.kallsyms] [k] sched_clock_cpu [k] sched_clock 5 1.80% ls [kernel.kallsyms] [k] irqtime_account_irq [k] sched_clock_cpu 20 1.58% ls [kernel.kallsyms] [k] gic_handle_irq [k] generic_handle_domain_irq 19 1.58% ls [kernel.kallsyms] [k] call_on_irq_stack [k] gic_handle_irq 9 1.58% ls [kernel.kallsyms] [k] do_interrupt_handler [k] call_on_irq_stack 23 1.58% ls [kernel.kallsyms] [k] generic_handle_domain_irq [k] __irq_resolve_mapping 6 1.58% ls [kernel.kallsyms] [k] __irq_resolve_mapping [k] __rcu_read_lock 10 -------------------------- Snip ---------------------- $perf report -D | grep cycles -------------------------- Snip ---------------------- ..... 1: ffff800080dd3334 -> ffff800080dd759c 39 cycles P 0 IND_CALL ..... 2: ffff800080ffaea0 -> ffff800080ffb688 16 cycles P 0 IND_CALL ..... 3: ffff800080139918 -> ffff800080ffae64 9 cycles P 0 CALL ..... 4: ffff800080dd3324 -> ffff8000801398f8 7 cycles P 0 CALL ..... 5: ffff8000800f8548 -> ffff800080dd330c 21 cycles P 0 IND_CALL ..... 6: ffff8000800f864c -> ffff8000800f84ec 6 cycles P 0 CALL ..... 7: ffff8000800f86dc -> ffff8000800f8638 11 cycles P 0 CALL ..... 8: ffff8000800f86d4 -> ffff800081008630 16 cycles P 0 CALL -------------------------- Snip ---------------------- perf script and other tooling can also be applied on the captured perf.data Similarly branch stack sampling records can be collected via direct system call i.e perf_event_open() method after setting 'struct perf_event_attr' as required. event->attr.sample_type |= PERF_SAMPLE_BRANCH_STACK event->attr.branch_sample_type |= PERF_SAMPLE_BRANCH_<FILTER_1> | PERF_SAMPLE_BRANCH_<FILTER_2> | PERF_SAMPLE_BRANCH_<FILTER_3> | ............................... But all branch filters might not be supported on the platform. ----------------------- BRBE Branch Filters Support ----------------------- - Following branch filters are supported on arm64. PERF_SAMPLE_BRANCH_USER /* Branch privilege filters */ PERF_SAMPLE_BRANCH_KERNEL PERF_SAMPLE_BRANCH_HV PERF_SAMPLE_BRANCH_ANY /* Branch type filters */ PERF_SAMPLE_BRANCH_ANY_CALL PERF_SAMPLE_BRANCH_ANY_RETURN PERF_SAMPLE_BRANCH_IND_CALL PERF_SAMPLE_BRANCH_COND PERF_SAMPLE_BRANCH_IND_JUMP PERF_SAMPLE_BRANCH_CALL PERF_SAMPLE_BRANCH_NO_FLAGS /* Branch record flags */ PERF_SAMPLE_BRANCH_NO_CYCLES PERF_SAMPLE_BRANCH_TYPE_SAVE PERF_SAMPLE_BRANCH_HW_INDEX PERF_SAMPLE_BRANCH_PRIV_SAVE - Following branch filters are not supported on arm64. PERF_SAMPLE_BRANCH_ABORT_TX PERF_SAMPLE_BRANCH_IN_TX PERF_SAMPLE_BRANCH_NO_TX PERF_SAMPLE_BRANCH_CALL_STACK Events requesting above non-supported branch filters get rejected. --------------------------- Virtualisation support ------------------------ - No guest support -------------------------------- Testing --------------------------------- - Cross compiled for both arm64 and arm32 platforms - Passes all branch tests with 'perf test branch' on arm64 Changes in V18: - Changed BRBIDR0_EL1 register fields CC and FORMAT, updated the commit message - Replaced BRBIDR0_EL1_FORMAT_0 as BRBIDR0_EL1_FORMAT_FORMAT_0 in BRBE driver - Dropped ifdef CONFIG_ARM64_BRBE around __init_el2_brbe() - Updated in code comment around __init_el2_brbe() - Dropped the write up for EL2->EL1 transition, also moved up the EL3 write up - Unconditionally capture branch record type and privilege information - Scan valid branch stack events in armpmu_start() to create merged filter - Dropped branch_sample_type override in armv8pmu_branch_stack_add() - Dropped branch filter mismatch between PMU and event in read_branch_records() - Added SW filtering framework in read_branch_records() during filter mismatch - Added SW filtering for privilege modes - Used host_data_ptr() to access host_debug_state.brbcr_el1 register - Changed DEBUG_STATE_SAVE_BRBE to use BIT(7) - Reverted back iflags as u8 https://lore.kernel.org/all/20240405024639.1179064-1-anshuman.khandual@arm.… Changes in V17: - Added back Reviewed-by tags from Mark Brown - Updated the commit message regarding the field BRBINFx_EL1_TYPE_IMPDEF_TRAP_EL3 - Added leading 0s for all values as BRBIDR0_EL1.NUMREC is a 8 bit field - Added leading 0s for all values as BRBFCR_EL1.BANK is a 2 bit field - Reordered BRBCR_EL1/BRBCR_EL12/BRBCR_EL2 registers as per sysreg encodings - Renamed s/FIRST/BANK_0 and s/SECOND/BANK_1 in BRBFCR_EL1.BANK - Renamed s/UNCOND_DIRECT/DIRECT_UNCOND in BRBINFx_EL1.TYPE - Renamed s/COND_DIRECT/DIRECT_COND in BRBINFx_EL1.TYPE - Dropped __SYS_BRBINF/__SYS_BRBSRC/__SYS_BRBTGT and their expansions - Moved all existing BRBE registers from sysreg.h header to tools/sysreg format - Updated the commit message including about sys_insn_descs[] - Changed KVM to use existing SYS_BRBSRC/TGT/INF_EL1(n) format - Moved the BRBE instructions into sys_insn_descs[] array - ARM PMUV3 changes have been moved into the BRBE driver patch instead - Moved down branch_stack_add() in armpmu_add() after event's basic checks - Added new callbacks in struct arm_pmu e.g branch_stack_[init|add|del]() - Renamed struct arm_pmu callback branch_reset() as branch_stack_reset() - Dropped the comment in armpmu_event_init() - Renamed 'pmu_hw_events' elements from 'brbe_' to more generic 'branch_' - Separated out from the BRBE driver implementation patch - Dropped the comment in __init_el2_brbe() - Updated __init_el2_brbe() with BRBCR_EL2.MPRED requirements - Updated __init_el2_brbe() with __check_hvhe() constructs - Updated booting.rst regarding MPRED, MDCR_EL3 and fine grained control - Dropped Documentation/arch/arm64/brbe.rst - Renamed armv8pmu_branch_reset() as armv8pmu_branch_stack_reset() - Separated out booting.rst and EL2 boot requirements into a new patch - Dropped process_branch_aborts() completely - Added an warning if transaction states get detected unexpectedly - Dropped enum brbe_bank_idx from the driver - Defined armv8pmu_branch_stack_init/add/del() callbacks in the driver - Changed BRBE driver to use existing SYS_BRBSRC/TGT/INF_EL1(n) format - Dropped isb() call sites in __debug_[save|restore]_brbe() - Changed to [read|write]_sysreg_el1() accessors in __debug_[save|restore]_brbe() Changes in V16 https://lore.kernel.org/all/20240125094119.2542332-1-anshuman.khandual@arm.… - Updated BRBINFx_EL1.TYPE = 0b110000 as field IMPDEF_TRAP_EL3 - Updated BRBCR_ELx[9] as field FZPSS - Updated BRBINFINJ_EL1 to use sysreg field BRBINFx_EL1 - Added BRB_INF_SRC_TGT_EL1 macro for corresponding BRB_[INF|SRC|TGT] expansion - Renamed arm_brbe.h as arm_pmuv3_branch.h - Updated perf_sample_save_brstack()'s new argument requirements with NULL - Fixed typo (s/informations/information) in Documentation/arch/arm64/brbe.rst - Added SPDX-License-Identifier in Documentation/arch/arm64/brbe.rst - Added new PERF_SAMPLE_BRANCH_COUNTERS into BRBE_EXCLUDE_BRANCH_FILTERS - Dropped BRBFCR_EL1 and BRBCR_EL1 from enum vcpu_sysreg - Reverted back the KVM NVHE patch - use host_debug_state based 'brbcr_el1' element and dropped the previous dependency on Jame's coresight series Changes in V15: https://lore.kernel.org/all/20231201053906.1261704-1-anshuman.khandual@arm.… - Added a comment for armv8pmu_branch_probe() regarding single cpu probe - Added a text in brbe.rst regarding single cpu probe - Dropped runtime BRBE enable for setting DEBUG_STATE_SAVE_BRBE - Dropped zero_branch_stack based zero branch records mechanism - Replaced BRBFCR_EL1_DEFAULT_CONFIG with BRBFCR_EL1_CONFIG_MASK - Added BRBFCR_EL1_CONFIG_MASK masking in branch_type_to_brbfcr() - Moved BRBE helpers from arm_brbe.h into arm_brbe.c - Moved armv8_pmu_xxx() declaration inside arm_brbe.h for arm64 (CONFIG_ARM64_BRBE) - Moved armv8_pmu_xxx() stub definitions inside arm_brbe.h for arm32 (!CONFIG_ARM64_BRBE) - Included arm_brbe.h header both in arm_pmuv3.c and arm_brbe.c - Dropped BRBE custom pr_fmt() - Dropped CONFIG_PERF_EVENTS wrapping from header entries - Flush branch records when a cpu bound event follows a task bound event - Dropped BRBFCR_EL1 from __debug_save_brbe()/__debug_restore_brbe() - Always save the live SYS_BRBCR_EL1 in host context and then check if BRBE was enabled before resetting SYS_BRBCR_EL1 for the host Changes in V14: https://lore.kernel.org/all/20231114051329.327572-1-anshuman.khandual@arm.c… - This series has been reorganised as suggested during V13 - There are just eight patches now i.e 5 enablement and 3 perf branch tests - Fixed brackets problem in __SYS_BRBINFO/BRBSRC/BRBTGT() macros - Renamed the macro i.e s/__SYS_BRBINFO/__SYS_BRBINF/ - Renamed s/BRB_IALL/BRB_IALL_INSN and s/BRBE_INJ/BRB_INJ_INSN - Moved BRB_IALL_INSN and SYS_BRB_INSN instructions to sysreg patch - Changed E1BRE as ExBRE in sysreg fields inside BRBCR_ELx - Used BRBCR_ELx for defining all BRBCR_EL1, BRBCR_EL2, and BRBCR_EL12 (new) - Folded the following three patches into a single patch i.e [PATCH 3/8] drivers: perf: arm_pmu: Add new sched_task() callback arm64/perf: Add branch stack support in struct arm_pmu arm64/perf: Add branch stack support in struct pmu_hw_events arm64/perf: Add branch stack support in ARMV8 PMU arm64/perf: Add PERF_ATTACH_TASK_DATA to events with has_branch_stack() - All armv8pmu_branch_xxxx() stub definitions have been moved inside include/linux/perf/arm_pmuv3.h for easy access from both arm32 and arm64 - Added brbe_users, brbe_context and brbe_sample_type in struct pmu_hw_events - Added comments for all the above new elements in struct pmu_hw_events - Added branch_reset() and sched_task() callbacks - Changed and optimized branch records processing during a PMU IRQ - NO branch records get captured for event with mismatched brbe_sample_type - Branch record context is tracked from armpmu_del() & armpmu_add() - Branch record hardware is driven from armv8pmu_start() & armv8pmu_stop() - Dropped NULL check for 'pmu_ctx' inside armv8pmu_sched_task() - Moved down PERF_ATTACH_TASK_DATA assignment with a preceding comment - In conflicting branch sample type requests, first event takes precedence - Folded the following five patches from V13 into a single patch i.e [PATCH 4/8] arm64/perf: Enable branch stack events via FEAT_BRBE arm64/perf: Add struct brbe_regset helper functions arm64/perf: Implement branch records save on task sched out arm64/perf: Implement branch records save on PMU IRQ - Fixed the year in copyright statement - Added Documentation/arch/arm64/brbe.rst - Updated Documentation/arch/arm64/booting.rst (BRBCR_EL2.CC for EL1 entry) - Added __init_el2_brbe() which enables branch record cycle count support - Disabled EL2 traps in __init_el2_fgt() while accessing BRBE registers and executing instructions - Changed CONFIG_ARM64_BRBE user visible description - Fixed a typo in CONFIG_ARM64_BRBE config option description text - Added BUILD_BUG_ON() co-relating BRBE_BANK_MAX_ENTRIES and MAX_BRANCH_RECORDS - Dropped arm64_create_brbe_task_ctx_kmem_cache() - Moved down comment for PERF_SAMPLE_BRANCH_KERNEL in branch_type_to_brbcr() - Renamed BRBCR_ELx_DEFAULT_CONFIG as BRBCR_ELx_CONFIG_MASK - Replaced BRBCR_ELx_DEFAULT_TS with BRBCR_ELx_TS_MASK in BRBCR_ELx_CONFIG_MASK - Replaced BRBCR_ELx_E1BRE instances with BRBCR_ELx_ExBRE - Added BRBE specific branch stack sampling perf test patches into the series - Added a patch to prevent guest accesses into BRBE registers and instructions - Added a patch to save the BRBE host context in NVHE environment - Updated most commit messages Changes in V13: https://lore.kernel.org/all/20230711082455.215983-1-anshuman.khandual@arm.c… https://lore.kernel.org/all/20230622065351.1092893-1-anshuman.khandual@arm.… - Added branch callback stubs for aarch32 pmuv3 based platforms - Updated the comments for capture_brbe_regset() - Deleted the comments in __read_brbe_regset() - Reversed the arguments order in capture_brbe_regset() and brbe_branch_save() - Fixed BRBE_BANK[0|1]_IDX_MAX indices comparison in armv8pmu_branch_read() - Fixed BRBE_BANK[0|1]_IDX_MAX indices comparison in capture_brbe_regset() Changes in V12: https://lore.kernel.org/all/20230615133239.442736-1-anshuman.khandual@arm.c… - Replaced branch types with complete DIRECT/INDIRECT prefixes/suffixes - Replaced branch types with complete INSN/ALIGN prefixes/suffixes - Replaced return branch types as simple RET/ERET - Replaced time field GST_PHYSICAL as GUEST_PHYSICAL - Added 0 padding for BRBIDR0_EL1.NUMREC enum values - Dropped helper arm_pmu_branch_stack_supported() - Renamed armv8pmu_branch_valid() as armv8pmu_branch_attr_valid() - Separated perf_task_ctx_cache setup from arm_pmu private allocation - Collected changes to branch_records_alloc() in a single patch [5/10] - Reworked and cleaned up branch_records_alloc() - Reworked armv8pmu_branch_read() with new loop iterations in patch [6/10] - Reworked capture_brbe_regset() with new loop iterations in patch [8/10] - Updated the comment in branch_type_to_brbcr() - Fixed the comment before stitch_stored_live_entries() - Fixed BRBINFINJ_EL1 definition for VALID_FULL enum field - Factored out helper __read_brbe_regset() from capture_brbe_regset() - Dropped the helper copy_brbe_regset() - Simplified stitch_stored_live_entries() with memcpy(), memmove() - Reworked armv8pmu_probe_pmu() to bail out early with !probe.present - Rework brbe_attributes_probe() without 'struct brbe_hw_attr' - Dropped 'struct brbe_hw_attr' argument from capture_brbe_regset() - Dropped 'struct brbe_hw_attr' argument from brbe_branch_save() - Dropped arm_pmu->private and added arm_pmu->reg_trbidr instead Changes in V11: https://lore.kernel.org/all/20230531040428.501523-1-anshuman.khandual@arm.c… - Fixed the crash for per-cpu events without event->pmu_ctx->task_ctx_data Changes in V10: https://lore.kernel.org/all/20230517022410.722287-1-anshuman.khandual@arm.c… - Rebased the series on v6.4-rc2 - Moved ARMV8 PMUV3 changes inside drivers/perf/arm_pmuv3.c - Moved BRBE driver changes inside drivers/perf/arm_brbe.[c|h] - Moved the WARN_ON() inside the if condition in armv8pmu_handle_irq() Changes in V9: https://lore.kernel.org/all/20230315051444.1683170-1-anshuman.khandual@arm.… - Fixed build problem with has_branch_stack() in arm64 header - BRBINF_EL1 definition has been changed from 'Sysreg' to 'SysregFields' - Renamed all BRBINF_EL1 call sites as BRBINFx_EL1 - Dropped static const char branch_filter_error_msg[] - Implemented a positive list check for BRBE supported perf branch filters - Added a comment in armv8pmu_handle_irq() - Implemented per-cpu allocation for struct branch_record records - Skipped looping through bank 1 if an invalid record is detected in bank 0 - Added comment in armv8pmu_branch_read() explaining prohibited region etc - Added comment warning about erroneously marking transactions as aborted - Replaced the first argument (perf_branch_entry) in capture_brbe_flags() - Dropped the last argument (idx) in capture_brbe_flags() - Dropped the brbcr argument from capture_brbe_flags() - Used perf_sample_save_brstack() to capture branch records for perf_sample_data - Added comment explaining rationale for setting BRBCR_EL1_FZP for user only traces - Dropped BRBE prohibited state mechanism while in armv8pmu_branch_read() - Implemented event task context based branch records save mechanism Changes in V8: https://lore.kernel.org/all/20230123125956.1350336-1-anshuman.khandual@arm.… - Replaced arm_pmu->features as arm_pmu->has_branch_stack, updated its helper - Added a comment and line break before arm_pmu->private element - Added WARN_ON_ONCE() in helpers i.e armv8pmu_branch_[read|valid|enable|disable]() - Dropped comments in armv8pmu_enable_event() and armv8pmu_disable_event() - Replaced open bank encoding in BRBFCR_EL1 with SYS_FIELD_PREP() - Changed brbe_hw_attr->brbe_version from 'bool' to 'int' - Updated pr_warn() as pr_warn_once() with values in brbe_get_perf_[type|priv]() - Replaced all pr_warn_once() as pr_debug_once() in armv8pmu_branch_valid() - Added a comment in branch_type_to_brbcr() for the BRBCR_EL1 privilege settings - Modified the comment related to BRBINFx_EL1.LASTFAILED in capture_brbe_flags() - Modified brbe_get_perf_entry_type() as brbe_set_perf_entry_type() - Renamed brbe_valid() as brbe_record_is_complete() - Renamed brbe_source() as brbe_record_is_source_only() - Renamed brbe_target() as brbe_record_is_target_only() - Inverted checks for !brbe_record_is_[target|source]_only() for info capture - Replaced 'fetch' with 'get' in all helpers that extract field value - Dropped 'static int brbe_current_bank' optimization in select_brbe_bank() - Dropped select_brbe_bank_index() completely, added capture_branch_entry() - Process captured branch entries in two separate loops one for each BRBE bank - Moved branch_records_alloc() inside armv8pmu_probe_pmu() - Added a forward declaration for the helper has_branch_stack() - Added new callbacks armv8pmu_private_alloc() and armv8pmu_private_free() - Updated armv8pmu_probe_pmu() to allocate the private structure before SMP call Changes in V7: https://lore.kernel.org/all/20230105031039.207972-1-anshuman.khandual@arm.c… - Folded [PATCH 7/7] into [PATCH 3/7] which enables branch stack sampling event - Defined BRBFCR_EL1_BRANCH_FILTERS, BRBCR_EL1_DEFAULT_CONFIG in the header - Defined BRBFCR_EL1_DEFAULT_CONFIG in the header - Updated BRBCR_EL1_DEFAULT_CONFIG with BRBCR_EL1_FZP - Defined BRBCR_EL1_DEFAULT_TS in the header - Updated BRBCR_EL1_DEFAULT_CONFIG with BRBCR_EL1_DEFAULT_TS - Moved BRBCR_EL1_DEFAULT_CONFIG check inside branch_type_to_brbcr() - Moved down BRBCR_EL1_CC, BRBCR_EL1_MPRED later in branch_type_to_brbcr() - Also set BRBE in paused state in armv8pmu_branch_disable() - Dropped brbe_paused(), set_brbe_paused() helpers - Extracted error string via branch_filter_error_msg[] for armv8pmu_branch_valid() - Replaced brbe_v1p1 with brbe_version in struct brbe_hw_attr - Added valid_brbe_[cc, format, version]() helpers - Split a separate brbe_attributes_probe() from armv8pmu_branch_probe() - Capture event->attr.branch_sample_type earlier in armv8pmu_branch_valid() - Defined enum brbe_bank_idx with possible values for BRBE bank indices - Changed armpmu->hw_attr into armpmu->private - Added missing space in stub definition for armv8pmu_branch_valid() - Replaced both kmalloc() with kzalloc() - Added BRBE_BANK_MAX_ENTRIES - Updated comment for capture_brbe_flags() - Updated comment for struct brbe_hw_attr - Dropped space after type cast in couple of places - Replaced inverse with negation for testing BRBCR_EL1_FZP in armv8pmu_branch_read() - Captured cpuc->branches->branch_entries[idx] in a local variable - Dropped saved_priv from armv8pmu_branch_read() - Reorganize PERF_SAMPLE_BRANCH_NO_[CYCLES|NO_FLAGS] related configuration - Replaced with FIELD_GET() and FIELD_PREP() wherever applicable - Replaced BRBCR_EL1_TS_PHYSICAL with BRBCR_EL1_TS_VIRTUAL - Moved valid_brbe_nr(), valid_brbe_cc(), valid_brbe_format(), valid_brbe_version() select_brbe_bank(), select_brbe_bank_index() helpers inside the C implementation - Reorganized brbe_valid_nr() and dropped the pr_warn() message - Changed probe sequence in brbe_attributes_probe() - Added 'brbcr' argument into capture_brbe_flags() to ascertain correct state - Disable BRBE before disabling the PMU event counter - Enable PERF_SAMPLE_BRANCH_HV filters when is_kernel_in_hyp_mode() - Guard armv8pmu_reset() & armv8pmu_sched_task() with arm_pmu_branch_stack_supported() Changes in V6: https://lore.kernel.org/linux-arm-kernel/20221208084402.863310-1-anshuman.k… - Restore the exception level privilege after reading the branch records - Unpause the buffer after reading the branch records - Decouple BRBCR_EL1_EXCEPTION/ERTN from perf event privilege level - Reworked BRBE implementation and branch stack sampling support on arm pmu - BRBE implementation is now part of overall ARMV8 PMU implementation - BRBE implementation moved from drivers/perf/ to inside arch/arm64/kernel/ - CONFIG_ARM_BRBE_PMU renamed as CONFIG_ARM64_BRBE in arch/arm64/Kconfig - File moved - drivers/perf/arm_pmu_brbe.c -> arch/arm64/kernel/brbe.c - File moved - drivers/perf/arm_pmu_brbe.h -> arch/arm64/kernel/brbe.h - BRBE name has been dropped from struct arm_pmu and struct hw_pmu_events - BRBE name has been abstracted out as 'branches' in arm_pmu and hw_pmu_events - BRBE name has been abstracted out as 'branches' in ARMV8 PMU implementation - Added sched_task() callback into struct arm_pmu - Added 'hw_attr' into struct arm_pmu encapsulating possible PMU HW attributes - Dropped explicit attributes brbe_(v1p1, nr, cc, format) from struct arm_pmu - Dropped brbfcr, brbcr, registers scratch area from struct hw_pmu_events - Dropped brbe_users, brbe_context tracking in struct hw_pmu_events - Added 'features' tracking into struct arm_pmu with ARM_PMU_BRANCH_STACK flag - armpmu->hw_attr maps into 'struct brbe_hw_attr' inside BRBE implementation - Set ARM_PMU_BRANCH_STACK in 'arm_pmu->features' after successful BRBE probe - Added armv8pmu_branch_reset() inside armv8pmu_branch_enable() - Dropped brbe_supported() as events will be rejected via ARM_PMU_BRANCH_STACK - Dropped set_brbe_disabled() as well - Reformated armv8pmu_branch_valid() warnings while rejecting unsupported events Changes in V5: https://lore.kernel.org/linux-arm-kernel/20221107062514.2851047-1-anshuman.… - Changed BRBCR_EL1.VIRTUAL from 0b1 to 0b01 - Changed BRBFCR_EL1.EnL into BRBFCR_EL1.EnI - Changed config ARM_BRBE_PMU from 'tristate' to 'bool' Changes in V4: https://lore.kernel.org/all/20221017055713.451092-1-anshuman.khandual@arm.c… - Changed ../tools/sysreg declarations as suggested - Set PERF_SAMPLE_BRANCH_STACK in data.sample_flags - Dropped perfmon_capable() check in armpmu_event_init() - s/pr_warn_once/pr_info in armpmu_event_init() - Added brbe_format element into struct pmu_hw_events - Changed v1p1 as brbe_v1p1 in struct pmu_hw_events - Dropped pr_info() from arm64_pmu_brbe_probe(), solved LOCKDEP warning Changes in V3: https://lore.kernel.org/all/20220929075857.158358-1-anshuman.khandual@arm.c… - Moved brbe_stack from the stack and now dynamically allocated - Return PERF_BR_PRIV_UNKNOWN instead of -1 in brbe_fetch_perf_priv() - Moved BRBIDR0, BRBCR, BRBFCR registers and fields into tools/sysreg - Created dummy BRBINF_EL1 field definitions in tools/sysreg - Dropped ARMPMU_EVT_PRIV framework which cached perfmon_capable() - Both exception and exception return branche records are now captured only if the event has PERF_SAMPLE_BRANCH_KERNEL which would already been checked in generic perf via perf_allow_kernel() Changes in V2: https://lore.kernel.org/all/20220908051046.465307-1-anshuman.khandual@arm.c… - Dropped branch sample filter helpers consolidation patch from this series - Added new hw_perf_event.flags element ARMPMU_EVT_PRIV to cache perfmon_capable() - Use cached perfmon_capable() while configuring BRBE branch record filters Changes in V1: https://lore.kernel.org/linux-arm-kernel/20220613100119.684673-1-anshuman.k… - Added CONFIG_PERF_EVENTS wrapper for all branch sample filter helpers - Process new perf branch types via PERF_BR_EXTEND_ABI Changes in RFC V2: https://lore.kernel.org/linux-arm-kernel/20220412115455.293119-1-anshuman.k… - Added branch_sample_priv() while consolidating other branch sample filter helpers - Changed all SYS_BRBXXXN_EL1 register definition encodings per Marc - Changed the BRBE driver as per proposed BRBE related perf ABI changes (V5) - Added documentation for struct arm_pmu changes, updated commit message - Updated commit message for BRBE detection infrastructure patch - PERF_SAMPLE_BRANCH_KERNEL gets checked during arm event init (outside the driver) - Branch privilege state capture mechanism has now moved inside the driver Changes in RFC V1: https://lore.kernel.org/all/1642998653-21377-1-git-send-email-anshuman.khan… Anshuman Khandual (6): arm64/sysreg: Add BRBE registers and fields KVM: arm64: Explicitly handle BRBE traps as UNDEFINED drivers: perf: arm_pmu: Add infrastructure for branch stack sampling arm64/boot: Enable EL2 requirements for BRBE drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE KVM: arm64: nvhe: Disable branch generation in nVHE guests James Clark (3): perf: test: Speed up running brstack test on an Arm model perf: test: Remove empty lines from branch filter test output perf: test: Extend branch stack sampling test for Arm64 BRBE Marc Zyngier (2): KVM: arm64: nv: Drop VCPU_HYP_CONTEXT flag KVM: arm64: Fix TRFCR_EL1/PMSCR_EL1 access in hVHE mode Miguel Luis (2): arm64: Add missing _EL12 encodings arm64: Add missing _EL2 encodings Documentation/arch/arm64/booting.rst | 21 + arch/arm64/include/asm/el2_setup.h | 87 +- arch/arm64/include/asm/kvm_host.h | 5 +- arch/arm64/include/asm/sysreg.h | 55 +- arch/arm64/kvm/debug.c | 5 + arch/arm64/kvm/hyp/nvhe/debug-sr.c | 43 +- arch/arm64/kvm/hyp/vhe/switch.c | 7 +- arch/arm64/kvm/sys_regs.c | 56 ++ arch/arm64/tools/sysreg | 131 +++ drivers/perf/Kconfig | 11 + drivers/perf/Makefile | 1 + drivers/perf/arm_brbe.c | 1198 ++++++++++++++++++++++++ drivers/perf/arm_pmu.c | 42 +- drivers/perf/arm_pmuv3.c | 160 +++- drivers/perf/arm_pmuv3_branch.h | 83 ++ include/linux/perf/arm_pmu.h | 37 +- tools/perf/tests/builtin-test.c | 1 + tools/perf/tests/shell/test_brstack.sh | 57 +- tools/perf/tests/tests.h | 1 + tools/perf/tests/workloads/Build | 2 + tools/perf/tests/workloads/traploop.c | 39 + 21 files changed, 2006 insertions(+), 36 deletions(-) create mode 100644 drivers/perf/arm_brbe.c create mode 100644 drivers/perf/arm_pmuv3_branch.h create mode 100644 tools/perf/tests/workloads/traploop.c -- 2.33.0

2 14

[PATCH openEuler-1.0-LTS 0/1] irqchip/mbigen: Fix mbigen node address layout
by Yuntao Liu 24 Sep '24

24 Sep '24

irqchip/mbigen: Fix mbigen node address layout Yipeng Zou (1): irqchip/mbigen: Fix mbigen node address layout drivers/irqchip/irq-mbigen.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] driver: iio: add missing checks on iio_info's callback access
by Cui GaoSheng 24 Sep '24

24 Sep '24

From: Julien Stephan <jstephan(a)baylibre.com> stable inclusion from stable-v6.6.50 commit 72f022ebb9deac28663fa4c04ba315ed5d6654d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV1X CVE: CVE-2024-46715 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c4ec8dedca961db056ec85cb7ca8c9f7e2e92252 ] Some callbacks from iio_info structure are accessed without any check, so if a driver doesn't implement them trying to access the corresponding sysfs entries produce a kernel oops such as: [ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute [...] [ 2203.783416] Call trace: [ 2203.783429] iio_read_channel_info_avail from dev_attr_show+0x18/0x48 [ 2203.789807] dev_attr_show from sysfs_kf_seq_show+0x90/0x120 [ 2203.794181] sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4 [ 2203.798555] seq_read_iter from vfs_read+0x238/0x2a0 [ 2203.802236] vfs_read from ksys_read+0xa4/0xd4 [ 2203.805385] ksys_read from ret_fast_syscall+0x0/0x54 [ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0) [ 2203.812880] dfa0: 00000003 b6f10f80 00000003 b6eab000 00020000 00000000 [ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000 [ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0 [ 2203.830363] Code: bad PC value [ 2203.832695] ---[ end trace 0000000000000000 ]--- Reviewed-by: Nuno Sa <nuno.sa(a)analog.com> Signed-off-by: Julien Stephan <jstephan(a)baylibre.com> Link: https://lore.kernel.org/r/20240530-iio-core-fix-segfault-v3-1-8b7cd2a03773@… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/iio/industrialio-core.c | 7 ++++++- drivers/iio/industrialio-event.c | 9 +++++++++ drivers/iio/inkern.c | 32 ++++++++++++++++++++++---------- 3 files changed, 37 insertions(+), 11 deletions(-) diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c index 5e1a85ca1211..121bde49ccb7 100644 --- a/drivers/iio/industrialio-core.c +++ b/drivers/iio/industrialio-core.c @@ -752,9 +752,11 @@ static ssize_t iio_read_channel_info(struct device *dev, INDIO_MAX_RAW_ELEMENTS, vals, &val_len, this_attr->address); - else + else if (indio_dev->info->read_raw) ret = indio_dev->info->read_raw(indio_dev, this_attr->c, &vals[0], &vals[1], this_attr->address); + else + return -EINVAL; if (ret < 0) return ret; @@ -836,6 +838,9 @@ static ssize_t iio_read_channel_info_avail(struct device *dev, int length; int type; + if (!indio_dev->info->read_avail) + return -EINVAL; + ret = indio_dev->info->read_avail(indio_dev, this_attr->c, &vals, &type, &length, this_attr->address); diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c index 19f7a91157ee..f67e4afa5f94 100644 --- a/drivers/iio/industrialio-event.c +++ b/drivers/iio/industrialio-event.c @@ -285,6 +285,9 @@ static ssize_t iio_ev_state_store(struct device *dev, if (ret < 0) return ret; + if (!indio_dev->info->write_event_config) + return -EINVAL; + ret = indio_dev->info->write_event_config(indio_dev, this_attr->c, iio_ev_attr_type(this_attr), iio_ev_attr_dir(this_attr), val); @@ -300,6 +303,9 @@ static ssize_t iio_ev_state_show(struct device *dev, struct iio_dev_attr *this_attr = to_iio_dev_attr(attr); int val; + if (!indio_dev->info->read_event_config) + return -EINVAL; + val = indio_dev->info->read_event_config(indio_dev, this_attr->c, iio_ev_attr_type(this_attr), iio_ev_attr_dir(this_attr)); @@ -318,6 +324,9 @@ static ssize_t iio_ev_value_show(struct device *dev, int val, val2, val_arr[2]; int ret; + if (!indio_dev->info->read_event_value) + return -EINVAL; + ret = indio_dev->info->read_event_value(indio_dev, this_attr->c, iio_ev_attr_type(this_attr), iio_ev_attr_dir(this_attr), iio_ev_attr_info(this_attr), diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c index 7a1f6713318a..b85556538475 100644 --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -562,6 +562,7 @@ EXPORT_SYMBOL_GPL(devm_iio_channel_get_all); static int iio_channel_read(struct iio_channel *chan, int *val, int *val2, enum iio_chan_info_enum info) { + const struct iio_info *iio_info = chan->indio_dev->info; int unused; int vals[INDIO_MAX_RAW_ELEMENTS]; int ret; @@ -573,15 +574,18 @@ static int iio_channel_read(struct iio_channel *chan, int *val, int *val2, if (!iio_channel_has_info(chan->channel, info)) return -EINVAL; - if (chan->indio_dev->info->read_raw_multi) { - ret = chan->indio_dev->info->read_raw_multi(chan->indio_dev, - chan->channel, INDIO_MAX_RAW_ELEMENTS, - vals, &val_len, info); + if (iio_info->read_raw_multi) { + ret = iio_info->read_raw_multi(chan->indio_dev, + chan->channel, + INDIO_MAX_RAW_ELEMENTS, + vals, &val_len, info); *val = vals[0]; *val2 = vals[1]; + } else if (iio_info->read_raw) { + ret = iio_info->read_raw(chan->indio_dev, + chan->channel, val, val2, info); } else { - ret = chan->indio_dev->info->read_raw(chan->indio_dev, - chan->channel, val, val2, info); + return -EINVAL; } return ret; @@ -801,11 +805,15 @@ static int iio_channel_read_avail(struct iio_channel *chan, const int **vals, int *type, int *length, enum iio_chan_info_enum info) { + const struct iio_info *iio_info = chan->indio_dev->info; + if (!iio_channel_has_available(chan->channel, info)) return -EINVAL; - return chan->indio_dev->info->read_avail(chan->indio_dev, chan->channel, - vals, type, length, info); + if (iio_info->read_avail) + return iio_info->read_avail(chan->indio_dev, chan->channel, + vals, type, length, info); + return -EINVAL; } int iio_read_avail_channel_attribute(struct iio_channel *chan, @@ -995,8 +1003,12 @@ EXPORT_SYMBOL_GPL(iio_get_channel_type); static int iio_channel_write(struct iio_channel *chan, int val, int val2, enum iio_chan_info_enum info) { - return chan->indio_dev->info->write_raw(chan->indio_dev, - chan->channel, val, val2, info); + const struct iio_info *iio_info = chan->indio_dev->info; + + if (iio_info->write_raw) + return iio_info->write_raw(chan->indio_dev, + chan->channel, val, val2, info); + return -EINVAL; } int iio_write_channel_attribute(struct iio_channel *chan, int val, int val2, -- 2.34.1

