- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
by Yi Yang 06 Jan '25

06 Jan '25

From: Nuno Sa <nuno.sa(a)analog.com> mainline inclusion from mainline-v6.13-rc1 commit 3a4187ec454e19903fd15f6e1825a4b84e59a4cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMO CVE: CVE-2024-56557 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The AD7923 was updated to support devices with 8 channels, but the size of tx_buf and ring_xfer was not increased accordingly, leading to a potential buffer overflow in ad7923_update_scan_mode(). Fixes: 851644a60d20 ("iio: adc: ad7923: Add support for the ad7908/ad7918/ad7928") Cc: stable(a)vger.kernel.org Signed-off-by: Nuno Sa <nuno.sa(a)analog.com> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> Link: https://patch.msgid.link/20241029134637.2261336-1-quzicheng@huawei.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/adc/ad7923.c [conflicts due to not mergered 908af45d70573 ("iio: adc: ad7923: Fix alignment for DMA safety")] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/iio/adc/ad7923.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iio/adc/ad7923.c b/drivers/iio/adc/ad7923.c index 96eeda433ad6..b44a853a8390 100644 --- a/drivers/iio/adc/ad7923.c +++ b/drivers/iio/adc/ad7923.c @@ -47,7 +47,7 @@ struct ad7923_state { struct spi_device *spi; - struct spi_transfer ring_xfer[5]; + struct spi_transfer ring_xfer[9]; struct spi_transfer scan_single_xfer[2]; struct spi_message ring_msg; struct spi_message scan_single_msg; @@ -63,7 +63,7 @@ struct ad7923_state { * Length = 8 channels + 4 extra for 8 byte timestamp */ __be16 rx_buf[12] ____cacheline_aligned; - __be16 tx_buf[4]; + __be16 tx_buf[8]; }; struct ad7923_chip_info { -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56701
by Liao Chen 06 Jan '25

06 Jan '25

fix CVE-2024-56701 Michael Ellerman (1): powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore arch/powerpc/include/asm/dtl.h | 4 ++-- arch/powerpc/platforms/pseries/dtl.c | 8 ++++---- arch/powerpc/platforms/pseries/lpar.c | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-56567
by Liao Chen 06 Jan '25

06 Jan '25

fix CVE-2024-56567 Zicheng Qu (1): ad7780: fix division by zero in ad7780_write_raw() drivers/iio/adc/ad7780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-56677
by Liao Chen 06 Jan '25

06 Jan '25

fix CVE-2024-56677 Ritesh Harjani (IBM) (1): powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() arch/powerpc/include/asm/fadump.h | 7 +++++++ arch/powerpc/kernel/fadump.c | 6 +----- arch/powerpc/kernel/setup-common.c | 6 ++++-- 3 files changed, 12 insertions(+), 7 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
by Xiongfeng Wang 06 Jan '25

06 Jan '25

From: Zicheng Qu <quzicheng(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 6a057072ddd127255350357dd880903e8fa23f36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEI CVE: CVE-2024-53201 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This commit addresses a null pointer dereference issue in dcn20_program_pipe(). Previously, commit 8e4ed3cf1642 ("drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe") partially fixed the null pointer dereference issue. However, in dcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and plane_state is accessed again through pipe_ctx. Multiple if statements directly call attributes of plane_state, leading to potential null pointer dereference issues. This patch adds necessary null checks to ensure stability. Fixes: 8e4ed3cf1642 ("drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe") Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c [wangxiongfeng: Fix conflicts because file path is changed] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c index ebb8a0c63fcc8..8c257a4e3c03b 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c @@ -1601,9 +1601,9 @@ static void dcn20_program_pipe( dc->res_pool->hubbub->funcs->force_wm_propagate_to_pipes(dc->res_pool->hubbub); } - if (pipe_ctx->update_flags.raw || - (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.raw) || - pipe_ctx->stream->update_flags.raw) + if (pipe_ctx->plane_state && (pipe_ctx->update_flags.raw || + pipe_ctx->plane_state->update_flags.raw || + pipe_ctx->stream->update_flags.raw)) dcn20_update_dchubp_dpp(dc, pipe_ctx, context); if (pipe_ctx->plane_state && (pipe_ctx->update_flags.bits.enable || -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
by Xiongfeng Wang 06 Jan '25

06 Jan '25

From: Zicheng Qu <quzicheng(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 6a057072ddd127255350357dd880903e8fa23f36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEI CVE: CVE-2024-53201 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This commit addresses a null pointer dereference issue in dcn20_program_pipe(). Previously, commit 8e4ed3cf1642 ("drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe") partially fixed the null pointer dereference issue. However, in dcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and plane_state is accessed again through pipe_ctx. Multiple if statements directly call attributes of plane_state, leading to potential null pointer dereference issues. This patch adds necessary null checks to ensure stability. Fixes: 8e4ed3cf1642 ("drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe") Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c [wangxiongfeng: Fix conflicts because file path is changed] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c index ebb8a0c63fcc8..8c257a4e3c03b 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c @@ -1601,9 +1601,9 @@ static void dcn20_program_pipe( dc->res_pool->hubbub->funcs->force_wm_propagate_to_pipes(dc->res_pool->hubbub); } - if (pipe_ctx->update_flags.raw || - (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.raw) || - pipe_ctx->stream->update_flags.raw) + if (pipe_ctx->plane_state && (pipe_ctx->update_flags.raw || + pipe_ctx->plane_state->update_flags.raw || + pipe_ctx->stream->update_flags.raw)) dcn20_update_dchubp_dpp(dc, pipe_ctx, context); if (pipe_ctx->plane_state && (pipe_ctx->update_flags.bits.enable || -- 2.20.1

2 1

[PATCH OLK-6.6] drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
by Xiongfeng Wang 06 Jan '25

06 Jan '25

From: Zicheng Qu <quzicheng(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 6a057072ddd127255350357dd880903e8fa23f36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEI CVE: CVE-2024-53201 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This commit addresses a null pointer dereference issue in dcn20_program_pipe(). Previously, commit 8e4ed3cf1642 ("drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe") partially fixed the null pointer dereference issue. However, in dcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and plane_state is accessed again through pipe_ctx. Multiple if statements directly call attributes of plane_state, leading to potential null pointer dereference issues. This patch adds necessary null checks to ensure stability. Fixes: 8e4ed3cf1642 ("drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe") Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c [wangxiongfeng: Fix conflicts because file path is changed] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c index c6c465b46e19..509e0fd52491 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c @@ -1733,9 +1733,9 @@ static void dcn20_program_pipe( dc->res_pool->hubbub->funcs->program_det_size( dc->res_pool->hubbub, pipe_ctx->plane_res.hubp->inst, pipe_ctx->det_buffer_size_kb); - if (pipe_ctx->update_flags.raw || - (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.raw) || - pipe_ctx->stream->update_flags.raw) + if (pipe_ctx->plane_state && (pipe_ctx->update_flags.raw || + pipe_ctx->plane_state->update_flags.raw || + pipe_ctx->stream->update_flags.raw)) dcn20_update_dchubp_dpp(dc, pipe_ctx, context); if (pipe_ctx->plane_state && (pipe_ctx->update_flags.bits.enable || -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: ath10k: avoid NULL pointer error during sdio remove
by Liu Mingrui 06 Jan '25

06 Jan '25

From: Kang Yang <quic_kangyang(a)quicinc.com> mainline inclusion from mainline-v6.13-rc1 commit 95c38953cb1ecf40399a676a1f85dfe2b5780a9a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPA CVE: CVE-2024-56599 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen: Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c This is because during 'rmmod ath10k', ath10k_sdio_remove() will call ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release() will finally be called in ath10k_core_destroy(). This function will free struct cfg80211_registered_device *rdev and all its members, including wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio workqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON. After device release, destroy_workqueue() will use NULL pointer then the kernel panic happen. Call trace: ath10k_sdio_remove ->ath10k_core_unregister …… ->ath10k_core_stop ->ath10k_hif_stop ->ath10k_sdio_irq_disable ->ath10k_hif_power_down ->del_timer_sync(&ar_sdio->sleep_timer) ->ath10k_core_destroy ->ath10k_mac_destroy ->ieee80211_free_hw ->wiphy_free …… ->wiphy_dev_release ->destroy_workqueue Need to call destroy_workqueue() before ath10k_core_destroy(), free the work queue buffer first and then free pointer of work queue by ath10k_core_destroy(). This order matches the error path order in ath10k_sdio_probe(). No work will be queued on sdio workqueue between it is destroyed and ath10k_core_destroy() is called. Based on the call_stack above, the reason is: Only ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and ath10k_sdio_irq_disable() will queue work on sdio workqueue. Sleep timer will be deleted before ath10k_core_destroy() in ath10k_hif_power_down(). ath10k_sdio_irq_disable() only be called in ath10k_hif_stop(). ath10k_core_unregister() will call ath10k_hif_power_down() to stop hif bus, so ath10k_sdio_hif_tx_sg() won't be called anymore. Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189 Signed-off-by: Kang Yang <quic_kangyang(a)quicinc.com> Tested-by: David Ruth <druth(a)chromium.org> Reviewed-by: David Ruth <druth(a)chromium.org> Link: https://patch.msgid.link/20241008022246.1010-1-quic_kangyang@quicinc.com Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Conflicts: drivers/net/wireless/ath/ath10k/sdio.c [Context conflicts, no function change] Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/net/wireless/ath/ath10k/sdio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c index 0fe639710a8b..7f2bd4889bb5 100644 --- a/drivers/net/wireless/ath/ath10k/sdio.c +++ b/drivers/net/wireless/ath/ath10k/sdio.c @@ -2649,10 +2649,10 @@ static void ath10k_sdio_remove(struct sdio_func *func) netif_napi_del(&ar->napi); - ath10k_core_destroy(ar); - flush_workqueue(ar_sdio->workqueue); destroy_workqueue(ar_sdio->workqueue); + + ath10k_core_destroy(ar); } static const struct sdio_device_id ath10k_sdio_devices[] = { -- 2.25.1

2 1

[PATCH OLK-5.10] wifi: ath10k: avoid NULL pointer error during sdio remove
by Liu Mingrui 06 Jan '25

06 Jan '25

From: Kang Yang <quic_kangyang(a)quicinc.com> mainline inclusion from mainline-v6.13-rc1 commit 95c38953cb1ecf40399a676a1f85dfe2b5780a9a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPA CVE: CVE-2024-56599 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen: Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c This is because during 'rmmod ath10k', ath10k_sdio_remove() will call ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release() will finally be called in ath10k_core_destroy(). This function will free struct cfg80211_registered_device *rdev and all its members, including wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio workqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON. After device release, destroy_workqueue() will use NULL pointer then the kernel panic happen. Call trace: ath10k_sdio_remove ->ath10k_core_unregister …… ->ath10k_core_stop ->ath10k_hif_stop ->ath10k_sdio_irq_disable ->ath10k_hif_power_down ->del_timer_sync(&ar_sdio->sleep_timer) ->ath10k_core_destroy ->ath10k_mac_destroy ->ieee80211_free_hw ->wiphy_free …… ->wiphy_dev_release ->destroy_workqueue Need to call destroy_workqueue() before ath10k_core_destroy(), free the work queue buffer first and then free pointer of work queue by ath10k_core_destroy(). This order matches the error path order in ath10k_sdio_probe(). No work will be queued on sdio workqueue between it is destroyed and ath10k_core_destroy() is called. Based on the call_stack above, the reason is: Only ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and ath10k_sdio_irq_disable() will queue work on sdio workqueue. Sleep timer will be deleted before ath10k_core_destroy() in ath10k_hif_power_down(). ath10k_sdio_irq_disable() only be called in ath10k_hif_stop(). ath10k_core_unregister() will call ath10k_hif_power_down() to stop hif bus, so ath10k_sdio_hif_tx_sg() won't be called anymore. Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189 Signed-off-by: Kang Yang <quic_kangyang(a)quicinc.com> Tested-by: David Ruth <druth(a)chromium.org> Reviewed-by: David Ruth <druth(a)chromium.org> Link: https://patch.msgid.link/20241008022246.1010-1-quic_kangyang@quicinc.com Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Conflicts: drivers/net/wireless/ath/ath10k/sdio.c [Context conflicts, no function change] Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/net/wireless/ath/ath10k/sdio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c index 0fe639710a8b..7f2bd4889bb5 100644 --- a/drivers/net/wireless/ath/ath10k/sdio.c +++ b/drivers/net/wireless/ath/ath10k/sdio.c @@ -2649,10 +2649,10 @@ static void ath10k_sdio_remove(struct sdio_func *func) netif_napi_del(&ar->napi); - ath10k_core_destroy(ar); - flush_workqueue(ar_sdio->workqueue); destroy_workqueue(ar_sdio->workqueue); + + ath10k_core_destroy(ar); } static const struct sdio_device_id ath10k_sdio_devices[] = { -- 2.25.1

2 1

[PATCH OLK-5.10] BEAEC[Backport] ALSA: 6fire: Release resources at card release
by Lin Ruifeng 06 Jan '25

06 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit f2d06d4e129e2508e356136f99bb20a332ff1a00 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEC CVE: CVE-2024-53239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ] The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback. Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://patch.msgid.link/20241113111042.15058-6-tiwai@suse.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index 08c6e6a52eb9..ad6f89845a5c 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -62,8 +62,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy(struct sfire_chip *chip) +static void usb6fire_card_free(struct snd_card *card) { + struct sfire_chip *chip = card->private_data; + if (chip) { if (chip->pcm) usb6fire_pcm_destroy(chip); @@ -73,8 +75,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip) usb6fire_comm_destroy(chip); if (chip->control) usb6fire_control_destroy(chip); - if (chip->card) - snd_card_free(chip->card); } } @@ -137,6 +137,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count = 1; chip->card = card; + card->private_free = usb6fire_card_free; ret = usb6fire_comm_init(chip); if (ret < 0) @@ -163,7 +164,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, return 0; destroy_chip: - usb6fire_chip_destroy(chip); + snd_card_free(card); return ret; } @@ -182,7 +183,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true; usb6fire_chip_abort(chip); - usb6fire_chip_destroy(chip); } } } -- 2.22.0

2 1

[PATCH OLK-6.6] [Backport] ALSA: 6fire: Release resources at card release
by Lin Ruifeng 06 Jan '25

06 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.64 commit b754e831a94f82f2593af806741392903f359168 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEC CVE: CVE-2024-53239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ] The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback. Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://patch.msgid.link/20241113111042.15058-6-tiwai@suse.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index 33e962178c93..d562a30b087f 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -61,8 +61,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy(struct sfire_chip *chip) +static void usb6fire_card_free(struct snd_card *card) { + struct sfire_chip *chip = card->private_data; + if (chip) { if (chip->pcm) usb6fire_pcm_destroy(chip); @@ -72,8 +74,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip) usb6fire_comm_destroy(chip); if (chip->control) usb6fire_control_destroy(chip); - if (chip->card) - snd_card_free(chip->card); } } @@ -136,6 +136,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count = 1; chip->card = card; + card->private_free = usb6fire_card_free; ret = usb6fire_comm_init(chip); if (ret < 0) @@ -162,7 +163,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, return 0; destroy_chip: - usb6fire_chip_destroy(chip); + snd_card_free(card); return ret; } @@ -181,7 +182,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true; usb6fire_chip_abort(chip); - usb6fire_chip_destroy(chip); } } } -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] BEAEC[Backport] ALSA: 6fire: Release resources at card release
by Lin Ruifeng 06 Jan '25

06 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.325 commit 74357d0b5cd3ef544752bc9f21cbeee4902fae6c bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEC CVE: CVE-2024-53239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ] The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback. Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://patch.msgid.link/20241113111042.15058-6-tiwai@suse.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index 17d5e3ee6d73..f5a9b7a0b585 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -66,8 +66,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy(struct sfire_chip *chip) +static void usb6fire_card_free(struct snd_card *card) { + struct sfire_chip *chip = card->private_data; + if (chip) { if (chip->pcm) usb6fire_pcm_destroy(chip); @@ -77,8 +79,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip) usb6fire_comm_destroy(chip); if (chip->control) usb6fire_control_destroy(chip); - if (chip->card) - snd_card_free(chip->card); } } @@ -141,6 +141,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count = 1; chip->card = card; + card->private_free = usb6fire_card_free; ret = usb6fire_comm_init(chip); if (ret < 0) @@ -167,7 +168,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, return 0; destroy_chip: - usb6fire_chip_destroy(chip); + snd_card_free(card); return ret; } @@ -186,7 +187,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true; usb6fire_chip_abort(chip); - usb6fire_chip_destroy(chip); } } } -- 2.22.0

2 1

[PATCH OLK-6.6] [Backport] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
by Lin Ruifeng 06 Jan '25

06 Jan '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v6.6.66 commit 8ad09ddc63ace3950ac43db6fbfe25b40f589dd6 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANO CVE: CVE-2024-56605 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7c4f78cdb8e7501e9f92d291a7d956591bf73be9 ] bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-3-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index f04ce8426798..379ca86c41cd 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1885,6 +1885,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, chan = l2cap_chan_create(); if (!chan) { sk_free(sk); + sock->sk = NULL; return NULL; } -- 2.22.0

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
by Lin Ruifeng 06 Jan '25

06 Jan '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit daa13175a6dea312a76099066cb4cbd4fc959a84 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANO CVE: CVE-2024-56605 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7c4f78cdb8e7501e9f92d291a7d956591bf73be9 ] bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-3-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 51927765473b..87be9d294773 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1863,6 +1863,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, chan = l2cap_chan_create(); if (!chan) { sk_free(sk); + sock->sk = NULL; return NULL; } -- 2.22.0

2 1

[PATCH OLK-5.10] [Backport] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
by Lin Ruifeng 06 Jan '25

06 Jan '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit daa13175a6dea312a76099066cb4cbd4fc959a84 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANO CVE: CVE-2024-56605 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7c4f78cdb8e7501e9f92d291a7d956591bf73be9 ] bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-3-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index f7240442bde6..27223e43aff2 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1872,6 +1872,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, chan = l2cap_chan_create(); if (!chan) { sk_free(sk); + sock->sk = NULL; return NULL; } -- 2.22.0

2 1

[PATCH OLK-6.6] sched: fix warning in sched_setaffinity
by Zicheng Qu 06 Jan '25

06 Jan '25

From: Josh Don <joshdon(a)google.com> mainline inclusion from mainline-6.13-rc3 commit 70ee7947a29029736a1a06c73a48ff37674a851b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBD13G Reference: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=70ee… -------------------------------- Commit 8f9ea86fdf99b added some logic to sched_setaffinity that included a WARN when a per-task affinity assignment races with a cpuset update. Specifically, we can have a race where a cpuset update results in the task affinity no longer being a subset of the cpuset. That's fine; we have a fallback to instead use the cpuset mask. However, we have a WARN set up that will trigger if the cpuset mask has no overlap at all with the requested task affinity. This shouldn't be a warning condition; its trivial to create this condition. Reproduced the warning by the following setup: - $PID inside a cpuset cgroup - another thread repeatedly switching the cpuset cpus from 1-2 to just 1 - another thread repeatedly setting the $PID affinity (via taskset) to 2 Fixes: 8f9ea86fdf99b ("sched: Always preserve the user requested cpumask") Signed-off-by: Josh Don <joshdon(a)google.com> Acked-and-tested-by: Vincent Guittot <vincent.guittot(a)linaro.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Waiman Long <longman(a)redhat.com> Tested-by: Madadi Vineeth Reddy <vineethr(a)linux.ibm.com> Link: https://lkml.kernel.org/r/20241111182738.1832953-1-joshdon@google.com Conflicts: kernel/sched/core.c kernel/sched/syscalls.c [The linux stable 6.6 lacks this commit 70ee7947a290 ("sched: fix warning in sched_setaffinity"), so pick from linux mainline, this function "__sched_setaffinity" has been moved from core to syscall in mainline.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 7a9aff1dbb3c..5569c89bbaf3 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -8415,7 +8415,7 @@ __sched_setaffinity(struct task_struct *p, struct affinity_context *ctx) bool empty = !cpumask_and(new_mask, new_mask, ctx->user_mask); - if (WARN_ON_ONCE(empty)) + if (empty) cpumask_copy(new_mask, cpus_allowed); } __set_cpus_allowed_ptr(p, ctx); -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
by Lin Ruifeng 06 Jan '25

06 Jan '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v6.6.67 commit ecdcaea0e4057171ea4c3783e1cc1c900ad99125 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOV CVE: CVE-2024-56653 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b548f5e9456c568155499d9ebac675c0d7a296e8 ] hci_devcd_append may lead to the release of the skb, so it cannot be accessed once it is called. ================================================================== BUG: KASAN: slab-use-after-free in btmtk_process_coredump+0x2a7/0x2d0 [btmtk] Read of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82 CPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G U 6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c Hardware name: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 05/07/2024 Workqueue: events btusb_rx_work [btusb] Call Trace: <TASK> dump_stack_lvl+0xfd/0x150 print_report+0x131/0x780 kasan_report+0x177/0x1c0 btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01] btusb_recv_acl_mtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec] btusb_rx_work+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 </TASK> Allocated by task 82: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 __kasan_slab_alloc+0x4e/0x60 kmem_cache_alloc+0x19f/0x360 skb_clone+0x132/0xf70 btusb_recv_acl_mtk+0x104/0x1a0 [btusb] btusb_rx_work+0x9e/0xe0 [btusb] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 Freed by task 1733: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 kasan_save_free_info+0x28/0xb0 ____kasan_slab_free+0xfd/0x170 kmem_cache_free+0x183/0x3f0 hci_devcd_rx+0x91a/0x2060 [bluetooth] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 The buggy address belongs to the object at ffff888033cfab40 which belongs to the cache skbuff_head_cache of size 232 The buggy address is located 112 bytes inside of freed 232-byte region [ffff888033cfab40, ffff888033cfac28) The buggy address belongs to the physical page: page:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa head:00000000a174ba93 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x4000000000000840(slab|head|zone=1) page_type: 0xffffffff() raw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb >ffff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Check if we need to call hci_devcd_complete before calling hci_devcd_append. That requires that we check data->cd_info.cnt >= MTK_COREDUMP_NUM instead of data->cd_info.cnt > MTK_COREDUMP_NUM, as we increment data->cd_info.cnt only once the call to hci_devcd_append succeeds. Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/bluetooth/btmtk.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index 812fd2a8f853..4c53ab22d09b 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -371,6 +371,7 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) { struct btmediatek_data *data = hci_get_priv(hdev); int err; + bool complete = false; if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) { kfree_skb(skb); @@ -392,19 +393,22 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) fallthrough; case HCI_DEVCOREDUMP_ACTIVE: default: + /* Mediatek coredump data would be more than MTK_COREDUMP_NUM */ + if (data->cd_info.cnt >= MTK_COREDUMP_NUM && + skb->len > MTK_COREDUMP_END_LEN) + if (!memcmp((char *)&skb->data[skb->len - MTK_COREDUMP_END_LEN], + MTK_COREDUMP_END, MTK_COREDUMP_END_LEN - 1)) + complete = true; + err = hci_devcd_append(hdev, skb); if (err < 0) break; data->cd_info.cnt++; - /* Mediatek coredump data would be more than MTK_COREDUMP_NUM */ - if (data->cd_info.cnt > MTK_COREDUMP_NUM && - skb->len > MTK_COREDUMP_END_LEN) - if (!memcmp((char *)&skb->data[skb->len - MTK_COREDUMP_END_LEN], - MTK_COREDUMP_END, MTK_COREDUMP_END_LEN - 1)) { - bt_dev_info(hdev, "Mediatek coredump end"); - hci_devcd_complete(hdev); - } + if (complete) { + bt_dev_info(hdev, "Mediatek coredump end"); + hci_devcd_complete(hdev); + } break; } -- 2.22.0

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] ALSA: 6fire: Release resources at card release
by Lin Ruifeng 06 Jan '25

06 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit f2d06d4e129e2508e356136f99bb20a332ff1a00 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEC CVE: CVE-2024-53239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ] The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback. Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://patch.msgid.link/20241113111042.15058-6-tiwai@suse.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index 08c6e6a52eb9..ad6f89845a5c 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -62,8 +62,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy(struct sfire_chip *chip) +static void usb6fire_card_free(struct snd_card *card) { + struct sfire_chip *chip = card->private_data; + if (chip) { if (chip->pcm) usb6fire_pcm_destroy(chip); @@ -73,8 +75,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip) usb6fire_comm_destroy(chip); if (chip->control) usb6fire_control_destroy(chip); - if (chip->card) - snd_card_free(chip->card); } } @@ -137,6 +137,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count = 1; chip->card = card; + card->private_free = usb6fire_card_free; ret = usb6fire_comm_init(chip); if (ret < 0) @@ -163,7 +164,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, return 0; destroy_chip: - usb6fire_chip_destroy(chip); + snd_card_free(card); return ret; } @@ -182,7 +183,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true; usb6fire_chip_abort(chip); - usb6fire_chip_destroy(chip); } } } -- 2.22.0

2 1

[PATCH OLK-6.6 v2 0/2] CVE-2024-53224
by Pu Lehui 06 Jan '25

06 Jan '25

Jianbo Liu (1): IB/mlx5: Allocate resources just before first QP/SRQ is created Patrisious Haddad (1): RDMA/mlx5: Move events notifier registration to be after device registration drivers/infiniband/hw/mlx5/main.c | 185 ++++++++++++++++++--------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 6 +- drivers/infiniband/hw/mlx5/qp.c | 4 + drivers/infiniband/hw/mlx5/srq.c | 4 + 4 files changed, 136 insertions(+), 63 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] xsk: Add generic xdp multi-buffer send support
by Yue Haibing 06 Jan '25

06 Jan '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAOZOH ---------------------------------------------- This is partialy backport from mainline xdp multi-buffer send support for generic xsk. Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/xdp/xsk.c | 237 ++++++++++++++++++++++++++++++++++++++++++++ net/xdp/xsk_queue.h | 14 +++ 2 files changed, 251 insertions(+) diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 34d210a08393..eca562d20ddc 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -528,6 +528,231 @@ static void xsk_destruct_skb(struct sk_buff *skb) sock_wfree(skb); } +#ifdef CONFIG_XSK_MULTI_BUF +static int xsk_cq_reserve_addr_locked(struct xdp_sock *xs, u64 addr) +{ + unsigned long flags; + int ret; + + spin_lock_irqsave(&xs->pool->cq_lock, flags); + ret = xskq_prod_reserve_addr(xs->pool->cq, addr); + spin_unlock_irqrestore(&xs->pool->cq_lock, flags); + + return ret; +} + +static void xsk_cq_submit_locked(struct xdp_sock *xs, u32 n) +{ + unsigned long flags; + + spin_lock_irqsave(&xs->pool->cq_lock, flags); + xskq_prod_submit_n(xs->pool->cq, n); + spin_unlock_irqrestore(&xs->pool->cq_lock, flags); +} + +static void xsk_cq_cancel_locked(struct xdp_sock *xs, u32 n) +{ + unsigned long flags; + + spin_lock_irqsave(&xs->pool->cq_lock, flags); + xskq_prod_cancel_n(xs->pool->cq, n); + spin_unlock_irqrestore(&xs->pool->cq_lock, flags); +} + +static u32 xsk_get_num_desc(struct sk_buff *skb) +{ + return skb ? (long)skb_shinfo(skb)->destructor_arg : 0; +} + +static void xsk_destruct_skb_multi(struct sk_buff *skb) +{ + xsk_cq_submit_locked(xdp_sk(skb->sk), xsk_get_num_desc(skb)); + sock_wfree(skb); +} + +static void xsk_set_destructor_arg(struct sk_buff *skb) +{ + long num = xsk_get_num_desc(xdp_sk(skb->sk)->skb) + 1; + + skb_shinfo(skb)->destructor_arg = (void *)num; +} + +static void xsk_consume_skb(struct sk_buff *skb) +{ + struct xdp_sock *xs = xdp_sk(skb->sk); + + skb->destructor = sock_wfree; + xsk_cq_cancel_locked(xs, xsk_get_num_desc(skb)); + /* Free skb without triggering the perf drop trace */ + consume_skb(skb); + xs->skb = NULL; +} + +static void xsk_drop_skb(struct sk_buff *skb) +{ + xdp_sk(skb->sk)->tx->invalid_descs += xsk_get_num_desc(skb); + xsk_consume_skb(skb); +} + +static struct sk_buff *xsk_build_skb(struct xdp_sock *xs, + struct xdp_desc *desc) +{ + struct net_device *dev = xs->dev; + struct sk_buff *skb = xs->skb; + int err; + + if (dev->priv_flags & IFF_TX_SKB_NO_LINEAR) { + err = -EOPNOTSUPP; + goto free_err; + } else { + u32 hr, tr, len; + void *buffer; + + buffer = xsk_buff_raw_get_data(xs->pool, desc->addr); + len = desc->len; + + if (!skb) { + hr = max(NET_SKB_PAD, L1_CACHE_ALIGN(dev->needed_headroom)); + tr = dev->needed_tailroom; + skb = sock_alloc_send_skb(&xs->sk, hr + len + tr, 1, &err); + if (unlikely(!skb)) + goto free_err; + + skb_reserve(skb, hr); + skb_put(skb, len); + + err = skb_store_bits(skb, 0, buffer, len); + if (unlikely(err)) { + kfree_skb(skb); + goto free_err; + } + } else { + int nr_frags = skb_shinfo(skb)->nr_frags; + struct page *page; + u8 *vaddr; + + if (unlikely(nr_frags == (MAX_SKB_FRAGS - 1) && xp_mb_desc(desc))) { + err = -EOVERFLOW; + goto free_err; + } + + page = alloc_page(xs->sk.sk_allocation); + if (unlikely(!page)) { + err = -EAGAIN; + goto free_err; + } + + vaddr = kmap(page); + memcpy(vaddr, buffer, len); + kunmap(page); + + skb_add_rx_frag(skb, nr_frags, page, 0, len, PAGE_SIZE); + refcount_add(PAGE_SIZE, &xs->sk.sk_wmem_alloc); + } + } + + skb->dev = dev; + skb->priority = xs->sk.sk_priority; + skb->mark = xs->sk.sk_mark; + skb->destructor = xsk_destruct_skb_multi; + xsk_set_destructor_arg(skb); + + return skb; +free_err: + if (err == -EOVERFLOW) { + /* Drop the packet */ + xsk_set_destructor_arg(xs->skb); + xsk_drop_skb(xs->skb); + xskq_cons_release(xs->tx); + } else { + /* Let application retry */ + xsk_cq_cancel_locked(xs, 1); + } + + return ERR_PTR(err); +} + +static int xsk_generic_xmit_multi(struct sock *sk) +{ + struct xdp_sock *xs = xdp_sk(sk); + u32 max_batch = TX_BATCH_SIZE; + bool sent_frame = false; + struct xdp_desc desc; + struct sk_buff *skb; + int err = 0; + + mutex_lock(&xs->mutex); + + if (xs->queue_id >= xs->dev->real_num_tx_queues) + goto out; + + while (xskq_cons_peek_desc(xs->tx, &desc, xs->pool)) { + if (max_batch-- == 0) { + err = -EAGAIN; + goto out; + } + + /* This is the backpressure mechanism for the Tx path. + * Reserve space in the completion queue and only proceed + * if there is space in it. This avoids having to implement + * any buffering in the Tx path. + */ + if (xsk_cq_reserve_addr_locked(xs, desc.addr)) + goto out; + + skb = xsk_build_skb(xs, &desc); + if (IS_ERR(skb)) { + err = PTR_ERR(skb); + if (err != -EOVERFLOW) + goto out; + err = 0; + continue; + } + + xskq_cons_release(xs->tx); + + if (xp_mb_desc(&desc)) { + xs->skb = skb; + continue; + } + + err = __dev_direct_xmit(skb, xs->queue_id); + if (err == NETDEV_TX_BUSY) { + /* Tell user-space to retry the send */ + xskq_cons_cancel_n(xs->tx, xsk_get_num_desc(skb)); + xsk_consume_skb(skb); + err = -EAGAIN; + goto out; + } + + /* Ignore NET_XMIT_CN as packet might have been sent */ + if (err == NET_XMIT_DROP) { + /* SKB completed but not sent */ + err = -EBUSY; + xs->skb = NULL; + goto out; + } + + sent_frame = true; + xs->skb = NULL; + } + + if (xskq_has_descs(xs->tx)) { + if (xs->skb) + xsk_drop_skb(xs->skb); + xskq_cons_release(xs->tx); + } + +out: + if (sent_frame) + if (xsk_tx_writeable(xs)) + sk->sk_write_space(sk); + + mutex_unlock(&xs->mutex); + return err; +} +#endif + static int xsk_generic_xmit(struct sock *sk) { struct xdp_sock *xs = xdp_sk(sk); @@ -631,7 +856,14 @@ static int __xsk_sendmsg(struct sock *sk) if (unlikely(!xs->tx)) return -ENOBUFS; +#ifdef CONFIG_XSK_MULTI_BUF + if (xs->zc) + return xsk_zc_xmit(xs); + else + return xs->sg ? xsk_generic_xmit_multi(sk) : xsk_generic_xmit(sk); +#else return xs->zc ? xsk_zc_xmit(xs) : xsk_generic_xmit(sk); +#endif } static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) @@ -769,6 +1001,11 @@ static int xsk_release(struct socket *sock) net = sock_net(sk); +#ifdef CONFIG_XSK_MULTI_BUF + if (xs->skb) + xsk_drop_skb(xs->skb); +#endif + mutex_lock(&net->xdp.lock); sk_del_node_init_rcu(sk); mutex_unlock(&net->xdp.lock); diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h index 75d6fe2ae32d..419cd38d635f 100644 --- a/net/xdp/xsk_queue.h +++ b/net/xdp/xsk_queue.h @@ -186,6 +186,13 @@ static inline bool xp_validate_desc(struct xsk_buff_pool *pool, xp_aligned_validate_desc(pool, desc); } +#ifdef CONFIG_XSK_MULTI_BUF +static inline bool xskq_has_descs(struct xsk_queue *q) +{ + return q->cached_cons != q->cached_prod; +} +#endif + static inline bool xskq_cons_is_valid_desc(struct xsk_queue *q, struct xdp_desc *d, struct xsk_buff_pool *pool) @@ -282,6 +289,13 @@ static inline bool xskq_cons_is_full(struct xsk_queue *q) q->nentries; } +#ifdef CONFIG_XSK_MULTI_BUF +static inline void xskq_cons_cancel_n(struct xsk_queue *q, u32 cnt) +{ + q->cached_cons -= cnt; +} +#endif + static inline u32 xskq_cons_present_entries(struct xsk_queue *q) { /* No barriers needed since data is not accessed */ -- 2.34.1