2 1

[PATCH OLK-5.10] driver: iio: add missing checks on iio_info's callback access
by Cui GaoSheng 24 Sep '24

24 Sep '24

From: Julien Stephan <jstephan(a)baylibre.com> stable inclusion from stable-v6.1.109 commit 0cc7e0ee31e5c44904e98e2229d591e093282a70 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV1X CVE: CVE-2024-46715 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c4ec8dedca961db056ec85cb7ca8c9f7e2e92252 ] Some callbacks from iio_info structure are accessed without any check, so if a driver doesn't implement them trying to access the corresponding sysfs entries produce a kernel oops such as: [ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute [...] [ 2203.783416] Call trace: [ 2203.783429] iio_read_channel_info_avail from dev_attr_show+0x18/0x48 [ 2203.789807] dev_attr_show from sysfs_kf_seq_show+0x90/0x120 [ 2203.794181] sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4 [ 2203.798555] seq_read_iter from vfs_read+0x238/0x2a0 [ 2203.802236] vfs_read from ksys_read+0xa4/0xd4 [ 2203.805385] ksys_read from ret_fast_syscall+0x0/0x54 [ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0) [ 2203.812880] dfa0: 00000003 b6f10f80 00000003 b6eab000 00020000 00000000 [ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000 [ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0 [ 2203.830363] Code: bad PC value [ 2203.832695] ---[ end trace 0000000000000000 ]--- Reviewed-by: Nuno Sa <nuno.sa(a)analog.com> Signed-off-by: Julien Stephan <jstephan(a)baylibre.com> Link: https://lore.kernel.org/r/20240530-iio-core-fix-segfault-v3-1-8b7cd2a03773@… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/iio/inkern.c [ Context conflicts with commit 110f11589c8777. ] Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/iio/industrialio-core.c | 7 ++++++- drivers/iio/industrialio-event.c | 9 ++++++++ drivers/iio/inkern.c | 35 ++++++++++++++++++++++---------- 3 files changed, 39 insertions(+), 12 deletions(-) diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c index ea98aad9fb81..b57461731718 100644 --- a/drivers/iio/industrialio-core.c +++ b/drivers/iio/industrialio-core.c @@ -684,9 +684,11 @@ static ssize_t iio_read_channel_info(struct device *dev, INDIO_MAX_RAW_ELEMENTS, vals, &val_len, this_attr->address); - else + else if (indio_dev->info->read_raw) ret = indio_dev->info->read_raw(indio_dev, this_attr->c, &vals[0], &vals[1], this_attr->address); + else + return -EINVAL; if (ret < 0) return ret; @@ -791,6 +793,9 @@ static ssize_t iio_read_channel_info_avail(struct device *dev, int length; int type; + if (!indio_dev->info->read_avail) + return -EINVAL; + ret = indio_dev->info->read_avail(indio_dev, this_attr->c, &vals, &type, &length, this_attr->address); diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c index 99ba657b8568..8720b86d8834 100644 --- a/drivers/iio/industrialio-event.c +++ b/drivers/iio/industrialio-event.c @@ -274,6 +274,9 @@ static ssize_t iio_ev_state_store(struct device *dev, if (ret < 0) return ret; + if (!indio_dev->info->write_event_config) + return -EINVAL; + ret = indio_dev->info->write_event_config(indio_dev, this_attr->c, iio_ev_attr_type(this_attr), iio_ev_attr_dir(this_attr), val); @@ -289,6 +292,9 @@ static ssize_t iio_ev_state_show(struct device *dev, struct iio_dev_attr *this_attr = to_iio_dev_attr(attr); int val; + if (!indio_dev->info->read_event_config) + return -EINVAL; + val = indio_dev->info->read_event_config(indio_dev, this_attr->c, iio_ev_attr_type(this_attr), iio_ev_attr_dir(this_attr)); @@ -307,6 +313,9 @@ static ssize_t iio_ev_value_show(struct device *dev, int val, val2, val_arr[2]; int ret; + if (!indio_dev->info->read_event_value) + return -EINVAL; + ret = indio_dev->info->read_event_value(indio_dev, this_attr->c, iio_ev_attr_type(this_attr), iio_ev_attr_dir(this_attr), iio_ev_attr_info(this_attr), diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c index c32b2577dd99..746e05dd899d 100644 --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -500,6 +500,7 @@ EXPORT_SYMBOL_GPL(devm_iio_channel_get_all); static int iio_channel_read(struct iio_channel *chan, int *val, int *val2, enum iio_chan_info_enum info) { + const struct iio_info *iio_info = chan->indio_dev->info; int unused; int vals[INDIO_MAX_RAW_ELEMENTS]; int ret; @@ -511,15 +512,19 @@ static int iio_channel_read(struct iio_channel *chan, int *val, int *val2, if (!iio_channel_has_info(chan->channel, info)) return -EINVAL; - if (chan->indio_dev->info->read_raw_multi) { - ret = chan->indio_dev->info->read_raw_multi(chan->indio_dev, - chan->channel, INDIO_MAX_RAW_ELEMENTS, - vals, &val_len, info); + if (iio_info->read_raw_multi) { + ret = iio_info->read_raw_multi(chan->indio_dev, + chan->channel, + INDIO_MAX_RAW_ELEMENTS, + vals, &val_len, info); *val = vals[0]; *val2 = vals[1]; - } else - ret = chan->indio_dev->info->read_raw(chan->indio_dev, - chan->channel, val, val2, info); + } else if (iio_info->read_raw) { + ret = iio_info->read_raw(chan->indio_dev, + chan->channel, val, val2, info); + } else { + return -EINVAL; + } return ret; } @@ -720,11 +725,15 @@ static int iio_channel_read_avail(struct iio_channel *chan, const int **vals, int *type, int *length, enum iio_chan_info_enum info) { + const struct iio_info *iio_info = chan->indio_dev->info; + if (!iio_channel_has_available(chan->channel, info)) return -EINVAL; - return chan->indio_dev->info->read_avail(chan->indio_dev, chan->channel, - vals, type, length, info); + if (iio_info->read_avail) + return iio_info->read_avail(chan->indio_dev, chan->channel, + vals, type, length, info); + return -EINVAL; } int iio_read_avail_channel_attribute(struct iio_channel *chan, @@ -852,8 +861,12 @@ EXPORT_SYMBOL_GPL(iio_get_channel_type); static int iio_channel_write(struct iio_channel *chan, int val, int val2, enum iio_chan_info_enum info) { - return chan->indio_dev->info->write_raw(chan->indio_dev, - chan->channel, val, val2, info); + const struct iio_info *iio_info = chan->indio_dev->info; + + if (iio_info->write_raw) + return iio_info->write_raw(chan->indio_dev, + chan->channel, val, val2, info); + return -EINVAL; } int iio_write_channel_attribute(struct iio_channel *chan, int val, int val2, -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] A group of optimization and bug fix for numa-affinity
by Nanyong Sun 24 Sep '24

24 Sep '24

A group of optimization and bug fix for numa-affinity. Nanyong Sun (5): mm: thp: support to control numa migration mm: numa-affinity: add helper numa_affinity_sampling_enabled() mm: numa-affinity: adapt for should_numa_migrate_memory mm: numa-affinity: adapt for task_numa_placement mm: numa-affinity: fix build error when !CONFIG_PROC_SYSCTL Documentation/admin-guide/mm/transhuge.rst | 8 ++++++ arch/arm64/Kconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/huge_mm.h | 13 +++++++++ include/linux/mem_sampling.h | 13 +++++++++ kernel/sched/fair.c | 30 ++++++++++++++------ mm/Kconfig | 10 +++++++ mm/huge_memory.c | 33 ++++++++++++++++++++++ mm/mem_sampling.c | 4 --- mm/migrate.c | 3 ++ 11 files changed, 105 insertions(+), 12 deletions(-) -- 2.33.0

2 6

[openeuler:OLK-5.10 16261/30000] drivers/video/fbdev/ls2k500sfb.c:244: undefined reference to `fg_console'
by kernel test robot 24 Sep '24

24 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ec708b533135368027cf0b97c4d1abf6950e86db commit: d74f3b70d73220d919db010ec1c81aa1d89082b6 [16261/30000] fbdev: add ls2k500sfb driver for ls2k500 bmc. config: x86_64-randconfig-074-20240924 (https://download.01.org/0day-ci/archive/20240924/202409241851.FLydbyQT-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240924/202409241851.FLydbyQT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409241851.FLydbyQT-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/video/fbdev/ls2k500sfb.o: in function `ls2k500sfb_events_fn': >> drivers/video/fbdev/ls2k500sfb.c:244: undefined reference to `fg_console' >> ld: drivers/video/fbdev/ls2k500sfb.c:244: undefined reference to `fg_console' >> ld: drivers/video/fbdev/ls2k500sfb.c:244: undefined reference to `fg_console' vim +244 drivers/video/fbdev/ls2k500sfb.c 110 111 static void ls2k500sfb_events_fn(struct work_struct *work) 112 { 113 struct ls2k500sfb_struct *priv = container_of(work, struct ls2k500sfb_struct, work); 114 struct pci_dev *pdev = priv->dev; 115 struct pci_dev *ppdev = pdev->bus->self; 116 uint32_t i, d, timeout, retry = 0; 117 static const uint32_t index[] = { 118 0x10, 0x14, 0x18, 0x1c, 0x20, 0x24, 0x30, 0x3c, 0x54, 0x58, 0x78, 0x7c, 0x80, 4 119 }; 120 121 static uint32_t data[sizeof(index) / 4]; 122 static const uint32_t cindex[] = { 0x10, 0x3c, 4 }; 123 124 static uint32_t cdata[sizeof(cindex) / 4]; 125 static uint32_t d80c, d71c, ctrl; 126 static void *p; 127 128 if (!priv->running) { 129 for (i = 0; i < ARRAY_SIZE(index); i++) 130 pci_read_config_dword(ppdev, index[i], &data[i]); 131 for (i = 0; i < ARRAY_SIZE(cindex); i++) 132 pci_read_config_dword(pdev, cindex[i], &cdata[i]); 133 if (ppdev->vendor == 0x14) { 134 pci_read_config_dword(ppdev, 0x80c, &d80c); 135 d80c = (d80c & ~(3 << 17)) | (1 << 17); 136 137 pci_read_config_dword(ppdev, 0x71c, &d71c); 138 d71c |= 1 << 26; 139 140 p = pci_iomap(ppdev, 0, 0x100); 141 } 142 ctrl = readl(p); 143 return; 144 } 145 local_bh_disable(); 146 pciebreak_smp_send_stop(100); 147 wmb(); /* flush all write before we disable pcie window */ 148 pci_write_config_dword(ppdev, 0x18, 0); 149 pci_write_config_dword(ppdev, 0x1c, 0); 150 pci_write_config_dword(ppdev, 0x20, 0); 151 atomic_set(&waiting_for_pciebreak_ipi, 0); 152 wmb(); /* flush all write after change pcie window */ 153 local_bh_enable(); 154 if (ppdev->vendor == 0x14) { 155 timeout = 10000; 156 while (timeout) { 157 pci_read_config_dword(ppdev, 0x10, &d); 158 d &= ~0xf; 159 if (!d) 160 break; 161 mdelay(1); 162 timeout--; 163 }; 164 if (!timeout) 165 pr_info("bar not clear 0\n"); 166 167 pci_read_config_dword(ppdev, 0x0, &d); 168 pr_info("pcie port deviceid=0x%x recover begin\n", d); 169 retrain: 170 while (1) { 171 pci_write_config_dword(ppdev, index[0], data[0]); 172 pci_read_config_dword(ppdev, index[0], &d); 173 d &= ~0xf; 174 if (d) 175 break; 176 mdelay(1); 177 } 178 179 while (1) { 180 for (i = 0; i < ARRAY_SIZE(index); i++) { 181 if (index[i] != 0x18 && index[i] != 0x1c && index[i] != 0x20) 182 pci_write_config_dword(ppdev, index[i], data[i]); 183 } 184 pci_write_config_dword(ppdev, 0x80c, d80c); 185 pci_write_config_dword(ppdev, 0x71c, d71c); 186 187 pci_read_config_dword(ppdev, 0x10, &d); 188 d &= ~0xf; 189 if (d) 190 break; 191 mdelay(1); 192 } 193 194 timeout = 10000; 195 196 writel(ctrl | 0x8, p); 197 while (1) { 198 d = readl(p + 0xc); 199 if ((d & 0x11) == 0x11) { 200 break; 201 } else if (!timeout) { 202 pr_info("pcie train failed status=0x%x\n", d); 203 goto out; 204 } 205 mdelay(1); 206 timeout--; 207 } 208 209 210 pr_info("pcie recovered done\n"); 211 212 if (!retry) { 213 /*wait u-boot ddr config */ 214 set_current_state(TASK_UNINTERRUPTIBLE); 215 schedule_timeout(HZ*resetbootwait); 216 set_current_state(TASK_RUNNING); 217 pci_read_config_dword(ppdev, 0x10, &d); 218 d &= ~0xf; 219 if (!d) { 220 retry = 1; 221 goto retrain; 222 } 223 } 224 } else { 225 set_current_state(TASK_UNINTERRUPTIBLE); 226 schedule_timeout(HZ*resetbootwait); 227 set_current_state(TASK_RUNNING); 228 } 229 local_bh_disable(); 230 pciebreak_smp_send_stop(10000); 231 wmb(); /* flush all write before we update pcie window */ 232 for (i = 0; i < ARRAY_SIZE(index); i++) 233 pci_write_config_dword(ppdev, index[i], data[i]); 234 235 for (i = 0; i < ARRAY_SIZE(cindex); i++) 236 pci_write_config_dword(pdev, cindex[i], cdata[i]); 237 atomic_set(&waiting_for_pciebreak_ipi, 0); 238 wmb(); /* flush all write after we update pcie window */ 239 local_bh_enable(); 240 241 242 pr_info("redraw console\n"); 243 > 244 saved_console = fg_console; 245 switch_console(fg_console > 0?fg_console - 1 : fg_console + 1); 246 queue_delayed_work(priv->wq, &priv->redraw_work, HZ); 247 out: 248 priv->running = 0; 249 } 250 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
by Liu Mingrui 24 Sep '24

24 Sep '24

From: robelin <robelin(a)nvidia.com> stable inclusion from stable-v5.10.226 commit 8ca21e7a27c66b95a4b215edc8e45e5d66679f9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAA CVE: CVE-2024-46798 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b4a90b543d9f62d3ac34ec1ab97fc5334b048565 upstream. When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug: [ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 [ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it. Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables") Signed-off-by: robelin <robelin(a)nvidia.com> Signed-off-by: Sameer Pujar <spujar(a)nvidia.com> Link: https://patch.msgid.link/20240823144342.4123814-2-spujar@nvidia.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- sound/soc/soc-dapm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index 754c1f16ee83..acb46e1f9c0a 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -4014,6 +4014,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w, case SND_SOC_DAPM_POST_PMD: kfree(substream->runtime); + substream->runtime = NULL; break; default: -- 2.25.1

2 1

[PATCH OLK-5.10] ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
by Liu Mingrui 24 Sep '24

24 Sep '24

From: robelin <robelin(a)nvidia.com> stable inclusion from stable-v5.10.226 commit 8ca21e7a27c66b95a4b215edc8e45e5d66679f9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAA CVE: CVE-2024-46798 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b4a90b543d9f62d3ac34ec1ab97fc5334b048565 upstream. When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug: [ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 [ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it. Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables") Signed-off-by: robelin <robelin(a)nvidia.com> Signed-off-by: Sameer Pujar <spujar(a)nvidia.com> Link: https://patch.msgid.link/20240823144342.4123814-2-spujar@nvidia.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- sound/soc/soc-dapm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index 754c1f16ee83..acb46e1f9c0a 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -4014,6 +4014,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w, case SND_SOC_DAPM_POST_PMD: kfree(substream->runtime); + substream->runtime = NULL; break; default: -- 2.25.1

2 1

[PATCH OLK-6.6] ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
by Liu Mingrui 24 Sep '24

24 Sep '24

From: robelin <robelin(a)nvidia.com> stable inclusion from stable-v5.10.226 commit 8ca21e7a27c66b95a4b215edc8e45e5d66679f9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAA CVE: CVE-2024-46798 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b4a90b543d9f62d3ac34ec1ab97fc5334b048565 upstream. When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug: [ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 [ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it. Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables") Signed-off-by: robelin <robelin(a)nvidia.com> Signed-off-by: Sameer Pujar <spujar(a)nvidia.com> Link: https://patch.msgid.link/20240823144342.4123814-2-spujar@nvidia.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- sound/soc/soc-dapm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index 85e3bbf7e5f0..7729f8f4d5e6 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -4018,6 +4018,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w, case SND_SOC_DAPM_POST_PMD: kfree(substream->runtime); + substream->runtime = NULL; break; default: -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
by Bowen You 24 Sep '24

24 Sep '24

mainline inclusion from mainline-v6.11-rc1 commit 0974d03eb479384466d828d65637814bee6b26d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWPW CVE: CVE-2024-46774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Smatch warns: arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential spectre issue 'args.args' [r] (local cap) The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copy_to_user() after they are subject to bounds checks. Use array_index_nospec() after the bounds checks to clamp these values for speculative execution. Signed-off-by: Nathan Lynch <nathanl(a)linux.ibm.com> Reported-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240530-sys_rtas-nargs-nret-v1-1-129acddd4d89@linux.ibm… Conflicts: arch/powerpc/kernel/rtas.c [Some header files are not included.] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/powerpc/kernel/rtas.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c index 7e0722b62cae..e39d25744ea2 100644 --- a/arch/powerpc/kernel/rtas.c +++ b/arch/powerpc/kernel/rtas.c @@ -24,6 +24,7 @@ #include <linux/completion.h> #include <linux/cpumask.h> #include <linux/memblock.h> +#include <linux/nospec.h> #include <linux/slab.h> #include <linux/reboot.h> #include <linux/syscalls.h> @@ -1224,6 +1225,9 @@ SYSCALL_DEFINE1(rtas, struct rtas_args __user *, uargs) || nargs + nret > ARRAY_SIZE(args.args)) return -EINVAL; + nargs = array_index_nospec(nargs, ARRAY_SIZE(args.args)); + nret = array_index_nospec(nret, ARRAY_SIZE(args.args) - nargs); + /* Copy in args. */ if (copy_from_user(args.args, uargs->args, nargs * sizeof(rtas_arg_t)) != 0) -- 2.34.1

2 1

[openeuler:OLK-5.10 29872/30000] ld.lld: error: duplicate symbol: lld_dev_hold
by kernel test robot 24 Sep '24

24 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 686352476cd29ec854b93e09a49d57c25a18a32f commit: 33116132568edcf6565cfd65cfa433f440d90494 [29872/30000] drm/qxl: Add check for drm_cvt_mode config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240924/202409241604.35w0b2j4-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240924/202409241604.35w0b2j4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409241604.35w0b2j4-lkp@intel.com/ Note: the openeuler/OLK-5.10 HEAD 686352476cd29ec854b93e09a49d57c25a18a32f builds fine. It only hurts bisectability. All errors (new ones prefixed by >>): >> ld.lld: error: duplicate symbol: lld_dev_hold >>> defined at hifc_lld.c >>> scsi/huawei/hifc/hifc_lld.o:(lld_dev_hold) in archive drivers/built-in.a >>> defined at sss_adapter_mgmt.c >>> net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.o:(.text+0x20) in archive drivers/built-in.a -- >> ld.lld: error: duplicate symbol: lld_dev_put >>> defined at hifc_lld.c >>> scsi/huawei/hifc/hifc_lld.o:(lld_dev_put) in archive drivers/built-in.a >>> defined at sss_adapter_mgmt.c >>> net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.o:(.text+0x80) in archive drivers/built-in.a -- >> ld.lld: error: duplicate symbol: g_uld_mutex >>> defined at sss_pci_global.c >>> net/ethernet/3snic/sssnic/hw/sss_pci_global.o:(g_uld_mutex) in archive drivers/built-in.a >>> defined at hinic3_lld.c >>> net/ethernet/huawei/hinic3/hw/hinic3_lld.o:(.bss+0x340) in archive drivers/built-in.a -- >> ld.lld: error: duplicate symbol: lld_dev_hold >>> defined at hifc_lld.c >>> scsi/huawei/hifc/hifc_lld.o:(lld_dev_hold) in archive drivers/built-in.a >>> defined at hinic3_dev_mgmt.c >>> net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.o:(.text+0x120) in archive drivers/built-in.a -- >> ld.lld: error: duplicate symbol: lld_dev_put >>> defined at hifc_lld.c >>> scsi/huawei/hifc/hifc_lld.o:(lld_dev_put) in archive drivers/built-in.a >>> defined at hinic3_dev_mgmt.c >>> net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.o:(.text+0x180) in archive drivers/built-in.a -- >> ld.lld: error: duplicate symbol: nic_ioctl >>> defined at hinic_nictool.c >>> net/ethernet/huawei/hinic/hinic_nictool.o:(nic_ioctl) in archive drivers/built-in.a >>> defined at hinic3_dbg.c >>> net/ethernet/huawei/hinic3/hinic3_dbg.o:(.text+0x0) in archive drivers/built-in.a -- >> ld.lld: error: duplicate symbol: set_slave_host_enable >>> defined at hinic_multi_host_mgmt.c >>> net/ethernet/huawei/hinic/hinic_multi_host_mgmt.o:(set_slave_host_enable) in archive drivers/built-in.a >>> defined at hinic3_hwdev.c >>> net/ethernet/huawei/hinic3/hw/hinic3_hwdev.o:(.text+0x0) in archive drivers/built-in.a -- >> ld.lld: error: duplicate symbol: set_func_host_mode >>> defined at hinic_multi_host_mgmt.c >>> net/ethernet/huawei/hinic/hinic_multi_host_mgmt.o:(set_func_host_mode) in archive drivers/built-in.a >>> defined at hinic3_hwdev.c >>> net/ethernet/huawei/hinic3/hw/hinic3_hwdev.o:(.text+0x2C0) in archive drivers/built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
by Bowen You 24 Sep '24

24 Sep '24

mainline inclusion from mainline-v6.11-rc1 commit 0974d03eb479384466d828d65637814bee6b26d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWPW CVE: CVE-2024-46774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Smatch warns: arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential spectre issue 'args.args' [r] (local cap) The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copy_to_user() after they are subject to bounds checks. Use array_index_nospec() after the bounds checks to clamp these values for speculative execution. Signed-off-by: Nathan Lynch <nathanl(a)linux.ibm.com> Reported-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240530-sys_rtas-nargs-nret-v1-1-129acddd4d89@linux.ibm… Conflicts: arch/powerpc/kernel/rtas.c [Some header files are not included.] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/powerpc/kernel/rtas.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c index bf962051af0a..2e92e87ac0e3 100644 --- a/arch/powerpc/kernel/rtas.c +++ b/arch/powerpc/kernel/rtas.c @@ -21,6 +21,7 @@ #include <linux/completion.h> #include <linux/cpumask.h> #include <linux/memblock.h> +#include <linux/nospec.h> #include <linux/slab.h> #include <linux/reboot.h> #include <linux/syscalls.h> @@ -1168,6 +1169,9 @@ SYSCALL_DEFINE1(rtas, struct rtas_args __user *, uargs) || nargs + nret > ARRAY_SIZE(args.args)) return -EINVAL; + nargs = array_index_nospec(nargs, ARRAY_SIZE(args.args)); + nret = array_index_nospec(nret, ARRAY_SIZE(args.args) - nargs); + /* Copy in args. */ if (copy_from_user(args.args, uargs->args, nargs * sizeof(rtas_arg_t)) != 0) -- 2.34.1

2 1

[PATCH OLK-6.6] powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
by Bowen You 24 Sep '24

24 Sep '24

mainline inclusion from mainline-v6.11-rc1 commit 0974d03eb479384466d828d65637814bee6b26d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWPW CVE: CVE-2024-46774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Smatch warns: arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential spectre issue 'args.args' [r] (local cap) The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copy_to_user() after they are subject to bounds checks. Use array_index_nospec() after the bounds checks to clamp these values for speculative execution. Signed-off-by: Nathan Lynch <nathanl(a)linux.ibm.com> Reported-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240530-sys_rtas-nargs-nret-v1-1-129acddd4d89@linux.ibm… Conflicts: arch/powerpc/kernel/rtas.c [Some header files are not included.] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/powerpc/kernel/rtas.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c index 46b9476d7582..dc294c95da21 100644 --- a/arch/powerpc/kernel/rtas.c +++ b/arch/powerpc/kernel/rtas.c @@ -18,6 +18,7 @@ #include <linux/kernel.h> #include <linux/lockdep.h> #include <linux/memblock.h> +#include <linux/nospec.h> #include <linux/of.h> #include <linux/of_fdt.h> #include <linux/reboot.h> @@ -1839,6 +1840,9 @@ SYSCALL_DEFINE1(rtas, struct rtas_args __user *, uargs) || nargs + nret > ARRAY_SIZE(args.args)) return -EINVAL; + nargs = array_index_nospec(nargs, ARRAY_SIZE(args.args)); + nret = array_index_nospec(nret, ARRAY_SIZE(args.args) - nargs); + /* Copy in args. */ if (copy_from_user(args.args, uargs->args, nargs * sizeof(rtas_arg_t)) != 0) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 24 Sep '24

24 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://lore.kernel.org/lkml/20240828154338.754746-1-david.fernandez.gonzal… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index da1ee2e1ba99..2779704e128a 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -152,7 +152,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-5.10] powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
by Bowen You 24 Sep '24

24 Sep '24

mainline inclusion from mainline-v6.11-rc1 commit 0974d03eb479384466d828d65637814bee6b26d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWPW CVE: CVE-2024-46774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Smatch warns: arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential spectre issue 'args.args' [r] (local cap) The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copy_to_user() after they are subject to bounds checks. Use array_index_nospec() after the bounds checks to clamp these values for speculative execution. Signed-off-by: Nathan Lynch <nathanl(a)linux.ibm.com> Reported-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240530-sys_rtas-nargs-nret-v1-1-129acddd4d89@linux.ibm… Conflicts: arch/powerpc/kernel/rtas.c [Some header files are not included.] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/powerpc/kernel/rtas.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c index 5976a25c6264..9d87e7dec5f1 100644 --- a/arch/powerpc/kernel/rtas.c +++ b/arch/powerpc/kernel/rtas.c @@ -21,6 +21,7 @@ #include <linux/completion.h> #include <linux/cpumask.h> #include <linux/memblock.h> +#include <linux/nospec.h> #include <linux/slab.h> #include <linux/reboot.h> #include <linux/syscalls.h> @@ -1173,6 +1174,9 @@ SYSCALL_DEFINE1(rtas, struct rtas_args __user *, uargs) || nargs + nret > ARRAY_SIZE(args.args)) return -EINVAL; + nargs = array_index_nospec(nargs, ARRAY_SIZE(args.args)); + nret = array_index_nospec(nret, ARRAY_SIZE(args.args) - nargs); + /* Copy in args. */ if (copy_from_user(args.args, uargs->args, nargs * sizeof(rtas_arg_t)) != 0) -- 2.34.1

2 1

[PATCH OLK-6.6] hwmon: (adc128d818) Fix underflows seen when writing limit attributes
by Chen Zhongjin 24 Sep '24

24 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v6.6.51 commit 6891b11a0c6227ca7ed15786928a07b1c0e4d4af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWHX CVE: CVE-2024-46759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8cad724c8537fe3e0da8004646abc00290adae40 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/hwmon/adc128d818.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/adc128d818.c b/drivers/hwmon/adc128d818.c index 46e3c8c50765..73fd96799847 100644 --- a/drivers/hwmon/adc128d818.c +++ b/drivers/hwmon/adc128d818.c @@ -176,7 +176,7 @@ static ssize_t adc128_in_store(struct device *dev, mutex_lock(&data->update_lock); /* 10 mV LSB on limit registers */ - regval = clamp_val(DIV_ROUND_CLOSEST(val, 10), 0, 255); + regval = DIV_ROUND_CLOSEST(clamp_val(val, 0, 2550), 10); data->in[index][nr] = regval << 4; reg = index == 1 ? ADC128_REG_IN_MIN(nr) : ADC128_REG_IN_MAX(nr); i2c_smbus_write_byte_data(data->client, reg, regval); @@ -214,7 +214,7 @@ static ssize_t adc128_temp_store(struct device *dev, return err; mutex_lock(&data->update_lock); - regval = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127); + regval = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000); data->temp[index] = regval << 1; i2c_smbus_write_byte_data(data->client, index == 1 ? ADC128_REG_TEMP_MAX -- 2.25.1

2 1

[PATCH OLK-5.10] hwmon: (adc128d818) Fix underflows seen when writing limit attributes
by Chen Zhongjin 24 Sep '24

24 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v5.10.226 commit 2a3add62f183459a057336381ef3a896da01ce38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWHX CVE: CVE-2024-46759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8cad724c8537fe3e0da8004646abc00290adae40 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/hwmon/adc128d818.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/adc128d818.c b/drivers/hwmon/adc128d818.c index 6c9a906631b8..e73c4de9471f 100644 --- a/drivers/hwmon/adc128d818.c +++ b/drivers/hwmon/adc128d818.c @@ -176,7 +176,7 @@ static ssize_t adc128_in_store(struct device *dev, mutex_lock(&data->update_lock); /* 10 mV LSB on limit registers */ - regval = clamp_val(DIV_ROUND_CLOSEST(val, 10), 0, 255); + regval = DIV_ROUND_CLOSEST(clamp_val(val, 0, 2550), 10); data->in[index][nr] = regval << 4; reg = index == 1 ? ADC128_REG_IN_MIN(nr) : ADC128_REG_IN_MAX(nr); i2c_smbus_write_byte_data(data->client, reg, regval); @@ -214,7 +214,7 @@ static ssize_t adc128_temp_store(struct device *dev, return err; mutex_lock(&data->update_lock); - regval = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127); + regval = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000); data->temp[index] = regval << 1; i2c_smbus_write_byte_data(data->client, index == 1 ? ADC128_REG_TEMP_MAX -- 2.25.1

2 1

[PATCH] hwmon: (adc128d818) Fix underflows seen when writing limit attributes
by Chen Zhongjin 24 Sep '24

24 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v6.6.51 commit 6891b11a0c6227ca7ed15786928a07b1c0e4d4af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWHX CVE: CVE-2024-46759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8cad724c8537fe3e0da8004646abc00290adae40 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/hwmon/adc128d818.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/adc128d818.c b/drivers/hwmon/adc128d818.c index 46e3c8c50765..73fd96799847 100644 --- a/drivers/hwmon/adc128d818.c +++ b/drivers/hwmon/adc128d818.c @@ -176,7 +176,7 @@ static ssize_t adc128_in_store(struct device *dev, mutex_lock(&data->update_lock); /* 10 mV LSB on limit registers */ - regval = clamp_val(DIV_ROUND_CLOSEST(val, 10), 0, 255); + regval = DIV_ROUND_CLOSEST(clamp_val(val, 0, 2550), 10); data->in[index][nr] = regval << 4; reg = index == 1 ? ADC128_REG_IN_MIN(nr) : ADC128_REG_IN_MAX(nr); i2c_smbus_write_byte_data(data->client, reg, regval); @@ -214,7 +214,7 @@ static ssize_t adc128_temp_store(struct device *dev, return err; mutex_lock(&data->update_lock); - regval = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127); + regval = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000); data->temp[index] = regval << 1; i2c_smbus_write_byte_data(data->client, index == 1 ? ADC128_REG_TEMP_MAX -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] hwmon: (adc128d818) Fix underflows seen when writing limit attributes
by Chen Zhongjin 24 Sep '24

24 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v4.19.322 commit 05419d0056dcf7088687e561bb583cc06deba777 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWHX CVE: CVE-2024-46759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8cad724c8537fe3e0da8004646abc00290adae40 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/hwmon/adc128d818.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/adc128d818.c b/drivers/hwmon/adc128d818.c index bd2ca315c9d8..5abb28cd81bf 100644 --- a/drivers/hwmon/adc128d818.c +++ b/drivers/hwmon/adc128d818.c @@ -184,7 +184,7 @@ static ssize_t adc128_set_in(struct device *dev, struct device_attribute *attr, mutex_lock(&data->update_lock); /* 10 mV LSB on limit registers */ - regval = clamp_val(DIV_ROUND_CLOSEST(val, 10), 0, 255); + regval = DIV_ROUND_CLOSEST(clamp_val(val, 0, 2550), 10); data->in[index][nr] = regval << 4; reg = index == 1 ? ADC128_REG_IN_MIN(nr) : ADC128_REG_IN_MAX(nr); i2c_smbus_write_byte_data(data->client, reg, regval); @@ -222,7 +222,7 @@ static ssize_t adc128_set_temp(struct device *dev, return err; mutex_lock(&data->update_lock); - regval = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127); + regval = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000); data->temp[index] = regval << 1; i2c_smbus_write_byte_data(data->client, index == 1 ? ADC128_REG_TEMP_MAX -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] swiotlb: fix swiotlb_bounce() to do partial sync's correctly
by Kaixiong Yu 24 Sep '24

24 Sep '24

Merge mainline commit e8068f2d756d("swiotlb: fix swiotlb_bounce() to do partial sync's correctly") and af133562d5a("swiotlb: extend buffer pre-padding to alloc_align_mask if necessary") Michael Kelley (1): swiotlb: fix swiotlb_bounce() to do partial sync's correctly Petr Tesarik (1): swiotlb: extend buffer pre-padding to alloc_align_mask if necessary kernel/dma/swiotlb.c | 87 +++++++++++++++++++++++++++++--------------- 1 file changed, 58 insertions(+), 29 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-46777 for SP1
by Wupeng Ma 24 Sep '24

24 Sep '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-46777 for SP1. Jan Kara (2): udf: Define EFSCORRUPTED error code udf: Avoid excessive partition lengths fs/udf/super.c | 15 +++++++++++++++ fs/udf/udf_sb.h | 2 ++ 2 files changed, 17 insertions(+) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] Input: MT - limit max slots
by Yuan Can 24 Sep '24

24 Sep '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v4.19.321 commit 2829c80614890624456337e47320289112785f3e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZN CVE: CVE-2024-45008 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 99d3bf5f7377d42f8be60a6b9cb60fb0be34dceb upstream. syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible max slots, this patch chose 1024. Reported-by: syzbot <syzbot+0122fa359a69694395d5(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 Suggested-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/input/input-mt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c index 6c7326c93721..fd01c9306e66 100644 --- a/drivers/input/input-mt.c +++ b/drivers/input/input-mt.c @@ -48,6 +48,9 @@ int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots, return 0; if (mt) return mt->num_slots != num_slots ? -EINVAL : 0; + /* Arbitrary limit for avoiding too large memory allocation. */ + if (num_slots > 1024) + return -EINVAL; mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL); if (!mt) -- 2.17.1

2 1

[PATCH OLK-6.6] Input: MT - limit max slots
by Yuan Can 24 Sep '24

24 Sep '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.48 commit 8f04edd554d191834e9e1349ef030318ea6b11ba category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZN CVE: CVE-2024-45008 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 99d3bf5f7377d42f8be60a6b9cb60fb0be34dceb upstream. syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible max slots, this patch chose 1024. Reported-by: syzbot <syzbot+0122fa359a69694395d5(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 Suggested-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/input/input-mt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c index 14b53dac1253..6b04a674f832 100644 --- a/drivers/input/input-mt.c +++ b/drivers/input/input-mt.c @@ -46,6 +46,9 @@ int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots, return 0; if (mt) return mt->num_slots != num_slots ? -EINVAL : 0; + /* Arbitrary limit for avoiding too large memory allocation. */ + if (num_slots > 1024) + return -EINVAL; mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL); if (!mt) -- 2.17.1