2 1

[PATCH OLK-6.6] sched: fix warning in sched_setaffinity
by Zicheng Qu 06 Jan '25

06 Jan '25

From: Josh Don <joshdon(a)google.com> mainline inclusion from mainline-6.13-rc3 commit 70ee7947a29029736a1a06c73a48ff37674a851b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBD13G Reference: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=70ee… -------------------------------- Commit 8f9ea86fdf99b added some logic to sched_setaffinity that included a WARN when a per-task affinity assignment races with a cpuset update. Specifically, we can have a race where a cpuset update results in the task affinity no longer being a subset of the cpuset. That's fine; we have a fallback to instead use the cpuset mask. However, we have a WARN set up that will trigger if the cpuset mask has no overlap at all with the requested task affinity. This shouldn't be a warning condition; its trivial to create this condition. Reproduced the warning by the following setup: - $PID inside a cpuset cgroup - another thread repeatedly switching the cpuset cpus from 1-2 to just 1 - another thread repeatedly setting the $PID affinity (via taskset) to 2 Fixes: 8f9ea86fdf99b ("sched: Always preserve the user requested cpumask") Signed-off-by: Josh Don <joshdon(a)google.com> Acked-and-tested-by: Vincent Guittot <vincent.guittot(a)linaro.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Waiman Long <longman(a)redhat.com> Tested-by: Madadi Vineeth Reddy <vineethr(a)linux.ibm.com> Link: https://lkml.kernel.org/r/20241111182738.1832953-1-joshdon@google.com iConflicts: kernel/sched/core.c kernel/sched/syscalls.c [The linux stable 6.6 lacks this commit 70ee7947a290 ("sched: fix warning in sched_setaffinity"), so pick from linux mainline, this function "__sched_setaffinity" has been moved from core to syscall in mainline.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 7a9aff1dbb3c..5569c89bbaf3 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -8415,7 +8415,7 @@ __sched_setaffinity(struct task_struct *p, struct affinity_context *ctx) bool empty = !cpumask_and(new_mask, new_mask, ctx->user_mask); - if (WARN_ON_ONCE(empty)) + if (empty) cpumask_copy(new_mask, cpus_allowed); } __set_cpus_allowed_ptr(p, ctx); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
by Yi Yang 06 Jan '25

06 Jan '25

From: Luo Qiu <luoqiu(a)kylinsec.com.cn> stable inclusion from stable-v4.19.325 commit 12e2c520a0a4202575e4a45ea41f06a8e9aa3417 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGL CVE: CVE-2024-53157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 109aa654f85c5141e813b2cd1bd36d90be678407 ] Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero. dvfs_info.opp_count may be zero on some platforms during the reboot test, and the kernel will crash after dereferencing the pointer to kcalloc(info->count, sizeof(*opp), GFP_KERNEL). | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 | Mem abort info: | ESR = 0x96000004 | Exception class = DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c | [0000000000000028] pgd=0000000000000000 | Internal error: Oops: 96000004 [#1] SMP | scpi-hwmon: probe of PHYT000D:00 failed with error -110 | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c) | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1 | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS | pstate: 60000005 (nZCv daif -PAN -UAO) | pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | lr : clk_register+0x438/0x720 | Call trace: | scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | devm_clk_hw_register+0x50/0xa0 | scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi] | scpi_clocks_probe+0x528/0x70c [clk_scpi] | platform_drv_probe+0x58/0xa8 | really_probe+0x260/0x3d0 | driver_probe_device+0x12c/0x148 | device_driver_attach+0x74/0x98 | __driver_attach+0xb4/0xe8 | bus_for_each_dev+0x88/0xe0 | driver_attach+0x30/0x40 | bus_add_driver+0x178/0x2b0 | driver_register+0x64/0x118 | __platform_driver_register+0x54/0x60 | scpi_clocks_driver_init+0x24/0x1000 [clk_scpi] | do_one_initcall+0x54/0x220 | do_init_module+0x54/0x1c8 | load_module+0x14a4/0x1668 | __se_sys_finit_module+0xf8/0x110 | __arm64_sys_finit_module+0x24/0x30 | el0_svc_common+0x78/0x170 | el0_svc_handler+0x38/0x78 | el0_svc+0x8/0x340 | Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820) | ---[ end trace 06feb22469d89fa8 ]--- | Kernel panic - not syncing: Fatal exception | SMP: stopping secondary CPUs | Kernel Offset: disabled | CPU features: 0x10,a0002008 | Memory Limit: none Fixes: 8cb7cf56c9fe ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol") Signed-off-by: Luo Qiu <luoqiu(a)kylinsec.com.cn> Message-Id: <55A2F7A784391686+20241101032115.275977-1-luoqiu(a)kylinsec.com.cn> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/firmware/arm_scpi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c index baa7280eccb3..e3fff7b29045 100644 --- a/drivers/firmware/arm_scpi.c +++ b/drivers/firmware/arm_scpi.c @@ -638,6 +638,9 @@ static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain) if (ret) return ERR_PTR(ret); + if (!buf.opp_count) + return ERR_PTR(-ENOENT); + info = kmalloc(sizeof(*info), GFP_KERNEL); if (!info) return ERR_PTR(-ENOMEM); -- 2.25.1

2 1

[PATCH OLK-5.10] firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
by Yi Yang 06 Jan '25

06 Jan '25

From: Luo Qiu <luoqiu(a)kylinsec.com.cn> stable inclusion from stable-v5.10.231 commit 380c0e1d96f3b522f3170c18ee5e0f1a28fec5d6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGL CVE: CVE-2024-53157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 109aa654f85c5141e813b2cd1bd36d90be678407 ] Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero. dvfs_info.opp_count may be zero on some platforms during the reboot test, and the kernel will crash after dereferencing the pointer to kcalloc(info->count, sizeof(*opp), GFP_KERNEL). | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 | Mem abort info: | ESR = 0x96000004 | Exception class = DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c | [0000000000000028] pgd=0000000000000000 | Internal error: Oops: 96000004 [#1] SMP | scpi-hwmon: probe of PHYT000D:00 failed with error -110 | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c) | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1 | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS | pstate: 60000005 (nZCv daif -PAN -UAO) | pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | lr : clk_register+0x438/0x720 | Call trace: | scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | devm_clk_hw_register+0x50/0xa0 | scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi] | scpi_clocks_probe+0x528/0x70c [clk_scpi] | platform_drv_probe+0x58/0xa8 | really_probe+0x260/0x3d0 | driver_probe_device+0x12c/0x148 | device_driver_attach+0x74/0x98 | __driver_attach+0xb4/0xe8 | bus_for_each_dev+0x88/0xe0 | driver_attach+0x30/0x40 | bus_add_driver+0x178/0x2b0 | driver_register+0x64/0x118 | __platform_driver_register+0x54/0x60 | scpi_clocks_driver_init+0x24/0x1000 [clk_scpi] | do_one_initcall+0x54/0x220 | do_init_module+0x54/0x1c8 | load_module+0x14a4/0x1668 | __se_sys_finit_module+0xf8/0x110 | __arm64_sys_finit_module+0x24/0x30 | el0_svc_common+0x78/0x170 | el0_svc_handler+0x38/0x78 | el0_svc+0x8/0x340 | Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820) | ---[ end trace 06feb22469d89fa8 ]--- | Kernel panic - not syncing: Fatal exception | SMP: stopping secondary CPUs | Kernel Offset: disabled | CPU features: 0x10,a0002008 | Memory Limit: none Fixes: 8cb7cf56c9fe ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol") Signed-off-by: Luo Qiu <luoqiu(a)kylinsec.com.cn> Message-Id: <55A2F7A784391686+20241101032115.275977-1-luoqiu(a)kylinsec.com.cn> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/firmware/arm_scpi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c index 36391cb5130e..3a1d77b882f7 100644 --- a/drivers/firmware/arm_scpi.c +++ b/drivers/firmware/arm_scpi.c @@ -627,6 +627,9 @@ static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain) if (ret) return ERR_PTR(ret); + if (!buf.opp_count) + return ERR_PTR(-ENOENT); + info = kmalloc(sizeof(*info), GFP_KERNEL); if (!info) return ERR_PTR(-ENOMEM); -- 2.25.1

2 1

[PATCH OLK-6.6] firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
by Yi Yang 06 Jan '25

06 Jan '25

From: Luo Qiu <luoqiu(a)kylinsec.com.cn> stable inclusion from stable-v6.6.64 commit 025067eeb945aa17c7dd483a63960125b7efb577 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGL CVE: CVE-2024-53157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 109aa654f85c5141e813b2cd1bd36d90be678407 ] Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero. dvfs_info.opp_count may be zero on some platforms during the reboot test, and the kernel will crash after dereferencing the pointer to kcalloc(info->count, sizeof(*opp), GFP_KERNEL). | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 | Mem abort info: | ESR = 0x96000004 | Exception class = DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c | [0000000000000028] pgd=0000000000000000 | Internal error: Oops: 96000004 [#1] SMP | scpi-hwmon: probe of PHYT000D:00 failed with error -110 | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c) | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1 | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS | pstate: 60000005 (nZCv daif -PAN -UAO) | pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | lr : clk_register+0x438/0x720 | Call trace: | scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi] | devm_clk_hw_register+0x50/0xa0 | scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi] | scpi_clocks_probe+0x528/0x70c [clk_scpi] | platform_drv_probe+0x58/0xa8 | really_probe+0x260/0x3d0 | driver_probe_device+0x12c/0x148 | device_driver_attach+0x74/0x98 | __driver_attach+0xb4/0xe8 | bus_for_each_dev+0x88/0xe0 | driver_attach+0x30/0x40 | bus_add_driver+0x178/0x2b0 | driver_register+0x64/0x118 | __platform_driver_register+0x54/0x60 | scpi_clocks_driver_init+0x24/0x1000 [clk_scpi] | do_one_initcall+0x54/0x220 | do_init_module+0x54/0x1c8 | load_module+0x14a4/0x1668 | __se_sys_finit_module+0xf8/0x110 | __arm64_sys_finit_module+0x24/0x30 | el0_svc_common+0x78/0x170 | el0_svc_handler+0x38/0x78 | el0_svc+0x8/0x340 | Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820) | ---[ end trace 06feb22469d89fa8 ]--- | Kernel panic - not syncing: Fatal exception | SMP: stopping secondary CPUs | Kernel Offset: disabled | CPU features: 0x10,a0002008 | Memory Limit: none Fixes: 8cb7cf56c9fe ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol") Signed-off-by: Luo Qiu <luoqiu(a)kylinsec.com.cn> Message-Id: <55A2F7A784391686+20241101032115.275977-1-luoqiu(a)kylinsec.com.cn> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/firmware/arm_scpi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c index 435d0e2658a4..3de25e9d18ef 100644 --- a/drivers/firmware/arm_scpi.c +++ b/drivers/firmware/arm_scpi.c @@ -627,6 +627,9 @@ static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain) if (ret) return ERR_PTR(ret); + if (!buf.opp_count) + return ERR_PTR(-ENOENT); + info = kmalloc(sizeof(*info), GFP_KERNEL); if (!info) return ERR_PTR(-ENOMEM); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: us122l: Use snd_card_free_when_closed() at disconnection
by Li Nan 06 Jan '25

06 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.325 commit 020cbc4d7414f0962004213e2b7bc5cc607e9ec7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAG2 CVE: CVE-2024-56532 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b7df09bb348016943f56b09dcaafe221e3f73947 ] The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. The loop of us122l->mmap_count check is dropped as well. The check is useless for the asynchronous operation with *_when_closed(). Fixes: 030a07e44129 ("ALSA: Add USB US122L driver") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://patch.msgid.link/20241113111042.15058-3-tiwai@suse.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- sound/usb/usx2y/us122l.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c index 8082f7b077f1..eac2e4d0e7d9 100644 --- a/sound/usb/usx2y/us122l.c +++ b/sound/usb/usx2y/us122l.c @@ -649,10 +649,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf) usb_put_intf(usb_ifnum_to_if(us122l->dev, 1)); usb_put_dev(us122l->dev); - while (atomic_read(&us122l->mmap_count)) - msleep(500); - - snd_card_free(card); + snd_card_free_when_closed(card); } static int snd_us122l_suspend(struct usb_interface *intf, pm_message_t message) -- 2.39.2

2 1

[PATCH OLK-5.10] iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
by Yi Yang 06 Jan '25

06 Jan '25

From: Nuno Sa <nuno.sa(a)analog.com> mainline inclusion from mainline-v6.13-rc1 commit 3a4187ec454e19903fd15f6e1825a4b84e59a4cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMO CVE: CVE-2024-56557 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The AD7923 was updated to support devices with 8 channels, but the size of tx_buf and ring_xfer was not increased accordingly, leading to a potential buffer overflow in ad7923_update_scan_mode(). Fixes: 851644a60d20 ("iio: adc: ad7923: Add support for the ad7908/ad7918/ad7928") Cc: stable(a)vger.kernel.org Signed-off-by: Nuno Sa <nuno.sa(a)analog.com> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> Link: https://patch.msgid.link/20241029134637.2261336-1-quzicheng@huawei.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/adc/ad7923.c [conflicts due to not mergered 908af45d70573 ("iio: adc: ad7923: Fix alignment for DMA safety")] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/iio/adc/ad7923.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iio/adc/ad7923.c b/drivers/iio/adc/ad7923.c index 96eeda433ad6..b44a853a8390 100644 --- a/drivers/iio/adc/ad7923.c +++ b/drivers/iio/adc/ad7923.c @@ -47,7 +47,7 @@ struct ad7923_state { struct spi_device *spi; - struct spi_transfer ring_xfer[5]; + struct spi_transfer ring_xfer[9]; struct spi_transfer scan_single_xfer[2]; struct spi_message ring_msg; struct spi_message scan_single_msg; @@ -63,7 +63,7 @@ struct ad7923_state { * Length = 8 channels + 4 extra for 8 byte timestamp */ __be16 rx_buf[12] ____cacheline_aligned; - __be16 tx_buf[4]; + __be16 tx_buf[8]; }; struct ad7923_chip_info { -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 1/1] 9p/xen: fix release of IRQ
by Ze Zuo 06 Jan '25

06 Jan '25

From: Alex Zenla <alex(a)edera.dev> stable inclusion from stable-v4.19.325 commit 692eb06703afc3e24d889d77e94a0e20229f6a4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDPA CVE: CVE-2024-56704 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e43c608f40c065b30964f0a806348062991b802d ] Kernel logs indicate an IRQ was double-freed. Pass correct device ID during IRQ release. Fixes: 71ebd71921e45 ("xen/9pfs: connect to the backend") Signed-off-by: Alex Zenla <alex(a)edera.dev> Signed-off-by: Alexander Merritt <alexander(a)edera.dev> Signed-off-by: Ariadne Conill <ariadne(a)ariadne.space> Reviewed-by: Juergen Gross <jgross(a)suse.com> Message-ID: <20241121225100.5736-1-alexander(a)edera.dev> [Dominique: remove confusing variable reset to 0] Signed-off-by: Dominique Martinet <asmadeus(a)codewreck.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> (cherry picked from commit 692eb06703afc3e24d889d77e94a0e20229f6a4a) Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/9p/trans_xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 8e158f09cba8..4096cfc7efc6 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -297,7 +297,7 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0) - unbind_from_irqhandler(priv->rings[i].irq, priv->dev); + unbind_from_irqhandler(priv->rings[i].irq, ring); if (priv->rings[i].data.in) { for (j = 0; j < (1 << XEN_9PFS_RING_ORDER); j++) { grant_ref_t ref; -- 2.25.1

2 1

[PATCH OLK-6.6] iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
by Yi Yang 06 Jan '25

06 Jan '25

From: Nuno Sa <nuno.sa(a)analog.com> stable inclusion from stable-v6.6.64 commit e5cac32721997cb8bcb208a29f4598b3faf46338 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMO CVE: CVE-2024-56557 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a4187ec454e19903fd15f6e1825a4b84e59a4cd upstream. The AD7923 was updated to support devices with 8 channels, but the size of tx_buf and ring_xfer was not increased accordingly, leading to a potential buffer overflow in ad7923_update_scan_mode(). Fixes: 851644a60d20 ("iio: adc: ad7923: Add support for the ad7908/ad7918/ad7928") Cc: stable(a)vger.kernel.org Signed-off-by: Nuno Sa <nuno.sa(a)analog.com> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> Link: https://patch.msgid.link/20241029134637.2261336-1-quzicheng@huawei.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/iio/adc/ad7923.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iio/adc/ad7923.c b/drivers/iio/adc/ad7923.c index 9d6bf6d0927a..709ce2a50097 100644 --- a/drivers/iio/adc/ad7923.c +++ b/drivers/iio/adc/ad7923.c @@ -48,7 +48,7 @@ struct ad7923_state { struct spi_device *spi; - struct spi_transfer ring_xfer[5]; + struct spi_transfer ring_xfer[9]; struct spi_transfer scan_single_xfer[2]; struct spi_message ring_msg; struct spi_message scan_single_msg; @@ -64,7 +64,7 @@ struct ad7923_state { * Length = 8 channels + 4 extra for 8 byte timestamp */ __be16 rx_buf[12] __aligned(IIO_DMA_MINALIGN); - __be16 tx_buf[4]; + __be16 tx_buf[8]; }; struct ad7923_chip_info { -- 2.25.1

2 1

[PATCH OLK-6.6] vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
by Yi Yang 06 Jan '25

06 Jan '25

From: Yishai Hadas <yishaih(a)nvidia.com> mainline inclusion from mainline-v6.13-rc1 commit 22e87bf3f77c18f5982c19ffe2732ef0c7a25f16 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGF7 CVE: CVE-2024-56742 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix an unwind issue in mlx5vf_add_migration_pages(). If a set of pages is allocated but fails to be added to the SG table, they need to be freed to prevent a memory leak. Any pages successfully added to the SG table will be freed as part of mlx5vf_free_data_buffer(). Fixes: 6fadb021266d ("vfio/mlx5: Implement vfio_pci driver for mlx5 devices") Signed-off-by: Yishai Hadas <yishaih(a)nvidia.com> Reviewed-by: Jason Gunthorpe <jgg(a)nvidia.com> Link: https://lore.kernel.org/r/20241114095318.16556-2-yishaih@nvidia.com Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com> Conflicts: drivers/vfio/pci/mlx5/main.c drivers/vfio/pci/mlx5/cmd.c [conflicts due to not mergered 821b8f6bf8489 ("vfio/mlx5: Enforce PRE_COPY support")] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/vfio/pci/mlx5/main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/vfio/pci/mlx5/main.c b/drivers/vfio/pci/mlx5/main.c index 5cf2b491d15a..54bb74433ec1 100644 --- a/drivers/vfio/pci/mlx5/main.c +++ b/drivers/vfio/pci/mlx5/main.c @@ -71,6 +71,7 @@ int mlx5vf_add_migration_pages(struct mlx5_vhca_data_buffer *buf, unsigned long filled; unsigned int to_fill; int ret; + int i; to_fill = min_t(unsigned int, npages, PAGE_SIZE / sizeof(*page_list)); page_list = kvzalloc(to_fill * sizeof(*page_list), GFP_KERNEL_ACCOUNT); @@ -91,7 +92,7 @@ int mlx5vf_add_migration_pages(struct mlx5_vhca_data_buffer *buf, GFP_KERNEL_ACCOUNT); if (ret) - goto err; + goto err_append; buf->allocated_length += filled * PAGE_SIZE; /* clean input for another bulk allocation */ memset(page_list, 0, filled * sizeof(*page_list)); @@ -102,6 +103,9 @@ int mlx5vf_add_migration_pages(struct mlx5_vhca_data_buffer *buf, kvfree(page_list); return 0; +err_append: + for (i = filled - 1; i >= 0; i--) + __free_page(page_list[i]); err: kvfree(page_list); return ret; -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: ath10k: avoid NULL pointer error during sdio remove
by Liu Mingrui 06 Jan '25

06 Jan '25

From: Kang Yang <quic_kangyang(a)quicinc.com> mainline inclusion from mainline-v6.13-rc1 commit 95c38953cb1ecf40399a676a1f85dfe2b5780a9a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPA CVE: CVE-2024-56599 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen: Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c This is because during 'rmmod ath10k', ath10k_sdio_remove() will call ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release() will finally be called in ath10k_core_destroy(). This function will free struct cfg80211_registered_device *rdev and all its members, including wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio workqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON. After device release, destroy_workqueue() will use NULL pointer then the kernel panic happen. Call trace: ath10k_sdio_remove ->ath10k_core_unregister …… ->ath10k_core_stop ->ath10k_hif_stop ->ath10k_sdio_irq_disable ->ath10k_hif_power_down ->del_timer_sync(&ar_sdio->sleep_timer) ->ath10k_core_destroy ->ath10k_mac_destroy ->ieee80211_free_hw ->wiphy_free …… ->wiphy_dev_release ->destroy_workqueue Need to call destroy_workqueue() before ath10k_core_destroy(), free the work queue buffer first and then free pointer of work queue by ath10k_core_destroy(). This order matches the error path order in ath10k_sdio_probe(). No work will be queued on sdio workqueue between it is destroyed and ath10k_core_destroy() is called. Based on the call_stack above, the reason is: Only ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and ath10k_sdio_irq_disable() will queue work on sdio workqueue. Sleep timer will be deleted before ath10k_core_destroy() in ath10k_hif_power_down(). ath10k_sdio_irq_disable() only be called in ath10k_hif_stop(). ath10k_core_unregister() will call ath10k_hif_power_down() to stop hif bus, so ath10k_sdio_hif_tx_sg() won't be called anymore. Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189 Signed-off-by: Kang Yang <quic_kangyang(a)quicinc.com> Tested-by: David Ruth <druth(a)chromium.org> Reviewed-by: David Ruth <druth(a)chromium.org> Link: https://patch.msgid.link/20241008022246.1010-1-quic_kangyang@quicinc.com Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Conflicts: drivers/net/wireless/ath/ath10k/sdio.c Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/net/wireless/ath/ath10k/sdio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c index 56fbcfb80bf8..850d999615a2 100644 --- a/drivers/net/wireless/ath/ath10k/sdio.c +++ b/drivers/net/wireless/ath/ath10k/sdio.c @@ -3,6 +3,7 @@ * Copyright (c) 2004-2011 Atheros Communications Inc. * Copyright (c) 2011-2012,2017 Qualcomm Atheros, Inc. * Copyright (c) 2016-2017 Erik Stromdahl <erik.stromdahl(a)gmail.com> + * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include <linux/module.h> @@ -2647,9 +2648,9 @@ static void ath10k_sdio_remove(struct sdio_func *func) netif_napi_del(&ar->napi); - ath10k_core_destroy(ar); - destroy_workqueue(ar_sdio->workqueue); + + ath10k_core_destroy(ar); } static const struct sdio_device_id ath10k_sdio_devices[] = { -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] backport mainline bugfix patch
by Lin Yujun 06 Jan '25

06 Jan '25

Jinjie Ruan (1): [Backport] genirq/msi: Fix off-by-one error in msi_domain_alloc() kernel/irq/msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10] usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
by Liu Mingrui 06 Jan '25

06 Jan '25

From: Lianqin Hu <hulianqin(a)vivo.com> stable inclusion from stable-v5.10.232 commit 28b3c03a6790de1f6f2683919ad657840f0f0f58 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO8 CVE: CVE-2024-56670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b upstream. Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Thread A is executing the open operation and calling the gs_open, Thread B is executing the disconnect operation and calling the gserial_disconnect function,The port->port_usb pointer will be set to NULL. E.g. Thread A Thread B gs_open() gadget_unbind_driver() gs_start_io() composite_disconnect() gs_start_rx() gserial_disconnect() ... ... spin_unlock(&port->port_lock) status = usb_ep_queue() spin_lock(&port->port_lock) spin_lock(&port->port_lock) port->port_usb = NULL gs_free_requests(port->port_usb->in) spin_unlock(&port->port_lock) Crash This causes thread A to access a null pointer (port->port_usb is null) when calling the gs_free_requests function, causing a crash. If port_usb is NULL, the release request will be skipped as it will be done by gserial_disconnect. So add a null pointer check to gs_start_io before attempting to access the value of the pointer port->port_usb. Call trace: gs_start_io+0x164/0x25c gs_open+0x108/0x13c tty_open+0x314/0x638 chrdev_open+0x1b8/0x258 do_dentry_open+0x2c4/0x700 vfs_open+0x2c/0x3c path_openat+0xa64/0xc60 do_filp_open+0xb8/0x164 do_sys_openat2+0x84/0xf0 __arm64_sys_openat+0x70/0x9c invoke_syscall+0x58/0x114 el0_svc_common+0x80/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x38/0x68 Fixes: c1dca562be8a ("usb gadget: split out serial core") Cc: stable(a)vger.kernel.org Suggested-by: Prashanth K <quic_prashk(a)quicinc.com> Signed-off-by: Lianqin Hu <hulianqin(a)vivo.com> Acked-by: Prashanth K <quic_prashk(a)quicinc.com> Link: https://lore.kernel.org/r/TYUPR06MB62178DC3473F9E1A537DCD02D2362@TYUPR06MB6… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/gadget/function/u_serial.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 2caccbb6e014..b3cb3bef06d2 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -569,9 +569,12 @@ static int gs_start_io(struct gs_port *port) * we didn't in gs_start_tx() */ tty_wakeup(port->port.tty); } else { - gs_free_requests(ep, head, &port->read_allocated); - gs_free_requests(port->port_usb->in, &port->write_pool, - &port->write_allocated); + /* Free reqs only if we are still connected */ + if (port->port_usb) { + gs_free_requests(ep, head, &port->read_allocated); + gs_free_requests(port->port_usb->in, &port->write_pool, + &port->write_allocated); + } status = -EIO; } -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] backport mainline bugfix patch
by Lin Yujun 06 Jan '25

06 Jan '25

Jinjie Ruan (1): [Backport] genirq/msi: Fix off-by-one error in msi_domain_alloc() kernel/irq/msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] RDMA/mlx5: Move events notifier registration to be after device registration
by Tengda Wu 06 Jan '25

06 Jan '25

From: Patrisious Haddad <phaddad(a)nvidia.com> stable inclusion from stable-v6.6.64 commit 921fcf2971a1e8d3b904ba2c2905b96f4ec3d4ad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADY CVE: CVE-2024-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 ] Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]--- Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Michael Guralnik <michaelgur(a)nvidia.com> Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.173149694… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 40 +++++++++++++--------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- 2 files changed, 20 insertions(+), 22 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index bc38af6cda6e..c510484e024b 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2899,7 +2899,6 @@ int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev) static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; int ret; if (!MLX5_CAP_GEN(dev->mdev, xrc)) @@ -2915,10 +2914,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) return ret; } - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - INIT_WORK(&devr->ports[port].pkey_change_work, - pkey_change_handler); - mutex_init(&devr->cq_lock); mutex_init(&devr->srq_lock); @@ -2928,16 +2923,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; - - /* - * Make sure no change P_Key work items are still executing. - * - * At this stage, the mlx5_ib_event should be unregistered - * and it ensures that no new works are added. - */ - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - cancel_work_sync(&devr->ports[port].pkey_change_work); /* After s0/s1 init, they are not unset during the device lifetime. */ if (devr->s1) { @@ -4201,6 +4186,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev) static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + INIT_WORK(&devr->ports[port].pkey_change_work, + pkey_change_handler); + dev->mdev_events.notifier_call = mlx5_ib_event; mlx5_notifier_register(dev->mdev, &dev->mdev_events); @@ -4211,8 +4203,14 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + mlx5r_macsec_event_unregister(dev); mlx5_notifier_unregister(dev->mdev, &dev->mdev_events); + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + cancel_work_sync(&devr->ports[port].pkey_change_work); } void __mlx5_ib_remove(struct mlx5_ib_dev *dev, @@ -4286,9 +4284,6 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_ODP, mlx5_ib_odp_init_one, mlx5_ib_odp_cleanup_one), @@ -4313,6 +4308,9 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), @@ -4349,9 +4347,6 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_COUNTERS, mlx5_ib_counters_init, mlx5_ib_counters_cleanup), @@ -4373,6 +4368,9 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h index 1c83d132197f..94678e5c59dd 100644 --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -954,7 +954,6 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_QP, MLX5_IB_STAGE_SRQ, MLX5_IB_STAGE_DEVICE_RESOURCES, - MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_ODP, MLX5_IB_STAGE_COUNTERS, MLX5_IB_STAGE_CONG_DEBUGFS, @@ -963,6 +962,7 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_PRE_IB_REG_UMR, MLX5_IB_STAGE_WHITELIST_UID, MLX5_IB_STAGE_IB_REG, + MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_POST_IB_REG_UMR, MLX5_IB_STAGE_DELAY_DROP, MLX5_IB_STAGE_RESTRACK, -- 2.34.1

2 1

[PATCH OLK-5.10] memcg: fix soft lockup in the OOM process
by Chen Ridong 06 Jan '25

06 Jan '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBE42N Reference: https://lore.kernel.org/linux-kernel/8cf29751-7c71-52ff-5492-0019ca7b0e02@g… ---------------------------------------- A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggered. watchdog: BUG: soft lockup - CPU#2 stuck for 23s! [VM Thread:1503066] CPU: 2 PID: 1503066 Comm: VM Thread Kdump: loaded Tainted: G Hardware name: Huawei Cloud OpenStack Nova, BIOS RIP: 0010:console_unlock+0x343/0x540 RSP: 0000:ffffb751447db9a0 EFLAGS: 00000247 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 00000000ffffffff RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000247 RBP: ffffffffafc71f90 R08: 0000000000000000 R09: 0000000000000040 R10: 0000000000000080 R11: 0000000000000000 R12: ffffffffafc74bd0 R13: ffffffffaf60a220 R14: 0000000000000247 R15: 0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2fe6ad91f0 CR3: 00000004b2076003 CR4: 0000000000360ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vprintk_emit+0x193/0x280 printk+0x52/0x6e dump_task+0x114/0x130 mem_cgroup_scan_tasks+0x76/0x100 dump_header+0x1fe/0x210 oom_kill_process+0xd1/0x100 out_of_memory+0x125/0x570 mem_cgroup_out_of_memory+0xb5/0xd0 try_charge+0x720/0x770 mem_cgroup_try_charge+0x86/0x180 mem_cgroup_try_charge_delay+0x1c/0x40 do_anonymous_page+0xb5/0x390 handle_mm_fault+0xc4/0x1f0 This is because thousands of processes are in the OOM cgroup, it takes a long time to traverse all of them. As a result, this lead to soft lockup in the OOM process. To fix this issue, call 'cond_resched' in the 'mem_cgroup_scan_tasks' function per 1000 iterations. For global OOM, call 'touch_softlockup_watchdog' per 1000 iterations to avoid this issue. Fixes: 9cbb78bb3143 ("mm, memcg: introduce own oom handler to iterate only over its own threads") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- mm/memcontrol.c | 7 ++++++- mm/oom_kill.c | 8 +++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 3e928581ab47..f5b1322ac77e 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1202,6 +1202,7 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, { struct mem_cgroup *iter; int ret = 0; + int i = 0; BUG_ON(memcg == root_mem_cgroup); @@ -1210,8 +1211,12 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, struct task_struct *task; css_task_iter_start(&iter->css, CSS_TASK_ITER_PROCS, &it); - while (!ret && (task = css_task_iter_next(&it))) + while (!ret && (task = css_task_iter_next(&it))) { + /* Avoid potential softlockup warning */ + if ((++i & 1023) == 0) + cond_resched(); ret = fn(task, arg); + } css_task_iter_end(&it); if (ret) { mem_cgroup_iter_break(memcg, iter); diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 9d595265bbf5..fe5f4f20c5c8 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -43,6 +43,7 @@ #include <linux/kthread.h> #include <linux/init.h> #include <linux/mmu_notifier.h> +#include <linux/nmi.h> #include <asm/tlb.h> #include "internal.h" @@ -479,10 +480,15 @@ static void dump_tasks(struct oom_control *oc) memcg_print_bad_task(oc); } else { struct task_struct *p; + int i = 0; rcu_read_lock(); - for_each_process(p) + for_each_process(p) { + /* Avoid potential softlockup warning */ + if ((++i & 1023) == 0) + touch_softlockup_watchdog(); dump_task(p, oc); + } rcu_read_unlock(); } } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] memcg: fix soft lockup in the OOM process
by Chen Ridong 06 Jan '25