2 1

[PATCH OLK-6.6] ksmbd: unset the binding mark of a reused connection
by Long Li 24 Sep '24

24 Sep '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.10-rc2 commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWIK CVE: CVE-2024-46795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/server/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 4d91210e6acf..28684316bccb 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -1681,6 +1681,8 @@ int smb2_sess_setup(struct ksmbd_work *work) rc = ksmbd_session_register(conn, sess); if (rc) goto out_err; + + conn->binding = false; } else if (conn->dialect >= SMB30_PROT_ID && (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { @@ -1759,6 +1761,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess = NULL; goto out_err; } + + conn->binding = false; } work->sess = sess; -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: handle errors from btrfs_dec_ref() properly
by Long Li 24 Sep '24

24 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.10-rc2 commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYDJ CVE: CVE-2024-46753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Conflict due to not merge mainline commit e094f48040cd] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/extent-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index c6ecfd05e1db..b6be2e2f1994 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5505,7 +5505,10 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, ret = btrfs_dec_ref(trans, root, eb, 1); else ret = btrfs_dec_ref(trans, root, eb, 0); - BUG_ON(ret); /* -ENOMEM */ + if (ret) { + btrfs_abort_transaction(trans, ret); + return ret; + } if (is_fstree(root->root_key.objectid)) { ret = btrfs_qgroup_trace_leaf_items(trans, eb); if (ret) { -- 2.39.2

2 1

[PATCH OLK-5.10] media: xc2028: avoid use-after-free in load_firmware_cb()
by Wenyu Huang 24 Sep '24

24 Sep '24

From: Chi Zhiling <chizhiling(a)kylinos.cn> stable inclusion from stable-v6.6.46 commit 850304152d367f104d21c77cfbcc05806504218b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMTD CVE: CVE-2024-43900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 68594cec291ff9523b9feb3f43fd853dcddd1f60 ] syzkaller reported use-after-free in load_firmware_cb() [1]. The reason is because the module allocated a struct tuner in tuner_probe(), and then the module initialization failed, the struct tuner was released. A worker which created during module initialization accesses this struct tuner later, it caused use-after-free. The process is as follows: task-6504 worker_thread tuner_probe <= alloc dvb_frontend [2] ... request_firmware_nowait <= create a worker ... tuner_remove <= free dvb_frontend ... request_firmware_work_func <= the firmware is ready load_firmware_cb <= but now the dvb_frontend has been freed To fix the issue, check the dvd_frontend in load_firmware_cb(), if it is null, report a warning and just return. [1]: ================================================================== BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0 Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504 Call trace: load_firmware_cb+0x1310/0x17a0 request_firmware_work_func+0x128/0x220 process_one_work+0x770/0x1824 worker_thread+0x488/0xea0 kthread+0x300/0x430 ret_from_fork+0x10/0x20 Allocated by task 6504: kzalloc tuner_probe+0xb0/0x1430 i2c_device_probe+0x92c/0xaf0 really_probe+0x678/0xcd0 driver_probe_device+0x280/0x370 __device_attach_driver+0x220/0x330 bus_for_each_drv+0x134/0x1c0 __device_attach+0x1f4/0x410 device_initial_probe+0x20/0x30 bus_probe_device+0x184/0x200 device_add+0x924/0x12c0 device_register+0x24/0x30 i2c_new_device+0x4e0/0xc44 v4l2_i2c_new_subdev_board+0xbc/0x290 v4l2_i2c_new_subdev+0xc8/0x104 em28xx_v4l2_init+0x1dd0/0x3770 Freed by task 6504: kfree+0x238/0x4e4 tuner_remove+0x144/0x1c0 i2c_device_remove+0xc8/0x290 __device_release_driver+0x314/0x5fc device_release_driver+0x30/0x44 bus_remove_device+0x244/0x490 device_del+0x350/0x900 device_unregister+0x28/0xd0 i2c_unregister_device+0x174/0x1d0 v4l2_device_unregister+0x224/0x380 em28xx_v4l2_init+0x1d90/0x3770 The buggy address belongs to the object at ffff8000d7ca2000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 776 bytes inside of 2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800) The buggy address belongs to the page: page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0 flags: 0x7ff800000000100(slab) raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [2] Actually, it is allocated for struct tuner, and dvb_frontend is inside. Signed-off-by: Chi Zhiling <chizhiling(a)kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/media/tuners/tuner-xc2028.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c index 574c3bb135d72..50ebd35b58a9c 100644 --- a/drivers/media/tuners/tuner-xc2028.c +++ b/drivers/media/tuners/tuner-xc2028.c @@ -1361,9 +1361,16 @@ static void load_firmware_cb(const struct firmware *fw, void *context) { struct dvb_frontend *fe = context; - struct xc2028_data *priv = fe->tuner_priv; + struct xc2028_data *priv; int rc; + if (!fe) { + pr_warn("xc2028: No frontend in %s\n", __func__); + return; + } + + priv = fe->tuner_priv; + tuner_dbg("request_firmware_nowait(): %s\n", fw ? "OK" : "error"); if (!fw) { tuner_err("Could not load firmware %s.\n", priv->fname); -- 2.34.1

2 1

[PATCH OLK-5.10] scsi: qedi: Fix crash while reading debugfs attribute
by Wenyu Huang 24 Sep '24

24 Sep '24

From: Manish Rangankar <mrangankar(a)marvell.com> stable inclusion from stable-v5.10.221 commit 144d76a676b630e321556965011b00e2de0b40a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACQZS CVE: CVE-2024-40978 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 28027ec8e32ecbadcd67623edb290dad61e735b5 ] The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly on a __user pointer, which results into the crash. To fix this issue, use a small local stack buffer for sprintf() and then call simple_read_from_buffer(), which in turns make the copy_to_user() call. BUG: unable to handle page fault for address: 00007f4801111000 PGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0 Oops: 0002 [#1] PREEMPT SMP PTI Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023 RIP: 0010:memcpy_orig+0xcd/0x130 RSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202 RAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f RDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000 RBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572 R10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff R13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af FS: 00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x1a/0x60 ? page_fault_oops+0x183/0x510 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x22/0x30 ? memcpy_orig+0xcd/0x130 vsnprintf+0x102/0x4c0 sprintf+0x51/0x80 qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324] full_proxy_read+0x50/0x80 vfs_read+0xa5/0x2e0 ? folio_add_new_anon_rmap+0x44/0xa0 ? set_pte_at+0x15/0x30 ? do_pte_missing+0x426/0x7f0 ksys_read+0xa5/0xe0 do_syscall_64+0x58/0x80 ? __count_memcg_events+0x46/0x90 ? count_memcg_event_mm+0x3d/0x60 ? handle_mm_fault+0x196/0x2f0 ? do_user_addr_fault+0x267/0x890 ? exc_page_fault+0x69/0x150 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f4800f20b4d Tested-by: Martin Hoyer <mhoyer(a)redhat.com> Reviewed-by: John Meneghini <jmeneghi(a)redhat.com> Signed-off-by: Manish Rangankar <mrangankar(a)marvell.com> Link: https://lore.kernel.org/r/20240415072155.30840-1-mrangankar@marvell.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/scsi/qedi/qedi_debugfs.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/qedi/qedi_debugfs.c b/drivers/scsi/qedi/qedi_debugfs.c index 42f5afb60055c..6e724f47ab9e8 100644 --- a/drivers/scsi/qedi/qedi_debugfs.c +++ b/drivers/scsi/qedi/qedi_debugfs.c @@ -120,15 +120,11 @@ static ssize_t qedi_dbg_do_not_recover_cmd_read(struct file *filp, char __user *buffer, size_t count, loff_t *ppos) { - size_t cnt = 0; - - if (*ppos) - return 0; + char buf[64]; + int len; - cnt = sprintf(buffer, "do_not_recover=%d\n", qedi_do_not_recover); - cnt = min_t(int, count, cnt - *ppos); - *ppos += cnt; - return cnt; + len = sprintf(buf, "do_not_recover=%d\n", qedi_do_not_recover); + return simple_read_from_buffer(buffer, count, ppos, buf, len); } static int -- 2.34.1

2 1

[PATCH OLK-5.10] lib: objagg: Fix general protection fault
by Wenyu Huang 24 Sep '24

24 Sep '24

From: Ido Schimmel <idosch(a)nvidia.com> stable inclusion from stable-v5.10.224 commit 22ae17a267f4812861f0c644186c3421ff97dbfc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2U CVE: CVE-2024-43846 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b4a3a89fffcdf09702b1f161b914e52abca1894d ] The library supports aggregation of objects into other objects only if the parent object does not have a parent itself. That is, nesting is not supported. Aggregation happens in two cases: Without and with hints, where hints are a pre-computed recommendation on how to aggregate the provided objects. Nesting is not possible in the first case due to a check that prevents it, but in the second case there is no check because the assumption is that nesting cannot happen when creating objects based on hints. The violation of this assumption leads to various warnings and eventually to a general protection fault [1]. Before fixing the root cause, error out when nesting happens and warn. [1] general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Fixes: 9069a3817d82 ("lib: objagg: implement optimization hints assembly and use hints for object creation") Reported-by: Alexander Zubkov <green(a)qrator.net> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Tested-by: Alexander Zubkov <green(a)qrator.net> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- lib/objagg.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/objagg.c b/lib/objagg.c index 5e1676ccdaddd..73d7116025736 100644 --- a/lib/objagg.c +++ b/lib/objagg.c @@ -167,6 +167,9 @@ static int objagg_obj_parent_assign(struct objagg *objagg, { void *delta_priv; + if (WARN_ON(!objagg_obj_is_root(parent))) + return -EINVAL; + delta_priv = objagg->ops->delta_create(objagg->priv, parent->obj, objagg_obj->obj); if (IS_ERR(delta_priv)) -- 2.34.1

2 1

[PATCH OLK-5.10] jfs: fix null ptr deref in dtInsertEntry
by Wenyu Huang 24 Sep '24

24 Sep '24

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.47 commit 6ea10dbb1e6c58384136e9adfd75f81951e423f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMM9 CVE: CVE-2024-44939 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ce6dede912f064a855acf6f04a04cbb2c25b8c8c ] [syzbot reported] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713 ... [Analyze] In dtInsertEntry(), when the pointer h has the same value as p, after writing name in UniStrncpy_to_le(), p->header.flag will be cleared. This will cause the previously true judgment "p->header.flag & BT-LEAF" to change to no after writing the name operation, this leads to entering an incorrect branch and accessing the uninitialized object ih when judging this condition for the second time. [Fix] After got the page, check freelist first, if freelist == 0 then exit dtInsert() and return -EINVAL. Reported-by: syzbot+bba84aef3a26fb93deb9(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index a222a9d71887f..defa82acb432c 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -834,6 +834,8 @@ int dtInsert(tid_t tid, struct inode *ip, * the full page. */ DT_GETSEARCH(ip, btstack->top, bn, mp, p, index); + if (p->header.freelist == 0) + return -EINVAL; /* * insert entry for new key -- 2.34.1

2 1

[PATCH OLK-5.10] drm/vmwgfx: Fix a deadlock in dma buf fence polling
by Wenyu Huang 24 Sep '24

24 Sep '24

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v5.15.165 commit 9e20d028d8d1deb1e7fed18f22ffc01669cf3237 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALCS5 CVE: CVE-2024-43863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e58337100721f3cc0c7424a18730e4f39844934f upstream. Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix poll->fence wait->fence unref deadlocks. vmwgfx overwrites the wait callback to iterate over the list of all fences and update their status, to do that it holds a lock to prevent the list modifcations from other threads. The fence destroy callback both deletes the fence and removes it from the list of pending fences, for which it holds a lock. dma buf polling cb unrefs a fence after it's been signaled: so the poll calls the wait, which signals the fences, which are being destroyed. The destruction tries to acquire the lock on the pending fences list which it can never get because it's held by the wait from which it was called. Old bug, but not a lot of userspace apps were using dma-buf polling interfaces. Fix those, in particular this fixes KDE stalls/deadlock. Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Fixes: 2298e804e96e ("drm/vmwgfx: rework to new fence interface, v2") Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list(a)broadcom.com> Cc: dri-devel(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v6.2+ Reviewed-by: Maaz Mombasawala <maaz.mombasawala(a)broadcom.com> Reviewed-by: Martin Krastev <martin.krastev(a)broadcom.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240722184313.181318-2-zack.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c index 6bacdb7583dfe..cd8a6fabc4e21 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -32,7 +32,6 @@ #define VMW_FENCE_WRAP (1 << 31) struct vmw_fence_manager { - int num_fence_objects; struct vmw_private *dev_priv; spinlock_t lock; struct list_head fence_list; @@ -113,13 +112,13 @@ static void vmw_fence_obj_destroy(struct dma_fence *f) { struct vmw_fence_obj *fence = container_of(f, struct vmw_fence_obj, base); - struct vmw_fence_manager *fman = fman_from_fence(fence); - spin_lock(&fman->lock); - list_del_init(&fence->head); - --fman->num_fence_objects; - spin_unlock(&fman->lock); + if (!list_empty(&fence->head)) { + spin_lock(&fman->lock); + list_del_init(&fence->head); + spin_unlock(&fman->lock); + } fence->destroy(fence); } @@ -353,7 +352,6 @@ static int vmw_fence_obj_init(struct vmw_fence_manager *fman, goto out_unlock; } list_add_tail(&fence->head, &fman->fence_list); - ++fman->num_fence_objects; out_unlock: spin_unlock(&fman->lock); @@ -402,7 +400,7 @@ static bool vmw_fence_goal_new_locked(struct vmw_fence_manager *fman, { u32 goal_seqno; u32 *fifo_mem; - struct vmw_fence_obj *fence; + struct vmw_fence_obj *fence, *next_fence; if (likely(!fman->seqno_valid)) return false; @@ -413,7 +411,7 @@ static bool vmw_fence_goal_new_locked(struct vmw_fence_manager *fman, return false; fman->seqno_valid = false; - list_for_each_entry(fence, &fman->fence_list, head) { + list_for_each_entry_safe(fence, next_fence, &fman->fence_list, head) { if (!list_empty(&fence->seq_passed_actions)) { fman->seqno_valid = true; vmw_mmio_write(fence->base.seqno, -- 2.34.1

2 1

[PATCH OLK-6.6] Squashfs: sanity check symbolic link size
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v4.19.322 commit c3af7e460a526007e4bed1ce3623274a1a6afe5e bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAF CVE: CVE-2024-46744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 810ee43d9cd245d138a2733d87a24858a23f577d ] Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk Reported-by: Lizhi Xu <lizhi.xu(a)windriver.com> Reported-by: syzbot+24ac24ff58dc5b0d26b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/ V2: fix spelling mistake. Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/squashfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 16bd693d0b3a..d5918eba27e3 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -279,8 +279,13 @@ int squashfs_read_inode(struct inode *inode, long long ino) if (err < 0) goto failed_read; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le32_to_cpu(sqsh_ino->symlink_size); + if (inode->i_size > PAGE_SIZE) { + ERROR("Corrupted symlink\n"); + return -EINVAL; + } + + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_op = &squashfs_symlink_inode_ops; inode_nohighmem(inode); inode->i_data.a_ops = &squashfs_symlink_aops; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] Squashfs: sanity check symbolic link size
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v5.10.226 commit 5c8906de98d0d7ad42ff3edf2cb6cd7e0ea658c4 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAF CVE: CVE-2024-46744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 810ee43d9cd245d138a2733d87a24858a23f577d ] Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk Reported-by: Lizhi Xu <lizhi.xu(a)windriver.com> Reported-by: syzbot+24ac24ff58dc5b0d26b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/ V2: fix spelling mistake. Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/squashfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 9fb8e9fd4c00..95a9ff9e2399 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -279,8 +279,13 @@ int squashfs_read_inode(struct inode *inode, long long ino) if (err < 0) goto failed_read; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le32_to_cpu(sqsh_ino->symlink_size); + if (inode->i_size > PAGE_SIZE) { + ERROR("Corrupted symlink\n"); + return -EINVAL; + } + + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_op = &squashfs_symlink_inode_ops; inode_nohighmem(inode); inode->i_data.a_ops = &squashfs_symlink_aops; -- 2.39.2

2 1

[PATCH OLK-5.10 v2] Squashfs: sanity check symbolic link size
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v5.10.226 commit 5c8906de98d0d7ad42ff3edf2cb6cd7e0ea658c4 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAF CVE: CVE-2024-46744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 810ee43d9cd245d138a2733d87a24858a23f577d ] Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk Reported-by: Lizhi Xu <lizhi.xu(a)windriver.com> Reported-by: syzbot+24ac24ff58dc5b0d26b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/ V2: fix spelling mistake. Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/squashfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 9fb8e9fd4c00..95a9ff9e2399 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -279,8 +279,13 @@ int squashfs_read_inode(struct inode *inode, long long ino) if (err < 0) goto failed_read; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le32_to_cpu(sqsh_ino->symlink_size); + if (inode->i_size > PAGE_SIZE) { + ERROR("Corrupted symlink\n"); + return -EINVAL; + } + + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_op = &squashfs_symlink_inode_ops; inode_nohighmem(inode); inode->i_data.a_ops = &squashfs_symlink_aops; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] Squashfs: sanity check symbolic link size
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v4.19.322 commit f82cb7f24032ed023fc67d26ea9bf322d8431a90 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAF CVE: CVE-2024-46744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 810ee43d9cd245d138a2733d87a24858a23f577d ] Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk Reported-by: Lizhi Xu <lizhi.xu(a)windriver.com> Reported-by: syzbot+24ac24ff58dc5b0d26b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/ V2: fix spelling mistake. Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- V2: Fix commit msg to adapt openEuler, since some marks made openEuler CI ignore below signed-off-by information. fs/squashfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 98825d8a03eb..aee2ec547f1a 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -292,8 +292,13 @@ int squashfs_read_inode(struct inode *inode, long long ino) if (err < 0) goto failed_read; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le32_to_cpu(sqsh_ino->symlink_size); + if (inode->i_size > PAGE_SIZE) { + ERROR("Corrupted symlink\n"); + return -EINVAL; + } + + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_op = &squashfs_symlink_inode_ops; inode_nohighmem(inode); inode->i_data.a_ops = &squashfs_symlink_aops; -- 2.39.2

2 1

[PATCH OLK-6.6 v3] mm/migration: do not folio copy in MIGRATE_SYNC_NO_COPY mode
by Tong Tiangen 24 Sep '24

24 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IASFAM -------------------------------- During page migration, if MIGRATE_SYNC_NO_COPY mode is used, the page content should not be migrated. This patch fix it. Fixes: 374fe8ea8082 ("fs: hugetlbfs: support poisoned recover from hugetlbfs_migrate_folio()") Fixes: 1d263184ba06 ("mm: migrate: support poisoned recover from migrate folio") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- fs/hugetlbfs/inode.c | 2 +- include/linux/migrate.h | 4 ++-- mm/migrate.c | 26 ++++++++++++++++---------- 3 files changed, 19 insertions(+), 13 deletions(-) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 8386d78eabe5..fb0d3db162c2 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1146,7 +1146,7 @@ static int hugetlbfs_migrate_folio(struct address_space *mapping, { int rc; - rc = migrate_huge_page_move_mapping(mapping, dst, src); + rc = migrate_huge_page_move_mapping(mapping, dst, src, mode); if (rc != MIGRATEPAGE_SUCCESS) return rc; diff --git a/include/linux/migrate.h b/include/linux/migrate.h index 517f70b70620..910a6718ad33 100644 --- a/include/linux/migrate.h +++ b/include/linux/migrate.h @@ -72,7 +72,7 @@ struct folio *alloc_migration_target(struct folio *src, unsigned long private); bool isolate_movable_page(struct page *page, isolate_mode_t mode); int migrate_huge_page_move_mapping(struct address_space *mapping, - struct folio *dst, struct folio *src); + struct folio *dst, struct folio *src, enum migrate_mode mode); void migration_entry_wait_on_locked(swp_entry_t entry, spinlock_t *ptl) __releases(ptl); void folio_migrate_flags(struct folio *newfolio, struct folio *folio); @@ -94,7 +94,7 @@ static inline bool isolate_movable_page(struct page *page, isolate_mode_t mode) { return false; } static inline int migrate_huge_page_move_mapping(struct address_space *mapping, - struct folio *dst, struct folio *src) + struct folio *dst, struct folio *src, enum migrate_mode mode) { return -ENOSYS; } diff --git a/mm/migrate.c b/mm/migrate.c index efcca5330568..2a4c4a4d15e9 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -544,20 +544,30 @@ int folio_migrate_mapping(struct address_space *mapping, } EXPORT_SYMBOL(folio_migrate_mapping); +static int folio_migrate_mc_copy(struct folio *dst, struct folio *src, + enum migrate_mode mode, int expected_count) +{ + /* Check whether src does not have extra refs before we do more work */ + if (folio_ref_count(src) != expected_count) + return -EAGAIN; + + if (mode == MIGRATE_SYNC_NO_COPY) + return 0; + + return folio_mc_copy(dst, src); +} + /* * The expected number of remaining references is the same as that * of folio_migrate_mapping(). */ int migrate_huge_page_move_mapping(struct address_space *mapping, - struct folio *dst, struct folio *src) + struct folio *dst, struct folio *src, enum migrate_mode mode) { XA_STATE(xas, &mapping->i_pages, folio_index(src)); int rc, expected_count = folio_expected_refs(mapping, src); - if (folio_ref_count(src) != expected_count) - return -EAGAIN; - - rc = folio_mc_copy(dst, src); + rc = folio_migrate_mc_copy(dst, src, mode, expected_count); if (unlikely(rc)) return rc; @@ -691,11 +701,7 @@ static int __migrate_folio(struct address_space *mapping, struct folio *dst, { int rc, expected_count = folio_expected_refs(mapping, src); - /* Check whether src does not have extra refs before we do more work */ - if (folio_ref_count(src) != expected_count) - return -EAGAIN; - - rc = folio_mc_copy(dst, src); + rc = folio_migrate_mc_copy(dst, src, mode, expected_count); if (unlikely(rc)) return rc; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-46777 for 4.19
by Wupeng Ma 24 Sep '24

24 Sep '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-46777 for 4.19. Jan Kara (2): udf: Define EFSCORRUPTED error code udf: Avoid excessive partition lengths fs/udf/super.c | 15 +++++++++++++++ fs/udf/udf_sb.h | 2 ++ 2 files changed, 17 insertions(+) -- 2.25.1

2 3

[PATCH OLK-6.6] rtla/osnoise: Prevent NULL dereference in error handling
by Yuan Can 24 Sep '24

24 Sep '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.48 commit 753f1745146e03abd17eec8eee95faffc96d743d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY19 CVE: CVE-2024-45002 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 90574d2a675947858b47008df8d07f75ea50d0d0 upstream. If the "tool->data" allocation fails then there is no need to call osnoise_free_top() and, in fact, doing so will lead to a NULL dereference. Cc: stable(a)vger.kernel.org Cc: John Kacur <jkacur(a)redhat.com> Cc: "Luis Claudio R. Goncalves" <lgoncalv(a)redhat.com> Cc: Clark Williams <williams(a)redhat.com> Fixes: 1eceb2fc2ca5 ("rtla/osnoise: Add osnoise top mode") Link: https://lore.kernel.org/f964ed1f-64d2-4fde-ad3e-708331f8f358@stanley.mounta… Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- tools/tracing/rtla/src/osnoise_top.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/tools/tracing/rtla/src/osnoise_top.c b/tools/tracing/rtla/src/osnoise_top.c index 457360db0767..d7295c0115a2 100644 --- a/tools/tracing/rtla/src/osnoise_top.c +++ b/tools/tracing/rtla/src/osnoise_top.c @@ -624,8 +624,10 @@ struct osnoise_tool *osnoise_init_top(struct osnoise_top_params *params) return NULL; tool->data = osnoise_alloc_top(nr_cpus); - if (!tool->data) - goto out_err; + if (!tool->data) { + osnoise_destroy_tool(tool); + return NULL; + } tool->params = params; @@ -633,11 +635,6 @@ struct osnoise_tool *osnoise_init_top(struct osnoise_top_params *params) osnoise_top_handler, NULL); return tool; - -out_err: - osnoise_free_top(tool->data); - osnoise_destroy_tool(tool); - return NULL; } static int stop_tracing; -- 2.17.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-41008
by Yongqiang Liu 24 Sep '24

24 Sep '24

Shashank Sharma (1): drm/amdgpu: change vm->task_info handling drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 18 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 149 ++++++++++++++------ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 21 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 24 ++-- drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 23 +-- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 20 ++- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 24 ++-- drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 23 +-- drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 22 +-- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 20 +-- 13 files changed, 242 insertions(+), 126 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-43904
by Yongqiang Liu 24 Sep '24

24 Sep '24

Srinivasan Shanmugam (1): drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] Squashfs: sanity check symbolic link size
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v4.19.322 commit c3af7e460a526007e4bed1ce3623274a1a6afe5e bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAF CVE: CVE-2024-46744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 810ee43d9cd245d138a2733d87a24858a23f577d ] Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. -- Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk Reported-by: Lizhi Xu <lizhi.xu(a)windriver.com> Reported-by: syzbot+24ac24ff58dc5b0d26b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/ V2: fix spelling mistake. Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/squashfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 16bd693d0b3a..d5918eba27e3 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -279,8 +279,13 @@ int squashfs_read_inode(struct inode *inode, long long ino) if (err < 0) goto failed_read; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le32_to_cpu(sqsh_ino->symlink_size); + if (inode->i_size > PAGE_SIZE) { + ERROR("Corrupted symlink\n"); + return -EINVAL; + } + + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_op = &squashfs_symlink_inode_ops; inode_nohighmem(inode); inode->i_data.a_ops = &squashfs_symlink_aops; -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v6.6.51 commit 41a0f85e268d72fe04f731b8ceea4748c2d65491 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX1T CVE: CVE-2024-46752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b56329a782314fde5b61058e2a25097af7ccb675 ] Instead of a BUG_ON() just return an error, log an error message and abort the transaction in case we find an extent buffer belonging to the relocation tree that doesn't have the full backref flag set. This is unexpected and should never happen (save for bugs or a potential bad memory). Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ctree.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index 118ad4d2cbbe..2eb4e03080ac 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -451,8 +451,16 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans, } owner = btrfs_header_owner(buf); - BUG_ON(owner == BTRFS_TREE_RELOC_OBJECTID && - !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)); + if (unlikely(owner == BTRFS_TREE_RELOC_OBJECTID && + !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF))) { + btrfs_crit(fs_info, +"found tree block at bytenr %llu level %d root %llu refs %llu flags %llx without full backref flag set", + buf->start, btrfs_header_level(buf), + btrfs_root_id(root), refs, flags); + ret = -EUCLEAN; + btrfs_abort_transaction(trans, ret); + return ret; + } if (refs > 1) { if ((owner == root->root_key.objectid || -- 2.39.2

2 1

[PATCH OLK-6.6 0/3] CVE-2024-46751
by Yifan Qiao 24 Sep '24

24 Sep '24

Filipe Manana (3): btrfs: remove superfluous metadata check at btrfs_lookup_extent_info() btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() fs/btrfs/extent-tree.c | 45 +++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 16 deletions(-) -- 2.39.2

2 4

[PATCH OLK-6.6] btrfs: fix qgroup reserve leaks in cow_file_range
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Boris Burkov <boris(a)bur.io> mainline inclusion from mainline-v6.11-rc3 commit 30479f31d44d47ed00ae0c7453d9b253537005b2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5C CVE: CVE-2024-46733 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the buffered write path, the dirty page owns the qgroup reserve until it creates an ordered_extent. Therefore, any errors that occur before the ordered_extent is created must free that reservation, or else the space is leaked. The fstest generic/475 exercises various IO error paths, and is able to trigger errors in cow_file_range where we fail to get to allocating the ordered extent. Note that because we *do* clear delalloc, we are likely to remove the inode from the delalloc list, so the inodes/pages to not have invalidate/launder called on them in the commit abort path. This results in failures at the unmount stage of the test that look like: BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:close_ctree+0x222/0x4d0 [btrfs] RSP: 0018:ffffb4465283be00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0 Call Trace: <TASK> ? close_ctree+0x222/0x4d0 [btrfs] ? __warn.cold+0x8e/0xea ? close_ctree+0x222/0x4d0 [btrfs] ? report_bug+0xff/0x140 ? handle_bug+0x3b/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? close_ctree+0x222/0x4d0 [btrfs] generic_shutdown_super+0x70/0x160 kill_anon_super+0x11/0x40 btrfs_kill_super+0x11/0x20 [btrfs] deactivate_locked_super+0x2e/0xa0 cleanup_mnt+0xb5/0x150 task_work_run+0x57/0x80 syscall_exit_to_user_mode+0x121/0x130 do_syscall_64+0xab/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f916847a887 ---[ end trace 0000000000000000 ]--- BTRFS error (device dm-8 state EA): qgroup reserved space leaked Cases 2 and 3 in the out_reserve path both pertain to this type of leak and must free the reserved qgroup data. Because it is already an error path, I opted not to handle the possible errors in btrfs_free_qgroup_data. Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/inode.c [Just context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/inode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 5ddee801a830..5c34909ea95b 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1543,6 +1543,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, locked_page, clear_bits, page_ops); + btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size, NULL); start += cur_alloc_size; } @@ -1556,6 +1557,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, clear_bits |= EXTENT_CLEAR_DATA_RESV; extent_clear_unlock_delalloc(inode, start, end, locked_page, clear_bits, page_ops); + btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size, NULL); } return ret; } @@ -2219,13 +2221,15 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, */ if (cow_start != (u64)-1) cur_offset = cow_start; - if (cur_offset < end) + if (cur_offset < end) { extent_clear_unlock_delalloc(inode, cur_offset, end, locked_page, EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DEFRAG | EXTENT_DO_ACCOUNTING, PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK); + btrfs_qgroup_free_data(inode, NULL, cur_offset, end - cur_offset + 1, NULL); + } btrfs_free_path(path); return ret; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: fix qgroup reserve leaks in cow_file_range
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Boris Burkov <boris(a)bur.io> mainline inclusion from mainline-v6.11-rc3 commit 30479f31d44d47ed00ae0c7453d9b253537005b2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5C CVE: CVE-2024-46733 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the buffered write path, the dirty page owns the qgroup reserve until it creates an ordered_extent. Therefore, any errors that occur before the ordered_extent is created must free that reservation, or else the space is leaked. The fstest generic/475 exercises various IO error paths, and is able to trigger errors in cow_file_range where we fail to get to allocating the ordered extent. Note that because we *do* clear delalloc, we are likely to remove the inode from the delalloc list, so the inodes/pages to not have invalidate/launder called on them in the commit abort path. This results in failures at the unmount stage of the test that look like: BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:close_ctree+0x222/0x4d0 [btrfs] RSP: 0018:ffffb4465283be00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0 Call Trace: <TASK> ? close_ctree+0x222/0x4d0 [btrfs] ? __warn.cold+0x8e/0xea ? close_ctree+0x222/0x4d0 [btrfs] ? report_bug+0xff/0x140 ? handle_bug+0x3b/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? close_ctree+0x222/0x4d0 [btrfs] generic_shutdown_super+0x70/0x160 kill_anon_super+0x11/0x40 btrfs_kill_super+0x11/0x20 [btrfs] deactivate_locked_super+0x2e/0xa0 cleanup_mnt+0xb5/0x150 task_work_run+0x57/0x80 syscall_exit_to_user_mode+0x121/0x130 do_syscall_64+0xab/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f916847a887 ---[ end trace 0000000000000000 ]--- BTRFS error (device dm-8 state EA): qgroup reserved space leaked Cases 2 and 3 in the out_reserve path both pertain to this type of leak and must free the reserved qgroup data. Because it is already an error path, I opted not to handle the possible errors in btrfs_free_qgroup_data. Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/inode.c [The cleanup logic is very old in 5.10, need to adapt the logic.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/inode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index ff876a4626cb..f8da92bc83be 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1161,6 +1161,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, locked_page, clear_bits, page_ops); + btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size); start += cur_alloc_size; if (start >= end) goto out; @@ -1168,6 +1169,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, extent_clear_unlock_delalloc(inode, start, end, locked_page, clear_bits | EXTENT_CLEAR_DATA_RESV, page_ops); + btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size); goto out; } @@ -1777,7 +1779,7 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, if (nocow) btrfs_dec_nocow_writers(fs_info, disk_bytenr); - if (ret && cur_offset < end) + if (ret && cur_offset < end) { extent_clear_unlock_delalloc(inode, cur_offset, end, locked_page, EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DEFRAG | @@ -1785,6 +1787,8 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, PAGE_CLEAR_DIRTY | PAGE_SET_WRITEBACK | PAGE_END_WRITEBACK); + btrfs_qgroup_free_data(inode, NULL, cur_offset, end - cur_offset + 1); + } btrfs_free_path(path); return ret; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] Squashfs: sanity check symbolic link size
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v5.10.226 commit 5c8906de98d0d7ad42ff3edf2cb6cd7e0ea658c4 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAF CVE: CVE-2024-46744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 810ee43d9cd245d138a2733d87a24858a23f577d ] Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. -- Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk Reported-by: Lizhi Xu <lizhi.xu(a)windriver.com> Reported-by: syzbot+24ac24ff58dc5b0d26b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/ V2: fix spelling mistake. Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/squashfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 9fb8e9fd4c00..95a9ff9e2399 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -279,8 +279,13 @@ int squashfs_read_inode(struct inode *inode, long long ino) if (err < 0) goto failed_read; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le32_to_cpu(sqsh_ino->symlink_size); + if (inode->i_size > PAGE_SIZE) { + ERROR("Corrupted symlink\n"); + return -EINVAL; + } + + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_op = &squashfs_symlink_inode_ops; inode_nohighmem(inode); inode->i_data.a_ops = &squashfs_symlink_aops; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v6.6.51 commit 41a0f85e268d72fe04f731b8ceea4748c2d65491 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX1T CVE: CVE-2024-46752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b56329a782314fde5b61058e2a25097af7ccb675 ] Instead of a BUG_ON() just return an error, log an error message and abort the transaction in case we find an extent buffer belonging to the relocation tree that doesn't have the full backref flag set. This is unexpected and should never happen (save for bugs or a potential bad memory). Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflict: fs/btrfs/ctree.c [No btrfs_root_id yet.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ctree.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index 5addd1e36a8e..f88c443cffea 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -896,8 +896,16 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans, } owner = btrfs_header_owner(buf); - BUG_ON(owner == BTRFS_TREE_RELOC_OBJECTID && - !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)); + if (unlikely(owner == BTRFS_TREE_RELOC_OBJECTID && + !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF))) { + btrfs_crit(fs_info, +"found tree block at bytenr %llu level %d root %llu refs %llu flags %llx without full backref flag set", + buf->start, btrfs_header_level(buf), + root->root_key.objectid, refs, flags); + ret = -EUCLEAN; + btrfs_abort_transaction(trans, ret); + return ret; + } if (refs > 1) { if ((owner == root->root_key.objectid || -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-46751
by Yifan Qiao 24 Sep '24

24 Sep '24

Filipe Manana (3): btrfs: remove superfluous metadata check at btrfs_lookup_extent_info() btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() fs/btrfs/extent-tree.c | 45 +++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 16 deletions(-) -- 2.39.2

2 4

[PATCH OLK-5.10 0/3] CVE-2024-46751
by Yifan Qiao 24 Sep '24

24 Sep '24

Filipe Manana (3): btrfs: remove superfluous metadata check at btrfs_lookup_extent_info() btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() fs/btrfs/extent-tree.c | 45 +++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 16 deletions(-) -- 2.39.2

2 4

[PATCH OLK-5.10] btrfs: fix qgroup reserve leaks in cow_file_range
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Boris Burkov <boris(a)bur.io> mainline inclusion from mainline-v6.11-rc3 commit 30479f31d44d47ed00ae0c7453d9b253537005b2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5C CVE: CVE-2024-46733 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the buffered write path, the dirty page owns the qgroup reserve until it creates an ordered_extent. Therefore, any errors that occur before the ordered_extent is created must free that reservation, or else the space is leaked. The fstest generic/475 exercises various IO error paths, and is able to trigger errors in cow_file_range where we fail to get to allocating the ordered extent. Note that because we *do* clear delalloc, we are likely to remove the inode from the delalloc list, so the inodes/pages to not have invalidate/launder called on them in the commit abort path. This results in failures at the unmount stage of the test that look like: BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:close_ctree+0x222/0x4d0 [btrfs] RSP: 0018:ffffb4465283be00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0 Call Trace: <TASK> ? close_ctree+0x222/0x4d0 [btrfs] ? __warn.cold+0x8e/0xea ? close_ctree+0x222/0x4d0 [btrfs] ? report_bug+0xff/0x140 ? handle_bug+0x3b/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? close_ctree+0x222/0x4d0 [btrfs] generic_shutdown_super+0x70/0x160 kill_anon_super+0x11/0x40 btrfs_kill_super+0x11/0x20 [btrfs] deactivate_locked_super+0x2e/0xa0 cleanup_mnt+0xb5/0x150 task_work_run+0x57/0x80 syscall_exit_to_user_mode+0x121/0x130 do_syscall_64+0xab/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f916847a887 ---[ end trace 0000000000000000 ]--- BTRFS error (device dm-8 state EA): qgroup reserved space leaked Cases 2 and 3 in the out_reserve path both pertain to this type of leak and must free the reserved qgroup data. Because it is already an error path, I opted not to handle the possible errors in btrfs_free_qgroup_data. Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/inode.c [The cleanup logic is very old in 5.10, need to adapt the logic.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/inode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index b1138ba9642d..9e8e5be6e97f 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1161,6 +1161,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, locked_page, clear_bits, page_ops); + btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size); start += cur_alloc_size; if (start >= end) goto out; @@ -1168,6 +1169,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, extent_clear_unlock_delalloc(inode, start, end, locked_page, clear_bits | EXTENT_CLEAR_DATA_RESV, page_ops); + btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size); goto out; } @@ -1777,7 +1779,7 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, if (nocow) btrfs_dec_nocow_writers(fs_info, disk_bytenr); - if (ret && cur_offset < end) + if (ret && cur_offset < end) { extent_clear_unlock_delalloc(inode, cur_offset, end, locked_page, EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DEFRAG | @@ -1785,6 +1787,8 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, PAGE_CLEAR_DIRTY | PAGE_SET_WRITEBACK | PAGE_END_WRITEBACK); + btrfs_qgroup_free_data(inode, NULL, cur_offset, end - cur_offset + 1); + } btrfs_free_path(path); return ret; } -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v6.6.51 commit 41a0f85e268d72fe04f731b8ceea4748c2d65491 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX1T CVE: CVE-2024-46752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b56329a782314fde5b61058e2a25097af7ccb675 ] Instead of a BUG_ON() just return an error, log an error message and abort the transaction in case we find an extent buffer belonging to the relocation tree that doesn't have the full backref flag set. This is unexpected and should never happen (save for bugs or a potential bad memory). Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflict: fs/btrfs/ctree.c [No btrfs_root_id yet.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ctree.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index 814f2f07e74c..55896280b2dd 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -896,8 +896,16 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans, } owner = btrfs_header_owner(buf); - BUG_ON(owner == BTRFS_TREE_RELOC_OBJECTID && - !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)); + if (unlikely(owner == BTRFS_TREE_RELOC_OBJECTID && + !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF))) { + btrfs_crit(fs_info, +"found tree block at bytenr %llu level %d root %llu refs %llu flags %llx without full backref flag set", + buf->start, btrfs_header_level(buf), + root->root_key.objectid, refs, flags); + ret = -EUCLEAN; + btrfs_abort_transaction(trans, ret); + return ret; + } if (refs > 1) { if ((owner == root->root_key.objectid || -- 2.39.2

2 1

[PATCH OLK-5.10] Squashfs: sanity check symbolic link size
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v5.10.226 commit 5c8906de98d0d7ad42ff3edf2cb6cd7e0ea658c4 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAF CVE: CVE-2024-46744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 810ee43d9cd245d138a2733d87a24858a23f577d ] Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. -- Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk Reported-by: Lizhi Xu <lizhi.xu(a)windriver.com> Reported-by: syzbot+24ac24ff58dc5b0d26b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/ V2: fix spelling mistake. Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/squashfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 9fb8e9fd4c00..95a9ff9e2399 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -279,8 +279,13 @@ int squashfs_read_inode(struct inode *inode, long long ino) if (err < 0) goto failed_read; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le32_to_cpu(sqsh_ino->symlink_size); + if (inode->i_size > PAGE_SIZE) { + ERROR("Corrupted symlink\n"); + return -EINVAL; + } + + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_op = &squashfs_symlink_inode_ops; inode_nohighmem(inode); inode->i_data.a_ops = &squashfs_symlink_aops; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] Squashfs: sanity check symbolic link size
by Yifan Qiao 24 Sep '24

24 Sep '24

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v4.19.322 commit f82cb7f24032ed023fc67d26ea9bf322d8431a90 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYAF CVE: CVE-2024-46744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 810ee43d9cd245d138a2733d87a24858a23f577d ] Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. -- Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk Reported-by: Lizhi Xu <lizhi.xu(a)windriver.com> Reported-by: syzbot+24ac24ff58dc5b0d26b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/ V2: fix spelling mistake. Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/squashfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 98825d8a03eb..aee2ec547f1a 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -292,8 +292,13 @@ int squashfs_read_inode(struct inode *inode, long long ino) if (err < 0) goto failed_read; - set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le32_to_cpu(sqsh_ino->symlink_size); + if (inode->i_size > PAGE_SIZE) { + ERROR("Corrupted symlink\n"); + return -EINVAL; + } + + set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_op = &squashfs_symlink_inode_ops; inode_nohighmem(inode); inode->i_data.a_ops = &squashfs_symlink_aops; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] binder: fix UAF caused by offsets overwrite
by Wupeng Ma 24 Sep '24

24 Sep '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.226 commit 3a8154bb4ab4a01390a3abf1e6afac296e037da4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY7V CVE: CVE-2024-46740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4df153652cc46545722879415937582028c18af5 upstream. Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Allocated by task 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Freed by task 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ================================================================== To avoid this issue, let's check that the raw data copy is within the boundaries of the data section. Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") Cc: Todd Kjos <tkjos(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20240822182353.2129600-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/android/binder.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 723e5a919c20..266ce581e751 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3555,6 +3555,7 @@ static void binder_transaction(struct binder_proc *proc, */ copy_size = object_offset - user_offset; if (copy_size && (user_offset > object_offset || + object_offset > tr->data_size || binder_alloc_copy_user_to_buffer( &target_proc->alloc, t->buffer, user_offset, -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 21355/23742] drivers/gpio/gpio-phytium-core.c:346:5: warning: "CONFIG_SMP" is not defined, evaluates to 0
by kernel test robot 24 Sep '24

24 Sep '24

Hi Tian, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f2ffc6afa458c9c8ddacf5000e60c1be28e095e1 commit: 00711bad7e372a30c4975ba43811ffa666aff0e1 [21355/23742] gpio: add phytium gpio driver config: x86_64-randconfig-r063-20240924 (https://download.01.org/0day-ci/archive/20240924/202409241018.HxSSkSip-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240924/202409241018.HxSSkSip-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409241018.HxSSkSip-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/gpio/gpio-phytium-core.c:346:5: warning: "CONFIG_SMP" is not defined, evaluates to 0 [-Wundef] 346 | #if CONFIG_SMP | ^~~~~~~~~~ >> drivers/gpio/gpio-phytium-core.c:346:5: warning: "CONFIG_SMP" is not defined, evaluates to 0 [-Wundef] 346 | #if CONFIG_SMP | ^~~~~~~~~~ vim +/CONFIG_SMP +346 drivers/gpio/gpio-phytium-core.c 345 > 346 #if CONFIG_SMP 347 int 348 phytium_gpio_irq_set_affinity(struct irq_data *d, 349 const struct cpumask *mask_val, bool force) 350 { 351 struct gpio_chip *chip_data = irq_data_get_irq_chip_data(d); 352 struct irq_chip *chip = irq_get_chip(chip_data->irq.num_parents); 353 struct irq_data *data = irq_get_irq_data(chip_data->irq.num_parents); 354 355 if (chip && chip->irq_set_affinity) 356 return chip->irq_set_affinity(data, mask_val, force); 357 358 return -EINVAL; 359 } 360 EXPORT_SYMBOL_GPL(phytium_gpio_irq_set_affinity); 361 #endif 362 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] userfaultfd: fix checks for huge PMDs
by Liu Shixin 24 Sep '24

24 Sep '24

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.11-rc7 commit 71c186efc1b2cf1aeabfeff3b9bd5ac4c5ac14d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWOX CVE: CVE-2024-46787 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2. The pmd_trans_huge() code in mfill_atomic() is wrong in three different ways depending on kernel version: 1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit the right two race windows) - I've tested this in a kernel build with some extra mdelay() calls. See the commit message for a description of the race scenario. On older kernels (before 6.5), I think the same bug can even theoretically lead to accessing transhuge page contents as a page table if you hit the right 5 narrow race windows (I haven't tested this case). 2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for detecting PMDs that don't point to page tables. On older kernels (before 6.5), you'd just have to win a single fairly wide race to hit this. I've tested this on 6.1 stable by racing migration (with a mdelay() patched into try_to_migrate()) against UFFDIO_ZEROPAGE - on my x86 VM, that causes a kernel oops in ptlock_ptr(). 3. On newer kernels (>=6.5), for shmem mappings, khugepaged is allowed to yank page tables out from under us (though I haven't tested that), so I think the BUG_ON() checks in mfill_atomic() are just wrong. I decided to write two separate fixes for these (one fix for bugs 1+2, one fix for bug 3), so that the first fix can be backported to kernels affected by bugs 1+2. This patch (of 2): This fixes two issues. I discovered that the following race can occur: mfill_atomic other thread ============ ============ <zap PMD> pmdp_get_lockless() [reads none pmd] <bail if trans_huge> <if none:> <pagefault creates transhuge zeropage> __pte_alloc [no-op] <zap PMD> <bail if pmd_trans_huge(*dst_pmd)> BUG_ON(pmd_none(*dst_pmd)) I have experimentally verified this in a kernel with extra mdelay() calls; the BUG_ON(pmd_none(*dst_pmd)) triggers. On kernels newer than commit 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail"), this can't lead to anything worse than a BUG_ON(), since the page table access helpers are actually designed to deal with page tables concurrently disappearing; but on older kernels (<=6.4), I think we could probably theoretically race past the two BUG_ON() checks and end up treating a hugepage as a page table. The second issue is that, as Qi Zheng pointed out, there are other types of huge PMDs that pmd_trans_huge() can't catch: devmap PMDs and swap PMDs (in particular, migration PMDs). On <=6.4, this is worse than the first issue: If mfill_atomic() runs on a PMD that contains a migration entry (which just requires winning a single, fairly wide race), it will pass the PMD to pte_offset_map_lock(), which assumes that the PMD points to a page table. Breakage follows: First, the kernel tries to take the PTE lock (which will crash or maybe worse if there is no "struct page" for the address bits in the migration entry PMD - I think at least on X86 there usually is no corresponding "struct page" thanks to the PTE inversion mitigation, amd64 looks different). If that didn't crash, the kernel would next try to write a PTE into what it wrongly thinks is a page table. As part of fixing these issues, get rid of the check for pmd_trans_huge() before __pte_alloc() - that's redundant, we're going to have to check for that after the __pte_alloc() anyway. Backport note: pmdp_get_lockless() is pmd_read_atomic() in older kernels. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-0-5efa61078a41@goog… Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-1-5efa61078a41@goog… Fixes: c1a4de99fada ("userfaultfd: mcopy_atomic|mfill_zeropage: UFFDIO_COPY|UFFDIO_ZEROPAGE preparation") Signed-off-by: Jann Horn <jannh(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Jann Horn <jannh(a)google.com> Cc: Pavel Emelyanov <xemul(a)virtuozzo.com> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/userfaultfd.c [ pmd_read_atomic() is renamed to pmdp_get_lockless() in dab6e717429e5e ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/userfaultfd.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index 15c46208a2ac..41ebcdce430a 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -583,21 +583,23 @@ static __always_inline ssize_t __mcopy_atomic(struct mm_struct *dst_mm, } dst_pmdval = pmd_read_atomic(dst_pmd); - /* - * If the dst_pmd is mapped as THP don't - * override it and just be strict. - */ - if (unlikely(pmd_trans_huge(dst_pmdval))) { - err = -EEXIST; - break; - } if (unlikely(pmd_none(dst_pmdval)) && unlikely(__pte_alloc(dst_mm, dst_pmd))) { err = -ENOMEM; break; } - /* If an huge pmd materialized from under us fail */ - if (unlikely(pmd_trans_huge(*dst_pmd))) { + dst_pmdval = pmd_read_atomic(dst_pmd); + /* + * If the dst_pmd is THP don't override it and just be strict. + * (This includes the case where the PMD used to be THP and + * changed back to none after __pte_alloc().) + */ + if (unlikely(!pmd_present(dst_pmdval) || pmd_trans_huge(dst_pmdval) || + pmd_devmap(dst_pmdval))) { + err = -EEXIST; + break; + } + if (unlikely(pmd_bad(dst_pmdval))) { err = -EFAULT; break; } -- 2.34.1

2 1

[PATCH OLK-5.10] userfaultfd: fix checks for huge PMDs
by Liu Shixin 24 Sep '24

24 Sep '24

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.11-rc7 commit 71c186efc1b2cf1aeabfeff3b9bd5ac4c5ac14d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWOX CVE: CVE-2024-46787 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2. The pmd_trans_huge() code in mfill_atomic() is wrong in three different ways depending on kernel version: 1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit the right two race windows) - I've tested this in a kernel build with some extra mdelay() calls. See the commit message for a description of the race scenario. On older kernels (before 6.5), I think the same bug can even theoretically lead to accessing transhuge page contents as a page table if you hit the right 5 narrow race windows (I haven't tested this case). 2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for detecting PMDs that don't point to page tables. On older kernels (before 6.5), you'd just have to win a single fairly wide race to hit this. I've tested this on 6.1 stable by racing migration (with a mdelay() patched into try_to_migrate()) against UFFDIO_ZEROPAGE - on my x86 VM, that causes a kernel oops in ptlock_ptr(). 3. On newer kernels (>=6.5), for shmem mappings, khugepaged is allowed to yank page tables out from under us (though I haven't tested that), so I think the BUG_ON() checks in mfill_atomic() are just wrong. I decided to write two separate fixes for these (one fix for bugs 1+2, one fix for bug 3), so that the first fix can be backported to kernels affected by bugs 1+2. This patch (of 2): This fixes two issues. I discovered that the following race can occur: mfill_atomic other thread ============ ============ <zap PMD> pmdp_get_lockless() [reads none pmd] <bail if trans_huge> <if none:> <pagefault creates transhuge zeropage> __pte_alloc [no-op] <zap PMD> <bail if pmd_trans_huge(*dst_pmd)> BUG_ON(pmd_none(*dst_pmd)) I have experimentally verified this in a kernel with extra mdelay() calls; the BUG_ON(pmd_none(*dst_pmd)) triggers. On kernels newer than commit 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail"), this can't lead to anything worse than a BUG_ON(), since the page table access helpers are actually designed to deal with page tables concurrently disappearing; but on older kernels (<=6.4), I think we could probably theoretically race past the two BUG_ON() checks and end up treating a hugepage as a page table. The second issue is that, as Qi Zheng pointed out, there are other types of huge PMDs that pmd_trans_huge() can't catch: devmap PMDs and swap PMDs (in particular, migration PMDs). On <=6.4, this is worse than the first issue: If mfill_atomic() runs on a PMD that contains a migration entry (which just requires winning a single, fairly wide race), it will pass the PMD to pte_offset_map_lock(), which assumes that the PMD points to a page table. Breakage follows: First, the kernel tries to take the PTE lock (which will crash or maybe worse if there is no "struct page" for the address bits in the migration entry PMD - I think at least on X86 there usually is no corresponding "struct page" thanks to the PTE inversion mitigation, amd64 looks different). If that didn't crash, the kernel would next try to write a PTE into what it wrongly thinks is a page table. As part of fixing these issues, get rid of the check for pmd_trans_huge() before __pte_alloc() - that's redundant, we're going to have to check for that after the __pte_alloc() anyway. Backport note: pmdp_get_lockless() is pmd_read_atomic() in older kernels. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-0-5efa61078a41@goog… Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-1-5efa61078a41@goog… Fixes: c1a4de99fada ("userfaultfd: mcopy_atomic|mfill_zeropage: UFFDIO_COPY|UFFDIO_ZEROPAGE preparation") Signed-off-by: Jann Horn <jannh(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Jann Horn <jannh(a)google.com> Cc: Pavel Emelyanov <xemul(a)virtuozzo.com> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/userfaultfd.c [ pmd_read_atomic() is renamed to pmdp_get_lockless() in dab6e717429e5e ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/userfaultfd.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index eb272c4d1e89..9d462ffa0157 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -575,21 +575,23 @@ static __always_inline ssize_t __mcopy_atomic(struct mm_struct *dst_mm, } dst_pmdval = pmd_read_atomic(dst_pmd); - /* - * If the dst_pmd is mapped as THP don't - * override it and just be strict. - */ - if (unlikely(pmd_trans_huge(dst_pmdval))) { - err = -EEXIST; - break; - } if (unlikely(pmd_none(dst_pmdval)) && unlikely(__pte_alloc(dst_mm, dst_pmd))) { err = -ENOMEM; break; } - /* If an huge pmd materialized from under us fail */ - if (unlikely(pmd_trans_huge(*dst_pmd))) { + dst_pmdval = pmd_read_atomic(dst_pmd); + /* + * If the dst_pmd is THP don't override it and just be strict. + * (This includes the case where the PMD used to be THP and + * changed back to none after __pte_alloc().) + */ + if (unlikely(!pmd_present(dst_pmdval) || pmd_trans_huge(dst_pmdval) || + pmd_devmap(dst_pmdval))) { + err = -EEXIST; + break; + } + if (unlikely(pmd_bad(dst_pmdval))) { err = -EFAULT; break; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] x86/mm: Fix pti_clone_pgtable() alignment assumption
by Liu Shixin 24 Sep '24

24 Sep '24

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v4.19.320 commit 18da1b27ce16a14a9b636af9232acb4fb24f4c9e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYY CVE: CVE-2024-44965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 41e71dbb0e0a0fe214545fe64af031303a08524c ] Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions. Fixes: 16a3fe634f6a ("x86/mm/pti: Clone kernel-image on PTE level for 32 bit") Reported-by: Guenter Roeck <linux(a)roeck-us.net> Tested-by: Guenter Roeck <linux(a)roeck-us.net> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20240731163105.GG33588@noisy.programming.kicks-as… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- arch/x86/mm/pti.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c index 622d5968c979..21105ae44ca1 100644 --- a/arch/x86/mm/pti.c +++ b/arch/x86/mm/pti.c @@ -383,14 +383,14 @@ pti_clone_pgtable(unsigned long start, unsigned long end, */ *target_pmd = *pmd; - addr += PMD_SIZE; + addr = round_up(addr + 1, PMD_SIZE); } else if (level == PTI_CLONE_PTE) { /* Walk the page-table down to the pte level */ pte = pte_offset_kernel(pmd, addr); if (pte_none(*pte)) { - addr += PAGE_SIZE; + addr = round_up(addr + 1, PAGE_SIZE); continue; } @@ -410,7 +410,7 @@ pti_clone_pgtable(unsigned long start, unsigned long end, /* Clone the PTE */ *target_pte = *pte; - addr += PAGE_SIZE; + addr = round_up(addr + 1, PAGE_SIZE); } else { BUG(); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] x86/mm: Fix pti_clone_pgtable() alignment assumption
by Liu Shixin 24 Sep '24

24 Sep '24

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v5.10.224 commit d00c9b4bbc442d99e1dafbdfdab848bc1ead73f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYY CVE: CVE-2024-44965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 41e71dbb0e0a0fe214545fe64af031303a08524c ] Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions. Fixes: 16a3fe634f6a ("x86/mm/pti: Clone kernel-image on PTE level for 32 bit") Reported-by: Guenter Roeck <linux(a)roeck-us.net> Tested-by: Guenter Roeck <linux(a)roeck-us.net> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20240731163105.GG33588@noisy.programming.kicks-as… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- arch/x86/mm/pti.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c index 1aab92930569..59c13fdb8da0 100644 --- a/arch/x86/mm/pti.c +++ b/arch/x86/mm/pti.c @@ -374,14 +374,14 @@ pti_clone_pgtable(unsigned long start, unsigned long end, */ *target_pmd = *pmd; - addr += PMD_SIZE; + addr = round_up(addr + 1, PMD_SIZE); } else if (level == PTI_CLONE_PTE) { /* Walk the page-table down to the pte level */ pte = pte_offset_kernel(pmd, addr); if (pte_none(*pte)) { - addr += PAGE_SIZE; + addr = round_up(addr + 1, PAGE_SIZE); continue; } @@ -401,7 +401,7 @@ pti_clone_pgtable(unsigned long start, unsigned long end, /* Clone the PTE */ *target_pte = *pte; - addr += PAGE_SIZE; + addr = round_up(addr + 1, PAGE_SIZE); } else { BUG(); -- 2.34.1

2 1

[PATCH OLK-5.10] x86/mm: Fix pti_clone_pgtable() alignment assumption
by Liu Shixin 24 Sep '24

24 Sep '24

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v5.10.224 commit d00c9b4bbc442d99e1dafbdfdab848bc1ead73f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYY CVE: CVE-2024-44965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 41e71dbb0e0a0fe214545fe64af031303a08524c ] Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions. Fixes: 16a3fe634f6a ("x86/mm/pti: Clone kernel-image on PTE level for 32 bit") Reported-by: Guenter Roeck <linux(a)roeck-us.net> Tested-by: Guenter Roeck <linux(a)roeck-us.net> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20240731163105.GG33588@noisy.programming.kicks-as… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- arch/x86/mm/pti.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c index 1aab92930569..59c13fdb8da0 100644 --- a/arch/x86/mm/pti.c +++ b/arch/x86/mm/pti.c @@ -374,14 +374,14 @@ pti_clone_pgtable(unsigned long start, unsigned long end, */ *target_pmd = *pmd; - addr += PMD_SIZE; + addr = round_up(addr + 1, PMD_SIZE); } else if (level == PTI_CLONE_PTE) { /* Walk the page-table down to the pte level */ pte = pte_offset_kernel(pmd, addr); if (pte_none(*pte)) { - addr += PAGE_SIZE; + addr = round_up(addr + 1, PAGE_SIZE); continue; } @@ -401,7 +401,7 @@ pti_clone_pgtable(unsigned long start, unsigned long end, /* Clone the PTE */ *target_pte = *pte; - addr += PAGE_SIZE; + addr = round_up(addr + 1, PAGE_SIZE); } else { BUG(); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] Fix iBMA bug and change version
by Yuan Can 24 Sep '24

24 Sep '24

From: Wujiahai <wujiahai(a)huawei.com> 1. The initialization sequence of the edma_host.timer and edma_host is optimized when the iBMA initializes the edma driver. 2. Change the iBMA driver version. Wujiahai (1): BMA: Fix edma driver initialization problem and change the version number. .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../ethernet/huawei/bma/edma_drv/edma_host.c | 80 ++++++++----------- .../huawei/bma/kbox_drv/kbox_include.h | 2 +- .../ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 38 insertions(+), 50 deletions(-) -- 2.27.0

2 2

[PATCH openEuler-22.03-LTS-SP1 0/4] Fix CVE-2024-45025
by Long Li 24 Sep '24

24 Sep '24

This patch fix CVE-2024-45025 Al Viro (1): fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE Alexander Lobakin (3): fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64() bitmap: introduce generic optimized bitmap_size() s390/cio: rename bitmap_size() -> idset_bitmap_size() drivers/md/dm-clone-metadata.c | 5 --- drivers/s390/cio/idset.c | 12 ++++--- fs/file.c | 30 +++++++--------- fs/ntfs3/bitmap.c | 4 +-- fs/ntfs3/fsntfs.c | 2 +- fs/ntfs3/index.c | 11 +++--- fs/ntfs3/ntfs_fs.h | 4 +-- fs/ntfs3/super.c | 2 +- include/linux/bitmap.h | 20 +++++++++-- include/linux/cpumask.h | 2 +- lib/math/prime_numbers.c | 2 -- tools/include/linux/bitmap.h | 7 ++-- .../testing/selftests/core/close_range_test.c | 35 +++++++++++++++++++ 13 files changed, 89 insertions(+), 47 deletions(-) -- 2.39.2

2 5

[PATCH openEuler-1.0-LTS] wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
by Liu Jian 24 Sep '24

24 Sep '24

From: Sascha Hauer <s.hauer(a)pengutronix.de> stable inclusion from stable-v4.19.322 commit a12cf97cbefa139ef8d95081f2ea047cbbd74b7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYCZ CVE: CVE-2024-46755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit c145eea2f75ff7949392aebecf7ef0a81c1f6c14 ] mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which have priv->bss_mode set to something else than NL80211_IFTYPE_UNSPECIFIED. Said NULL pointer dereference happened when an Accesspoint was started with wpa_supplicant -i mlan0 with this config: network={ ssid="somessid" mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk="12345678" } When waiting for the AP to be established, interrupting wpa_supplicant with <ctrl-c> and starting it again this happens: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000 | [0000000000000140] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18 | Hardware name: somemachine (DT) | Workqueue: events sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157 | x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Call trace: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | process_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | process_one_work+0x148/0x2a0 | worker_thread+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ end trace 0000000000000000 ]--- Signed-off-by: Sascha Hauer <s.hauer(a)pengutronix.de> Acked-by: Brian Norris <briannorris(a)chromium.org> Reviewed-by: Francesco Dolcini <francesco.dolcini(a)toradex.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://patch.msgid.link/20240703072409.556618-1-s.hauer@pengutronix.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/wireless/marvell/mwifiex/main.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h index e39bb5c42c9a..3643b0372f16 100644 --- a/drivers/net/wireless/marvell/mwifiex/main.h +++ b/drivers/net/wireless/marvell/mwifiex/main.h @@ -1319,6 +1319,9 @@ mwifiex_get_priv_by_id(struct mwifiex_adapter *adapter, for (i = 0; i < adapter->priv_num; i++) { if (adapter->priv[i]) { + if (adapter->priv[i]->bss_mode == NL80211_IFTYPE_UNSPECIFIED) + continue; + if ((adapter->priv[i]->bss_num == bss_num) && (adapter->priv[i]->bss_type == bss_type)) break; -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 686352476cd29ec854b93e09a49d57c25a18a32f
by kernel test robot 24 Sep '24

24 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 686352476cd29ec854b93e09a49d57c25a18a32f !9476 [22.03-LTS-SP3]enable CONFIG_BPF_LSM option by default to use safegurad Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202409240243.FnQ7nuJi-lkp@intel.com drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2361: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2875: first defined here drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2371: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2885: first defined here drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2393: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2908: first defined here mm/memcontrol.c:5879:26: error: implicit declaration of function 'ksm_process_profit' [-Werror,-Wimplicit-function-declaration] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-003-20240923 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | |-- ld.lld:error:duplicate-symbol:debug | `-- ld.lld:error:duplicate-symbol:nic_ioctl |-- x86_64-buildonly-randconfig-001-20240924 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-buildonly-randconfig-002-20240924 | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-003-20240924 | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20240924 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-005-20240924 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-006-20240924 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-kexec | |-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-001-20240923 | |-- multiple-definition-of-flash_erase_chip-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here | |-- multiple-definition-of-flash_erase_sector-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here | |-- multiple-definition-of-flash_write_dword-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here | |-- multiple-definition-of-fmgr_cmd_op-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here | `-- multiple-definition-of-fmgr_usr_cmd_op-drivers-net-ethernet-netswift-txgbe-txgbe_hw.o:drivers-net-ethernet-netswift-txgbe-txgbe_hw.c:first-defined-here |-- x86_64-randconfig-001-20240924 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-002-20240924 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-003-20240924 | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-004-20240924 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-161-20240924 | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_root_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_root_table-procname | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_table-procname | |-- fs-cifs-file.c-cifs_write_from_iter()-error:uninitialized-symbol-pagevec-. | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register | `-- mm-memcontrol.c-uncharge_page()-error:uninitialized-symbol-objcg-. |-- x86_64-rhel-8.3 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-func | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-kselftests | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 728m configs tested: 22 configs skipped: 128 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240923 clang-20 arm64 randconfig-002-20240923 clang-20 arm64 randconfig-003-20240923 clang-20 arm64 randconfig-004-20240923 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240924 gcc-12 x86_64 buildonly-randconfig-002-20240924 gcc-12 x86_64 buildonly-randconfig-003-20240924 clang-18 x86_64 buildonly-randconfig-004-20240924 clang-18 x86_64 buildonly-randconfig-005-20240924 clang-18 x86_64 buildonly-randconfig-006-20240924 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240924 clang-18 x86_64 randconfig-002-20240924 gcc-12 x86_64 randconfig-003-20240924 gcc-12 x86_64 randconfig-004-20240924 gcc-12 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 497bb858ba94e6004a6c2a2e824d1b329056e80b
by kernel test robot 24 Sep '24

24 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 497bb858ba94e6004a6c2a2e824d1b329056e80b !11669 cgroup-psi-add-PSI_STATE_LAST-for-kabi-reserve Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_gerror_handler |-- loongarch-allmodconfig | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance |-- x86_64-buildonly-randconfig-002-20240924 | `-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node `-- x86_64-buildonly-randconfig-005-20240924 `-- drivers-crypto-ccp-hygon-hct.c:error:no-member-named-numa_node-in-struct-device elapsed time: 723m configs tested: 28 configs skipped: 124 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240923 clang-20 arm64 randconfig-002-20240923 clang-20 arm64 randconfig-003-20240923 clang-20 arm64 randconfig-004-20240923 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240923 gcc-14.1.0 loongarch randconfig-002-20240923 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240924 gcc-12 x86_64 buildonly-randconfig-002-20240924 gcc-12 x86_64 buildonly-randconfig-003-20240924 clang-18 x86_64 buildonly-randconfig-004-20240924 clang-18 x86_64 buildonly-randconfig-005-20240924 clang-18 x86_64 buildonly-randconfig-006-20240924 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240924 clang-18 x86_64 randconfig-002-20240924 gcc-12 x86_64 randconfig-003-20240924 gcc-12 x86_64 randconfig-004-20240924 gcc-12 x86_64 randconfig-005-20240924 clang-18 x86_64 randconfig-006-20240924 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 13578/30000] drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here
by kernel test robot 24 Sep '24

24 Sep '24

Hi DuanqiangWen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 686352476cd29ec854b93e09a49d57c25a18a32f commit: 3ddd74dceeba1f4ea8b20db59276ea3c6eded3d5 [13578/30000] openeuler: net: txgbe: Fix some known bugs, merge net-swift txgbe-1.2.3 out-of-tree config: x86_64-randconfig-001-20240923 (https://download.01.org/0day-ci/archive/20240924/202409240243.FnQ7nuJi-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240924/202409240243.FnQ7nuJi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409240243.FnQ7nuJi-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_cmd_op': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2340: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2854: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `fmgr_usr_cmd_op': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2361: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2875: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_chip': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2371: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2885: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_sector': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_write_dword': >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2393: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2908: first defined here vim +2340 drivers/net/ethernet/netswift/ngbe/ngbe_hw.c a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2333 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2334 /** a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2335 * cmd_addr is used for some special command: a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2336 * 1. to be sector address, when implemented erase sector command a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2337 * 2. to be flash address when implemented read, write flash address a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2338 **/ a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2339 u8 fmgr_cmd_op(struct ngbe_hw *hw, u32 cmd, u32 cmd_addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2340 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2341 u32 cmd_val = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2342 u32 time_out = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2343 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2344 cmd_val = (cmd << SPI_CLK_CMD_OFFSET) | (SPI_CLK_DIV << SPI_CLK_DIV_OFFSET) | cmd_addr; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2345 wr32(hw, SPI_H_CMD_REG_ADDR, cmd_val); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2346 while (1) { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2347 if (rd32(hw, SPI_H_STA_REG_ADDR) & 0x1) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2348 break; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2349 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2350 if (time_out == SPI_TIME_OUT_VALUE) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2351 return 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2352 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2353 time_out = time_out + 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2354 udelay(10); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2355 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2356 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2357 return 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2358 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2359 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2360 u8 fmgr_usr_cmd_op(struct ngbe_hw *hw, u32 usr_cmd) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2361 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2362 u8 status = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2363 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2364 wr32(hw, SPI_H_USR_CMD_REG_ADDR, usr_cmd); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2365 status = fmgr_cmd_op(hw, SPI_CMD_USER_CMD, 0); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2366 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2367 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2368 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2369 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2370 u8 flash_erase_chip(struct ngbe_hw *hw) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2371 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2372 u8 status = fmgr_cmd_op(hw, SPI_CMD_ERASE_CHIP, 0); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2373 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2374 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2375 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2376 u8 flash_erase_sector(struct ngbe_hw *hw, u32 sec_addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2377 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2378 u8 status = fmgr_cmd_op(hw, SPI_CMD_ERASE_SECTOR, sec_addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2379 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2380 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2381 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2382 u32 ngbe_flash_read_dword(struct ngbe_hw *hw, u32 addr) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2383 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2384 u8 status = fmgr_cmd_op(hw, SPI_CMD_READ_DWORD, addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2385 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2386 if (status) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2387 return (u32)status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2388 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2389 return rd32(hw, SPI_H_DAT_REG_ADDR); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2390 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2391 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2392 u8 flash_write_dword(struct ngbe_hw *hw, u32 addr, u32 dword) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2393 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2394 u8 status = 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2395 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2396 wr32(hw, SPI_H_DAT_REG_ADDR, dword); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2397 status = fmgr_cmd_op(hw, SPI_CMD_WRITE_DWORD, addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2398 if (status) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2399 return status; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2400 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2401 if (dword != ngbe_flash_read_dword(hw, addr)) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2402 return 1; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2403 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2404 return 0; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2405 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2406 :::::: The code at line 2340 was first introduced by commit :::::: a5961b4bc6ce09a70902686ecc848a47493a9251 openeuler: net: ngbe: add ngbe module support :::::: TO: Duanqiang Wen <duanqiangwen(a)net-swift.com> :::::: CC: Duanqiang Wen <duanqiangwen(a)net-swift.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION f2ffc6afa458c9c8ddacf5000e60c1be28e095e1
by kernel test robot 24 Sep '24