06 Jan '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBE42N Reference: https://lore.kernel.org/linux-kernel/8cf29751-7c71-52ff-5492-0019ca7b0e02@g… ---------------------------------------- A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggered. watchdog: BUG: soft lockup - CPU#2 stuck for 23s! [VM Thread:1503066] CPU: 2 PID: 1503066 Comm: VM Thread Kdump: loaded Tainted: G Hardware name: Huawei Cloud OpenStack Nova, BIOS RIP: 0010:console_unlock+0x343/0x540 RSP: 0000:ffffb751447db9a0 EFLAGS: 00000247 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 00000000ffffffff RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000247 RBP: ffffffffafc71f90 R08: 0000000000000000 R09: 0000000000000040 R10: 0000000000000080 R11: 0000000000000000 R12: ffffffffafc74bd0 R13: ffffffffaf60a220 R14: 0000000000000247 R15: 0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2fe6ad91f0 CR3: 00000004b2076003 CR4: 0000000000360ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vprintk_emit+0x193/0x280 printk+0x52/0x6e dump_task+0x114/0x130 mem_cgroup_scan_tasks+0x76/0x100 dump_header+0x1fe/0x210 oom_kill_process+0xd1/0x100 out_of_memory+0x125/0x570 mem_cgroup_out_of_memory+0xb5/0xd0 try_charge+0x720/0x770 mem_cgroup_try_charge+0x86/0x180 mem_cgroup_try_charge_delay+0x1c/0x40 do_anonymous_page+0xb5/0x390 handle_mm_fault+0xc4/0x1f0 This is because thousands of processes are in the OOM cgroup, it takes a long time to traverse all of them. As a result, this lead to soft lockup in the OOM process. To fix this issue, call 'cond_resched' in the 'mem_cgroup_scan_tasks' function per 1000 iterations. For global OOM, call 'touch_softlockup_watchdog' per 1000 iterations to avoid this issue. Fixes: 9cbb78bb3143 ("mm, memcg: introduce own oom handler to iterate only over its own threads") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- mm/memcontrol.c | 7 ++++++- mm/oom_kill.c | 8 +++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 3e928581ab47..f5b1322ac77e 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1202,6 +1202,7 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, { struct mem_cgroup *iter; int ret = 0; + int i = 0; BUG_ON(memcg == root_mem_cgroup); @@ -1210,8 +1211,12 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, struct task_struct *task; css_task_iter_start(&iter->css, CSS_TASK_ITER_PROCS, &it); - while (!ret && (task = css_task_iter_next(&it))) + while (!ret && (task = css_task_iter_next(&it))) { + /* Avoid potential softlockup warning */ + if ((++i & 1023) == 0) + cond_resched(); ret = fn(task, arg); + } css_task_iter_end(&it); if (ret) { mem_cgroup_iter_break(memcg, iter); diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 9d595265bbf5..fe5f4f20c5c8 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -43,6 +43,7 @@ #include <linux/kthread.h> #include <linux/init.h> #include <linux/mmu_notifier.h> +#include <linux/nmi.h> #include <asm/tlb.h> #include "internal.h" @@ -479,10 +480,15 @@ static void dump_tasks(struct oom_control *oc) memcg_print_bad_task(oc); } else { struct task_struct *p; + int i = 0; rcu_read_lock(); - for_each_process(p) + for_each_process(p) { + /* Avoid potential softlockup warning */ + if ((++i & 1023) == 0) + touch_softlockup_watchdog(); dump_task(p, oc); + } rcu_read_unlock(); } } -- 2.34.1

2 1

[PATCH OLK-6.6] memcg: fix soft lockup in the OOM process
by Chen Ridong 06 Jan '25

06 Jan '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBE42N Reference: https://lore.kernel.org/linux-kernel/8cf29751-7c71-52ff-5492-0019ca7b0e02@g… ---------------------------------------- A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggered. watchdog: BUG: soft lockup - CPU#2 stuck for 23s! [VM Thread:1503066] CPU: 2 PID: 1503066 Comm: VM Thread Kdump: loaded Tainted: G Hardware name: Huawei Cloud OpenStack Nova, BIOS RIP: 0010:console_unlock+0x343/0x540 RSP: 0000:ffffb751447db9a0 EFLAGS: 00000247 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 00000000ffffffff RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000247 RBP: ffffffffafc71f90 R08: 0000000000000000 R09: 0000000000000040 R10: 0000000000000080 R11: 0000000000000000 R12: ffffffffafc74bd0 R13: ffffffffaf60a220 R14: 0000000000000247 R15: 0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2fe6ad91f0 CR3: 00000004b2076003 CR4: 0000000000360ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vprintk_emit+0x193/0x280 printk+0x52/0x6e dump_task+0x114/0x130 mem_cgroup_scan_tasks+0x76/0x100 dump_header+0x1fe/0x210 oom_kill_process+0xd1/0x100 out_of_memory+0x125/0x570 mem_cgroup_out_of_memory+0xb5/0xd0 try_charge+0x720/0x770 mem_cgroup_try_charge+0x86/0x180 mem_cgroup_try_charge_delay+0x1c/0x40 do_anonymous_page+0xb5/0x390 handle_mm_fault+0xc4/0x1f0 This is because thousands of processes are in the OOM cgroup, it takes a long time to traverse all of them. As a result, this lead to soft lockup in the OOM process. To fix this issue, call 'cond_resched' in the 'mem_cgroup_scan_tasks' function per 1000 iterations. For global OOM, call 'touch_softlockup_watchdog' per 1000 iterations to avoid this issue. Fixes: 9cbb78bb3143 ("mm, memcg: introduce own oom handler to iterate only over its own threads") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- mm/memcontrol.c | 7 ++++++- mm/oom_kill.c | 8 +++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 9bc0819629344..606a481afe2e2 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1322,6 +1322,7 @@ void mem_cgroup_scan_tasks(struct mem_cgroup *memcg, { struct mem_cgroup *iter; int ret = 0; + int i = 0; BUG_ON(mem_cgroup_is_root(memcg)); @@ -1330,8 +1331,12 @@ void mem_cgroup_scan_tasks(struct mem_cgroup *memcg, struct task_struct *task; css_task_iter_start(&iter->css, CSS_TASK_ITER_PROCS, &it); - while (!ret && (task = css_task_iter_next(&it))) + while (!ret && (task = css_task_iter_next(&it))) { + /* Avoid potential softlockup warning */ + if ((++i & 1023) == 0) + cond_resched(); ret = fn(task, arg); + } css_task_iter_end(&it); if (ret) { mem_cgroup_iter_break(memcg, iter); diff --git a/mm/oom_kill.c b/mm/oom_kill.c index dc932c5837479..f8a45a224ca2a 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -44,6 +44,7 @@ #include <linux/kthread.h> #include <linux/init.h> #include <linux/mmu_notifier.h> +#include <linux/nmi.h> #include <asm/tlb.h> #include "internal.h" @@ -482,10 +483,15 @@ static void dump_tasks(struct oom_control *oc) memcg_print_bad_task(oc); } else { struct task_struct *p; + int i = 0; rcu_read_lock(); - for_each_process(p) + for_each_process(p) { + /* Avoid potential softlockup warning */ + if ((++i & 1023) == 0) + touch_softlockup_watchdog(); dump_task(p, oc); + } rcu_read_unlock(); } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] memcg: fix soft lockup in the OOM process
by Chen Ridong 06 Jan '25

06 Jan '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBE42N CVE: NA Reference: https://lore.kernel.org/linux-kernel/8cf29751-7c71-52ff-5492-0019ca7b0e02@g… ---------------------------------------- A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggered. watchdog: BUG: soft lockup - CPU#2 stuck for 23s! [VM Thread:1503066] CPU: 2 PID: 1503066 Comm: VM Thread Kdump: loaded Tainted: G Hardware name: Huawei Cloud OpenStack Nova, BIOS RIP: 0010:console_unlock+0x343/0x540 RSP: 0000:ffffb751447db9a0 EFLAGS: 00000247 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 00000000ffffffff RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000247 RBP: ffffffffafc71f90 R08: 0000000000000000 R09: 0000000000000040 R10: 0000000000000080 R11: 0000000000000000 R12: ffffffffafc74bd0 R13: ffffffffaf60a220 R14: 0000000000000247 R15: 0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2fe6ad91f0 CR3: 00000004b2076003 CR4: 0000000000360ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vprintk_emit+0x193/0x280 printk+0x52/0x6e dump_task+0x114/0x130 mem_cgroup_scan_tasks+0x76/0x100 dump_header+0x1fe/0x210 oom_kill_process+0xd1/0x100 out_of_memory+0x125/0x570 mem_cgroup_out_of_memory+0xb5/0xd0 try_charge+0x720/0x770 mem_cgroup_try_charge+0x86/0x180 mem_cgroup_try_charge_delay+0x1c/0x40 do_anonymous_page+0xb5/0x390 handle_mm_fault+0xc4/0x1f0 This is because thousands of processes are in the OOM cgroup, it takes a long time to traverse all of them. As a result, this lead to soft lockup in the OOM process. To fix this issue, call 'cond_resched' in the 'mem_cgroup_scan_tasks' function per 1000 iterations. For global OOM, call 'touch_softlockup_watchdog' per 1000 iterations to avoid this issue. Fixes: 9cbb78bb3143 ("mm, memcg: introduce own oom handler to iterate only over its own threads") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- mm/memcontrol.c | 7 ++++++- mm/oom_kill.c | 8 +++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 6d062b0022be..a35b94cacada 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1230,6 +1230,7 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, { struct mem_cgroup *iter; int ret = 0; + int i = 0; BUG_ON(memcg == root_mem_cgroup); @@ -1238,8 +1239,12 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, struct task_struct *task; css_task_iter_start(&iter->css, CSS_TASK_ITER_PROCS, &it); - while (!ret && (task = css_task_iter_next(&it))) + while (!ret && (task = css_task_iter_next(&it))) { + /* Avoid potential softlockup warning */ + if ((++i & 1023) == 0) + cond_resched(); ret = fn(task, arg); + } css_task_iter_end(&it); if (ret) { mem_cgroup_iter_break(memcg, iter); diff --git a/mm/oom_kill.c b/mm/oom_kill.c index d917e1e47f7d..3ab166322986 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -42,6 +42,7 @@ #include <linux/init.h> #include <linux/mmu_notifier.h> #include <linux/share_pool.h> +#include <linux/nmi.h> #include <asm/tlb.h> #include "internal.h" @@ -518,10 +519,15 @@ static void dump_tasks(struct oom_control *oc) memcg_print_bad_task(oc); } else { struct task_struct *p; + int i = 0; rcu_read_lock(); - for_each_process(p) + for_each_process(p) { + /* Avoid potential softlockup warning */ + if ((++i & 1023) == 0) + touch_softlockup_watchdog(); dump_task(p, oc); + } rcu_read_unlock(); } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
by Cai Xinchen 06 Jan '25

06 Jan '25

From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> stable inclusion from stable-v4.19.265 commit a2728bf9b6c65e46468c763e3dab7e04839d4e11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBFBZR CVE: CVE-2022-49035 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ] I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/media/platform/s5p-cec/s5p_cec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/s5p-cec/s5p_cec.c b/drivers/media/platform/s5p-cec/s5p_cec.c index 8837e2678bde..b8f125e45e38 100644 --- a/drivers/media/platform/s5p-cec/s5p_cec.c +++ b/drivers/media/platform/s5p-cec/s5p_cec.c @@ -116,6 +116,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); cec->rx = STATE_BUSY; cec->msg.len = status >> 24; + if (cec->msg.len > CEC_MAX_MSG_SIZE) + cec->msg.len = CEC_MAX_MSG_SIZE; cec->msg.rx_status = CEC_RX_STATUS_OK; s5p_cec_get_rx_buf(cec, cec->msg.len, cec->msg.msg); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] f2fs: fix to do sanity check on node blkaddr in truncate_node()
by Yifan Qiao 06 Jan '25

06 Jan '25

From: Chao Yu <chao(a)kernel.org> mainline inclusion from mainline-v6.13-rc1 commit 6babe00ccd34fc65b78ef8b99754e32b4385f23d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDP8 CVE: CVE-2024-56692 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reports a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace: truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909 f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288 f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856 evict+0x4e8/0x9b0 fs/inode.c:723 f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986 f2fs_create+0x357/0x530 fs/f2fs/namei.c:394 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let's add sanity check on nat blkaddr in truncate_node(). Reported-by: syzbot+33379ce4ac76acf7d0c7(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/0000000000009a6cd706224ca720@googl… Cc: stable(a)vger.kernel.org Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/node.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index c63274d4b74b..97c5e521acae 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -838,6 +838,15 @@ static int truncate_node(struct dnode_of_data *dn) if (err) return err; + if (ni.blk_addr != NEW_ADDR && + !f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC_ENHANCE)) { + f2fs_err(sbi, + "nat entry is corrupted, run fsck to fix it, ino:%u, " + "nid:%u, blkaddr:%u", ni.ino, ni.nid, ni.blk_addr); + set_sbi_flag(sbi, SBI_NEED_FSCK); + return -EFSCORRUPTED; + } + /* Deallocate node address */ f2fs_invalidate_blocks(sbi, ni.blk_addr); dec_valid_node_count(sbi, dn->inode, dn->nid == dn->inode->i_ino); -- 2.39.2

2 1

[PATCH OLK-6.6] KVM: arm64: Don't retire aborted MMIO instruction
by Zhang Kunbo 06 Jan '25