24 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: f2ffc6afa458c9c8ddacf5000e60c1be28e095e1 !11645 block: backport debugfs patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | `-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20240923 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | `-- drivers-nvme-host-core.c:error:expected-before-ptrval |-- arm64-randconfig-002-20240923 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-003-20240923 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- arm64-randconfig-004-20240923 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- x86_64-buildonly-randconfig-001-20240923 | |-- drivers-hid-i2c-hid-i2c-hid-dmi-quirks.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20240923 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20240923 | `-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-004-20240923 | `-- arch-x86-power-.tmp_cpu.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-buildonly-randconfig-005-20240923 | |-- drivers-clk-renesas-rcar-gen3-cpg.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-pci-hotplug-pciehp_core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-scsi-scsi_logging.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-dir.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-group.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-symlink.o:warning:objtool:missing-symbol-for-section-.text | `-- net-ax25-ax25_dev.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-003-20240923 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-006-20240923 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-015-20240923 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-071-20240923 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-073-20240923 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-076-20240923 `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity elapsed time: 724m configs tested: 36 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240923 gcc-14.1.0 arm64 randconfig-002-20240923 gcc-14.1.0 arm64 randconfig-003-20240923 gcc-14.1.0 arm64 randconfig-004-20240923 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240923 clang-18 x86_64 buildonly-randconfig-002-20240923 clang-18 x86_64 buildonly-randconfig-003-20240923 clang-18 x86_64 buildonly-randconfig-004-20240923 gcc-12 x86_64 buildonly-randconfig-005-20240923 gcc-12 x86_64 buildonly-randconfig-006-20240923 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240923 gcc-12 x86_64 randconfig-002-20240923 gcc-12 x86_64 randconfig-003-20240923 clang-18 x86_64 randconfig-004-20240923 clang-18 x86_64 randconfig-005-20240923 gcc-12 x86_64 randconfig-006-20240923 clang-18 x86_64 randconfig-011-20240923 clang-18 x86_64 randconfig-012-20240923 clang-18 x86_64 randconfig-013-20240923 gcc-12 x86_64 randconfig-014-20240923 clang-18 x86_64 randconfig-015-20240923 gcc-12 x86_64 randconfig-016-20240923 gcc-12 x86_64 randconfig-071-20240923 clang-18 x86_64 randconfig-072-20240923 gcc-12 x86_64 randconfig-073-20240923 clang-18 x86_64 randconfig-074-20240923 gcc-12 x86_64 randconfig-075-20240923 clang-18 x86_64 randconfig-076-20240923 gcc-12 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-46723
by Liao Chen 23 Sep '24

23 Sep '24

fix CVE-2024-46723 Tim Huang (1): drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/3] Fix CVE-2024-39501
by Chen Jun 23 Sep '24

23 Sep '24

*** BLURB HERE *** Amit Cohen (1): selftests: forwarding: devlink_lib: Wait for udev events after reloading Dan Williams (1): driver core: Fix uevent_show() vs driver detach race Dirk Behme (1): drivers: core: synchronize really_probe() and dev_uevent() drivers/base/core.c | 10 ++++++++-- drivers/base/module.c | 4 ++++ tools/testing/selftests/net/forwarding/devlink_lib.sh | 2 ++ 3 files changed, 14 insertions(+), 2 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-46723
by Liao Chen 23 Sep '24

23 Sep '24

fix CVE-2024-46723 Tim Huang (1): drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] sch/netem: fix use after free in netem_dequeue
by Wang Liang 23 Sep '24

23 Sep '24

From: Stephen Hemminger <stephen(a)networkplumber.org> stable inclusion from stable-v6.6.51 commit dde33a9d0b80aae0c69594d1f462515d7ff1cb3d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX29 CVE: CVE-2024-46800 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a upstream. If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails") Commands to trigger KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF Fixes: 50612537e9ab ("netem: fix classful handling") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Stephen Hemminger <stephen(a)networkplumber.org> Link: https://patch.msgid.link/20240901182438.4992-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_netem.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index 4ad39a4a3cf5..86b3f20a729d 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -731,11 +731,10 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) err = qdisc_enqueue(skb, q->qdisc, &to_free); kfree_skb_list(to_free); - if (err != NET_XMIT_SUCCESS && - net_xmit_drop_count(err)) { - qdisc_qstats_drop(sch); - qdisc_tree_reduce_backlog(sch, 1, - pkt_len); + if (err != NET_XMIT_SUCCESS) { + if (net_xmit_drop_count(err)) + qdisc_qstats_drop(sch); + qdisc_tree_reduce_backlog(sch, 1, pkt_len); } goto tfifo_dequeue; } -- 2.34.1

2 1

[PATCH OLK-5.10] sch/netem: fix use after free in netem_dequeue
by Wang Liang 23 Sep '24

23 Sep '24

From: Stephen Hemminger <stephen(a)networkplumber.org> stable inclusion from stable-v5.10.226 commit 98c75d76187944296068d685dfd8a1e9fd8c4fdc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX29 CVE: CVE-2024-46800 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a upstream. If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails") Commands to trigger KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF Fixes: 50612537e9ab ("netem: fix classful handling") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Stephen Hemminger <stephen(a)networkplumber.org> Link: https://patch.msgid.link/20240901182438.4992-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_netem.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index cd5d821c6f21..51996e971536 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -722,11 +722,10 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) err = qdisc_enqueue(skb, q->qdisc, &to_free); kfree_skb_list(to_free); - if (err != NET_XMIT_SUCCESS && - net_xmit_drop_count(err)) { - qdisc_qstats_drop(sch); - qdisc_tree_reduce_backlog(sch, 1, - pkt_len); + if (err != NET_XMIT_SUCCESS) { + if (net_xmit_drop_count(err)) + qdisc_qstats_drop(sch); + qdisc_tree_reduce_backlog(sch, 1, pkt_len); } goto tfifo_dequeue; } -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: fix double put of @cfile in smb2_rename_path()
by Long Li 23 Sep '24

23 Sep '24

From: Paulo Alcantara <pc(a)manguebit.com> stable inclusion from stable-v6.6.50 commit b27ea9c96efd2c252a981fb00d0f001b86c90f3e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWJS CVE: CVE-2024-46736 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 3523a3df03c6f04f7ea9c2e7050102657e331a4f ] If smb2_set_path_attr() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() again as the reference of @cfile was already dropped by previous smb2_compound_op() call. Fixes: 71f15c90e785 ("smb: client: retry compound request without reusing lease") Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Cc: David Howells <dhowells(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/client/smb2inode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c index 28031c7ba6b1..157466148c33 100644 --- a/fs/smb/client/smb2inode.c +++ b/fs/smb/client/smb2inode.c @@ -1105,6 +1105,8 @@ int smb2_rename_path(const unsigned int xid, co, DELETE, SMB2_OP_RENAME, cfile, source_dentry); if (rc == -EINVAL) { cifs_dbg(FYI, "invalid lease key, resending request without lease"); + cifs_get_writable_path(tcon, from_name, + FIND_WR_WITH_DELETE, &cfile); rc = smb2_set_path_attr(xid, tcon, from_name, to_name, cifs_sb, co, DELETE, SMB2_OP_RENAME, cfile, NULL); } -- 2.39.2

2 1

[PATCH OLK-6.6] smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
by Long Li 23 Sep '24

23 Sep '24

From: Stefan Metzmacher <metze(a)samba.org> stable inclusion from stable-v6.6.48 commit a01859dd6aebf826576513850a3b05992809e9d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4DV CVE: CVE-2024-46688 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit c724b2ab6a46435b4e7d58ad2fbbdb7a318823cf upstream. This happens when called from SMB2_read() while using rdma and reaching the rdma_readwrite_threshold. Cc: stable(a)vger.kernel.org Fixes: a6559cc1d35d ("cifs: split out smb3_use_rdma_offload() helper") Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Stefan Metzmacher <metze(a)samba.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/client/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 61df8a5c6824..bf45b8652e58 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -4431,7 +4431,7 @@ smb2_new_read_req(void **buf, unsigned int *total_len, * If we want to do a RDMA write, fill in and append * smbd_buffer_descriptor_v1 to the end of read request */ - if (smb3_use_rdma_offload(io_parms)) { + if (rdata && smb3_use_rdma_offload(io_parms)) { struct smbd_buffer_descriptor_v1 *v1; bool need_invalidate = server->dialect == SMB30_PROT_ID; -- 2.39.2

2 1

[PATCH OLK-6.6] udf: Avoid excessive partition lengths
by Wupeng Ma 23 Sep '24

23 Sep '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v6.6.51 commit a56330761950cb83de1dfb348479f20c56c95f90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX38 CVE: CVE-2024-46777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ebbe26fd54a9621994bc16b14f2ba8f84c089693 ] Avoid mounting filesystems where the partition would overflow the 32-bits used for block number. Also refuse to mount filesystems where the partition length is so large we cannot safely index bits in a block bitmap. Link: https://patch.msgid.link/20240620130403.14731-1-jack@suse.cz Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/udf/super.c [Ma Wupeng: fix compile warning] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- fs/udf/super.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/udf/super.c b/fs/udf/super.c index e0080fda2526b..a795f18db890b 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c @@ -1080,12 +1080,19 @@ static int udf_fill_partdesc_info(struct super_block *sb, struct udf_part_map *map; struct udf_sb_info *sbi = UDF_SB(sb); struct partitionHeaderDesc *phd; + u32 sum; int err; map = &sbi->s_partmaps[p_index]; map->s_partition_len = le32_to_cpu(p->partitionLength); /* blocks */ map->s_partition_root = le32_to_cpu(p->partitionStartingLocation); + if (check_add_overflow(map->s_partition_root, map->s_partition_len, + &sum)) { + udf_err(sb, "Partition %d has invalid location %u + %u\n", + p_index, map->s_partition_root, map->s_partition_len); + return -EFSCORRUPTED; + } if (p->accessType == cpu_to_le32(PD_ACCESS_TYPE_READ_ONLY)) map->s_partition_flags |= UDF_PART_FLAG_READ_ONLY; @@ -1141,6 +1148,14 @@ static int udf_fill_partdesc_info(struct super_block *sb, bitmap->s_extPosition = le32_to_cpu( phd->unallocSpaceBitmap.extPosition); map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_BITMAP; + /* Check whether math over bitmap won't overflow. */ + if (check_add_overflow(map->s_partition_len, + (__u32)(sizeof(struct spaceBitmapDesc) << 3), + &sum)) { + udf_err(sb, "Partition %d is too long (%u)\n", p_index, + map->s_partition_len); + return -EFSCORRUPTED; + } udf_debug("unallocSpaceBitmap (part %d) @ %u\n", p_index, bitmap->s_extPosition); } -- 2.25.1

2 1

[PATCH OLK-6.6] binder: fix UAF caused by offsets overwrite
by Wupeng Ma 23 Sep '24

23 Sep '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v6.6.51 commit 1f33d9f1d9ac3f0129f8508925000900c2fe5bb0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY7V CVE: CVE-2024-46740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4df153652cc46545722879415937582028c18af5 upstream. Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Allocated by task 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Freed by task 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ================================================================== To avoid this issue, let's check that the raw data copy is within the boundaries of the data section. Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") Cc: Todd Kjos <tkjos(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20240822182353.2129600-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/android/binder.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index ccaceedbc2c01..94f10c6eb336a 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3342,6 +3342,7 @@ static void binder_transaction(struct binder_proc *proc, */ copy_size = object_offset - user_offset; if (copy_size && (user_offset > object_offset || + object_offset > tr->data_size || binder_alloc_copy_user_to_buffer( &target_proc->alloc, t->buffer, user_offset, -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] binder: fix UAF caused by offsets overwrite
by Wupeng Ma 23 Sep '24

23 Sep '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.226 commit 3a8154bb4ab4a01390a3abf1e6afac296e037da4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY7V CVE: CVE-2024-46740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4df153652cc46545722879415937582028c18af5 upstream. Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Allocated by task 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Freed by task 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ================================================================== To avoid this issue, let's check that the raw data copy is within the boundaries of the data section. Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") Cc: Todd Kjos <tkjos(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20240822182353.2129600-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/android/binder.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index fad1f742197f..282b0495da34 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3530,6 +3530,7 @@ static void binder_transaction(struct binder_proc *proc, */ copy_size = object_offset - user_offset; if (copy_size && (user_offset > object_offset || + object_offset > tr->data_size || binder_alloc_copy_user_to_buffer( &target_proc->alloc, t->buffer, user_offset, -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-46777 for SP1
by Wupeng Ma 23 Sep '24

23 Sep '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-46777 for SP1. Jan Kara (2): udf: Define EFSCORRUPTED error code udf: Avoid excessive partition lengths fs/udf/super.c | 15 +++++++++++++++ fs/udf/udf_sb.h | 2 ++ 2 files changed, 17 insertions(+) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-46711
by Liu Jian 23 Sep '24

23 Sep '24

CVE-2024-46711 Matthieu Baerts (NGI0) (2): mptcp: pm: reuse ID 0 after delete and re-add mptcp: pm: fix ID 0 endp usage after multiple re-creations net/mptcp/pm_netlink.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] net/mlx5e: SHAMPO, Fix incorrect page release
by Liu Jian 23 Sep '24

23 Sep '24

From: Dragos Tatulea <dtatulea(a)nvidia.com> stable inclusion from stable-v6.6.50 commit ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV2G CVE: CVE-2024-46717 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 70bd03b89f20b9bbe51a7f73c4950565a17a45f7 ] Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the last page fragment of a SHAMPO header page) a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from header_index is released. This is wrong and it leads to SHAMPO header pages being released more than once. Signed-off-by: Dragos Tatulea <dtatulea(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://lore.kernel.org/r/20240603212219.1037656-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c index 79ec6fcc9e25..57b0e26696e3 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -2369,7 +2369,8 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct mlx5_cq if (flush) mlx5e_shampo_flush_skb(rq, cqe, match); free_hd_entry: - mlx5e_free_rx_shampo_hd_entry(rq, header_index); + if (likely(head_size)) + mlx5e_free_rx_shampo_hd_entry(rq, header_index); mpwrq_cqe_out: if (likely(wi->consumed_strides < rq->mpwqe.num_strides)) return; -- 2.34.1

2 1

[PATCH OLK-5.10] binder: fix UAF caused by offsets overwrite
by Wupeng Ma 23 Sep '24

23 Sep '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.226 commit 3a8154bb4ab4a01390a3abf1e6afac296e037da4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY7V CVE: CVE-2024-46740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4df153652cc46545722879415937582028c18af5 upstream. Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Allocated by task 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Freed by task 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ================================================================== To avoid this issue, let's check that the raw data copy is within the boundaries of the data section. Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") Cc: Todd Kjos <tkjos(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20240822182353.2129600-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/android/binder.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index bcbaa4d6a0ff..0edf85255043 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3532,6 +3532,7 @@ static void binder_transaction(struct binder_proc *proc, */ copy_size = object_offset - user_offset; if (copy_size && (user_offset > object_offset || + object_offset > tr->data_size || binder_alloc_copy_user_to_buffer( &target_proc->alloc, t->buffer, user_offset, -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
by Liu Jian 23 Sep '24

23 Sep '24

From: Sascha Hauer <s.hauer(a)pengutronix.de> stable inclusion from stable-v6.6.51 commit c2618dcb26c7211342b54520b5b148c0d3471c8a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYCZ CVE: CVE-2024-46755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit c145eea2f75ff7949392aebecf7ef0a81c1f6c14 ] mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which have priv->bss_mode set to something else than NL80211_IFTYPE_UNSPECIFIED. Said NULL pointer dereference happened when an Accesspoint was started with wpa_supplicant -i mlan0 with this config: network={ ssid="somessid" mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk="12345678" } When waiting for the AP to be established, interrupting wpa_supplicant with <ctrl-c> and starting it again this happens: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000 | [0000000000000140] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18 | Hardware name: somemachine (DT) | Workqueue: events sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157 | x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Call trace: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | process_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | process_one_work+0x148/0x2a0 | worker_thread+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ end trace 0000000000000000 ]--- Signed-off-by: Sascha Hauer <s.hauer(a)pengutronix.de> Acked-by: Brian Norris <briannorris(a)chromium.org> Reviewed-by: Francesco Dolcini <francesco.dolcini(a)toradex.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://patch.msgid.link/20240703072409.556618-1-s.hauer@pengutronix.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/wireless/marvell/mwifiex/main.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h index 7bdec6c62248..dc6b4cf616be 100644 --- a/drivers/net/wireless/marvell/mwifiex/main.h +++ b/drivers/net/wireless/marvell/mwifiex/main.h @@ -1290,6 +1290,9 @@ mwifiex_get_priv_by_id(struct mwifiex_adapter *adapter, for (i = 0; i < adapter->priv_num; i++) { if (adapter->priv[i]) { + if (adapter->priv[i]->bss_mode == NL80211_IFTYPE_UNSPECIFIED) + continue; + if ((adapter->priv[i]->bss_num == bss_num) && (adapter->priv[i]->bss_type == bss_type)) break; -- 2.34.1

2 1

[PATCH OLK-5.10] udf: Avoid excessive partition lengths
by Wupeng Ma 23 Sep '24

23 Sep '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.226 commit 551966371e17912564bc387fbeb2ac13077c3db1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX38 CVE: CVE-2024-46777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ebbe26fd54a9621994bc16b14f2ba8f84c089693 ] Avoid mounting filesystems where the partition would overflow the 32-bits used for block number. Also refuse to mount filesystems where the partition length is so large we cannot safely index bits in a block bitmap. Link: https://patch.msgid.link/20240620130403.14731-1-jack@suse.cz Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/udf/super.c [Ma Wupeng: fix compile warning] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- fs/udf/super.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/udf/super.c b/fs/udf/super.c index 1939678f0b62..8747d1c5db53 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c @@ -1076,12 +1076,19 @@ static int udf_fill_partdesc_info(struct super_block *sb, struct udf_part_map *map; struct udf_sb_info *sbi = UDF_SB(sb); struct partitionHeaderDesc *phd; + u32 sum; int err; map = &sbi->s_partmaps[p_index]; map->s_partition_len = le32_to_cpu(p->partitionLength); /* blocks */ map->s_partition_root = le32_to_cpu(p->partitionStartingLocation); + if (check_add_overflow(map->s_partition_root, map->s_partition_len, + &sum)) { + udf_err(sb, "Partition %d has invalid location %u + %u\n", + p_index, map->s_partition_root, map->s_partition_len); + return -EFSCORRUPTED; + } if (p->accessType == cpu_to_le32(PD_ACCESS_TYPE_READ_ONLY)) map->s_partition_flags |= UDF_PART_FLAG_READ_ONLY; @@ -1137,6 +1144,14 @@ static int udf_fill_partdesc_info(struct super_block *sb, bitmap->s_extPosition = le32_to_cpu( phd->unallocSpaceBitmap.extPosition); map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_BITMAP; + /* Check whether math over bitmap won't overflow. */ + if (check_add_overflow(map->s_partition_len, + (__u32)(sizeof(struct spaceBitmapDesc) << 3), + &sum)) { + udf_err(sb, "Partition %d is too long (%u)\n", p_index, + map->s_partition_len); + return -EFSCORRUPTED; + } udf_debug("unallocSpaceBitmap (part %d) @ %u\n", p_index, bitmap->s_extPosition); } -- 2.25.1

2 1

[PATCH OLK-5.10] wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
by Liu Jian 23 Sep '24

23 Sep '24

From: Sascha Hauer <s.hauer(a)pengutronix.de> stable inclusion from stable-v5.10.226 commit 9813770f25855b866b8ead8155b8806b2db70f6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYCZ CVE: CVE-2024-46755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit c145eea2f75ff7949392aebecf7ef0a81c1f6c14 ] mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which have priv->bss_mode set to something else than NL80211_IFTYPE_UNSPECIFIED. Said NULL pointer dereference happened when an Accesspoint was started with wpa_supplicant -i mlan0 with this config: network={ ssid="somessid" mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk="12345678" } When waiting for the AP to be established, interrupting wpa_supplicant with <ctrl-c> and starting it again this happens: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000 | [0000000000000140] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18 | Hardware name: somemachine (DT) | Workqueue: events sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157 | x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Call trace: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | process_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | process_one_work+0x148/0x2a0 | worker_thread+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ end trace 0000000000000000 ]--- Signed-off-by: Sascha Hauer <s.hauer(a)pengutronix.de> Acked-by: Brian Norris <briannorris(a)chromium.org> Reviewed-by: Francesco Dolcini <francesco.dolcini(a)toradex.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://patch.msgid.link/20240703072409.556618-1-s.hauer@pengutronix.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/wireless/marvell/mwifiex/main.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h index f4e3dce10d65..5b14fe08811e 100644 --- a/drivers/net/wireless/marvell/mwifiex/main.h +++ b/drivers/net/wireless/marvell/mwifiex/main.h @@ -1310,6 +1310,9 @@ mwifiex_get_priv_by_id(struct mwifiex_adapter *adapter, for (i = 0; i < adapter->priv_num; i++) { if (adapter->priv[i]) { + if (adapter->priv[i]->bss_mode == NL80211_IFTYPE_UNSPECIFIED) + continue; + if ((adapter->priv[i]->bss_num == bss_num) && (adapter->priv[i]->bss_type == bss_type)) break; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
by Liu Jian 23 Sep '24

23 Sep '24

From: Sascha Hauer <s.hauer(a)pengutronix.de> stable inclusion from stable-v5.10.226 commit 9813770f25855b866b8ead8155b8806b2db70f6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYCZ CVE: CVE-2024-46755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit c145eea2f75ff7949392aebecf7ef0a81c1f6c14 ] mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which have priv->bss_mode set to something else than NL80211_IFTYPE_UNSPECIFIED. Said NULL pointer dereference happened when an Accesspoint was started with wpa_supplicant -i mlan0 with this config: network={ ssid="somessid" mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk="12345678" } When waiting for the AP to be established, interrupting wpa_supplicant with <ctrl-c> and starting it again this happens: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000 | [0000000000000140] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18 | Hardware name: somemachine (DT) | Workqueue: events sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157 | x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Call trace: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | process_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | process_one_work+0x148/0x2a0 | worker_thread+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ end trace 0000000000000000 ]--- Signed-off-by: Sascha Hauer <s.hauer(a)pengutronix.de> Acked-by: Brian Norris <briannorris(a)chromium.org> Reviewed-by: Francesco Dolcini <francesco.dolcini(a)toradex.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://patch.msgid.link/20240703072409.556618-1-s.hauer@pengutronix.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/wireless/marvell/mwifiex/main.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h index f4e3dce10d65..5b14fe08811e 100644 --- a/drivers/net/wireless/marvell/mwifiex/main.h +++ b/drivers/net/wireless/marvell/mwifiex/main.h @@ -1310,6 +1310,9 @@ mwifiex_get_priv_by_id(struct mwifiex_adapter *adapter, for (i = 0; i < adapter->priv_num; i++) { if (adapter->priv[i]) { + if (adapter->priv[i]->bss_mode == NL80211_IFTYPE_UNSPECIFIED) + continue; + if ((adapter->priv[i]->bss_num == bss_num) && (adapter->priv[i]->bss_type == bss_type)) break; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netem: fix return value if duplicate enqueue fails
by Liu Jian 23 Sep '24

23 Sep '24

From: Stephen Hemminger <stephen(a)networkplumber.org> stable inclusion from stable-v5.10.225 commit c414000da1c2ea1ba9a5e5bb1a4ba774e51e202d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJ5 CVE: CVE-2024-45016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit c07ff8592d57ed258afee5a5e04991a48dbaf382 ] There is a bug in netem_enqueue() introduced by commit 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") that can lead to a use-after-free. This commit made netem_enqueue() always return NET_XMIT_SUCCESS when a packet is duplicated, which can cause the parent qdisc's q.qlen to be mistakenly incremented. When this happens qlen_notify() may be skipped on the parent during destruction, leaving a dangling pointer for some classful qdiscs like DRR. There are two ways for the bug happen: - If the duplicated packet is dropped by rootq->enqueue() and then the original packet is also dropped. - If rootq->enqueue() sends the duplicated packet to a different qdisc and the original packet is dropped. In both cases NET_XMIT_SUCCESS is returned even though no packets are enqueued at the netem qdisc. The fix is to defer the enqueue of the duplicate packet until after the original packet has been guaranteed to return NET_XMIT_SUCCESS. Fixes: 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Stephen Hemminger <stephen(a)networkplumber.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20240819175753.5151-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sched/sch_netem.c | 47 ++++++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index b72b308fe406..fe764fea738a 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -437,12 +437,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct netem_sched_data *q = qdisc_priv(sch); /* We don't fill cb now as skb_unshare() may invalidate it */ struct netem_skb_cb *cb; - struct sk_buff *skb2; + struct sk_buff *skb2 = NULL; struct sk_buff *segs = NULL; unsigned int prev_len = qdisc_pkt_len(skb); int count = 1; - int rc = NET_XMIT_SUCCESS; - int rc_drop = NET_XMIT_DROP; /* Do not fool qdisc_drop_all() */ skb->prev = NULL; @@ -471,19 +469,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, skb_orphan_partial(skb); /* - * If we need to duplicate packet, then re-insert at top of the - * qdisc tree, since parent queuer expects that only one - * skb will be queued. + * If we need to duplicate packet, then clone it before + * original is modified. */ - if (count > 1 && (skb2 = skb_clone(skb, GFP_ATOMIC)) != NULL) { - struct Qdisc *rootq = qdisc_root_bh(sch); - u32 dupsave = q->duplicate; /* prevent duplicating a dup... */ - - q->duplicate = 0; - rootq->enqueue(skb2, rootq, to_free); - q->duplicate = dupsave; - rc_drop = NET_XMIT_SUCCESS; - } + if (count > 1) + skb2 = skb_clone(skb, GFP_ATOMIC); /* * Randomized packet corruption. @@ -495,7 +485,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, if (skb_is_gso(skb)) { skb = netem_segment(skb, sch, to_free); if (!skb) - return rc_drop; + goto finish_segs; + segs = skb->next; skb_mark_not_on_list(skb); qdisc_skb_cb(skb)->pkt_len = skb->len; @@ -521,7 +512,24 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, /* re-link segs, so that qdisc_drop_all() frees them all */ skb->next = segs; qdisc_drop_all(skb, sch, to_free); - return rc_drop; + if (skb2) + __qdisc_drop(skb2, to_free); + return NET_XMIT_DROP; + } + + /* + * If doing duplication then re-insert at top of the + * qdisc tree, since parent queuer expects that only one + * skb will be queued. + */ + if (skb2) { + struct Qdisc *rootq = qdisc_root_bh(sch); + u32 dupsave = q->duplicate; /* prevent duplicating a dup... */ + + q->duplicate = 0; + rootq->enqueue(skb2, rootq, to_free); + q->duplicate = dupsave; + skb2 = NULL; } qdisc_qstats_backlog_inc(sch, skb); @@ -592,9 +600,12 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, } finish_segs: + if (skb2) + __qdisc_drop(skb2, to_free); + if (segs) { unsigned int len, last_len; - int nb; + int rc, nb; len = skb ? skb->len : 0; nb = skb ? 1 : 0; -- 2.34.1

2 1

[PATCH OLK-5.10] netem: fix return value if duplicate enqueue fails
by Liu Jian 23 Sep '24

23 Sep '24

From: Stephen Hemminger <stephen(a)networkplumber.org> stable inclusion from stable-v5.10.225 commit c414000da1c2ea1ba9a5e5bb1a4ba774e51e202d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJ5 CVE: CVE-2024-45016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit c07ff8592d57ed258afee5a5e04991a48dbaf382 ] There is a bug in netem_enqueue() introduced by commit 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") that can lead to a use-after-free. This commit made netem_enqueue() always return NET_XMIT_SUCCESS when a packet is duplicated, which can cause the parent qdisc's q.qlen to be mistakenly incremented. When this happens qlen_notify() may be skipped on the parent during destruction, leaving a dangling pointer for some classful qdiscs like DRR. There are two ways for the bug happen: - If the duplicated packet is dropped by rootq->enqueue() and then the original packet is also dropped. - If rootq->enqueue() sends the duplicated packet to a different qdisc and the original packet is dropped. In both cases NET_XMIT_SUCCESS is returned even though no packets are enqueued at the netem qdisc. The fix is to defer the enqueue of the duplicate packet until after the original packet has been guaranteed to return NET_XMIT_SUCCESS. Fixes: 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Stephen Hemminger <stephen(a)networkplumber.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20240819175753.5151-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sched/sch_netem.c | 47 ++++++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index cd5d821c6f21..43f9481b6506 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -437,12 +437,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct netem_sched_data *q = qdisc_priv(sch); /* We don't fill cb now as skb_unshare() may invalidate it */ struct netem_skb_cb *cb; - struct sk_buff *skb2; + struct sk_buff *skb2 = NULL; struct sk_buff *segs = NULL; unsigned int prev_len = qdisc_pkt_len(skb); int count = 1; - int rc = NET_XMIT_SUCCESS; - int rc_drop = NET_XMIT_DROP; /* Do not fool qdisc_drop_all() */ skb->prev = NULL; @@ -471,19 +469,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, skb_orphan_partial(skb); /* - * If we need to duplicate packet, then re-insert at top of the - * qdisc tree, since parent queuer expects that only one - * skb will be queued. + * If we need to duplicate packet, then clone it before + * original is modified. */ - if (count > 1 && (skb2 = skb_clone(skb, GFP_ATOMIC)) != NULL) { - struct Qdisc *rootq = qdisc_root_bh(sch); - u32 dupsave = q->duplicate; /* prevent duplicating a dup... */ - - q->duplicate = 0; - rootq->enqueue(skb2, rootq, to_free); - q->duplicate = dupsave; - rc_drop = NET_XMIT_SUCCESS; - } + if (count > 1) + skb2 = skb_clone(skb, GFP_ATOMIC); /* * Randomized packet corruption. @@ -495,7 +485,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, if (skb_is_gso(skb)) { skb = netem_segment(skb, sch, to_free); if (!skb) - return rc_drop; + goto finish_segs; + segs = skb->next; skb_mark_not_on_list(skb); qdisc_skb_cb(skb)->pkt_len = skb->len; @@ -521,7 +512,24 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, /* re-link segs, so that qdisc_drop_all() frees them all */ skb->next = segs; qdisc_drop_all(skb, sch, to_free); - return rc_drop; + if (skb2) + __qdisc_drop(skb2, to_free); + return NET_XMIT_DROP; + } + + /* + * If doing duplication then re-insert at top of the + * qdisc tree, since parent queuer expects that only one + * skb will be queued. + */ + if (skb2) { + struct Qdisc *rootq = qdisc_root_bh(sch); + u32 dupsave = q->duplicate; /* prevent duplicating a dup... */ + + q->duplicate = 0; + rootq->enqueue(skb2, rootq, to_free); + q->duplicate = dupsave; + skb2 = NULL; } qdisc_qstats_backlog_inc(sch, skb); @@ -592,9 +600,12 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, } finish_segs: + if (skb2) + __qdisc_drop(skb2, to_free); + if (segs) { unsigned int len, last_len; - int nb; + int rc, nb; len = skb ? skb->len : 0; nb = skb ? 1 : 0; -- 2.34.1

2 1

[PATCH OLK-6.6] netem: fix return value if duplicate enqueue fails
by Liu Jian 23 Sep '24

23 Sep '24

From: Stephen Hemminger <stephen(a)networkplumber.org> stable inclusion from stable-v6.6.48 commit 577d6c0619467fe90f7e8e57e45cb5bd9d936014 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJ5 CVE: CVE-2024-45016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit c07ff8592d57ed258afee5a5e04991a48dbaf382 ] There is a bug in netem_enqueue() introduced by commit 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") that can lead to a use-after-free. This commit made netem_enqueue() always return NET_XMIT_SUCCESS when a packet is duplicated, which can cause the parent qdisc's q.qlen to be mistakenly incremented. When this happens qlen_notify() may be skipped on the parent during destruction, leaving a dangling pointer for some classful qdiscs like DRR. There are two ways for the bug happen: - If the duplicated packet is dropped by rootq->enqueue() and then the original packet is also dropped. - If rootq->enqueue() sends the duplicated packet to a different qdisc and the original packet is dropped. In both cases NET_XMIT_SUCCESS is returned even though no packets are enqueued at the netem qdisc. The fix is to defer the enqueue of the duplicate packet until after the original packet has been guaranteed to return NET_XMIT_SUCCESS. Fixes: 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Stephen Hemminger <stephen(a)networkplumber.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20240819175753.5151-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sched/sch_netem.c | 47 ++++++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index 4ad39a4a3cf5..0224a9249245 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -446,12 +446,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct netem_sched_data *q = qdisc_priv(sch); /* We don't fill cb now as skb_unshare() may invalidate it */ struct netem_skb_cb *cb; - struct sk_buff *skb2; + struct sk_buff *skb2 = NULL; struct sk_buff *segs = NULL; unsigned int prev_len = qdisc_pkt_len(skb); int count = 1; - int rc = NET_XMIT_SUCCESS; - int rc_drop = NET_XMIT_DROP; /* Do not fool qdisc_drop_all() */ skb->prev = NULL; @@ -480,19 +478,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, skb_orphan_partial(skb); /* - * If we need to duplicate packet, then re-insert at top of the - * qdisc tree, since parent queuer expects that only one - * skb will be queued. + * If we need to duplicate packet, then clone it before + * original is modified. */ - if (count > 1 && (skb2 = skb_clone(skb, GFP_ATOMIC)) != NULL) { - struct Qdisc *rootq = qdisc_root_bh(sch); - u32 dupsave = q->duplicate; /* prevent duplicating a dup... */ - - q->duplicate = 0; - rootq->enqueue(skb2, rootq, to_free); - q->duplicate = dupsave; - rc_drop = NET_XMIT_SUCCESS; - } + if (count > 1) + skb2 = skb_clone(skb, GFP_ATOMIC); /* * Randomized packet corruption. @@ -504,7 +494,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, if (skb_is_gso(skb)) { skb = netem_segment(skb, sch, to_free); if (!skb) - return rc_drop; + goto finish_segs; + segs = skb->next; skb_mark_not_on_list(skb); qdisc_skb_cb(skb)->pkt_len = skb->len; @@ -530,7 +521,24 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, /* re-link segs, so that qdisc_drop_all() frees them all */ skb->next = segs; qdisc_drop_all(skb, sch, to_free); - return rc_drop; + if (skb2) + __qdisc_drop(skb2, to_free); + return NET_XMIT_DROP; + } + + /* + * If doing duplication then re-insert at top of the + * qdisc tree, since parent queuer expects that only one + * skb will be queued. + */ + if (skb2) { + struct Qdisc *rootq = qdisc_root_bh(sch); + u32 dupsave = q->duplicate; /* prevent duplicating a dup... */ + + q->duplicate = 0; + rootq->enqueue(skb2, rootq, to_free); + q->duplicate = dupsave; + skb2 = NULL; } qdisc_qstats_backlog_inc(sch, skb); @@ -601,9 +609,12 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, } finish_segs: + if (skb2) + __qdisc_drop(skb2, to_free); + if (segs) { unsigned int len, last_len; - int nb; + int rc, nb; len = skb ? skb->len : 0; nb = skb ? 1 : 0; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v4] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 23 Sep '24

23 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> stable inclusion from stable-v4.19.322 commit e239e44dcd419b13cf840e2a3a833204e4329714 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index ad2e87de7dc5..d58a108a96c0 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -104,7 +104,7 @@ static void cougar_fix_g6_mapping(struct hid_device *hdev) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v3] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 23 Sep '24

23 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> stable inclusion from stable-v6.11.29 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index ad2e87de7dc5..d58a108a96c0 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -104,7 +104,7 @@ static void cougar_fix_g6_mapping(struct hid_device *hdev) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[openeuler:OLK-5.10 19323/30000] drivers/ub/urma/ubcore/ubcore_tp.c:40:17: warning: no previous prototype for 'ubcore_get_mtu'
by kernel test robot 23 Sep '24

23 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 108b9a92793f61e1abf94d341c676515421e57a2 commit: 832e9fe8cf1ed02211ff43bd4f3f16ddc2d69969 [19323/30000] ub: ubcore add create/delete tp table api config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240923/202409231141.HzIwAaRi-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240923/202409231141.HzIwAaRi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409231141.HzIwAaRi-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_tp.c:40:17: warning: no previous prototype for 'ubcore_get_mtu' [-Wmissing-prototypes] 40 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:75:19: warning: no previous prototype for 'ubcore_create_vtp' [-Wmissing-prototypes] 75 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, const union ubcore_eid *remote_eid, | ^~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:83:5: warning: no previous prototype for 'ubcore_destroy_vtp' [-Wmissing-prototypes] 83 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/ubcore_get_mtu +40 drivers/ub/urma/ubcore/ubcore_tp.c c75b0bccca7777 Yizhen Fan 2023-09-14 39 c75b0bccca7777 Yizhen Fan 2023-09-14 @40 enum ubcore_mtu ubcore_get_mtu(int mtu) c75b0bccca7777 Yizhen Fan 2023-09-14 41 { c75b0bccca7777 Yizhen Fan 2023-09-14 42 mtu = mtu - UB_PROTOCOL_HEAD_BYTES; c75b0bccca7777 Yizhen Fan 2023-09-14 43 c75b0bccca7777 Yizhen Fan 2023-09-14 44 if (mtu >= ubcore_mtu_enum_to_int(UBCORE_MTU_8192)) c75b0bccca7777 Yizhen Fan 2023-09-14 45 return UBCORE_MTU_8192; c75b0bccca7777 Yizhen Fan 2023-09-14 46 if (mtu >= ubcore_mtu_enum_to_int(UBCORE_MTU_4096)) c75b0bccca7777 Yizhen Fan 2023-09-14 47 return UBCORE_MTU_4096; c75b0bccca7777 Yizhen Fan 2023-09-14 48 else if (mtu >= ubcore_mtu_enum_to_int(UBCORE_MTU_2048)) c75b0bccca7777 Yizhen Fan 2023-09-14 49 return UBCORE_MTU_2048; c75b0bccca7777 Yizhen Fan 2023-09-14 50 else if (mtu >= ubcore_mtu_enum_to_int(UBCORE_MTU_1024)) c75b0bccca7777 Yizhen Fan 2023-09-14 51 return UBCORE_MTU_1024; c75b0bccca7777 Yizhen Fan 2023-09-14 52 else if (mtu >= ubcore_mtu_enum_to_int(UBCORE_MTU_512)) c75b0bccca7777 Yizhen Fan 2023-09-14 53 return UBCORE_MTU_512; c75b0bccca7777 Yizhen Fan 2023-09-14 54 else if (mtu >= ubcore_mtu_enum_to_int(UBCORE_MTU_256)) c75b0bccca7777 Yizhen Fan 2023-09-14 55 return UBCORE_MTU_256; c75b0bccca7777 Yizhen Fan 2023-09-14 56 else c75b0bccca7777 Yizhen Fan 2023-09-14 57 return 0; c75b0bccca7777 Yizhen Fan 2023-09-14 58 } c75b0bccca7777 Yizhen Fan 2023-09-14 59 EXPORT_SYMBOL(ubcore_get_mtu); c75b0bccca7777 Yizhen Fan 2023-09-14 60 :::::: The code at line 40 was first introduced by commit :::::: c75b0bccca77778d5663004cb19d3dd31ef71f0a ub: ubcore add get_mtu and other APIs that will be used by the driver. :::::: TO: Yizhen Fan <fanyizhen(a)huawei.com> :::::: CC: fanyizhen1995 <en_0015767(a)163.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] cgroup-psi-add-PSI_STATE_LAST-for-kabi-reserve
by Chen Ridong 23 Sep '24

23 Sep '24

*** BLURB HERE *** Chen Ridong (1): cgroup/psi: add PSI_STATE_LAST for kabi reserve include/linux/psi_types.h | 5 ++++- kernel/sched/psi.c | 14 +++++++------- 2 files changed, 11 insertions(+), 8 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS v2] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 23 Sep '24

23 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> stable inclusion from stable-v6.11-rc5 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index ad2e87de7dc5..d58a108a96c0 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -104,7 +104,7 @@ static void cougar_fix_g6_mapping(struct hid_device *hdev) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit f1e261ced9bcad772a45a2fcdf413c3490e87299 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c index f503e61faa60..cc3b62f73394 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

1 0

[PATCH OLK-6.6] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit f1e261ced9bcad772a45a2fcdf413c3490e87299 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c index f503e61faa60..cc3b62f73394 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v5.10.226 commit 38e32a0d837443c91c4b615a067b976cfb925376 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c index 01dc46dc9c8a..165af862d054 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v5.10.226 commit 38e32a0d837443c91c4b615a067b976cfb925376 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c index 01dc46dc9c8a..165af862d054 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v5.10.226 commit 38e32a0d837443c91c4b615a067b976cfb925376 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c [Adapt conflicts due to directory change] Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c index 01dc46dc9c8a..165af862d054 100644 --- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

2 1

[PATCH OLK-5.10 0/9] xfs: some fix for forcealign
by Long Li 23 Sep '24

23 Sep '24

This patch set fix some bug for forcealign: patch 1 ~ 4 : fix tail alignment issue while approach to no space. patch 5 : fix file offset not align due to revert allocated offset while bmap alloc. patch 6 ~ 8 : fix expose stale data issue while truance down file. patch 9 : fix forcealign not compatible with reflink and realtime. Dave Chinner (3): xfs: only allow minlen allocations when near ENOSPC xfs: always tail align maxlen allocations xfs: align args->minlen for forced allocation alignment John Garry (2): xfs: Don't revert allocated offset for forcealign Long Li (3): xfs: set minlen to align for forcealign xfs: correct the truncate blocksize of forcealign xfs: forcealign not compatible with reflink and realtime device Zhang Yi (2): math64: add rem_u64() to just return the remainder iomap: pass blocksize to iomap_truncate_page() fs/iomap/buffered-io.c | 8 ++++---- fs/xfs/libxfs/xfs_alloc.c | 31 ++++++++++++++++++----------- fs/xfs/libxfs/xfs_bmap.c | 42 +++++++++++++++++++++++++++++---------- fs/xfs/xfs_iops.c | 10 ++++++++-- fs/xfs/xfs_super.c | 19 +++++++++++++++++- include/linux/iomap.h | 4 ++-- include/linux/math64.h | 24 ++++++++++++++++++++++ 7 files changed, 106 insertions(+), 32 deletions(-) -- 2.39.2

4 15

[PATCH OLK-6.6 0/1] cgroup-psi-add-PSI_STATE_LAST-for-kabi-reserve
by Chen Ridong 23 Sep '24

23 Sep '24

*** BLURB HERE *** Chen Ridong (1): cgroup/psi: add PSI_STATE_LAST for kabi reserve include/linux/psi_types.h | 5 ++++- kernel/sched/psi.c | 14 +++++++------- 2 files changed, 11 insertions(+), 8 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 1/1] cgroup/psi: add PSI_STATE_LAST for kabi reserve
by Chen Ridong 23 Sep '24

23 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARWZ2 -------------------------------- Adding KABI_RESERVE for psi_stat_states results in redundant information being shown when running cat pressure.stat. Therefore, add PSI_STATE_LAST to maintain an unchanged KABI and eliminate the invalid information displayed in pressure.stat. Fixes: cbd277b915b9 ("cgroup/psi: reserve kabi for future psi development") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- include/linux/psi_types.h | 5 ++++- kernel/sched/psi.c | 14 +++++++------- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/include/linux/psi_types.h b/include/linux/psi_types.h index 1c5bca4e48ed..b224a89c293e 100644 --- a/include/linux/psi_types.h +++ b/include/linux/psi_types.h @@ -100,12 +100,15 @@ enum psi_stat_states { #ifdef CONFIG_QOS_SCHED PSI_CPU_QOS_FULL, #endif + /* reserve for KABI start */ + PSI_STATE_LAST, PSI_STATE_RESERVE1, PSI_STATE_RESERVE2, PSI_STATE_RESERVE3, PSI_STATE_RESERVE4, PSI_STATE_RESERVE5, - PSI_STATE_RESERVE6, + /* reserve for KABI end */ + NR_PSI_STAT_STATES, }; diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index c66f64ab9f4e..9f68756a3baf 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -470,12 +470,12 @@ static void get_recent_stat_times(struct psi_group *group, int cpu, enum psi_aggregators aggregator, u64 *stat_delta, u64 nonidle) { struct psi_group_cpu *groupc = per_cpu_ptr(group->pcpu, cpu); - u32 times[NR_PSI_STAT_STATES] = {0}; + u32 times[PSI_STATE_LAST] = {0}; enum psi_stat_states s; u32 delta; - memcpy(times, groupc->fine_grained_times, sizeof(groupc->fine_grained_times)); - for (s = 0; s < NR_PSI_STAT_STATES; s++) { + for (s = 0; s < PSI_STATE_LAST; s++) { + times[s] = groupc->fine_grained_times[s]; if (groupc->fine_grained_state_mask & (1 << s)) times[s] += groupc->fine_grained_times_delta; delta = times[s] - groupc->fine_grained_times_prev[aggregator][s]; @@ -522,7 +522,7 @@ static void collect_percpu_times(struct psi_group *group, u32 *pchanged_states) { #ifdef CONFIG_PSI_FINE_GRAINED - u64 stat_delta[NR_PSI_STAT_STATES] = { 0 }; + u64 stat_delta[PSI_STATE_LAST] = { 0 }; #endif u64 deltas[NR_PSI_STATES - 1] = { 0, }; unsigned long nonidle_total = 0; @@ -575,7 +575,7 @@ static void collect_percpu_times(struct psi_group *group, div_u64(deltas[s], max(nonidle_total, 1UL)); #ifdef CONFIG_PSI_FINE_GRAINED - for (s = 0; s < NR_PSI_STAT_STATES; s++) + for (s = 0; s < PSI_STATE_LAST; s++) group->fine_grained_total[aggregator][s] += div_u64(stat_delta[s], max(nonidle_total, 1UL)); #endif @@ -753,7 +753,7 @@ static u64 update_averages(struct psi_group *group, u64 now) calc_avgs(group->avg[s], missed_periods, sample, period); } #ifdef CONFIG_PSI_FINE_GRAINED - for (s = 0; s < NR_PSI_STAT_STATES; s++) { + for (s = 0; s < PSI_STATE_LAST; s++) { u32 stat_sample; stat_sample = group->fine_grained_total[PSI_AVGS][s] - @@ -1935,7 +1935,7 @@ int psi_stat_show(struct seq_file *m, struct psi_group *group) group->avg_next_update = update_averages(group, now); mutex_unlock(&group->avgs_lock); - for (i = 0; i < NR_PSI_STAT_STATES; i++) { + for (i = 0; i < PSI_STATE_LAST; i++) { unsigned long avg[3] = {0, }; int w; u64 total; -- 2.34.1

2 2

[openeuler:OLK-5.10 19319/30000] drivers/ub/urma/uburma/uburma_cmd.c:180:6: warning: no previous prototype for 'uburma_jetty_event_cb'
by kernel test robot 22 Sep '24

22 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 108b9a92793f61e1abf94d341c676515421e57a2 commit: c3af5be3e72710b357d9f23a5bdcafe8f96d6dfd [19319/30000] ub: uburma add cmd create jetty implementation. config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240922/202409222352.T2dIjY0d-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409222352.T2dIjY0d-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409222352.T2dIjY0d-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfc_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfc_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 156 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:168:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] 168 | void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_cmd.c:180:6: warning: no previous prototype for 'uburma_jetty_event_cb' [-Wmissing-prototypes] 180 | void uburma_jetty_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/uburma_jetty_event_cb +180 drivers/ub/urma/uburma/uburma_cmd.c 179 > 180 void uburma_jetty_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 181 { 182 struct uburma_jetty_uobj *jetty_uobj; 183 184 if (event->element.jetty == NULL) 185 return; 186 187 jetty_uobj = (struct uburma_jetty_uobj *)event->element.jetty->jetty_cfg.jetty_context; 188 uburma_write_async_event(ctx, event->element.jetty->urma_jetty, event->event_type, 189 &jetty_uobj->async_event_list, &jetty_uobj->async_events_reported); 190 } 191 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15045/23728] drivers/clocksource/arm_arch_timer.c:554:44: error: 'hisi_161010101_read_cntvct_el0' undeclared
by kernel test robot 22 Sep '24

22 Sep '24

Hi Yang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3bbb0f885bf0f93bee0bb99c623877588ae005ee commit: e63b4759933f6a5c5ce6cdc1d11c7bf2201d0612 [15045/23728] arm64: arch_timer: only do cntvct workaround on VDSO path on D05 config: arm64-randconfig-001-20240922 (https://download.01.org/0day-ci/archive/20240922/202409222139.Ec9hFPhJ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409222139.Ec9hFPhJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409222139.Ec9hFPhJ-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/clocksource/arm_arch_timer.c: In function 'arch_timer_enable_workaround': >> drivers/clocksource/arm_arch_timer.c:554:44: error: 'hisi_161010101_read_cntvct_el0' undeclared (first use in this function) 554 | if (wa->read_cntvct_el0 == hisi_161010101_read_cntvct_el0) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/clocksource/arm_arch_timer.c:554:44: note: each undeclared identifier is reported only once for each function it appears in vim +/hisi_161010101_read_cntvct_el0 +554 drivers/clocksource/arm_arch_timer.c 527 528 static 529 void arch_timer_enable_workaround(const struct arch_timer_erratum_workaround *wa, 530 bool local) 531 { 532 int i; 533 534 if (local) { 535 __this_cpu_write(timer_unstable_counter_workaround, wa); 536 } else { 537 for_each_possible_cpu(i) 538 per_cpu(timer_unstable_counter_workaround, i) = wa; 539 } 540 541 /* 542 * Use the locked version, as we're called from the CPU 543 * hotplug framework. Otherwise, we end-up in deadlock-land. 544 */ 545 static_branch_enable_cpuslocked(&arch_timer_read_ool_enabled); 546 547 /* 548 * Don't use the vdso fastpath if errata require using the 549 * out-of-line counter accessor. We may change our mind pretty 550 * late in the game (with a per-CPU erratum, for example), so 551 * change both the default value and the vdso itself. 552 */ 553 if (wa->read_cntvct_el0) { > 554 if (wa->read_cntvct_el0 == hisi_161010101_read_cntvct_el0) { 555 clocksource_counter.archdata.vdso_direct = true; 556 vdso_default = true; 557 vdso_fix = true; 558 } else { 559 clocksource_counter.archdata.vdso_direct = false; 560 vdso_default = false; 561 } 562 } 563 } 564 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29966/30000] ld.lld: error: duplicate symbol: nic_ioctl
by kernel test robot 22 Sep '24

22 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 108b9a92793f61e1abf94d341c676515421e57a2 commit: eed73e172d7e51f1bf012d8dde3e35022f220dba [29966/30000] gtp: pull network headers in gtp_dev_xmit() config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240922/202409222141.UEcNSNCf-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409222141.UEcNSNCf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409222141.UEcNSNCf-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: duplicate symbol: nic_ioctl >>> defined at hinic_nictool.c >>> net/ethernet/huawei/hinic/hinic_nictool.o:(nic_ioctl) in archive drivers/built-in.a >>> defined at hinic3_dbg.c >>> net/ethernet/huawei/hinic3/hinic3_dbg.o:(.text+0x0) in archive drivers/built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3bbb0f885bf0f93bee0bb99c623877588ae005ee
by kernel test robot 22 Sep '24

22 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3bbb0f885bf0f93bee0bb99c623877588ae005ee !11544 Fix CVE-2024-45025 Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | `-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20240922 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-002-20240922 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-004-20240922 | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | `-- drivers-nvme-host-core.c:error:expected-before-ptrval |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- x86_64-buildonly-randconfig-002-20240911 | |-- drivers-char-hw_random-zhaoxin-rng.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-clk-renesas-rcar-gen3-cpg.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-i2c-busses-i2c-hisi.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-net-phy-ax88796b.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20240922 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-kexec `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration elapsed time: 1275m configs tested: 14 configs skipped: 115 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240922 gcc-14.1.0 arm64 randconfig-002-20240922 gcc-14.1.0 arm64 randconfig-003-20240922 gcc-14.1.0 arm64 randconfig-004-20240922 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240922 clang-18 x86_64 buildonly-randconfig-002-20240922 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19316/30000] drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfc_event_cb'
by kernel test robot 22 Sep '24

22 Sep '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 108b9a92793f61e1abf94d341c676515421e57a2 commit: c4cd0655c0c898569c0a70162f36258fd5c50eeb [19316/30000] ub: uburma add cmd create jfc implementation. config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240922/202409221433.k1AuxCcw-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409221433.k1AuxCcw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409221433.k1AuxCcw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfc_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfc_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 156 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:168:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] 168 | void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/uburma_jfc_event_cb +144 drivers/ub/urma/uburma/uburma_cmd.c 143 > 144 void uburma_jfc_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 145 { 146 struct uburma_jfc_uobj *jfc_uobj; 147 148 if (event->element.jfc == NULL) 149 return; 150 151 jfc_uobj = (struct uburma_jfc_uobj *)event->element.jfc->jfc_cfg.jfc_context; 152 uburma_write_async_event(ctx, event->element.jfc->urma_jfc, event->event_type, 153 &jfc_uobj->async_event_list, &jfc_uobj->async_events_reported); 154 } 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 108b9a92793f61e1abf94d341c676515421e57a2
by kernel test robot 22 Sep '24

22 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 108b9a92793f61e1abf94d341c676515421e57a2 !11555 v2 Fix CVE-2024-45025 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202409211946.NL6KIvwJ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409212219.Vif0Ex0V-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409220650.QvCRtuNe-lkp@intel.com https://lore.kernel.org/oe-kbuild/202409221431.y5saRbBn-lkp@intel.com drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] kernel/workqueue.c:4821:33: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] kernel/workqueue.c:4823:33: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/thermal/intel/intel_hfi.c:245 hfi_update_work_fn() warn: can 'hfi_instance' even be NULL? Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20240922 | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-002-20240922 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- arm64-randconfig-004-20240912 | |-- drivers-ub-urma-uburma-uburma_cmd.c:warning:no-previous-prototype-for-uburma_jfr_event_cb | `-- drivers-ub-urma-uburma-uburma_cmd.c:warning:no-previous-prototype-for-uburma_jfs_event_cb |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-001-20240922 | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20240922 | |-- drivers-usb-dwc2-core_intr.c:error:no-member-named-bus_suspended-in-struct-dwc2_hsotg | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-kexec | |-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-161-20240922 | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_root_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_root_table-procname | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_table-procname | |-- drivers-thermal-intel-intel_hfi.c-hfi_update_work_fn()-warn:can-hfi_instance-even-be-NULL | |-- fs-cifs-file.c-cifs_write_from_iter()-error:uninitialized-symbol-pagevec-. | |-- fs-xfs-xfs_icache.c-xfs_icwalk_tag()-warn:unsigned-goal-is-never-less-than-zero. | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-func | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-kselftests | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 1249m configs tested: 14 configs skipped: 115 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240922 gcc-14.1.0 arm64 randconfig-002-20240922 clang-20 arm64 randconfig-003-20240922 gcc-14.1.0 arm64 randconfig-004-20240922 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240922 clang-18 x86_64 buildonly-randconfig-002-20240922 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19314/30000] drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb'
by kernel test robot 22 Sep '24

22 Sep '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 108b9a92793f61e1abf94d341c676515421e57a2 commit: 79b60243a9ff771b76add8e16cfe55cc4f5edef2 [19314/30000] ub: uburma add cmd create jfr implementation. config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240922/202409220650.QvCRtuNe-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409220650.QvCRtuNe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409220650.QvCRtuNe-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] 156 | void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/uburma_jfr_event_cb +156 drivers/ub/urma/uburma/uburma_cmd.c 155 > 156 void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 157 { 158 struct uburma_jfr_uobj *jfr_uobj; 159 160 if (event->element.jfr == NULL) 161 return; 162 163 jfr_uobj = (struct uburma_jfr_uobj *)event->element.jfr->jfr_cfg.jfr_context; 164 uburma_write_async_event(ctx, event->element.jfr->urma_jfr, event->event_type, 165 &jfr_uobj->async_event_list, &jfr_uobj->async_events_reported); 166 } 167 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 10552/14021] arch/x86/kvm/svm/sev.c:2200:24: error: 'struct hygon_kvm_hooks_table' has no member named 'false'
by kernel test robot 22 Sep '24

22 Sep '24

Hi fangbaoshun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 70522ace7844a6fe96f8b19325c878ff23701ee7 commit: 1c3b1095a26ed8bc1aa7ac3d4e8dd3e65964a74b [10552/14021] KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode config: x86_64-randconfig-003-20240921 (https://download.01.org/0day-ci/archive/20240922/202409220627.7Iic9Lx5-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409220627.7Iic9Lx5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409220627.7Iic9Lx5-lkp@intel.com/ All errors (new ones prefixed by >>): arch/x86/kvm/svm/sev.c:2198:6: warning: no previous prototype for 'sev_install_hooks' [-Wmissing-prototypes] 2198 | void sev_install_hooks(void) | ^~~~~~~~~~~~~~~~~ arch/x86/kvm/svm/sev.c: In function 'sev_install_hooks': >> arch/x86/kvm/svm/sev.c:2200:24: error: 'struct hygon_kvm_hooks_table' has no member named 'false' 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ^ >> arch/x86/kvm/svm/sev.c:2200:39: error: lvalue required as unary '&' operand 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ^ vim +2200 arch/x86/kvm/svm/sev.c 2195 2196 #ifdef CONFIG_HYGON_CSV 2197 /* Code to set all of the function and vaiable pointers */ 2198 void sev_install_hooks(void) 2199 { > 2200 hygon_kvm_hooks.sev_enabled = &sev_enabled; 2201 hygon_kvm_hooks.sev_issue_cmd = sev_issue_cmd; 2202 hygon_kvm_hooks.get_num_contig_pages = get_num_contig_pages; 2203 hygon_kvm_hooks.sev_pin_memory = sev_pin_memory; 2204 hygon_kvm_hooks.sev_unpin_memory = sev_unpin_memory; 2205 2206 hygon_kvm_hooks.sev_hooks_installed = true; 2207 } 2208 #endif 2209 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 10552/14021] arch/x86/kvm/svm/sev.c:2200:18: error: no member named 'false' in 'struct hygon_kvm_hooks_table'
by kernel test robot 22 Sep '24

22 Sep '24

Hi fangbaoshun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 70522ace7844a6fe96f8b19325c878ff23701ee7 commit: 1c3b1095a26ed8bc1aa7ac3d4e8dd3e65964a74b [10552/14021] KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode config: x86_64-randconfig-001-20240921 (https://download.01.org/0day-ci/archive/20240922/202409220656.VVoQSbav-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409220656.VVoQSbav-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409220656.VVoQSbav-lkp@intel.com/ All errors (new ones prefixed by >>): >> arch/x86/kvm/svm/sev.c:2200:18: error: no member named 'false' in 'struct hygon_kvm_hooks_table' 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ~~~~~~~~~~~~~~~ ^ arch/x86/kvm/svm/sev.c:66:21: note: expanded from macro 'sev_enabled' 66 | #define sev_enabled false | ^ >> arch/x86/kvm/svm/sev.c:2200:32: error: cannot take the address of an rvalue of type 'int' 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ^~~~~~~~~~~~ arch/x86/kvm/svm/sev.c:2198:6: warning: no previous prototype for function 'sev_install_hooks' [-Wmissing-prototypes] 2198 | void sev_install_hooks(void) | ^ arch/x86/kvm/svm/sev.c:2198:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2198 | void sev_install_hooks(void) | ^ | static 1 warning and 2 errors generated. vim +2200 arch/x86/kvm/svm/sev.c 2195 2196 #ifdef CONFIG_HYGON_CSV 2197 /* Code to set all of the function and vaiable pointers */ 2198 void sev_install_hooks(void) 2199 { > 2200 hygon_kvm_hooks.sev_enabled = &sev_enabled; 2201 hygon_kvm_hooks.sev_issue_cmd = sev_issue_cmd; 2202 hygon_kvm_hooks.get_num_contig_pages = get_num_contig_pages; 2203 hygon_kvm_hooks.sev_pin_memory = sev_pin_memory; 2204 hygon_kvm_hooks.sev_unpin_memory = sev_unpin_memory; 2205 2206 hygon_kvm_hooks.sev_hooks_installed = true; 2207 } 2208 #endif 2209 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20575/23728] drivers/char/hw_random/zhaoxin-rng.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 22 Sep '24

22 Sep '24

Hi leoliuoc, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3bbb0f885bf0f93bee0bb99c623877588ae005ee commit: 050ff2f361bf733d1dde505dea8b0f5ecb23507c [20575/23728] hwrng: Add Zhaoxin rng driver config: x86_64-buildonly-randconfig-002-20240911 (https://download.01.org/0day-ci/archive/20240922/202409220524.x5qCvvAy-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409220524.x5qCvvAy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409220524.x5qCvvAy-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/char/hw_random/zhaoxin-rng.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17425/23728] drivers/i2c/busses/i2c-hisi.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 22 Sep '24

22 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3bbb0f885bf0f93bee0bb99c623877588ae005ee commit: f4c6df89b7d391c38011a39858a84e3d8fbc7ada [17425/23728] i2c: add support for HiSilicon I2C controller config: x86_64-buildonly-randconfig-002-20240911 (https://download.01.org/0day-ci/archive/20240922/202409220229.dtDgIDDl-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409220229.dtDgIDDl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409220229.dtDgIDDl-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/i2c/busses/i2c-hisi.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 12075/23728] drivers/clk/renesas/rcar-gen3-cpg.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 21 Sep '24

21 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3bbb0f885bf0f93bee0bb99c623877588ae005ee commit: 91f5f1778fb3bc7ad3ad50a2256737c90da215b6 [12075/23728] clk: renesas: rcar-gen3: Set state when registering SD clocks config: x86_64-buildonly-randconfig-002-20240911 (https://download.01.org/0day-ci/archive/20240921/202409212339.uW6OSjiT-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409212339.uW6OSjiT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409212339.uW6OSjiT-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/clk/renesas/rcar-gen3-cpg.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7137/14021] arch/loongarch/kvm/vcpu.c:68:37: error: 'struct sched_info' has no member named 'run_delay'
by kernel test robot 21 Sep '24

21 Sep '24

Hi Bibo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 70522ace7844a6fe96f8b19325c878ff23701ee7 commit: faa35b0fcdefb1e5f2d05b0eeac12be32e69e566 [7137/14021] LoongArch: KVM: Add steal time support in kvm side config: loongarch-randconfig-001-20240921 (https://download.01.org/0day-ci/archive/20240921/202409212227.aYLZJEKB-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409212227.aYLZJEKB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409212227.aYLZJEKB-lkp@intel.com/ All errors (new ones prefixed by >>): arch/loongarch/kvm/vcpu.c: In function 'kvm_update_stolen_time': >> arch/loongarch/kvm/vcpu.c:68:37: error: 'struct sched_info' has no member named 'run_delay' 68 | steal += current->sched_info.run_delay - | ^ arch/loongarch/kvm/vcpu.c:70:55: error: 'struct sched_info' has no member named 'run_delay' 70 | vcpu->arch.st.last_steal = current->sched_info.run_delay; | ^ vim +68 arch/loongarch/kvm/vcpu.c 33 34 static void kvm_update_stolen_time(struct kvm_vcpu *vcpu) 35 { 36 struct kvm_steal_time __user *st; 37 struct gfn_to_hva_cache *ghc; 38 struct kvm_memslots *slots; 39 gpa_t gpa; 40 u64 steal; 41 u32 version; 42 43 ghc = &vcpu->arch.st.cache; 44 gpa = vcpu->arch.st.guest_addr; 45 if (!(gpa & KVM_STEAL_PHYS_VALID)) 46 return; 47 48 gpa &= KVM_STEAL_PHYS_MASK; 49 slots = kvm_memslots(vcpu->kvm); 50 if (slots->generation != ghc->generation || gpa != ghc->gpa) { 51 if (kvm_gfn_to_hva_cache_init(vcpu->kvm, ghc, gpa, 52 sizeof(*st))) { 53 ghc->gpa = INVALID_GPA; 54 return; 55 } 56 } 57 58 st = (struct kvm_steal_time __user *)ghc->hva; 59 unsafe_get_user(version, &st->version, out); 60 if (version & 1) 61 version += 1; 62 version += 1; 63 unsafe_put_user(version, &st->version, out); 64 /* Make sure st->version is written first */ 65 smp_wmb(); 66 67 unsafe_get_user(steal, &st->steal, out); > 68 steal += current->sched_info.run_delay - 69 vcpu->arch.st.last_steal; 70 vcpu->arch.st.last_steal = current->sched_info.run_delay; 71 unsafe_put_user(steal, &st->steal, out); 72 73 /* Make sure st->steal is written first */ 74 smp_wmb(); 75 version += 1; 76 unsafe_put_user(version, &st->version, out); 77 out: 78 mark_page_dirty_in_slot(vcpu->kvm, ghc->memslot, gpa_to_gfn(ghc->gpa)); 79 } 80 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19313/30000] drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb'
by kernel test robot 21 Sep '24

21 Sep '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 108b9a92793f61e1abf94d341c676515421e57a2 commit: dd9641804ad19402838975c28003465d0b42042a [19313/30000] ub: uburma add cmd create/delete jfs implementation. config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240921/202409212219.Vif0Ex0V-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409212219.Vif0Ex0V-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409212219.Vif0Ex0V-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/uburma_jfs_event_cb +144 drivers/ub/urma/uburma/uburma_cmd.c 143 > 144 void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 145 { 146 struct uburma_jfs_uobj *jfs_uobj; 147 148 if (event->element.jfs == NULL) 149 return; 150 151 jfs_uobj = (struct uburma_jfs_uobj *)event->element.jfs->jfs_cfg.jfs_context; 152 uburma_write_async_event(ctx, event->element.jfs->urma_jfs, event->event_type, 153 &jfs_uobj->async_event_list, &jfs_uobj->async_events_reported); 154 } 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/5] numa-affinity: adapt for autonuma part1
by Nanyong Sun 21 Sep '24

21 Sep '24

Some optimizations and bug fixes. Nanyong Sun (5): mm: thp: support to control numa migration mm: numa-affinity: add helper numa_affinity_sampling_enabled() mm: numa-affinity: adapt for should_numa_migrate_memory mm: numa-affinity: adapt for task_numa_placement mm: numa-affinity: fix build error when !CONFIG_PROC_SYSCTL Documentation/admin-guide/mm/transhuge.rst | 8 ++++++ arch/arm64/Kconfig | 1 + include/linux/huge_mm.h | 13 +++++++++ include/linux/mem_sampling.h | 13 +++++++++ kernel/sched/fair.c | 30 ++++++++++++++------ mm/Kconfig | 10 +++++++ mm/huge_memory.c | 33 ++++++++++++++++++++++ mm/mem_sampling.c | 4 --- mm/migrate.c | 3 ++ 9 files changed, 103 insertions(+), 12 deletions(-) -- 2.33.0

2 6

[openeuler:OLK-6.6] BUILD SUCCESS 70522ace7844a6fe96f8b19325c878ff23701ee7
by kernel test robot 21 Sep '24

21 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 70522ace7844a6fe96f8b19325c878ff23701ee7 !11608 v3 arm64: perf: Add support for event counting threshold Warning ids grouped by kconfigs: recent_errors `-- arm64-allmodconfig `-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_gerror_handler elapsed time: 1581m configs tested: 12 configs skipped: 118 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240921 gcc-14.1.0 arm64 randconfig-002-20240921 clang-20 arm64 randconfig-003-20240921 clang-20 loongarch allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 13613/30000] kernel/workqueue.c:4821:33: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'?
by kernel test robot 21 Sep '24

21 Sep '24

Hi Johan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 108b9a92793f61e1abf94d341c676515421e57a2 commit: 3d01105a68b1318bdc3cef3bbcfcb544e2da856e [13613/30000] workqueue: fix state-dump console deadlock config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20240921/202409211946.NL6KIvwJ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409211946.NL6KIvwJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409211946.NL6KIvwJ-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/workqueue.c: In function 'show_workqueue_state': >> kernel/workqueue.c:4821:33: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] 4821 | printk_safe_enter(); | ^~~~~~~~~~~~~~~~~ | printk_nmi_enter >> kernel/workqueue.c:4823:33: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] 4823 | printk_safe_exit(); | ^~~~~~~~~~~~~~~~ | printk_nmi_exit kernel/workqueue.c: In function 'create_worker': kernel/workqueue.c:1935:54: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size between 5 and 14 [-Wformat-truncation=] 1935 | snprintf(id_buf, sizeof(id_buf), "%d:%d%s", pool->cpu, id, | ^~ kernel/workqueue.c:1935:50: note: directive argument in the range [0, 2147483647] 1935 | snprintf(id_buf, sizeof(id_buf), "%d:%d%s", pool->cpu, id, | ^~~~~~~~~ kernel/workqueue.c:1935:17: note: 'snprintf' output between 4 and 23 bytes into a destination of size 16 1935 | snprintf(id_buf, sizeof(id_buf), "%d:%d%s", pool->cpu, id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1936 | pool->attrs->nice < 0 ? "H" : ""); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +4821 kernel/workqueue.c 4780 4781 /** 4782 * show_workqueue_state - dump workqueue state 4783 * 4784 * Called from a sysrq handler or try_to_freeze_tasks() and prints out 4785 * all busy workqueues and pools. 4786 */ 4787 void show_workqueue_state(void) 4788 { 4789 struct workqueue_struct *wq; 4790 struct worker_pool *pool; 4791 unsigned long flags; 4792 int pi; 4793 4794 rcu_read_lock(); 4795 4796 pr_info("Showing busy workqueues and worker pools:\n"); 4797 4798 list_for_each_entry_rcu(wq, &workqueues, list) { 4799 struct pool_workqueue *pwq; 4800 bool idle = true; 4801 4802 for_each_pwq(pwq, wq) { 4803 if (pwq->nr_active || !list_empty(&pwq->delayed_works)) { 4804 idle = false; 4805 break; 4806 } 4807 } 4808 if (idle) 4809 continue; 4810 4811 pr_info("workqueue %s: flags=0x%x\n", wq->name, wq->flags); 4812 4813 for_each_pwq(pwq, wq) { 4814 raw_spin_lock_irqsave(&pwq->pool->lock, flags); 4815 if (pwq->nr_active || !list_empty(&pwq->delayed_works)) { 4816 /* 4817 * Defer printing to avoid deadlocks in console 4818 * drivers that queue work while holding locks 4819 * also taken in their write paths. 4820 */ > 4821 printk_safe_enter(); 4822 show_pwq(pwq); > 4823 printk_safe_exit(); 4824 } 4825 raw_spin_unlock_irqrestore(&pwq->pool->lock, flags); 4826 /* 4827 * We could be printing a lot from atomic context, e.g. 4828 * sysrq-t -> show_workqueue_state(). Avoid triggering 4829 * hard lockup. 4830 */ 4831 touch_nmi_watchdog(); 4832 } 4833 } 4834 4835 for_each_pool(pool, pi) { 4836 struct worker *worker; 4837 bool first = true; 4838 4839 raw_spin_lock_irqsave(&pool->lock, flags); 4840 if (pool->nr_workers == pool->nr_idle) 4841 goto next_pool; 4842 /* 4843 * Defer printing to avoid deadlocks in console drivers that 4844 * queue work while holding locks also taken in their write 4845 * paths. 4846 */ 4847 printk_safe_enter(); 4848 pr_info("pool %d:", pool->id); 4849 pr_cont_pool_info(pool); 4850 pr_cont(" hung=%us workers=%d", 4851 jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000, 4852 pool->nr_workers); 4853 if (pool->manager) 4854 pr_cont(" manager: %d", 4855 task_pid_nr(pool->manager->task)); 4856 list_for_each_entry(worker, &pool->idle_list, entry) { 4857 pr_cont(" %s%d", first ? "idle: " : "", 4858 task_pid_nr(worker->task)); 4859 first = false; 4860 } 4861 pr_cont("\n"); 4862 printk_safe_exit(); 4863 next_pool: 4864 raw_spin_unlock_irqrestore(&pool->lock, flags); 4865 /* 4866 * We could be printing a lot from atomic context, e.g. 4867 * sysrq-t -> show_workqueue_state(). Avoid triggering 4868 * hard lockup. 4869 */ 4870 touch_nmi_watchdog(); 4871 } 4872 4873 rcu_read_unlock(); 4874 } 4875 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 7438/23724] drivers/net/phy/ax88796b.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 21 Sep '24