06 Jan '25

From: Oliver Upton <oliver.upton(a)linux.dev> from stable-v6.6.66 commit ea6b5d98fea4ee8cb443ea98fda520909e90d30e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAG3 CVE: CVE-2024-53196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e735a5da64420a86be370b216c269b5dd8e830e2 ] Returning an abort to the guest for an unsupported MMIO access is a documented feature of the KVM UAPI. Nevertheless, it's clear that this plumbing has seen limited testing, since userspace can trivially cause a WARN in the MMIO return: WARNING: CPU: 0 PID: 30558 at arch/arm64/include/asm/kvm_emulate.h:536 kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 Call trace: kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 kvm_arch_vcpu_ioctl_run+0x98/0x15b4 arch/arm64/kvm/arm.c:1133 kvm_vcpu_ioctl+0x75c/0xa78 virt/kvm/kvm_main.c:4487 __do_sys_ioctl fs/ioctl.c:51 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x1e0/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x38/0x68 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x90/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The splat is complaining that KVM is advancing PC while an exception is pending, i.e. that KVM is retiring the MMIO instruction despite a pending synchronous external abort. Womp womp. Fix the glaring UAPI bug by skipping over all the MMIO emulation in case there is a pending synchronous exception. Note that while userspace is capable of pending an asynchronous exception (SError, IRQ, or FIQ), it is still safe to retire the MMIO instruction in this case as (1) they are by definition asynchronous, and (2) KVM relies on hardware support for pending/delivering these exceptions instead of the software state machine for advancing PC. Cc: stable(a)vger.kernel.org Fixes: da345174ceca ("KVM: arm/arm64: Allow user injection of external data aborts") Reported-by: Alexander Potapenko <glider(a)google.com> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20241025203106.3529261-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/arm64/kvm/mmio.c [ different return polarity introduced by this commit not merged: cc81b6dfc3bc8 ("KVM: arm64: Change kvm_handle_mmio_return() return polarity") ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/arm64/kvm/mmio.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/mmio.c b/arch/arm64/kvm/mmio.c index 40d6d056e261..bf5de05cb7a8 100644 --- a/arch/arm64/kvm/mmio.c +++ b/arch/arm64/kvm/mmio.c @@ -73,6 +73,31 @@ unsigned long kvm_mmio_read_buf(const void *buf, unsigned int len) return data; } +static bool kvm_pending_sync_exception(struct kvm_vcpu *vcpu) +{ + if (!vcpu_get_flag(vcpu, PENDING_EXCEPTION)) + return false; + + if (vcpu_el1_is_32bit(vcpu)) { + switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) { + case unpack_vcpu_flag(EXCEPT_AA32_UND): + case unpack_vcpu_flag(EXCEPT_AA32_IABT): + case unpack_vcpu_flag(EXCEPT_AA32_DABT): + return true; + default: + return false; + } + } else { + switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) { + case unpack_vcpu_flag(EXCEPT_AA64_EL1_SYNC): + case unpack_vcpu_flag(EXCEPT_AA64_EL2_SYNC): + return true; + default: + return false; + } + } +} + /** * kvm_handle_mmio_return -- Handle MMIO loads after user space emulation * or in-kernel IO emulation @@ -85,8 +110,11 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu) unsigned int len; int mask; - /* Detect an already handled MMIO return */ - if (unlikely(!vcpu->mmio_needed)) + /* + * Detect if the MMIO return was already handled or if userspace aborted + * the MMIO access. + */ + if (unlikely(!vcpu->mmio_needed || kvm_pending_sync_exception(vcpu))) return 0; vcpu->mmio_needed = 0; -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: arm64: Don't retire aborted MMIO instruction
by Zhang Kunbo 06 Jan '25

06 Jan '25

From: Oliver Upton <oliver.upton(a)linux.dev> stable inclusion from stable-v6.6.66 commit ea6b5d98fea4ee8cb443ea98fda520909e90d30e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAG3 CVE: CVE-2024-53196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e735a5da64420a86be370b216c269b5dd8e830e2 ] Returning an abort to the guest for an unsupported MMIO access is a documented feature of the KVM UAPI. Nevertheless, it's clear that this plumbing has seen limited testing, since userspace can trivially cause a WARN in the MMIO return: WARNING: CPU: 0 PID: 30558 at arch/arm64/include/asm/kvm_emulate.h:536 kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 Call trace: kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 kvm_arch_vcpu_ioctl_run+0x98/0x15b4 arch/arm64/kvm/arm.c:1133 kvm_vcpu_ioctl+0x75c/0xa78 virt/kvm/kvm_main.c:4487 __do_sys_ioctl fs/ioctl.c:51 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x1e0/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x38/0x68 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x90/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The splat is complaining that KVM is advancing PC while an exception is pending, i.e. that KVM is retiring the MMIO instruction despite a pending synchronous external abort. Womp womp. Fix the glaring UAPI bug by skipping over all the MMIO emulation in case there is a pending synchronous exception. Note that while userspace is capable of pending an asynchronous exception (SError, IRQ, or FIQ), it is still safe to retire the MMIO instruction in this case as (1) they are by definition asynchronous, and (2) KVM relies on hardware support for pending/delivering these exceptions instead of the software state machine for advancing PC. Cc: stable(a)vger.kernel.org Fixes: da345174ceca ("KVM: arm/arm64: Allow user injection of external data aborts") Reported-by: Alexander Potapenko <glider(a)google.com> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20241025203106.3529261-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/arm64/kvm/mmio.c [ different return polarity introduced by this commit not merged: cc81b6dfc3bc8 ("KVM: arm64: Change kvm_handle_mmio_return() return polarity") ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/arm64/kvm/mmio.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/mmio.c b/arch/arm64/kvm/mmio.c index 6bda06ad3196..b0f4f3dfaf67 100644 --- a/arch/arm64/kvm/mmio.c +++ b/arch/arm64/kvm/mmio.c @@ -76,6 +76,31 @@ unsigned long kvm_mmio_read_buf(const void *buf, unsigned int len) return data; } +static bool kvm_pending_sync_exception(struct kvm_vcpu *vcpu) +{ + if (!vcpu_get_flag(vcpu, PENDING_EXCEPTION)) + return false; + + if (vcpu_el1_is_32bit(vcpu)) { + switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) { + case unpack_vcpu_flag(EXCEPT_AA32_UND): + case unpack_vcpu_flag(EXCEPT_AA32_IABT): + case unpack_vcpu_flag(EXCEPT_AA32_DABT): + return true; + default: + return false; + } + } else { + switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) { + case unpack_vcpu_flag(EXCEPT_AA64_EL1_SYNC): + case unpack_vcpu_flag(EXCEPT_AA64_EL2_SYNC): + return true; + default: + return false; + } + } +} + /** * kvm_handle_mmio_return -- Handle MMIO loads after user space emulation * or in-kernel IO emulation @@ -88,8 +113,11 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu) unsigned int len; int mask; - /* Detect an already handled MMIO return */ - if (unlikely(!vcpu->mmio_needed)) + /* + * Detect if the MMIO return was already handled or if userspace aborted + * the MMIO access. + */ + if (unlikely(!vcpu->mmio_needed || kvm_pending_sync_exception(vcpu))) return 0; vcpu->mmio_needed = 0; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] KVM: arm64: Don't retire aborted MMIO instruction
by Zhang Kunbo 06 Jan '25

06 Jan '25

From: Oliver Upton <oliver.upton(a)linux.dev> stable inclusion from stable-v6.6.66 commit ea6b5d98fea4ee8cb443ea98fda520909e90d30e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAG3 CVE: CVE-2024-53196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e735a5da64420a86be370b216c269b5dd8e830e2 ] Returning an abort to the guest for an unsupported MMIO access is a documented feature of the KVM UAPI. Nevertheless, it's clear that this plumbing has seen limited testing, since userspace can trivially cause a WARN in the MMIO return: WARNING: CPU: 0 PID: 30558 at arch/arm64/include/asm/kvm_emulate.h:536 kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 Call trace: kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 kvm_arch_vcpu_ioctl_run+0x98/0x15b4 arch/arm64/kvm/arm.c:1133 kvm_vcpu_ioctl+0x75c/0xa78 virt/kvm/kvm_main.c:4487 __do_sys_ioctl fs/ioctl.c:51 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x1e0/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x38/0x68 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x90/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The splat is complaining that KVM is advancing PC while an exception is pending, i.e. that KVM is retiring the MMIO instruction despite a pending synchronous external abort. Womp womp. Fix the glaring UAPI bug by skipping over all the MMIO emulation in case there is a pending synchronous exception. Note that while userspace is capable of pending an asynchronous exception (SError, IRQ, or FIQ), it is still safe to retire the MMIO instruction in this case as (1) they are by definition asynchronous, and (2) KVM relies on hardware support for pending/delivering these exceptions instead of the software state machine for advancing PC. Cc: stable(a)vger.kernel.org Fixes: da345174ceca ("KVM: arm/arm64: Allow user injection of external data aborts") Reported-by: Alexander Potapenko <glider(a)google.com> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20241025203106.3529261-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/arm64/kvm/mmio.c [ different return polarity introduced by this commit not merged: cc81b6dfc3bc8 ("KVM: arm64: Change kvm_handle_mmio_return() return polarity") ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/arm64/kvm/mmio.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/mmio.c b/arch/arm64/kvm/mmio.c index 6a2826f1bf5e..3b68e2b3a933 100644 --- a/arch/arm64/kvm/mmio.c +++ b/arch/arm64/kvm/mmio.c @@ -72,6 +72,31 @@ unsigned long kvm_mmio_read_buf(const void *buf, unsigned int len) return data; } +static bool kvm_pending_sync_exception(struct kvm_vcpu *vcpu) +{ + if (!vcpu_get_flag(vcpu, PENDING_EXCEPTION)) + return false; + + if (vcpu_el1_is_32bit(vcpu)) { + switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) { + case unpack_vcpu_flag(EXCEPT_AA32_UND): + case unpack_vcpu_flag(EXCEPT_AA32_IABT): + case unpack_vcpu_flag(EXCEPT_AA32_DABT): + return true; + default: + return false; + } + } else { + switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) { + case unpack_vcpu_flag(EXCEPT_AA64_EL1_SYNC): + case unpack_vcpu_flag(EXCEPT_AA64_EL2_SYNC): + return true; + default: + return false; + } + } +} + /** * kvm_handle_mmio_return -- Handle MMIO loads after user space emulation * or in-kernel IO emulation @@ -84,8 +109,11 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu) unsigned int len; int mask; - /* Detect an already handled MMIO return */ - if (unlikely(!vcpu->mmio_needed)) + /* + * Detect if the MMIO return was already handled or if userspace aborted + * the MMIO access. + */ + if (unlikely(!vcpu->mmio_needed || kvm_pending_sync_exception(vcpu))) return 0; vcpu->mmio_needed = 0; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1367/1367] drivers/media/platform/qcom/camss/camss.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 05 Jan '25

05 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 21eb7b92f86861232fed9eff3c46634d7535ef8a commit: ec6859b23f2212275fbd476df14d7a94839c2a35 [1367/1367] media: Rename CAMSS driver path config: x86_64-buildonly-randconfig-005-20250103 (https://download.01.org/0day-ci/archive/20250105/202501051713.LBoKPNXw-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250105/202501051713.LBoKPNXw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501051713.LBoKPNXw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/media/platform/qcom/camss/camss.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] net: Fix CVE-2024-47684
by Dong Chenchen 04 Jan '25

04 Jan '25

Fix CVE-2024-47684. Eric Dumazet (1): tcp: introduce tcp_skb_timestamp_us() helper Josh Hunt (1): tcp: check skb is non-NULL in tcp_rto_delta_us() include/net/tcp.h | 27 +++++++++++++++++++++++++-- net/ipv4/tcp_input.c | 11 ++++++----- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_output.c | 2 +- net/ipv4/tcp_rate.c | 15 ++++++++------- net/ipv4/tcp_recovery.c | 5 +++-- 6 files changed, 44 insertions(+), 18 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] xfrm: validate new SA's prefixlen using SA family when sel.family is unset
by Dong Chenchen 04 Jan '25

04 Jan '25

From: Sabrina Dubroca <sd(a)queasysnail.net> stable inclusion from stable-v4.19.323 commit f31398570acf0f0804c644006f7bfa9067106b0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SWP CVE: CVE-2024-50142 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 ] This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.") syzbot created an SA with usersa.sel.family = AF_UNSPEC usersa.sel.prefixlen_s = 128 usersa.family = AF_INET Because of the AF_UNSPEC selector, verify_newsa_info doesn't put limits on prefixlen_{s,d}. But then copy_from_user_state sets x->sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on. Reported-by: syzbot+cc39f136925517aed571(a)syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Sabrina Dubroca <sd(a)queasysnail.net> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Antony Antony <antony.antony(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_user.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 4fe9651c6331..ff1e14019ff7 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -148,6 +148,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, struct nlattr **attrs) { int err; + u16 family = p->sel.family; err = -EINVAL; switch (p->family) { @@ -166,7 +167,10 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, goto out; } - switch (p->sel.family) { + if (!family && !(p->flags & XFRM_STATE_AF_UNSPEC)) + family = p->family; + + switch (family) { case AF_UNSPEC: break; -- 2.25.1

2 1

[PATCH OLK-5.10] i40e: fix race condition by adding filter's intermediate sync state
by Zhang Changzhong 04 Jan '25

04 Jan '25

From: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> mainline inclusion from mainline-v6.12-rc7 commit f30490e9695ef7da3d0899c6a0293cc7cd373567 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KRJ CVE: CVE-2024-53088 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix a race condition in the i40e driver that leads to MAC/VLAN filters becoming corrupted and leaking. Address the issue that occurs under heavy load when multiple threads are concurrently modifying MAC/VLAN filters by setting mac and port VLAN. 1. Thread T0 allocates a filter in i40e_add_filter() within i40e_ndo_set_vf_port_vlan(). 2. Thread T1 concurrently frees the filter in __i40e_del_filter() within i40e_ndo_set_vf_mac(). 3. Subsequently, i40e_service_task() calls i40e_sync_vsi_filters(), which refers to the already freed filter memory, causing corruption. Reproduction steps: 1. Spawn multiple VFs. 2. Apply a concurrent heavy load by running parallel operations to change MAC addresses on the VFs and change port VLANs on the host. 3. Observe errors in dmesg: "Error I40E_AQ_RC_ENOSPC adding RX filters on VF XX, please set promiscuous on manually for VF XX". Exact code for stable reproduction Intel can't open-source now. The fix involves implementing a new intermediate filter state, I40E_FILTER_NEW_SYNC, for the time when a filter is on a tmp_add_list. These filters cannot be deleted from the hash list directly but must be removed using the full process. Fixes: 278e7d0b9d68 ("i40e: store MAC/VLAN filters in a hash with the MAC Address as key") Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha(a)intel.com> (A Contingent worker at Intel) Reviewed-by: Michal Schmidt <mschmidt(a)redhat.com> Tested-by: Michal Schmidt <mschmidt(a)redhat.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/i40e/i40e_main.c [c87c938f62d8 ("i40e: Add VF VLAN pruning") and 5180ff1364bc ("i40e: use int for i40e_status") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 10 ++++++++-- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h index dd630b6..1641145 100644 --- a/drivers/net/ethernet/intel/i40e/i40e.h +++ b/drivers/net/ethernet/intel/i40e/i40e.h @@ -681,6 +681,7 @@ enum i40e_filter_state { I40E_FILTER_ACTIVE, /* Added to switch by FW */ I40E_FILTER_FAILED, /* Rejected by FW */ I40E_FILTER_REMOVE, /* To be removed */ + I40E_FILTER_NEW_SYNC, /* New, not sent yet, is in i40e_sync_vsi_filters() */ /* There is no 'removed' state; the filter struct is freed */ }; struct i40e_mac_filter { diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c index 8bcf590..66eacbf 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c @@ -105,6 +105,7 @@ static char *i40e_filter_state_string[] = { "ACTIVE", "FAILED", "REMOVE", + "NEW_SYNC", }; /** diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index 35a903f..00b6028 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -1232,6 +1232,7 @@ int i40e_count_filters(struct i40e_vsi *vsi) hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) { if (f->state == I40E_FILTER_NEW || + f->state == I40E_FILTER_NEW_SYNC || f->state == I40E_FILTER_ACTIVE) ++cnt; } @@ -1418,6 +1419,8 @@ static int i40e_correct_mac_vlan_filters(struct i40e_vsi *vsi, new->f = add_head; new->state = add_head->state; + if (add_head->state == I40E_FILTER_NEW) + add_head->state = I40E_FILTER_NEW_SYNC; /* Add the new filter to the tmp list */ hlist_add_head(&new->hlist, tmp_add_list); @@ -2307,7 +2310,8 @@ static i40e_status i40e_aqc_broadcast_filter(struct i40e_vsi *vsi, const char *vsi_name, struct i40e_mac_filter *f) { - bool enable = f->state == I40E_FILTER_NEW; + bool enable = f->state == I40E_FILTER_NEW || + f->state == I40E_FILTER_NEW_SYNC; struct i40e_hw *hw = &vsi->back->hw; i40e_status aq_ret; @@ -2481,6 +2485,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) /* Add it to the hash list */ hlist_add_head(&new->hlist, &tmp_add_list); + f->state = I40E_FILTER_NEW_SYNC; } /* Count the number of active (current and new) VLAN @@ -2628,7 +2633,8 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) spin_lock_bh(&vsi->mac_filter_hash_lock); hlist_for_each_entry_safe(new, h, &tmp_add_list, hlist) { /* Only update the state if we're still NEW */ - if (new->f->state == I40E_FILTER_NEW) + if (new->f->state == I40E_FILTER_NEW || + new->f->state == I40E_FILTER_NEW_SYNC) new->f->state = new->state; hlist_del(&new->hlist); netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-56604_openEuler-22.03-LTS-SP1
by dinglongwei 04 Jan '25