21 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3bbb0f885bf0f93bee0bb99c623877588ae005ee commit: 56e625aa545a24e8d3fa44b5fbcdedd88e443dcc [7438/23724] net: phy: rename Asix Electronics PHY driver config: x86_64-buildonly-randconfig-002-20240911 (https://download.01.org/0day-ci/archive/20240921/202409211917.FUngwi3h-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409211917.FUngwi3h-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409211917.FUngwi3h-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/phy/ax88796b.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 369b68f40ab0c9bf0a8e087ed7ced93dcad3cd6c
by kernel test robot 21 Sep '24

21 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 369b68f40ab0c9bf0a8e087ed7ced93dcad3cd6c !11560 mm/ksm: fix possible UAF of stable_node Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- x86_64-buildonly-randconfig-002-20240911 | `-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-kexec `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration elapsed time: 1450m configs tested: 8 configs skipped: 40 tested configs: arm64 allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-kselftests gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 6891/30000] arch/arm64/kernel/ipi_nmi.c:40:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'?
by kernel test robot 21 Sep '24

21 Sep '24

Hi Li, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9728eb343bf95f638ebe53d7bf78063c87131b7d commit: f86d165bfe5f6248743774bb07af0bd7cff12443 [6891/30000] arm64: Add non nmi ipi backtrace support config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20240921/202409211722.HQb4h8VT-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409211722.HQb4h8VT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409211722.HQb4h8VT-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kernel/ipi_nmi.c: In function 'ipi_cpu_backtrace': arch/arm64/kernel/ipi_nmi.c:38:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] 38 | printk_safe_enter(); | ^~~~~~~~~~~~~~~~~ | printk_nmi_enter >> arch/arm64/kernel/ipi_nmi.c:40:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] 40 | printk_safe_exit(); | ^~~~~~~~~~~~~~~~ | printk_nmi_exit cc1: some warnings being treated as errors vim +40 arch/arm64/kernel/ipi_nmi.c 35 36 static void ipi_cpu_backtrace(void *info) 37 { > 38 printk_safe_enter(); 39 nmi_cpu_backtrace(get_irq_regs()); > 40 printk_safe_exit(); 41 } 42 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v2] mm/migration: do not folio copy in MIGRATE_SYNC_NO_COPY mode
by Tong Tiangen 21 Sep '24

21 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IASFAM -------------------------------- During page migration, if MIGRATE_SYNC_NO_COPY mode is used, the page content should not be migrated. This patch fix it. Fixes: 374fe8ea8082 ("fs: hugetlbfs: support poisoned recover from hugetlbfs_migrate_folio()") Fixes: 1d263184ba06 ("mm: migrate: support poisoned recover from migrate folio") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- fs/hugetlbfs/inode.c | 4 ++++ include/linux/migrate.h | 8 ++++++++ mm/migrate.c | 45 ++++++++++++++++++++++++++++------------- 3 files changed, 43 insertions(+), 14 deletions(-) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 8386d78eabe5..7f95b0fece82 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1146,6 +1146,10 @@ static int hugetlbfs_migrate_folio(struct address_space *mapping, { int rc; + rc = folio_migrate_mc_copy(mapping, dst, src, mode); + if (rc != MIGRATEPAGE_SUCCESS) + return rc; + rc = migrate_huge_page_move_mapping(mapping, dst, src); if (rc != MIGRATEPAGE_SUCCESS) return rc; diff --git a/include/linux/migrate.h b/include/linux/migrate.h index 517f70b70620..68083e8432e8 100644 --- a/include/linux/migrate.h +++ b/include/linux/migrate.h @@ -79,6 +79,8 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio); void folio_migrate_copy(struct folio *newfolio, struct folio *folio); int folio_migrate_mapping(struct address_space *mapping, struct folio *newfolio, struct folio *folio, int extra_count); +int folio_migrate_mc_copy(struct address_space *mapping, struct folio *dst, + struct folio *src, enum migrate_mode mode); #else @@ -98,6 +100,12 @@ static inline int migrate_huge_page_move_mapping(struct address_space *mapping, { return -ENOSYS; } +static inline int folio_migrate_mc_copy(struct address_space *mapping, + struct folio *dst, struct folio *src, + enum migrate_mode mode) +{ + return -ENOSYS; +} #endif /* CONFIG_MIGRATION */ diff --git a/mm/migrate.c b/mm/migrate.c index efcca5330568..577c559b56fd 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -552,16 +552,10 @@ int migrate_huge_page_move_mapping(struct address_space *mapping, struct folio *dst, struct folio *src) { XA_STATE(xas, &mapping->i_pages, folio_index(src)); - int rc, expected_count = folio_expected_refs(mapping, src); - - if (folio_ref_count(src) != expected_count) - return -EAGAIN; - - rc = folio_mc_copy(dst, src); - if (unlikely(rc)) - return rc; + int expected_count; xas_lock_irq(&xas); + expected_count = folio_expected_refs(mapping, src); if (!folio_ref_freeze(src, expected_count)) { xas_unlock_irq(&xas); return -EAGAIN; @@ -681,6 +675,33 @@ void folio_migrate_copy(struct folio *newfolio, struct folio *folio) } EXPORT_SYMBOL(folio_migrate_copy); + +static int __folio_migrate_mc_copy(struct folio *dst, struct folio *src, + enum migrate_mode mode, int expected_count) +{ + int rc; + + /* Check whether src does not have extra refs before we do more work */ + if (folio_ref_count(src) != expected_count) + return -EAGAIN; + + if (mode != MIGRATE_SYNC_NO_COPY) { + rc = folio_mc_copy(dst, src); + if (unlikely(rc)) + return rc; + } + + return MIGRATEPAGE_SUCCESS; +} + +int folio_migrate_mc_copy(struct address_space *mapping, struct folio *dst, + struct folio *src, enum migrate_mode mode) +{ + int expected_count = folio_expected_refs(mapping, src); + + return __folio_migrate_mc_copy(dst, src, mode, expected_count); +} + /************************************************************ * Migration functions ***********************************************************/ @@ -691,12 +712,8 @@ static int __migrate_folio(struct address_space *mapping, struct folio *dst, { int rc, expected_count = folio_expected_refs(mapping, src); - /* Check whether src does not have extra refs before we do more work */ - if (folio_ref_count(src) != expected_count) - return -EAGAIN; - - rc = folio_mc_copy(dst, src); - if (unlikely(rc)) + rc = __folio_migrate_mc_copy(dst, src, mode, expected_count); + if (rc != MIGRATEPAGE_SUCCESS) return rc; rc = __folio_migrate_mapping(mapping, dst, src, expected_count); -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 9728eb343bf95f638ebe53d7bf78063c87131b7d
by kernel test robot 21 Sep '24

21 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 9728eb343bf95f638ebe53d7bf78063c87131b7d !11588 drm/amd/display: Skip finding free audio for unknown engine_id Error/Warning (recently discovered and may have been fixed): drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_rearm_jfc' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap' [-Wmissing-prototypes] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-004-20240912 | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_rearm_jfc | `-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_mmap |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-kexec | |-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-161-20240921 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-rhel-8.3 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-func | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-kselftests | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 1458m configs tested: 7 configs skipped: 40 tested configs: arm64 allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 7193/23724] net/9p/client.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 21 Sep '24

21 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 369b68f40ab0c9bf0a8e087ed7ced93dcad3cd6c commit: a6fb923f7803f40a567445dfe1ff3a539c8adc1f [7193/23724] 9p: Use a slab for allocating requests config: x86_64-buildonly-randconfig-002-20240911 (https://download.01.org/0day-ci/archive/20240921/202409211531.7WSQbHuU-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240921/202409211531.7WSQbHuU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409211531.7WSQbHuU-lkp@intel.com/ All warnings (new ones prefixed by >>): net/9p/client.c:376: warning: Function parameter or member 'c' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'req' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'status' not described in 'p9_client_cb' net/9p/client.c:523: warning: Function parameter or member 'uidata' not described in 'p9_check_zc_errors' net/9p/client.c:774: warning: Function parameter or member 'in_hdrlen' not described in 'p9_client_zc_rpc' net/9p/client.c:774: warning: Excess function parameter 'hdrlen' description in 'p9_client_zc_rpc' >> net/9p/client.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] arm64/mpam: Add early_param for MPAM detecting
by Zeng Heng 21 Sep '24

21 Sep '24

Zeng Heng (2): Revert "arm64: head.S: Initialise MPAM EL2 registers and disable traps" arm64/mpam: Add early_param for MPAM detecting arch/arm64/include/asm/cpufeature.h | 9 +++++++ arch/arm64/include/asm/el2_setup.h | 16 ------------ arch/arm64/kernel/cpufeature.c | 13 +++++++--- arch/arm64/kernel/cpuinfo.c | 1 + arch/arm64/kernel/mpam.c | 38 ++++++++++++++++++++++++++--- 5 files changed, 53 insertions(+), 24 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] arm64/mpam: Add early_param for MPAM detecting
by Zeng Heng 21 Sep '24

21 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9OXPO -------------------------------- If BIOS firmware doesn't enable MPAM function under EL3 environment, while the hardware has the MPAM ability, that would cause illegal instruction fault when access MPAM registers. Fixes: 21771eaaf93a ("arm64: cpufeature: discover CPU support for MPAM") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/cpufeature.h | 9 +++++++ arch/arm64/kernel/cpufeature.c | 13 +++++++--- arch/arm64/kernel/cpuinfo.c | 1 + arch/arm64/kernel/mpam.c | 38 ++++++++++++++++++++++++++--- 4 files changed, 53 insertions(+), 8 deletions(-) diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index 2af4c7ad7dc5..f8ec4b20fa69 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -858,6 +858,15 @@ static inline bool cpus_support_mpam(void) cpus_have_final_cap(ARM64_MPAM); } +#ifdef CONFIG_ARM64_MPAM +bool mpam_detect_is_enabled(void); +#else +static inline bool mpam_detect_is_enabled(void) +{ + return false; +} +#endif + int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt); bool try_emulate_mrs(struct pt_regs *regs, u32 isn); diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index f94bc6eb83e0..f4f3ad670391 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1078,8 +1078,9 @@ void __init init_cpu_features(struct cpuinfo_arm64 *info) vec_init_vq_map(ARM64_VEC_SME); } - if (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || - id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1)) + if (mpam_detect_is_enabled() && + (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || + id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1))) init_cpu_ftr_reg(SYS_MPAMIDR_EL1, info->reg_mpamidr); if (id_aa64pfr1_mte(info->reg_id_aa64pfr1)) @@ -1341,8 +1342,9 @@ void update_cpu_features(int cpu, vec_update_vq_map(ARM64_VEC_SME); } - if (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || - id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1)) { + if (mpam_detect_is_enabled() && + (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || + id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1))) { taint |= check_update_ftr_reg(SYS_MPAMIDR_EL1, cpu, info->reg_mpamidr, boot->reg_mpamidr); } @@ -2317,6 +2319,9 @@ test_has_mpam(const struct arm64_cpu_capabilities *entry, int scope) !id_aa64pfr1_mpamfrac(pfr1)) return false; + if (!mpam_detect_is_enabled()) + return false; + /* Check firmware actually enabled MPAM on this cpu. */ return (read_sysreg_s(SYS_MPAM1_EL1) & MPAM_SYSREG_EN); } diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c index 5ad8d8697d56..7466b6066d87 100644 --- a/arch/arm64/kernel/cpuinfo.c +++ b/arch/arm64/kernel/cpuinfo.c @@ -461,6 +461,7 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info) __cpuinfo_store_cpu_32bit(&info->aarch32); if (IS_ENABLED(CONFIG_ARM64_MPAM) && + mpam_detect_is_enabled() && (id_aa64pfr0_mpam(info->reg_id_aa64pfr0) || id_aa64pfr1_mpamfrac(info->reg_id_aa64pfr1))) info->reg_mpamidr = read_cpuid(MPAMIDR_EL1); diff --git a/arch/arm64/kernel/mpam.c b/arch/arm64/kernel/mpam.c index 8fd9dbdc2b01..87411609407e 100644 --- a/arch/arm64/kernel/mpam.c +++ b/arch/arm64/kernel/mpam.c @@ -13,15 +13,45 @@ DEFINE_STATIC_KEY_FALSE(mpam_enabled); DEFINE_PER_CPU(u64, arm64_mpam_default); DEFINE_PER_CPU(u64, arm64_mpam_current); +static const struct midr_range mpam_disable_list[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + { /* sentinel */ } +}; + +static bool __read_mostly mpam_detect_enabled; +static int __init mpam_setup(char *str) +{ + if (!is_midr_in_range_list(read_cpuid_id(), mpam_disable_list)) + mpam_detect_enabled = true; + + if (!strcmp(str, "acpi")) + mpam_detect_enabled = true; + + return 0; +} +early_param("mpam", mpam_setup); + +bool mpam_detect_is_enabled(void) +{ + return mpam_detect_enabled; +} + static int __init arm64_mpam_register_cpus(void) { + u16 partid_max; + u64 mpamidr; + u8 pmg_max; + if (is_kdump_kernel()) return 0; - u64 mpamidr = read_sanitised_ftr_reg(SYS_MPAMIDR_EL1); - u16 partid_max = FIELD_GET(MPAMIDR_PARTID_MAX, mpamidr); - u8 pmg_max = FIELD_GET(MPAMIDR_PMG_MAX, mpamidr); + if (!mpam_detect_is_enabled()) + return 0; + + mpamidr = read_sanitised_ftr_reg(SYS_MPAMIDR_EL1); + partid_max = FIELD_GET(MPAMIDR_PARTID_MAX, mpamidr); + pmg_max = FIELD_GET(MPAMIDR_PMG_MAX, mpamidr); return mpam_register_requestor(partid_max, pmg_max); } -arch_initcall(arm64_mpam_register_cpus) +arch_initcall(arm64_mpam_register_cpus); -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] fix CVE-2024-46714
by Lin Yujun 20 Sep '24

20 Sep '24

Alex Hung (1): drm/amd/display: Skip wbscl_set_scaler_filter if filter is null drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] drm/amd/display: Check denominator pbn_div before used
by Xia Fukun 20 Sep '24

20 Sep '24

From: Alex Hung <alex.hung(a)amd.com> mainline inclusion from mainline-v6.11-rc7 commit 116a678f3a9abc24f5c9d2525b7393d18d9eb58e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXX CVE: CVE-2024-46773 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHAT & HOW] A denominator cannot be 0, and is checked before used. This fixes 1 DIVIDE_BY_ZERO issue reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Jerry Zuo <jerry.zuo(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 94059aef762b..2c7ba6e4fd1b 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -6934,7 +6934,7 @@ static int dm_update_mst_vcpi_slots_for_dsc(struct drm_atomic_state *state, } } - if (j == dc_state->stream_count) + if (j == dc_state->stream_count || pbn_div == 0) continue; slot_num = DIV_ROUND_UP(pbn, pbn_div); -- 2.34.1

2 1

[PATCH OLK-6.6] mm/migration: do not folio copy in MIGRATE_SYNC_NO_COPY mode
by Tong Tiangen 20 Sep '24

20 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IASFAM -------------------------------- During page migration, if MIGRATE_SYNC_NO_COPY mode is used, the page content should not be migrated. This patch fix it. Fixes: 374fe8ea8082 ("fs: hugetlbfs: support poisoned recover from hugetlbfs_migrate_folio()") Fixes: 1d263184ba06 ("mm: migrate: support poisoned recover from migrate folio") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- fs/hugetlbfs/inode.c | 10 ++++++++++ include/linux/migrate.h | 7 +++++-- mm/migrate.c | 20 ++++++++------------ 3 files changed, 23 insertions(+), 14 deletions(-) diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 8386d78eabe5..d4fcfc03fac9 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1145,6 +1145,16 @@ static int hugetlbfs_migrate_folio(struct address_space *mapping, enum migrate_mode mode) { int rc; + int expected_count = folio_expected_refs(mapping, src); + + if (folio_ref_count(src) != expected_count) + return -EAGAIN; + + if (mode != MIGRATE_SYNC_NO_COPY) { + rc = folio_mc_copy(dst, src); + if (unlikely(rc)) + return rc; + } rc = migrate_huge_page_move_mapping(mapping, dst, src); if (rc != MIGRATEPAGE_SUCCESS) diff --git a/include/linux/migrate.h b/include/linux/migrate.h index 517f70b70620..832d711d381d 100644 --- a/include/linux/migrate.h +++ b/include/linux/migrate.h @@ -79,7 +79,7 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio); void folio_migrate_copy(struct folio *newfolio, struct folio *folio); int folio_migrate_mapping(struct address_space *mapping, struct folio *newfolio, struct folio *folio, int extra_count); - +int folio_expected_refs(struct address_space *mapping, struct folio *folio); #else static inline void putback_movable_pages(struct list_head *l) {} @@ -98,7 +98,10 @@ static inline int migrate_huge_page_move_mapping(struct address_space *mapping, { return -ENOSYS; } - +static inline int folio_expected_refs(struct address_space *mapping, struct folio *folio) +{ + return 0; +} #endif /* CONFIG_MIGRATION */ #ifdef CONFIG_COMPACTION diff --git a/mm/migrate.c b/mm/migrate.c index efcca5330568..50cf85d65cf3 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -376,7 +376,7 @@ void pmd_migration_entry_wait(struct mm_struct *mm, pmd_t *pmd) } #endif -static int folio_expected_refs(struct address_space *mapping, +int folio_expected_refs(struct address_space *mapping, struct folio *folio) { int refs = 1; @@ -552,16 +552,10 @@ int migrate_huge_page_move_mapping(struct address_space *mapping, struct folio *dst, struct folio *src) { XA_STATE(xas, &mapping->i_pages, folio_index(src)); - int rc, expected_count = folio_expected_refs(mapping, src); - - if (folio_ref_count(src) != expected_count) - return -EAGAIN; - - rc = folio_mc_copy(dst, src); - if (unlikely(rc)) - return rc; + int expected_count; xas_lock_irq(&xas); + expected_count = folio_expected_refs(mapping, src); if (!folio_ref_freeze(src, expected_count)) { xas_unlock_irq(&xas); return -EAGAIN; @@ -695,9 +689,11 @@ static int __migrate_folio(struct address_space *mapping, struct folio *dst, if (folio_ref_count(src) != expected_count) return -EAGAIN; - rc = folio_mc_copy(dst, src); - if (unlikely(rc)) - return rc; + if (mode != MIGRATE_SYNC_NO_COPY) { + rc = folio_mc_copy(dst, src); + if (unlikely(rc)) + return rc; + } rc = __folio_migrate_mapping(mapping, dst, src, expected_count); if (rc != MIGRATEPAGE_SUCCESS) -- 2.25.1

2 1

[PATCH OLK-5.10] media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
by Zheng Yejian 20 Sep '24

20 Sep '24

From: Sean Young <sean(a)mess.org> stable inclusion from stable-v5.10.224 commit 2de18b5cc38e83428316d6d6d05a702208fb299b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAS2LK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c84bde4f37ba27d50e4c70ecacd33fe4a57030d upstream. This reverts commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c. This breaks the TeVii s480 dual DVB-S2 S660. The device has a bulk in endpoint but no corresponding out endpoint, so the device does not pass the "has both receive and send bulk endpoint" test. Seemingly this device does not use dvb_usb_generic_rw() so I have tried removing the generic_bulk_ctrl_endpoint entry, but this resulted in different problems. As we have no explanation yet, revert. $ dmesg | grep -i -e dvb -e dw21 -e usb\ 4 [ 0.999122] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 1.023123] usb 4-1: new high-speed USB device number 2 using ehci-pci [ 1.130247] usb 1-1: New USB device found, idVendor=9022, idProduct=d482, +bcdDevice= 0.01 [ 1.130257] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1.152323] usb 4-1: New USB device found, idVendor=9022, idProduct=d481, +bcdDevice= 0.01 [ 1.152329] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 6.701033] dvb-usb: found a 'TeVii S480.2 USB' in cold state, will try to +load a firmware [ 6.701178] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.701179] dw2102: start downloading DW210X firmware [ 6.703715] dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in cold +state, will try to load a firmware [ 6.703974] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 6.756432] usb 1-1: USB disconnect, device number 2 [ 6.862119] dvb-usb: found a 'TeVii S480.2 USB' in warm state. [ 6.862194] dvb-usb: TeVii S480.2 USB error while loading driver (-22) [ 6.862209] dvb-usb: found a 'TeVii S480.1 USB' in cold state, will try to +load a firmware [ 6.862244] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.862245] dw2102: start downloading DW210X firmware [ 6.914811] usb 4-1: USB disconnect, device number 2 [ 7.014131] dvb-usb: found a 'TeVii S480.1 USB' in warm state. [ 7.014487] dvb-usb: TeVii S480.1 USB error while loading driver (-22) [ 7.014538] usbcore: registered new interface driver dw2102 Closes: https://lore.kernel.org/stable/20240801165146.38991f60@mir/ Fixes: 2052138b7da5 ("media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()") Reported-by: Stefan Lippers-Hollmann <s.l-h(a)gmx.de> Cc: stable(a)vger.kernel.org Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++--------------------- 1 file changed, 4 insertions(+), 31 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index 6cf6d08cc4ec..58eea8ab5477 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -23,40 +23,11 @@ static int dvb_usb_force_pid_filter_usage; module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); -static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) -{ - if (endpoint) { - int ret; - - ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); - if (ret) - return ret; - ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); - if (ret) - return ret; - } - return 0; -} - -static void dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint) -{ - if (endpoint) { - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); - } -} - static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) { struct dvb_usb_adapter *adap; int ret, n, o; - ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); - if (ret) - return ret; - ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); - if (ret) - return ret; for (n = 0; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d; @@ -132,8 +103,10 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) * when reloading the driver w/o replugging the device * sometimes a timeout occurs, this helps */ - dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint); - dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response); + if (d->props.generic_bulk_ctrl_endpoint != 0) { + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); + } return 0; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
by Zheng Yejian 20 Sep '24

20 Sep '24

From: Sean Young <sean(a)mess.org> stable inclusion from stable-v5.10.224 commit 2de18b5cc38e83428316d6d6d05a702208fb299b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAS2LK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c84bde4f37ba27d50e4c70ecacd33fe4a57030d upstream. This reverts commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c. This breaks the TeVii s480 dual DVB-S2 S660. The device has a bulk in endpoint but no corresponding out endpoint, so the device does not pass the "has both receive and send bulk endpoint" test. Seemingly this device does not use dvb_usb_generic_rw() so I have tried removing the generic_bulk_ctrl_endpoint entry, but this resulted in different problems. As we have no explanation yet, revert. $ dmesg | grep -i -e dvb -e dw21 -e usb\ 4 [ 0.999122] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 1.023123] usb 4-1: new high-speed USB device number 2 using ehci-pci [ 1.130247] usb 1-1: New USB device found, idVendor=9022, idProduct=d482, +bcdDevice= 0.01 [ 1.130257] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1.152323] usb 4-1: New USB device found, idVendor=9022, idProduct=d481, +bcdDevice= 0.01 [ 1.152329] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 6.701033] dvb-usb: found a 'TeVii S480.2 USB' in cold state, will try to +load a firmware [ 6.701178] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.701179] dw2102: start downloading DW210X firmware [ 6.703715] dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in cold +state, will try to load a firmware [ 6.703974] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 6.756432] usb 1-1: USB disconnect, device number 2 [ 6.862119] dvb-usb: found a 'TeVii S480.2 USB' in warm state. [ 6.862194] dvb-usb: TeVii S480.2 USB error while loading driver (-22) [ 6.862209] dvb-usb: found a 'TeVii S480.1 USB' in cold state, will try to +load a firmware [ 6.862244] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.862245] dw2102: start downloading DW210X firmware [ 6.914811] usb 4-1: USB disconnect, device number 2 [ 7.014131] dvb-usb: found a 'TeVii S480.1 USB' in warm state. [ 7.014487] dvb-usb: TeVii S480.1 USB error while loading driver (-22) [ 7.014538] usbcore: registered new interface driver dw2102 Closes: https://lore.kernel.org/stable/20240801165146.38991f60@mir/ Fixes: 2052138b7da5 ("media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()") Reported-by: Stefan Lippers-Hollmann <s.l-h(a)gmx.de> Cc: stable(a)vger.kernel.org Conflicts: drivers/media/usb/dvb-usb/dvb-usb-init.c [Resolve conflicts due to changes in comments] Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++--------------------- 1 file changed, 4 insertions(+), 31 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index 04af78316efd..39ac22486bcd 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -26,40 +26,11 @@ static int dvb_usb_force_pid_filter_usage; module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); -static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) -{ - if (endpoint) { - int ret; - - ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); - if (ret) - return ret; - ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); - if (ret) - return ret; - } - return 0; -} - -static void dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint) -{ - if (endpoint) { - usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); - usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); - } -} - static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) { struct dvb_usb_adapter *adap; int ret, n, o; - ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); - if (ret) - return ret; - ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); - if (ret) - return ret; for (n = 0; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d; @@ -129,8 +100,10 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) * when reloading the driver w/o replugging the device * sometimes a timeout occures, this helps */ - dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint); - dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response); + if (d->props.generic_bulk_ctrl_endpoint != 0) { + usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); + usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); + } return 0; } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 18192/23720] mm/memory.c:1546:10: error: implicit declaration of function 'hugetlb_insert_hugepage_pte_by_pa'
by kernel test robot 20 Sep '24

20 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bacbf9a9f0df34d979a8029d5a7a7e5dc91460b9 commit: 18f49509eef01d1ee6ed81899298994f2f88dd2a [18192/23720] ascend: share_pool: Use remap_pfn_range to share kva to uva config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20240920/202409201222.m2Vt8TXh-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240920/202409201222.m2Vt8TXh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409201222.m2Vt8TXh-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/memory.c:51: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> mm/memory.c:1546:10: error: implicit declaration of function 'hugetlb_insert_hugepage_pte_by_pa' [-Werror,-Wimplicit-function-declaration] 1546 | return hugetlb_insert_hugepage_pte_by_pa(vma->vm_mm, addr, | ^ mm/memory.c:1546:10: note: did you mean 'hugetlb_insert__hugepage_pte_by_pa'? include/linux/hugetlb.h:658:19: note: 'hugetlb_insert__hugepage_pte_by_pa' declared here 658 | static inline int hugetlb_insert__hugepage_pte_by_pa(struct mm_struct *mm, | ^ 1 warning and 1 error generated. vim +/hugetlb_insert_hugepage_pte_by_pa +1546 mm/memory.c 1504 1505 /** 1506 * vm_insert_page - insert single page into user vma 1507 * @vma: user vma to map to 1508 * @addr: target user address of this page 1509 * @page: source kernel page 1510 * 1511 * This allows drivers to insert individual pages they've allocated 1512 * into a user vma. 1513 * 1514 * The page has to be a nice clean _individual_ kernel allocation. 1515 * If you allocate a compound page, you need to have marked it as 1516 * such (__GFP_COMP), or manually just split the page up yourself 1517 * (see split_page()). 1518 * 1519 * NOTE! Traditionally this was done with "remap_pfn_range()" which 1520 * took an arbitrary page protection parameter. This doesn't allow 1521 * that. Your vma protection will have to be set up correctly, which 1522 * means that if you want a shared writable mapping, you'd better 1523 * ask for a shared writable mapping! 1524 * 1525 * The page does not need to be reserved. 1526 * 1527 * Usually this function is called from f_op->mmap() handler 1528 * under mm->mmap_sem write-lock, so it can change vma->vm_flags. 1529 * Caller must set VM_MIXEDMAP on vma if it wants to call this 1530 * function from other places, for example from page-fault handler. 1531 */ 1532 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, 1533 struct page *page) 1534 { 1535 if (addr < vma->vm_start || addr >= vma->vm_end) 1536 return -EFAULT; 1537 if (!page_count(page)) 1538 return -EINVAL; 1539 if (!(vma->vm_flags & VM_MIXEDMAP)) { 1540 BUG_ON(down_read_trylock(&vma->vm_mm->mmap_sem)); 1541 BUG_ON(vma->vm_flags & VM_PFNMAP); 1542 vma->vm_flags |= VM_MIXEDMAP; 1543 } 1544 1545 if (sp_check_hugepage(page)) > 1546 return hugetlb_insert_hugepage_pte_by_pa(vma->vm_mm, addr, 1547 vma->vm_page_prot, page_to_phys(page)); 1548 else 1549 return insert_page(vma, addr, page, vma->vm_page_prot); 1550 } 1551 EXPORT_SYMBOL(vm_insert_page); 1552 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/11] large folio: Performance and bugfix
by Liu Shixin 20 Sep '24

20 Sep '24

Patch [1-3] are cleanups for shmem. Patch [4,5] fix performance of shmem write. Patch [6-11] fix fault handler's handling of poisoned tail pages. Baolin Wang (3): mm: shmem: simplify the suitable huge orders validation for tmpfs mm: shmem: rename shmem_is_huge() to shmem_huge_global_enabled() mm: shmem: move shmem_huge_global_enabled() into shmem_allowable_huge_orders() Kefeng Wang (1): tmpfs: fault in smaller chunks if large folio allocation not allowed Matthew Wilcox (Oracle) (6): mm: make mapping_evict_folio() the preferred way to evict clean folios mm: convert __do_fault() to use a folio mm: use mapping_evict_folio() in truncate_error_page() mm: convert soft_offline_in_use_page() to use a folio mm: convert isolate_page() to mf_isolate_folio() mm: remove invalidate_inode_page() Rik van Riel (1): mm,tmpfs: consider end of file write in shmem_is_huge include/linux/fs.h | 2 + include/linux/shmem_fs.h | 15 ++--- mm/filemap.c | 7 +- mm/huge_memory.c | 11 +--- mm/internal.h | 2 +- mm/khugepaged.c | 2 +- mm/memory-failure.c | 54 ++++++++-------- mm/memory.c | 20 +++--- mm/shmem.c | 135 +++++++++++++++++++++------------------ mm/truncate.c | 42 +++++------- mm/userfaultfd.c | 2 +- 11 files changed, 145 insertions(+), 147 deletions(-) -- 2.34.1

2 12

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-46714
by Lin Yujun 20 Sep '24

20 Sep '24

Alex Hung (1): drm/amd/display: Skip wbscl_set_scaler_filter if filter is null drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] fix CVE-2024-46714
by Lin Yujun 20 Sep '24

20 Sep '24

Alex Hung (1): drm/amd/display: Skip wbscl_set_scaler_filter if filter is null drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] vsock: fix recursive ->recvmsg calls
by Zhang Changzhong 20 Sep '24

20 Sep '24

From: Cong Wang <cong.wang(a)bytedance.com> stable inclusion from stable-v6.6.48 commit 921f1acf0c3cf6b1260ab57a8a6e8b3d5f3023d5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZC CVE: CVE-2024-44996 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 69139d2919dd4aa9a553c8245e7c63e82613e3fc ] After a vsock socket has been added to a BPF sockmap, its prot->recvmsg has been replaced with vsock_bpf_recvmsg(). Thus the following recursiion could happen: vsock_bpf_recvmsg() -> __vsock_recvmsg() -> vsock_connectible_recvmsg() -> prot->recvmsg() -> vsock_bpf_recvmsg() again We need to fix it by calling the original ->recvmsg() without any BPF sockmap logic in __vsock_recvmsg(). Fixes: 634f1a7110b4 ("vsock: support sockmap") Reported-by: syzbot+bdb4bd87b5e22058e2a4(a)syzkaller.appspotmail.com Tested-by: syzbot+bdb4bd87b5e22058e2a4(a)syzkaller.appspotmail.com Cc: Bobby Eshleman <bobby.eshleman(a)bytedance.com> Cc: Michael S. Tsirkin <mst(a)redhat.com> Cc: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Cong Wang <cong.wang(a)bytedance.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Link: https://patch.msgid.link/20240812022153.86512-1-xiyou.wangcong@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- include/net/af_vsock.h | 4 ++++ net/vmw_vsock/af_vsock.c | 50 +++++++++++++++++++++++++++-------------------- net/vmw_vsock/vsock_bpf.c | 4 ++-- 3 files changed, 35 insertions(+), 23 deletions(-) diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index dc3cb16..f8b09a8 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -227,8 +227,12 @@ struct vsock_tap { int vsock_add_tap(struct vsock_tap *vt); int vsock_remove_tap(struct vsock_tap *vt); void vsock_deliver_tap(struct sk_buff *build_skb(void *opaque), void *opaque); +int __vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + int flags); int vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, int flags); +int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, + size_t len, int flags); int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, int flags); diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 4afb6a5..f5eb737 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1270,25 +1270,28 @@ static int vsock_dgram_connect(struct socket *sock, return err; } +int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, + size_t len, int flags) +{ + struct sock *sk = sock->sk; + struct vsock_sock *vsk = vsock_sk(sk); + + return vsk->transport->dgram_dequeue(vsk, msg, len, flags); +} + int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, int flags) { #ifdef CONFIG_BPF_SYSCALL + struct sock *sk = sock->sk; const struct proto *prot; -#endif - struct vsock_sock *vsk; - struct sock *sk; - sk = sock->sk; - vsk = vsock_sk(sk); - -#ifdef CONFIG_BPF_SYSCALL prot = READ_ONCE(sk->sk_prot); if (prot != &vsock_proto) return prot->recvmsg(sk, msg, len, flags, NULL); #endif - return vsk->transport->dgram_dequeue(vsk, msg, len, flags); + return __vsock_dgram_recvmsg(sock, msg, len, flags); } EXPORT_SYMBOL_GPL(vsock_dgram_recvmsg); @@ -2124,15 +2127,12 @@ static int __vsock_seqpacket_recvmsg(struct sock *sk, struct msghdr *msg, } int -vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - int flags) +__vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + int flags) { struct sock *sk; struct vsock_sock *vsk; const struct vsock_transport *transport; -#ifdef CONFIG_BPF_SYSCALL - const struct proto *prot; -#endif int err; sk = sock->sk; @@ -2183,14 +2183,6 @@ vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, goto out; } -#ifdef CONFIG_BPF_SYSCALL - prot = READ_ONCE(sk->sk_prot); - if (prot != &vsock_proto) { - release_sock(sk); - return prot->recvmsg(sk, msg, len, flags, NULL); - } -#endif - if (sk->sk_type == SOCK_STREAM) err = __vsock_stream_recvmsg(sk, msg, len, flags); else @@ -2200,6 +2192,22 @@ vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, release_sock(sk); return err; } + +int +vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + int flags) +{ +#ifdef CONFIG_BPF_SYSCALL + struct sock *sk = sock->sk; + const struct proto *prot; + + prot = READ_ONCE(sk->sk_prot); + if (prot != &vsock_proto) + return prot->recvmsg(sk, msg, len, flags, NULL); +#endif + + return __vsock_connectible_recvmsg(sock, msg, len, flags); +} EXPORT_SYMBOL_GPL(vsock_connectible_recvmsg); static int vsock_set_rcvlowat(struct sock *sk, int val) diff --git a/net/vmw_vsock/vsock_bpf.c b/net/vmw_vsock/vsock_bpf.c index a3c9754..c42c5cc1 100644 --- a/net/vmw_vsock/vsock_bpf.c +++ b/net/vmw_vsock/vsock_bpf.c @@ -64,9 +64,9 @@ static int __vsock_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int int err; if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) - err = vsock_connectible_recvmsg(sock, msg, len, flags); + err = __vsock_connectible_recvmsg(sock, msg, len, flags); else if (sk->sk_type == SOCK_DGRAM) - err = vsock_dgram_recvmsg(sock, msg, len, flags); + err = __vsock_dgram_recvmsg(sock, msg, len, flags); else err = -EPROTOTYPE; -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] net: hns3: fix a deadlock problem when config TC during resetting
by Zhang Changzhong 20 Sep '24

20 Sep '24

From: Jie Wang <wangjie125(a)huawei.com> stable inclusion from stable-v5.10.225 commit fc250eca15bde34c4c8f806b9d88f55bd56a992c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY0Z CVE: CVE-2024-44995 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be5e816d00a506719e9dbb1a9c861c5ced30a109 ] When config TC during the reset process, may cause a deadlock, the flow is as below: pf reset start │ ▼ ...... setup tc │ │ ▼ ▼ DOWN: napi_disable() napi_disable()(skip) │ │ │ ▼ ▼ ...... ...... │ │ ▼ │ napi_enable() │ ▼ UINIT: netif_napi_del() │ ▼ ...... │ ▼ INIT: netif_napi_add() │ ▼ ...... global reset start │ │ ▼ ▼ UP: napi_enable()(skip) ...... │ │ ▼ ▼ ...... napi_disable() In reset process, the driver will DOWN the port and then UINIT, in this case, the setup tc process will UP the port before UINIT, so cause the problem. Adds a DOWN process in UINIT to fix it. Fixes: bb6b94a896d4 ("net: hns3: Add reset interface implementation in client") Signed-off-by: Jie Wang <wangjie125(a)huawei.com> Signed-off-by: Jijie Shao <shaojijie(a)huawei.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index cf79cd6..f5f7b59 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -5798,6 +5798,9 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle) struct net_device *netdev = handle->kinfo.netdev; struct hns3_nic_priv *priv = netdev_priv(netdev); + if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) + hns3_nic_net_stop(netdev); + if (!test_and_clear_bit(HNS3_NIC_STATE_INITED, &priv->state)) { netdev_warn(netdev, "already uninitialized\n"); return 0; -- 2.9.5

2 1

[PATCH OLK-6.6] net: hns3: fix a deadlock problem when config TC during resetting
by Zhang Changzhong 20 Sep '24

20 Sep '24

From: Jie Wang <wangjie125(a)huawei.com> stable inclusion from stable-v6.6.48 commit fa1d4de7265c370e673583ac8d1bd17d21826cd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY0Z CVE: CVE-2024-44995 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be5e816d00a506719e9dbb1a9c861c5ced30a109 ] When config TC during the reset process, may cause a deadlock, the flow is as below: pf reset start │ ▼ ...... setup tc │ │ ▼ ▼ DOWN: napi_disable() napi_disable()(skip) │ │ │ ▼ ▼ ...... ...... │ │ ▼ │ napi_enable() │ ▼ UINIT: netif_napi_del() │ ▼ ...... │ ▼ INIT: netif_napi_add() │ ▼ ...... global reset start │ │ ▼ ▼ UP: napi_enable()(skip) ...... │ │ ▼ ▼ ...... napi_disable() In reset process, the driver will DOWN the port and then UINIT, in this case, the setup tc process will UP the port before UINIT, so cause the problem. Adds a DOWN process in UINIT to fix it. Fixes: bb6b94a896d4 ("net: hns3: Add reset interface implementation in client") Signed-off-by: Jie Wang <wangjie125(a)huawei.com> Signed-off-by: Jijie Shao <shaojijie(a)huawei.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 180787c..ce22b34 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -5998,6 +5998,9 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle) struct net_device *netdev = handle->kinfo.netdev; struct hns3_nic_priv *priv = netdev_priv(netdev); + if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) + hns3_nic_net_stop(netdev); + if (!test_and_clear_bit(HNS3_NIC_STATE_INITED, &priv->state)) { netdev_warn(netdev, "already uninitialized\n"); return 0; -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS 00/13] block: backport debugfs patches
by Yu Kuai 20 Sep '24

20 Sep '24

Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Greg Kroah-Hartman (2): blk-mq: no need to check return value of debugfs_create functions blk-mq: fix up placement of debugfs directory of queue files Jan Kara (1): blktrace: Avoid sparse warnings when assigning q->blk_trace Luis Chamberlain (3): blktrace: break out of blktrace setup on concurrent calls blktrace: annotate required lock on do_blk_trace_setup() block: create the request_queue debugfs_dir on registration Ming Lei (1): blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created Saravanan D (1): blk-mq: Fix spurious debugfs directory creation during initialization Yu Kuai (3): block: shutdown blktrace in blk_release_queue() block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: fix kabi broken in struct request_queue block/blk-core.c | 8 +- block/blk-io-hierarchy/debugfs.c | 6 ++ block/blk-io-hierarchy/stats.c | 8 ++ block/blk-mq-debugfs.c | 158 ++++++++++++------------------- block/blk-mq-debugfs.h | 36 +++---- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 2 + block/blk-sysfs.c | 24 +++-- block/blk.h | 2 - include/linux/blkdev.h | 11 ++- kernel/trace/blktrace.c | 72 +++++++------- 11 files changed, 168 insertions(+), 170 deletions(-) -- 2.39.2

2 14

[PATCH OLK-6.6] drm/amdgpu: fix dereference after null check
by Liu Chuang 20 Sep '24

20 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit 0aad97bf6d0bc7a34a19f266b0b9fb2861efe64c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARVHE CVE: CVE-2024-46720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit b1f7810b05d1950350ac2e06992982974343e441 ] check the pointer hive before use. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index d8c95f5adeb6..a3d755e1470b 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -5235,7 +5235,7 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev, * to put adev in the 1st position. */ INIT_LIST_HEAD(&device_list); - if (!amdgpu_sriov_vf(adev) && (adev->gmc.xgmi.num_physical_nodes > 1)) { + if (!amdgpu_sriov_vf(adev) && (adev->gmc.xgmi.num_physical_nodes > 1) && hive) { list_for_each_entry(tmp_adev, &hive->device_list, gmc.xgmi.head) { list_add_tail(&tmp_adev->reset_list, &device_list); if (gpu_reset_for_dev_remove && adev->shutdown) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 20 Sep '24

20 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index 28d671c5e0ca..d173b13ff198 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH OLK-6.6] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 20 Sep '24

20 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index cb8bd8aae15b..0fa785f52707 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH OLK-6.6] mm: set hugepage to false when anon mthp allocation
by Liu Shixin 20 Sep '24

20 Sep '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARA8A -------------------------------- When the hugepage parameter is true in vma_alloc_folio(), it indicates that we only try allocation on preferred node if possible, but it could lead to lots of failures for large folio allocation without commit ddc1a5cbc05d ("mempolicy: alloc_pages_mpol() for NUMA policy without vma"), it has no effect on runtime behavior on mainline, but we're affected, so fix it by setting hugepage to false. Fixes: ba572beac8be ("mm: thp: support allocation of anonymous multi-size THP") Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memory.c b/mm/memory.c index 4eea351aaccd..03fa94ae898a 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -4434,7 +4434,7 @@ static struct folio *alloc_anon_folio(struct vm_fault *vmf) gfp = vma_thp_gfp_mask(vma); while (orders) { addr = ALIGN_DOWN(vmf->address, PAGE_SIZE << order); - folio = vma_alloc_folio(gfp, order, vma, addr, true); + folio = vma_alloc_folio(gfp, order, vma, addr, false); if (folio) { if (mem_cgroup_charge(folio, vma->vm_mm, gfp)) { count_mthp_stat(order, MTHP_STAT_ANON_FAULT_FALLBACK_CHARGE); -- 2.34.1

2 1

[PATCH OLK-5.10] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 20 Sep '24

20 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index 28d671c5e0ca..d173b13ff198 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 20 Sep '24

20 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index ad2e87de7dc5..d58a108a96c0 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -104,7 +104,7 @@ static void cougar_fix_g6_mapping(struct hid_device *hdev) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2024-44991
by Wang Liang 20 Sep '24

20 Sep '24

Eric Dumazet (3): tcp/dccp: bypass empty buckets in inet_twsk_purge() tcp/dccp: do not care about families in inet_twsk_purge() tcp: do not export tcp_twsk_purge() Florian Westphal (1): tcp: prevent concurrent execution of tcp_sk_exit_batch include/net/inet_timewait_sock.h | 2 +- include/net/tcp.h | 2 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 ------ net/ipv4/inet_timewait_sock.c | 16 +++++++++------- net/ipv4/tcp_ipv4.c | 16 +++++++++++++++- net/ipv4/tcp_minisocks.c | 7 +++---- net/ipv6/tcp_ipv6.c | 6 ------ 8 files changed, 30 insertions(+), 27 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10] netfilter: tproxy: bail out if IP has been disabled on the device
by Yongqiang Liu 20 Sep '24

20 Sep '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.219 commit 07eeedafc59c45fe5de43958128542be3784764c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D8P CVE: CVE-2024-36270 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 21a673bddc8fd4873c370caf9ae70ffc6d47e8d3 ] syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [..] RIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62 Call Trace: nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline] nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168 __in_dev_get_rcu() can return NULL, so check for this. Reported-and-tested-by: syzbot+b94a6818504ea90d7661(a)syzkaller.appspotmail.com Fixes: cc6eb4338569 ("tproxy: use the interface primary IP address as a default value for --on-ip") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c index 61cb2341f50f..7c1a0cd9f435 100644 --- a/net/ipv4/netfilter/nf_tproxy_ipv4.c +++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c @@ -58,6 +58,8 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr) laddr = 0; indev = __in_dev_get_rcu(skb->dev); + if (!indev) + return daddr; in_dev_for_each_ifa_rcu(ifa, indev) { if (ifa->ifa_flags & IFA_F_SECONDARY) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: tproxy: bail out if IP has been disabled on the device
by Yongqiang Liu 20 Sep '24

20 Sep '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.219 commit 07eeedafc59c45fe5de43958128542be3784764c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D8P CVE: CVE-2024-36270 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 21a673bddc8fd4873c370caf9ae70ffc6d47e8d3 ] syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [..] RIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62 Call Trace: nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline] nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168 __in_dev_get_rcu() can return NULL, so check for this. Reported-and-tested-by: syzbot+b94a6818504ea90d7661(a)syzkaller.appspotmail.com Fixes: cc6eb4338569 ("tproxy: use the interface primary IP address as a default value for --on-ip") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c index 61cb2341f50f..7c1a0cd9f435 100644 --- a/net/ipv4/netfilter/nf_tproxy_ipv4.c +++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c @@ -58,6 +58,8 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr) laddr = 0; indev = __in_dev_get_rcu(skb->dev); + if (!indev) + return daddr; in_dev_for_each_ifa_rcu(ifa, indev) { if (ifa->ifa_flags & IFA_F_SECONDARY) -- 2.34.1

2 1

[PATCH OLK-6.6] arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register
by yangjinqian 19 Sep '24

19 Sep '24

From: Nianyao Tang <tangnianyao(a)huawei.com> mainline inclusion from mainline-v6.11-rc1 commit e8cde32f111f7f5681a7bad3ec747e9e697569a9 category: other bugzilla: https://gitee.com/openeuler/kernel/issues/IAS9Z8 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=… ------------------------------------------------------------------------------- Enable ECBHB bits in ID_AA64MMFR1 register as per ARM DDI 0487K.a specification. When guest OS read ID_AA64MMFR1_EL1, kvm emulate this reg using ftr_id_aa64mmfr1 and always return ID_AA64MMFR1_EL1.ECBHB=0 to guest. It results in guest syscall jump to tramp ventry, which is not needed in implementation with ID_AA64MMFR1_EL1.ECBHB=1. Let's make the guest syscall process the same as the host. Signed-off-by: Nianyao Tang <tangnianyao(a)huawei.com> Link: https://lore.kernel.org/r/20240611122049.2758600-1-tangnianyao@huawei.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Jinqian Yang <yangjinqian1(a)huawei.com> Signed-off-by: Zhou Wang <wangzhou1(a)hisilicon.com> --- arch/arm64/kernel/cpufeature.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index f94bc6eb83e0..eb700e404aac 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -367,6 +367,7 @@ static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = { }; static const struct arm64_ftr_bits ftr_id_aa64mmfr1[] = { + ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_ECBHB_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_TIDCP1_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_AFP_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_EL1_HCX_SHIFT, 4, 0), -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-46723
by Liao Chen 19 Sep '24

19 Sep '24

fix CVE-2024-46723 Tim Huang (1): [Backport] drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-46723
by Liao Chen 19 Sep '24

19 Sep '24

fix CVE-2024-46723 Tim Huang (1): drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] fix CVE-2024-46723
by Liao Chen 19 Sep '24

19 Sep '24

fix CVE-2024-46723 Tim Huang (1): drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] fix CVE-2024-46723
by Liao Chen 19 Sep '24

19 Sep '24

fix CVE-2024-46723 Tim Huang (1): [Backport] drm/amdgpu: fix ucode out-of-bounds read warning drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

3 5

[PATCH OLK-6.6 0/1] CVE-2024-46785
by Yuntao Liu 19 Sep '24

19 Sep '24

CVE-2024-46785 Steven Rostedt (1): eventfs: Use list_del_rcu() for SRCU protected list variable fs/tracefs/event_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] [Backport] smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
by Li Lingfeng 19 Sep '24

19 Sep '24

From: ChenXiaoSong <chenxiaosong(a)kylinos.cn> mainline inclusion from mainline-v6.11-rc5 commit 4e8771a3666c8f216eefd6bd2fd50121c6c437db category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWV6 CVE: CVE-2024-46742 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) and parse_lease_state() return NULL. Fix this by check if 'lease_ctx_info' is NULL. Additionally, remove the redundant parentheses in parse_durable_handle_context(). Signed-off-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/server/oplock.c | 2 +- fs/smb/server/smb2pdu.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c index a8f52c4ebbda..e546ffa57b55 100644 --- a/fs/smb/server/oplock.c +++ b/fs/smb/server/oplock.c @@ -1510,7 +1510,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) * parse_lease_state() - parse lease context containted in file open request * @open_req: buffer containing smb2 file open(create) request * - * Return: oplock state, -ENOENT if create lease context not found + * Return: allocated lease context object on success, otherwise NULL */ struct lease_ctx_info *parse_lease_state(void *open_req) { diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 4d91210e6acf..7f8b55c39e84 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2761,8 +2761,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work, } } - if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || - req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) { + if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || + req_op_level == SMB2_OPLOCK_LEVEL_BATCH) { dh_info->CreateGuid = durable_v2_blob->CreateGuid; dh_info->persistent = @@ -2782,8 +2782,8 @@ static int parse_durable_handle_context(struct ksmbd_work *work, goto out; } - if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || - req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) { + if ((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) || + req_op_level == SMB2_OPLOCK_LEVEL_BATCH) { ksmbd_debug(SMB, "Request for durable open\n"); dh_info->type = dh_idx; } @@ -3414,7 +3414,7 @@ int smb2_open(struct ksmbd_work *work) goto err_out1; } } else { - if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) { + if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) { if (S_ISDIR(file_inode(filp)->i_mode)) { lc->req_state &= ~SMB2_LEASE_WRITE_CACHING_LE; lc->is_dir = true; -- 2.31.1

2 1

[PATCH OLK-5.10] smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
by Li Lingfeng 19 Sep '24

19 Sep '24

From: ChenXiaoSong <chenxiaosong(a)kylinos.cn> mainline inclusion from mainline-v6.11-rc5 commit 4e8771a3666c8f216eefd6bd2fd50121c6c437db category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWV6 CVE: CVE-2024-46742 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) and parse_lease_state() return NULL. Fix this by check if 'lease_ctx_info' is NULL. Additionally, remove the redundant parentheses in parse_durable_handle_context(). Signed-off-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/oplock.c fs/smb/server/smb2pdu.c [Commit c8efcc786146 ("ksmbd: add support for durable handles v1/v2") add parse_durable_handle_context(); Commit 38c8a9a52082 ("smb: move client and server files to common directory fs/smb") move oplock.c and smb2pdu.c from fs/ksmbd/ to fs/smb/server/.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/oplock.c | 2 +- fs/ksmbd/smb2pdu.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/oplock.c b/fs/ksmbd/oplock.c index 6df455a54b70..3324bb226c79 100644 --- a/fs/ksmbd/oplock.c +++ b/fs/ksmbd/oplock.c @@ -1389,7 +1389,7 @@ void create_lease_buf(u8 *rbuf, struct lease *lease) * parse_lease_state() - parse lease context containted in file open request * @open_req: buffer containing smb2 file open(create) request * - * Return: oplock state, -ENOENT if create lease context not found + * Return: allocated lease context object on success, otherwise NULL */ struct lease_ctx_info *parse_lease_state(void *open_req) { diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..a5f71fd7b1a8 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -3115,7 +3115,7 @@ int smb2_open(struct ksmbd_work *work) goto err_out; } } else { - if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) { + if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE && lc) { req_op_level = smb2_map_lease_to_oplock(lc->req_state); ksmbd_debug(SMB, "lease req for(%s) req oplock state 0x%x, lease state 0x%x\n", -- 2.31.1

2 1

[PATCH OLK-6.6 0/1] Fix iBMA bug and change version
by Peng Zhang 19 Sep '24

19 Sep '24

From: Wujiahai <wujiahai(a)huawei.com> 1. The initialization sequence of the edma_host.timer and edma_host is optimized when the iBMA initializes the edma driver. 2. Change the iBMA driver version. Wujiahai (1): BMA: Fix edma driver initialization problem and change the version number. .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../ethernet/huawei/bma/edma_drv/edma_host.c | 80 ++++++++----------- .../huawei/bma/kbox_drv/kbox_include.h | 2 +- .../ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 38 insertions(+), 50 deletions(-) -- 2.27.0

2 2

[PATCH OLK-6.6 v3] KVM:arm64:Add a kvm module param to get current enabled GIC version
by Zhiqiang Ni 19 Sep '24

19 Sep '24

From: Yanan Wang <wangyanan55(a)huawei.com> virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAR5EZ CVE: NA Reference: NA -------------------------------- Using GICv4.1 is not a 100% win in all scenarios, sometimes we need to use different GIC version in different usecases. Given that there is not a straight forward way to check the GIC version that system is using (e.g., kernel messages may be overided with time elapses), let's add a module param in KVM such that userspace can check the GIC version simply by reading /sys/module/kvm/parameters/gic_version. Signed-off-by: Yanan Wang <wangyanan55(a)huawei.com> Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/kvm/vgic/vgic-v3.c | 37 +++++++++++++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic.h | 8 ++++++++ 2 files changed, 45 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-v3.c b/arch/arm64/kvm/vgic/vgic-v3.c index dab599e857b5..227fa1874c3b 100644 --- a/arch/arm64/kvm/vgic/vgic-v3.c +++ b/arch/arm64/kvm/vgic/vgic-v3.c @@ -20,6 +20,37 @@ static bool common_trap; static bool dir_trap; static bool gicv4_enable; +enum gic_version global_gic_version = UNKNOWN_GIC_VERSION; +static const char * const gic_version_str[] = { + "GICv2", + "GICv3", + "GICv4", + "GICv4.1", + "unknown" +}; + +static int get_gic_version(char *buffer, const struct kernel_param *kp); +static const struct kernel_param_ops gic_version_ops = { + .get = get_gic_version, +}; + +static const char *gic_version; +module_param_cb(gic_version, &gic_version_ops, &gic_version, 0444); +MODULE_PARM_DESC(gic_version, "Version of current enabled GIC"); + +static int get_gic_version(char *buffer, const struct kernel_param *kp) +{ + int index = global_gic_version; + + if (index < 0 || index >= ARRAY_SIZE(gic_version_str)) { + kvm_err("Invalid GIC version enum %d\n", index); + return -EINVAL; + } + gic_version = gic_version_str[index]; + + return param_get_charp(buffer, kp); +} + void vgic_v3_set_underflow(struct kvm_vcpu *vcpu) { struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3; @@ -654,6 +685,7 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.nr_lr = (ich_vtr_el2 & 0xf) + 1; kvm_vgic_global_state.can_emulate_gicv2 = false; kvm_vgic_global_state.ich_vtr_el2 = ich_vtr_el2; + global_gic_version = GICV3; /* GICv4 support? */ if (info->has_v4) { @@ -663,6 +695,11 @@ int vgic_v3_probe(const struct gic_kvm_info *info) kvm_vgic_global_state.has_gicv4_1 ? ".1" : "", gicv4_enable ? "en" : "dis"); + if (kvm_vgic_global_state.has_gicv4_1) + global_gic_version = GICV4_1; + else if (kvm_vgic_global_state.has_gicv4) + global_gic_version = GICV4; + #ifdef CONFIG_VIRT_VTIMER_IRQ_BYPASS kvm_vgic_global_state.has_direct_vtimer = info->has_vtimer && gicv4_enable; if (kvm_vgic_global_state.has_direct_vtimer) diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index 5135c690839e..539909a681d7 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -157,6 +157,14 @@ static inline bool vgic_direct_sgi_or_ppi(struct vgic_irq *irq) #endif } +enum gic_version { + GICV2, + GICV3, + GICV4, + GICV4_1, + UNKNOWN_GIC_VERSION +}; + /* * This struct provides an intermediate representation of the fields contained * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] Fix CVE-2024-44991
by Wang Liang 19 Sep '24

19 Sep '24

Eric Dumazet (2): tcp/dccp: bypass empty buckets in inet_twsk_purge() tcp/dccp: do not care about families in inet_twsk_purge() Florian Westphal (1): tcp: prevent concurrent execution of tcp_sk_exit_batch include/net/inet_timewait_sock.h | 2 +- include/net/tcp.h | 2 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 ------ net/ipv4/inet_timewait_sock.c | 16 +++++++++------- net/ipv4/tcp_ipv4.c | 16 +++++++++++++++- net/ipv4/tcp_minisocks.c | 6 +++--- net/ipv6/tcp_ipv6.c | 6 ------ 8 files changed, 30 insertions(+), 26 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 v3] KVM:arm64:Add a kvm parameter to control guest wfi trapping
by Zhiqiang Ni 19 Sep '24

19 Sep '24

virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAQV1W CVE: NA Reference: NA -------------------------------- Currently, on GICv4+ system if a vCPU is only runnable process on a pCPU and we are using direct injection of interrupts, the guest WFI trapping will be turn off. So in host view, the vcpu process's CPU util is almost 100%, which may confuse someone. Let's add a kvm parameter to control guest wfi trapping. Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/include/asm/kvm_emulate.h | 3 ++ arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 49 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index 2293caab9..6992d010b 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -119,6 +119,9 @@ static inline void vcpu_clear_wfx_traps(struct kvm_vcpu *vcpu) vcpu->arch.hcr_el2 &= ~HCR_TWI; else vcpu->arch.hcr_el2 |= HCR_TWI; + + if (force_wfi_trap) + vcpu->arch.hcr_el2 |= HCR_TWI; } static inline void vcpu_set_wfx_traps(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098..5ba983f71 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -54,6 +54,7 @@ #define KVM_REQ_SUSPEND KVM_ARCH_REQ(6) #define KVM_REQ_RESYNC_PMU_EL0 KVM_ARCH_REQ(7) #define KVM_REQ_RELOAD_TLBI_DVMBM KVM_ARCH_REQ(8) +#define KVM_REQ_RELOAD_WFI_TRAPS KVM_ARCH_REQ(9) #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ KVM_DIRTY_LOG_INITIALLY_SET) @@ -1244,6 +1245,7 @@ extern unsigned int twedel; void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu); bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu); +extern bool force_wfi_trap; extern bool kvm_ncsnp_support; extern bool kvm_dvmbm_support; diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index fe3add87e..3e0e84ce9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -82,6 +82,48 @@ unsigned int twedel; module_param(twedel, uint, 0644); #endif +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp); + +static const struct kernel_param_ops force_wfi_trap_ops = { + .set = vcpu_req_reload_wfi_traps, + .get = param_get_bool, +}; + +bool force_wfi_trap; +module_param_cb(force_wfi_trap, &force_wfi_trap_ops, &force_wfi_trap, 0644); + +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp) +{ + struct kvm *kvm; + bool oldvalue; + int err; + + oldvalue = force_wfi_trap; + err = param_set_bool(val, kp); + if (err) + return err; + + if (oldvalue == force_wfi_trap) + return err; + + /* + * If set the force_wfi_trap from 1 to 0, no need to kick vcpus here. + * The HCR_TWI flag will be cleared in kvm_arch_vcpu_load(). + */ + if (force_wfi_trap == 0) + return 0; + + /* + * We need to kick vcpus out of guest mode here to reload + * wfx trapping config when re-enter guest mode. + */ + mutex_lock(&kvm_lock); + list_for_each_entry(kvm, &vm_list, vm_list) + kvm_make_all_cpus_request(kvm, KVM_REQ_RELOAD_WFI_TRAPS); + mutex_unlock(&kvm_lock); + return err; +} + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) { return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE; @@ -958,6 +1000,13 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu) if (kvm_check_request(KVM_REQ_RELOAD_TLBI_DVMBM, vcpu)) kvm_hisi_reload_lsudvmbm(vcpu->kvm); + + if (kvm_check_request(KVM_REQ_RELOAD_WFI_TRAPS, vcpu)) { + if (single_task_running()) + vcpu_clear_wfx_traps(vcpu); + else + vcpu_set_wfx_traps(vcpu); + } } return 1; -- 2.43.0

2 1

[PATCH v3 OLK-6.6] KVM:arm64:Add a kvm parameter to control guest wfi trapping
by Zhiqiang Ni 19 Sep '24

19 Sep '24

virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAQV1W CVE: NA Reference: NA -------------------------------- Currently, on GICv4+ system if a vCPU is only runnable process on a pCPU and we are using direct injection of interrupts, the guest WFI trapping will be turn off. So in host view, the vcpu process's CPU util is almost 100%, which may confuse someone. Let's add a kvm parameter to control guest wfi trapping. Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/include/asm/kvm_emulate.h | 3 ++ arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 49 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index 2293caab9..6992d010b 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -119,6 +119,9 @@ static inline void vcpu_clear_wfx_traps(struct kvm_vcpu *vcpu) vcpu->arch.hcr_el2 &= ~HCR_TWI; else vcpu->arch.hcr_el2 |= HCR_TWI; + + if (force_wfi_trap) + vcpu->arch.hcr_el2 |= HCR_TWI; } static inline void vcpu_set_wfx_traps(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098..5ba983f71 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -54,6 +54,7 @@ #define KVM_REQ_SUSPEND KVM_ARCH_REQ(6) #define KVM_REQ_RESYNC_PMU_EL0 KVM_ARCH_REQ(7) #define KVM_REQ_RELOAD_TLBI_DVMBM KVM_ARCH_REQ(8) +#define KVM_REQ_RELOAD_WFI_TRAPS KVM_ARCH_REQ(9) #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ KVM_DIRTY_LOG_INITIALLY_SET) @@ -1244,6 +1245,7 @@ extern unsigned int twedel; void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu); bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu); +extern bool force_wfi_trap; extern bool kvm_ncsnp_support; extern bool kvm_dvmbm_support; diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index fe3add87e..3e0e84ce9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -82,6 +82,48 @@ unsigned int twedel; module_param(twedel, uint, 0644); #endif +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp); + +static const struct kernel_param_ops force_wfi_trap_ops = { + .set = vcpu_req_reload_wfi_traps, + .get = param_get_bool, +}; + +bool force_wfi_trap; +module_param_cb(force_wfi_trap, &force_wfi_trap_ops, &force_wfi_trap, 0644); + +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp) +{ + struct kvm *kvm; + bool oldvalue; + int err; + + oldvalue = force_wfi_trap; + err = param_set_bool(val, kp); + if (err) + return err; + + if (oldvalue == force_wfi_trap) + return err; + + /* + * If set the force_wfi_trap from 1 to 0, no need to kick vcpus here. + * The HCR_TWI flag will be cleared in kvm_arch_vcpu_load(). + */ + if (force_wfi_trap == 0) + return 0; + + /* + * We need to kick vcpus out of guest mode here to reload + * wfx trapping config when re-enter guest mode. + */ + mutex_lock(&kvm_lock); + list_for_each_entry(kvm, &vm_list, vm_list) + kvm_make_all_cpus_request(kvm, KVM_REQ_RELOAD_WFI_TRAPS); + mutex_unlock(&kvm_lock); + return err; +} + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) { return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE; @@ -958,6 +1000,13 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu) if (kvm_check_request(KVM_REQ_RELOAD_TLBI_DVMBM, vcpu)) kvm_hisi_reload_lsudvmbm(vcpu->kvm); + + if (kvm_check_request(KVM_REQ_RELOAD_WFI_TRAPS, vcpu)) { + if (single_task_running()) + vcpu_clear_wfx_traps(vcpu); + else + vcpu_set_wfx_traps(vcpu); + } } return 1; -- 2.43.0

2 1

[PATCH v3 OLK-6.6] KVM:arm64:Add a kvm parameter to control guest wfi trapping
by Zhiqiang Ni 19 Sep '24

19 Sep '24

virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAQV1W CVE: NA Reference: NA -------------------------------- Currently, on GICv4+ system if a vCPU is only runnable process on a pCPU and we are using direct injection of interrupts, the guest WFI trapping will be turn off. So in host view, the vcpu process's CPU util is almost 100%, which may confuse someone. Let's add a kvm parameter to control guest wfi trapping. Signed-off-by: Zhiqiang Ni <nizhiqiang1(a)huawei.com> --- arch/arm64/include/asm/kvm_emulate.h | 3 ++ arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 49 ++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index 2293caab9..6992d010b 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -119,6 +119,9 @@ static inline void vcpu_clear_wfx_traps(struct kvm_vcpu *vcpu) vcpu->arch.hcr_el2 &= ~HCR_TWI; else vcpu->arch.hcr_el2 |= HCR_TWI; + + if (force_wfi_trap) + vcpu->arch.hcr_el2 |= HCR_TWI; } static inline void vcpu_set_wfx_traps(struct kvm_vcpu *vcpu) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098..5ba983f71 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -54,6 +54,7 @@ #define KVM_REQ_SUSPEND KVM_ARCH_REQ(6) #define KVM_REQ_RESYNC_PMU_EL0 KVM_ARCH_REQ(7) #define KVM_REQ_RELOAD_TLBI_DVMBM KVM_ARCH_REQ(8) +#define KVM_REQ_RELOAD_WFI_TRAPS KVM_ARCH_REQ(9) #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ KVM_DIRTY_LOG_INITIALLY_SET) @@ -1244,6 +1245,7 @@ extern unsigned int twedel; void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu); bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu); +extern bool force_wfi_trap; extern bool kvm_ncsnp_support; extern bool kvm_dvmbm_support; diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index fe3add87e..3e0e84ce9 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -82,6 +82,48 @@ unsigned int twedel; module_param(twedel, uint, 0644); #endif +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp); + +static const struct kernel_param_ops force_wfi_trap_ops = { + .set = vcpu_req_reload_wfi_traps, + .get = param_get_bool, +}; + +bool force_wfi_trap; +module_param_cb(force_wfi_trap, &force_wfi_trap_ops, &force_wfi_trap, 0644); + +static int vcpu_req_reload_wfi_traps(const char *val, const struct kernel_param *kp) +{ + struct kvm *kvm; + bool oldvalue; + int err; + + oldvalue = force_wfi_trap; + err = param_set_bool(val, kp); + if (err) + return err; + + if (oldvalue == force_wfi_trap) + return err; + + /* + * If set the force_wfi_trap from 1 to 0, no need to kick vcpus here. + * The HCR_TWI flag will be cleared in kvm_arch_vcpu_load(). + */ + if (force_wfi_trap == 0) + return 0; + + /* + * We need to kick vcpus out of guest mode here to reload + * wfx trapping config when re-enter guest mode. + */ + mutex_lock(&kvm_lock); + list_for_each_entry(kvm, &vm_list, vm_list) + kvm_make_all_cpus_request(kvm, KVM_REQ_RELOAD_WFI_TRAPS); + mutex_unlock(&kvm_lock); + return err; +} + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) { return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE; @@ -958,6 +1000,13 @@ static int check_vcpu_requests(struct kvm_vcpu *vcpu) if (kvm_check_request(KVM_REQ_RELOAD_TLBI_DVMBM, vcpu)) kvm_hisi_reload_lsudvmbm(vcpu->kvm); + + if (kvm_check_request(KVM_REQ_RELOAD_WFI_TRAPS, vcpu)) { + if (single_task_running()) + vcpu_clear_wfx_traps(vcpu); + else + vcpu_set_wfx_traps(vcpu); + } } return 1; -- 2.43.0

2 1

[PATCH OLK-6.6] RDMA/hns: Fix ah error counter in sw stat not increasing
by Junxian Huang 19 Sep '24

19 Sep '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARV1S CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?id=39… ---------------------------------------------------------------------- There are several error cases where hns_roce_create_ah() returns directly without jumping to sw stat path, thus leading to a problem that the ah error counter does not increase. Fixes: db90f0012b30 ("RDMA/hns: Support SW stats with debugfs") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://patch.msgid.link/20240912115700.2016443-1-huangjunxian6@hisilicon.c… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_ah.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c index a1adf249b86a..2af9cfd435ec 100644 --- a/drivers/infiniband/hw/hns/hns_roce_ah.c +++ b/drivers/infiniband/hw/hns/hns_roce_ah.c @@ -63,8 +63,10 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, u32 max_sl; int ret; - if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 && udata) - return -EOPNOTSUPP; + if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08 && udata) { + ret = -EOPNOTSUPP; + goto err_out; + } ah->av.port = rdma_ah_get_port_num(ah_attr); ah->av.gid_index = grh->sgid_index; @@ -83,7 +85,7 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, ret = 0; if (ret && grh->sgid_attr->gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) - return ret; + goto err_out; if (tc_mode == HNAE3_TC_MAP_MODE_DSCP && grh->sgid_attr->gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) @@ -96,7 +98,8 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, ibdev_err_ratelimited(&hr_dev->ib_dev, "failed to set sl, sl (%u) shouldn't be larger than %u.\n", ah->av.sl, max_sl); - return -EINVAL; + ret = -EINVAL; + goto err_out; } memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE); -- 2.33.0

2 1

[PATCH OLK-6.6 v2 0/2] Fix VSYNC referencing an unmapped VPE on GIC v4.0/v4.1
by Zhou Wang 19 Sep '24

19 Sep '24

From: caijian <caijian11(a)h-partners.com> Patch#1 Fix VSYNC referencing an unmapped VPE on GIC v4.1 Patch#2 Fix VSYNC referencing an unmapped VPE on GIC v4.0 Nianyao Tang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 Zhou Wang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0 drivers/irqchip/irq-gic-v3-its.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS] mmc: mmc_test: Fix NULL dereference on allocation failure
by Cai Xinchen 19 Sep '24

19 Sep '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v4.19.321 commit e97be13a9f51284da450dd2a592e3fa87b49cdc9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJH CVE: CVE-2024-45028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a1e627af32ed60713941cbfc8075d44cad07f6dd ] If the "test->highmem = alloc_pages()" allocation fails then calling __free_pages(test->highmem) will result in a NULL dereference. Also change the error code to -ENOMEM instead of returning success. Fixes: 2661081f5ab9 ("mmc_test: highmem tests") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/8c90be28-67b4-4b0d-a105-034dc72a0b31@stanley.moun… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/mmc/core/mmc_test.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c index ef18daeaa4cc..164b4e43050e 100644 --- a/drivers/mmc/core/mmc_test.c +++ b/drivers/mmc/core/mmc_test.c @@ -3101,13 +3101,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL); #ifdef CONFIG_HIGHMEM test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER); + if (!test->highmem) { + count = -ENOMEM; + goto free_test_buffer; + } #endif -#ifdef CONFIG_HIGHMEM - if (test->buffer && test->highmem) { -#else if (test->buffer) { -#endif mutex_lock(&mmc_test_lock); mmc_test_run(test, testcase); mutex_unlock(&mmc_test_lock); @@ -3115,6 +3115,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, #ifdef CONFIG_HIGHMEM __free_pages(test->highmem, BUFFER_ORDER); +free_test_buffer: #endif kfree(test->buffer); kfree(test); -- 2.34.1

2 1