04 Jan '25

CVE-2024-56604_openEuler-22.03-LTS-SP1 Ignat Korchagin (1): Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() Luiz Augusto von Dentz (1): Bluetooth: Consolidate code around sk_alloc into a helper function include/net/bluetooth/bluetooth.h | 2 ++ net/bluetooth/af_bluetooth.c | 21 +++++++++++++++++++++ net/bluetooth/bnep/sock.c | 10 +--------- net/bluetooth/hci_sock.c | 10 ++-------- net/bluetooth/l2cap_sock.c | 10 +--------- net/bluetooth/rfcomm/sock.c | 21 +++++++-------------- net/bluetooth/sco.c | 10 +--------- 7 files changed, 35 insertions(+), 49 deletions(-) -- 2.22.0

2 3

[PATCH OLK-5.10 0/2] CVE-2024-56604_OLK-5.10
by dinglongwei 04 Jan '25

04 Jan '25

CVE-2024-56604_OLK-5.10 Ignat Korchagin (1): Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() Luiz Augusto von Dentz (1): Bluetooth: Consolidate code around sk_alloc into a helper function include/net/bluetooth/bluetooth.h | 2 ++ net/bluetooth/af_bluetooth.c | 21 +++++++++++++++++++++ net/bluetooth/bnep/sock.c | 10 +--------- net/bluetooth/hci_sock.c | 10 ++-------- net/bluetooth/l2cap_sock.c | 10 +--------- net/bluetooth/rfcomm/sock.c | 21 +++++++-------------- net/bluetooth/sco.c | 10 +--------- 7 files changed, 35 insertions(+), 49 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6] Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
by dinglongwei 04 Jan '25

04 Jan '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v6.6.66 commit 6021ccc2471b7b95e29b7cfc7938e042bf56e281 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANI CVE: CVE-2024-56604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3945c799f12b8d1f49a3b48369ca494d981ac465 ] bt_sock_alloc() attaches allocated sk object to the provided sock object. If rfcomm_dlc_alloc() fails, we release the sk object, but leave the dangling pointer in the sock object, which may cause use-after-free. Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc(). Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-4-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- net/bluetooth/rfcomm/sock.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index cbff37b32734..c32a2374638b 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -274,13 +274,13 @@ static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, struct rfcomm_dlc *d; struct sock *sk; - sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); - if (!sk) + d = rfcomm_dlc_alloc(prio); + if (!d) return NULL; - d = rfcomm_dlc_alloc(prio); - if (!d) { - sk_free(sk); + sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); + if (!sk) { + rfcomm_dlc_free(d); return NULL; } -- 2.22.0

2 1

[openeuler:openEuler-1.0-LTS 1367/1367] sound/soc/rockchip/rockchip_pcm.o: warning: objtool: missing symbol for section .text
by kernel test robot 04 Jan '25

04 Jan '25

Hi Mark, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 21eb7b92f86861232fed9eff3c46634d7535ef8a commit: 4aa5db22d35588e1a5d2ee88472348ea73d9fb23 [1367/1367] Merge branch 'asoc-4.19' into asoc-next config: x86_64-buildonly-randconfig-005-20250103 (https://download.01.org/0day-ci/archive/20250104/202501041833.o4WHox7g-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250104/202501041833.o4WHox7g-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501041833.o4WHox7g-lkp@intel.com/ All warnings (new ones prefixed by >>): >> sound/soc/rockchip/rockchip_pcm.o: warning: objtool: missing symbol for section .text -- >> sound/soc/meson/axg-tdmin.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] RDMA/mlx5: Move events notifier registration to be after device registration
by Pu Lehui 04 Jan '25

04 Jan '25

From: Patrisious Haddad <phaddad(a)nvidia.com> stable inclusion from stable-v6.6.64 commit 921fcf2971a1e8d3b904ba2c2905b96f4ec3d4ad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADY CVE: CVE-2024-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 ] Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]--- Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Michael Guralnik <michaelgur(a)nvidia.com> Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.173149694… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 40 +++++++++++++--------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- 2 files changed, 20 insertions(+), 22 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index bc38af6cda6e..c510484e024b 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2899,7 +2899,6 @@ int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev) static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; int ret; if (!MLX5_CAP_GEN(dev->mdev, xrc)) @@ -2915,10 +2914,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) return ret; } - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - INIT_WORK(&devr->ports[port].pkey_change_work, - pkey_change_handler); - mutex_init(&devr->cq_lock); mutex_init(&devr->srq_lock); @@ -2928,16 +2923,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; - - /* - * Make sure no change P_Key work items are still executing. - * - * At this stage, the mlx5_ib_event should be unregistered - * and it ensures that no new works are added. - */ - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - cancel_work_sync(&devr->ports[port].pkey_change_work); /* After s0/s1 init, they are not unset during the device lifetime. */ if (devr->s1) { @@ -4201,6 +4186,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev) static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + INIT_WORK(&devr->ports[port].pkey_change_work, + pkey_change_handler); + dev->mdev_events.notifier_call = mlx5_ib_event; mlx5_notifier_register(dev->mdev, &dev->mdev_events); @@ -4211,8 +4203,14 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + mlx5r_macsec_event_unregister(dev); mlx5_notifier_unregister(dev->mdev, &dev->mdev_events); + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + cancel_work_sync(&devr->ports[port].pkey_change_work); } void __mlx5_ib_remove(struct mlx5_ib_dev *dev, @@ -4286,9 +4284,6 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_ODP, mlx5_ib_odp_init_one, mlx5_ib_odp_cleanup_one), @@ -4313,6 +4308,9 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), @@ -4349,9 +4347,6 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_COUNTERS, mlx5_ib_counters_init, mlx5_ib_counters_cleanup), @@ -4373,6 +4368,9 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h index 1c83d132197f..94678e5c59dd 100644 --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -954,7 +954,6 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_QP, MLX5_IB_STAGE_SRQ, MLX5_IB_STAGE_DEVICE_RESOURCES, - MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_ODP, MLX5_IB_STAGE_COUNTERS, MLX5_IB_STAGE_CONG_DEBUGFS, @@ -963,6 +962,7 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_PRE_IB_REG_UMR, MLX5_IB_STAGE_WHITELIST_UID, MLX5_IB_STAGE_IB_REG, + MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_POST_IB_REG_UMR, MLX5_IB_STAGE_DELAY_DROP, MLX5_IB_STAGE_RESTRACK, -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] backport mainline bugfix patch
by Lin Yujun 04 Jan '25

04 Jan '25

Jinjie Ruan (1): [Backport] genirq/msi: Fix off-by-one error in msi_domain_alloc() kernel/irq/msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] backport mainline bugfix patch
by Lin Yujun 04 Jan '25

04 Jan '25

Jinjie Ruan (1): [Backport] genirq/msi: Fix off-by-one error in msi_domain_alloc() kernel/irq/msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
by Wang Hai 04 Jan '25

04 Jan '25

From: Norbert van Bolhuis <nvbolhuis(a)gmail.com> stable inclusion from stable-v5.10.231 commit 7522d7d745d13fbeff3350fe6aa56c8dae263571 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO3 CVE: CVE-2024-56593 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 857282b819cbaa0675aaab1e7542e2c0579f52d7 ] This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue. The problem is the number of entries in the pre-allocated sgtable, it is nents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1. Given the default [rt]xglom_size=32 it's actually 35 which is too small. Worst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB is added for each original SKB if tailroom isn't enough to hold tail_pad. At least one sg entry is needed for each SKB. So, eventually the "skb_queue_walk loop" in brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return NULL and this causes the oops. The patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle the worst-case. Btw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464 additional bytes of memory. Signed-off-by: Norbert van Bolhuis <nvbolhuis(a)gmail.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://patch.msgid.link/20241107132903.13513-1-nvbolhuis@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index b6d0bc73923f..75dc7904a4bd 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c @@ -769,7 +769,7 @@ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev) nents = max_t(uint, BRCMF_DEFAULT_RXGLOM_SIZE, sdiodev->settings->bus.sdio.txglomsz); - nents += (nents >> 4) + 1; + nents *= 2; WARN_ON(nents > sdiodev->max_segment_count); -- 2.17.1

2 1

[PATCH OLK-5.10] wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
by Wang Hai 04 Jan '25

04 Jan '25

From: Norbert van Bolhuis <nvbolhuis(a)gmail.com> stable inclusion from stable-v5.10.231 commit 7522d7d745d13fbeff3350fe6aa56c8dae263571 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO3 CVE: CVE-2024-56593 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 857282b819cbaa0675aaab1e7542e2c0579f52d7 ] This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue. The problem is the number of entries in the pre-allocated sgtable, it is nents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1. Given the default [rt]xglom_size=32 it's actually 35 which is too small. Worst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB is added for each original SKB if tailroom isn't enough to hold tail_pad. At least one sg entry is needed for each SKB. So, eventually the "skb_queue_walk loop" in brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return NULL and this causes the oops. The patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle the worst-case. Btw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464 additional bytes of memory. Signed-off-by: Norbert van Bolhuis <nvbolhuis(a)gmail.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://patch.msgid.link/20241107132903.13513-1-nvbolhuis@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index b6d0bc73923f..75dc7904a4bd 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c @@ -769,7 +769,7 @@ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev) nents = max_t(uint, BRCMF_DEFAULT_RXGLOM_SIZE, sdiodev->settings->bus.sdio.txglomsz); - nents += (nents >> 4) + 1; + nents *= 2; WARN_ON(nents > sdiodev->max_segment_count); -- 2.17.1

2 1

[PATCH OLK-6.6] wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
by Wang Hai 04 Jan '25

04 Jan '25

From: Norbert van Bolhuis <nvbolhuis(a)gmail.com> stable inclusion from stable-v6.6.66 commit 07c020c6d14d29e5a3ea4e4576b8ecf956a80834 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO3 CVE: CVE-2024-56593 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 857282b819cbaa0675aaab1e7542e2c0579f52d7 ] This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue. The problem is the number of entries in the pre-allocated sgtable, it is nents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1. Given the default [rt]xglom_size=32 it's actually 35 which is too small. Worst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB is added for each original SKB if tailroom isn't enough to hold tail_pad. At least one sg entry is needed for each SKB. So, eventually the "skb_queue_walk loop" in brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return NULL and this causes the oops. The patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle the worst-case. Btw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464 additional bytes of memory. Signed-off-by: Norbert van Bolhuis <nvbolhuis(a)gmail.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://patch.msgid.link/20241107132903.13513-1-nvbolhuis@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index 00679a990e3d..7710367c319e 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c @@ -770,7 +770,7 @@ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev) nents = max_t(uint, BRCMF_DEFAULT_RXGLOM_SIZE, sdiodev->settings->bus.sdio.txglomsz); - nents += (nents >> 4) + 1; + nents *= 2; WARN_ON(nents > sdiodev->max_segment_count); -- 2.17.1

2 1

[PATCH OLK-5.10] net/mlx5: Fix error path in multi-packet WQE transmit
by Guo Mengqi 04 Jan '25

04 Jan '25

From: Gerd Bayer <gbayer(a)linux.ibm.com> stable inclusion from stable-v5.10.227 commit ca36d6c1a49b6965c86dd528a73f38bc62d9c625 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRD9 CVE: CVE-2024-50001 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2bcae12c795f32ddfbf8c80d1b5f1d3286341c32 ] Remove the erroneous unmap in case no DMA mapping was established The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can't allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq's FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state. The erroneous behavior was seen in a stress-test environment that created memory pressure. Fixes: 5af75c747e2a ("net/mlx5e: Enhanced TX MPWQE for SKBs") Signed-off-by: Gerd Bayer <gbayer(a)linux.ibm.com> Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Acked-by: Maxim Mikityanskiy <maxtram95(a)gmail.com> Signed-off-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c index 373668068071..9b1e43ff8ae1 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c @@ -601,7 +601,6 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, return; err_unmap: - mlx5e_dma_unmap_wqe_err(sq, 1); sq->stats->dropped++; dev_kfree_skb_any(skb); } -- 2.22.0

2 1

[PATCH openEuler-22.03-LTS-SP1] net/mlx5: Fix error path in multi-packet WQE transmit
by Guo Mengqi 04 Jan '25

04 Jan '25

From: Gerd Bayer <gbayer(a)linux.ibm.com> stable inclusion from stable-v5.10.227 commit ca36d6c1a49b6965c86dd528a73f38bc62d9c625 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRD9 CVE: CVE-2024-50001 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2bcae12c795f32ddfbf8c80d1b5f1d3286341c32 ] Remove the erroneous unmap in case no DMA mapping was established The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can't allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq's FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state. The erroneous behavior was seen in a stress-test environment that created memory pressure. Fixes: 5af75c747e2a ("net/mlx5e: Enhanced TX MPWQE for SKBs") Signed-off-by: Gerd Bayer <gbayer(a)linux.ibm.com> Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Acked-by: Maxim Mikityanskiy <maxtram95(a)gmail.com> Signed-off-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c index 373668068071..9b1e43ff8ae1 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c @@ -601,7 +601,6 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, return; err_unmap: - mlx5e_dma_unmap_wqe_err(sq, 1); sq->stats->dropped++; dev_kfree_skb_any(skb); } -- 2.22.0

2 1

[PATCH OLK-5.10] crypto: hisilicon/qm - inject error before stopping queue
by Guo Mengqi 04 Jan '25

04 Jan '25

From: Weili Qian <qianweili(a)huawei.com> stable inclusion from stable-v6.1.113 commit 98d3be34c9153eceadb56de50d9f9347e88d86e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQSI CVE: CVE-2024-47730 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b04f06fc0243600665b3b50253869533b7938468 ] The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory. Fixes: 6c6dd5802c2d ("crypto: hisilicon/qm - add controller reset interface") Signed-off-by: Weili Qian <qianweili(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/crypto/hisilicon/qm.c [context conflict] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/crypto/hisilicon/qm.c | 48 +++++++++++++++++------------------ 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index fe043487ae58..23f74b630e5c 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -4196,6 +4196,28 @@ static int qm_set_vf_mse(struct hisi_qm *qm, bool set) return -ETIMEDOUT; } +static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm) +{ + u32 nfe_enb = 0; + + /* Kunpeng930 hardware automatically close master ooo when NFE occurs */ + if (qm->ver >= QM_HW_V3) + return; + + if (!qm->err_status.is_dev_ecc_mbit && + qm->err_status.is_qm_ecc_mbit && + qm->err_ini->close_axi_master_ooo) { + qm->err_ini->close_axi_master_ooo(qm); + } else if (qm->err_status.is_dev_ecc_mbit && + !qm->err_status.is_qm_ecc_mbit && + !qm->err_ini->close_axi_master_ooo) { + nfe_enb = readl(qm->io_base + QM_RAS_NFE_ENABLE); + writel(nfe_enb & QM_RAS_NFE_MBIT_DISABLE, + qm->io_base + QM_RAS_NFE_ENABLE); + writel(QM_ECC_MBIT, qm->io_base + QM_ABNORMAL_INT_SET); + } +} + static int qm_vf_reset_prepare(struct hisi_qm *qm, enum qm_stop_reason stop_reason) { @@ -4260,6 +4282,8 @@ static int qm_controller_reset_prepare(struct hisi_qm *qm) return ret; } + qm_dev_ecc_mbit_handle(qm); + /* PF obtains the information of VF by querying the register. */ qm_cmd_uninit(qm); @@ -4288,28 +4312,6 @@ static int qm_controller_reset_prepare(struct hisi_qm *qm) return 0; } -static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm) -{ - u32 nfe_enb = 0; - - /* Kunpeng930 hardware automatically close master ooo when NFE occurs */ - if (qm->ver >= QM_HW_V3) - return; - - if (!qm->err_status.is_dev_ecc_mbit && - qm->err_status.is_qm_ecc_mbit && - qm->err_ini->close_axi_master_ooo) { - qm->err_ini->close_axi_master_ooo(qm); - } else if (qm->err_status.is_dev_ecc_mbit && - !qm->err_status.is_qm_ecc_mbit && - !qm->err_ini->close_axi_master_ooo) { - nfe_enb = readl(qm->io_base + QM_RAS_NFE_ENABLE); - writel(nfe_enb & QM_RAS_NFE_MBIT_DISABLE, - qm->io_base + QM_RAS_NFE_ENABLE); - writel(QM_ECC_MBIT, qm->io_base + QM_ABNORMAL_INT_SET); - } -} - static int qm_soft_reset_prepare(struct hisi_qm *qm) { struct pci_dev *pdev = qm->pdev; @@ -4335,8 +4337,6 @@ static int qm_soft_reset_prepare(struct hisi_qm *qm) return ret; } - qm_dev_ecc_mbit_handle(qm); - /* OOO register set and check */ writel(ACC_MASTER_GLOBAL_CTRL_SHUTDOWN, qm->io_base + ACC_MASTER_GLOBAL_CTRL); -- 2.22.0

2 1

[PATCH OLK-5.10] drm/amd/display: Check null pointers before using dc->clk_mgr
by Guo Mengqi 04 Jan '25

04 Jan '25

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.227 commit 8d54001f8dccd56146973f23f3ab2ba037a21251 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZVX4 CVE: CVE-2024-49907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 95d9e0803e51d5a24276b7643b244c7477daf463 ] [WHY & HOW] dc->clk_mgr is null checked previously in the same function, indicating it might be null. Passing "dc" to "dc->hwss.apply_idle_power_optimizations", which dereferences null "dc->clk_mgr". (The function pointer resolves to "dcn35_apply_idle_power_optimizations".) This fixes 1 FORWARD_NULL issue reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Tom Chung <chiahsuan.chung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index 287a5b15cec9..3ecc4561a43e 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -3077,7 +3077,8 @@ void dc_allow_idle_optimizations(struct dc *dc, bool allow) if (allow == dc->idle_optimizations_allowed) return; - if (dc->hwss.apply_idle_power_optimizations && dc->hwss.apply_idle_power_optimizations(dc, allow)) + if (dc->hwss.apply_idle_power_optimizations && dc->clk_mgr != NULL && + dc->hwss.apply_idle_power_optimizations(dc, allow)) dc->idle_optimizations_allowed = allow; } -- 2.22.0

2 1

[PATCH openEuler-22.03-LTS-SP1] iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
by Guo Mengqi 04 Jan '25

04 Jan '25

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> stable inclusion from stable-v5.10.158 commit a5c65cd56aed027f8a97fda8b691caaeb66d115e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRE3 CVE: CVE-2022-49002 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4bedbbd782ebbe7287231fea862c158d4f08a9e3 ] for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() for the error path to avoid reference count leak. Fixes: 2e4552893038 ("iommu/vt-d: Unify the way to process DMAR device scope array") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Link: https://lore.kernel.org/r/20221121113649.190393-3-wangxiongfeng2@huawei.com Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/iommu/intel/dmar.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index c2af96eb633f..fde7eb3d8103 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -827,6 +827,7 @@ int __init dmar_dev_scope_init(void) info = dmar_alloc_pci_notify_info(dev, BUS_NOTIFY_ADD_DEVICE); if (!info) { + pci_dev_put(dev); return dmar_dev_scope_status; } else { dmar_pci_bus_add_dev(info); -- 2.22.0

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check null pointers before using dc->clk_mgr
by Guo Mengqi 04 Jan '25

04 Jan '25

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.227 commit 8d54001f8dccd56146973f23f3ab2ba037a21251 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZVX4 CVE: CVE-2024-49907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 95d9e0803e51d5a24276b7643b244c7477daf463 ] [WHY & HOW] dc->clk_mgr is null checked previously in the same function, indicating it might be null. Passing "dc" to "dc->hwss.apply_idle_power_optimizations", which dereferences null "dc->clk_mgr". (The function pointer resolves to "dcn35_apply_idle_power_optimizations".) This fixes 1 FORWARD_NULL issue reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Tom Chung <chiahsuan.chung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index f1d84092f057..1a183eb0568b 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -3075,7 +3075,8 @@ void dc_allow_idle_optimizations(struct dc *dc, bool allow) if (allow == dc->idle_optimizations_allowed) return; - if (dc->hwss.apply_idle_power_optimizations && dc->hwss.apply_idle_power_optimizations(dc, allow)) + if (dc->hwss.apply_idle_power_optimizations && dc->clk_mgr != NULL && + dc->hwss.apply_idle_power_optimizations(dc, allow)) dc->idle_optimizations_allowed = allow; } -- 2.22.0

2 1

[PATCH OLK-5.10] staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
by Guo Mengqi 04 Jan '25

04 Jan '25

From: Zicheng Qu <quzicheng(a)huawei.com> stable inclusion from stable-v5.10.229 commit 442f786c5bff8cfd756ebdeaa4aadbf05c22aa5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB67SG CVE: CVE-2024-50233 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6bd301819f8f69331a55ae2336c8b111fc933f3d upstream. In the ad9832_write_frequency() function, clk_get_rate() might return 0. This can lead to a division by zero when calling ad9832_calc_freqreg(). The check if (fout > (clk_get_rate(st->mclk) / 2)) does not protect against the case when fout is 0. The ad9832_write_frequency() function is called from ad9832_write(), and fout is derived from a text buffer, which can contain any value. Link: https://lore.kernel.org/all/2024100904-CVE-2024-47663-9bdc@gregkh/ Fixes: ea707584bac1 ("Staging: IIO: DDS: AD9832 / AD9835 driver") Cc: stable(a)vger.kernel.org Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> Reviewed-by: Nuno Sa <nuno.sa(a)analog.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://patch.msgid.link/20241022134354.574614-1-quzicheng@huawei.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/staging/iio/frequency/ad9832.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/staging/iio/frequency/ad9832.c b/drivers/staging/iio/frequency/ad9832.c index 447937e04ebd..61c5f33ac271 100644 --- a/drivers/staging/iio/frequency/ad9832.c +++ b/drivers/staging/iio/frequency/ad9832.c @@ -129,12 +129,15 @@ static unsigned long ad9832_calc_freqreg(unsigned long mclk, unsigned long fout) static int ad9832_write_frequency(struct ad9832_state *st, unsigned int addr, unsigned long fout) { + unsigned long clk_freq; unsigned long regval; - if (fout > (clk_get_rate(st->mclk) / 2)) + clk_freq = clk_get_rate(st->mclk); + + if (!clk_freq || fout > (clk_freq / 2)) return -EINVAL; - regval = ad9832_calc_freqreg(clk_get_rate(st->mclk), fout); + regval = ad9832_calc_freqreg(clk_freq, fout); st->freq_data[0] = cpu_to_be16((AD9832_CMD_FRE8BITSW << CMD_SHIFT) | (addr << ADD_SHIFT) | -- 2.22.0

2 1

[PATCH openEuler-22.03-LTS-SP1] staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
by Guo Mengqi 04 Jan '25

04 Jan '25

From: Zicheng Qu <quzicheng(a)huawei.com> stable inclusion from stable-v5.10.229 commit 442f786c5bff8cfd756ebdeaa4aadbf05c22aa5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB67SG CVE: CVE-2024-50233 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6bd301819f8f69331a55ae2336c8b111fc933f3d upstream. In the ad9832_write_frequency() function, clk_get_rate() might return 0. This can lead to a division by zero when calling ad9832_calc_freqreg(). The check if (fout > (clk_get_rate(st->mclk) / 2)) does not protect against the case when fout is 0. The ad9832_write_frequency() function is called from ad9832_write(), and fout is derived from a text buffer, which can contain any value. Link: https://lore.kernel.org/all/2024100904-CVE-2024-47663-9bdc@gregkh/ Fixes: ea707584bac1 ("Staging: IIO: DDS: AD9832 / AD9835 driver") Cc: stable(a)vger.kernel.org Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> Reviewed-by: Nuno Sa <nuno.sa(a)analog.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://patch.msgid.link/20241022134354.574614-1-quzicheng@huawei.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/staging/iio/frequency/ad9832.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/staging/iio/frequency/ad9832.c b/drivers/staging/iio/frequency/ad9832.c index 447937e04ebd..61c5f33ac271 100644 --- a/drivers/staging/iio/frequency/ad9832.c +++ b/drivers/staging/iio/frequency/ad9832.c @@ -129,12 +129,15 @@ static unsigned long ad9832_calc_freqreg(unsigned long mclk, unsigned long fout) static int ad9832_write_frequency(struct ad9832_state *st, unsigned int addr, unsigned long fout) { + unsigned long clk_freq; unsigned long regval; - if (fout > (clk_get_rate(st->mclk) / 2)) + clk_freq = clk_get_rate(st->mclk); + + if (!clk_freq || fout > (clk_freq / 2)) return -EINVAL; - regval = ad9832_calc_freqreg(clk_get_rate(st->mclk), fout); + regval = ad9832_calc_freqreg(clk_freq, fout); st->freq_data[0] = cpu_to_be16((AD9832_CMD_FRE8BITSW << CMD_SHIFT) | (addr << ADD_SHIFT) | -- 2.22.0

2 1

[PATCH OLK-6.6] brd: defer automatic disk creation until module initialization succeeds
by Zheng Qixing 04 Jan '25

04 Jan '25

From: Yang Erkun <yangerkun(a)huawei.com> stable inclusion from stable-v6.6.64 commit 410896624db639500f24f46478b4bfa05c76bf56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDPI CVE: CVE-2024-56693 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 826cc42adf44930a633d11a5993676d85ddb0842 ] My colleague Wupeng found the following problems during fault injection: BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__asan_load8+0x4c/0xa0 ... Call Trace: <TASK> blkdev_put_whole+0x41/0x70 bdev_release+0x1a3/0x250 blkdev_release+0x11/0x20 __fput+0x1d7/0x4a0 task_work_run+0xfc/0x180 syscall_exit_to_user_mode+0x1de/0x1f0 do_syscall_64+0x6b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e loop_init() is calling loop_add() after __register_blkdev() succeeds and is ignoring disk_add() failure from loop_add(), for loop_add() failure is not fatal and successfully created disks are already visible to bdev_open(). brd_init() is currently calling brd_alloc() before __register_blkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case: case 1: T1: modprobe brd brd_init brd_alloc(0) // success add_disk disk_scan_partitions bdev_file_open_by_dev // alloc file fput // won't free until back to userspace brd_alloc(1) // failed since mem alloc error inject // error path for modprobe will release code segment // back to userspace __fput blkdev_release bdev_release blkdev_put_whole bdev->bd_disk->fops->release // fops is freed now, UAF! case 2: T1: T2: modprobe brd brd_init brd_alloc(0) // success open(/dev/ram0) brd_alloc(1) // fail // error path for modprobe close(/dev/ram0) ... /* UAF! */ bdev->bd_disk->fops->release Fix this problem by following what loop_init() does. Besides, reintroduce brd_devices_mutex to help serialize modifications to brd_list. Fixes: 7f9b348cb5e9 ("brd: convert to blk_alloc_disk/blk_cleanup_disk") Reported-by: Wupeng Ma <mawupeng1(a)huawei.com> Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20241030034914.907829-1-yangerkun@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/block/brd.c | 66 ++++++++++++++++++++++++++++++--------------- 1 file changed, 44 insertions(+), 22 deletions(-) diff --git a/drivers/block/brd.c b/drivers/block/brd.c index 970bd6ff38c4..d816d1512531 100644 --- a/drivers/block/brd.c +++ b/drivers/block/brd.c @@ -310,8 +310,40 @@ __setup("ramdisk_size=", ramdisk_size); * (should share code eventually). */ static LIST_HEAD(brd_devices); +static DEFINE_MUTEX(brd_devices_mutex); static struct dentry *brd_debugfs_dir; +static struct brd_device *brd_find_or_alloc_device(int i) +{ + struct brd_device *brd; + + mutex_lock(&brd_devices_mutex); + list_for_each_entry(brd, &brd_devices, brd_list) { + if (brd->brd_number == i) { + mutex_unlock(&brd_devices_mutex); + return ERR_PTR(-EEXIST); + } + } + + brd = kzalloc(sizeof(*brd), GFP_KERNEL); + if (!brd) { + mutex_unlock(&brd_devices_mutex); + return ERR_PTR(-ENOMEM); + } + brd->brd_number = i; + list_add_tail(&brd->brd_list, &brd_devices); + mutex_unlock(&brd_devices_mutex); + return brd; +} + +static void brd_free_device(struct brd_device *brd) +{ + mutex_lock(&brd_devices_mutex); + list_del(&brd->brd_list); + mutex_unlock(&brd_devices_mutex); + kfree(brd); +} + static int brd_alloc(int i) { struct brd_device *brd; @@ -319,14 +351,9 @@ static int brd_alloc(int i) char buf[DISK_NAME_LEN]; int err = -ENOMEM; - list_for_each_entry(brd, &brd_devices, brd_list) - if (brd->brd_number == i) - return -EEXIST; - brd = kzalloc(sizeof(*brd), GFP_KERNEL); - if (!brd) - return -ENOMEM; - brd->brd_number = i; - list_add_tail(&brd->brd_list, &brd_devices); + brd = brd_find_or_alloc_device(i); + if (IS_ERR(brd)) + return PTR_ERR(brd); xa_init(&brd->brd_pages); @@ -369,8 +396,7 @@ static int brd_alloc(int i) out_cleanup_disk: put_disk(disk); out_free_dev: - list_del(&brd->brd_list); - kfree(brd); + brd_free_device(brd); return err; } @@ -389,8 +415,7 @@ static void brd_cleanup(void) del_gendisk(brd->brd_disk); put_disk(brd->brd_disk); brd_free_pages(brd); - list_del(&brd->brd_list); - kfree(brd); + brd_free_device(brd); } } @@ -417,16 +442,6 @@ static int __init brd_init(void) { int err, i; - brd_check_and_reset_par(); - - brd_debugfs_dir = debugfs_create_dir("ramdisk_pages", NULL); - - for (i = 0; i < rd_nr; i++) { - err = brd_alloc(i); - if (err) - goto out_free; - } - /* * brd module now has a feature to instantiate underlying device * structure on-demand, provided that there is an access dev node. @@ -442,11 +457,18 @@ static int __init brd_init(void) * dynamically. */ + brd_check_and_reset_par(); + + brd_debugfs_dir = debugfs_create_dir("ramdisk_pages", NULL); + if (__register_blkdev(RAMDISK_MAJOR, "ramdisk", brd_probe)) { err = -EIO; goto out_free; } + for (i = 0; i < rd_nr; i++) + brd_alloc(i); + pr_info("brd: module loaded\n"); return 0; -- 2.39.2

2 1

[PATCH OLK-5.10] drm: zynqmp_kms: Unplug DRM device before removal
by Zheng Qixing 04 Jan '25

04 Jan '25

From: Sean Anderson <sean.anderson(a)linux.dev> mainline inclusion from mainline-v6.13-rc1 commit 2e07c88914fc5289c21820b1aa94f058feb38197 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAE5 CVE: CVE-2024-56538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver's internals. Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem") Closes: https://lore.kernel.org/dri-devel/4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linu… Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240809193600.3360015-2-sean… Conflicts: drivers/gpu/drm/xlnx/zynqmp_kms.c [The conflict is due to the commit 074ef0ce9f83 ("drm: xlnx: zynqmp_dpsub: Move all DRM init and cleanup to zynqmp_kms.c") not being merged.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c index 5f6eea81f3cc..2f69e2671e79 100644 --- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c @@ -264,7 +264,7 @@ static int zynqmp_dpsub_remove(struct platform_device *pdev) struct zynqmp_dpsub *dpsub = platform_get_drvdata(pdev); struct drm_device *drm = &dpsub->drm; - drm_dev_unregister(drm); + drm_dev_unplug(drm); drm_atomic_helper_shutdown(drm); drm_kms_helper_poll_fini(drm); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] drm: zynqmp_kms: Unplug DRM device before removal
by Zheng Qixing 04 Jan '25

04 Jan '25

From: Sean Anderson <sean.anderson(a)linux.dev> mainline inclusion from mainline-v6.13-rc1 commit 2e07c88914fc5289c21820b1aa94f058feb38197 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAE5 CVE: CVE-2024-56538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver's internals. Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem") Closes: https://lore.kernel.org/dri-devel/4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linu… Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240809193600.3360015-2-sean… Conflicts: drivers/gpu/drm/xlnx/zynqmp_kms.c [The conflict is due to the commit 074ef0ce9f83 ("drm: xlnx: zynqmp_dpsub: Move all DRM init and cleanup to zynqmp_kms.c") not being merged.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c index 5f6eea81f3cc..2f69e2671e79 100644 --- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c @@ -264,7 +264,7 @@ static int zynqmp_dpsub_remove(struct platform_device *pdev) struct zynqmp_dpsub *dpsub = platform_get_drvdata(pdev); struct drm_device *drm = &dpsub->drm; - drm_dev_unregister(drm); + drm_dev_unplug(drm); drm_atomic_helper_shutdown(drm); drm_kms_helper_poll_fini(drm); -- 2.39.2

2 1

[PATCH OLK-6.6] drm: zynqmp_kms: Unplug DRM device before removal
by Zheng Qixing 04 Jan '25

04 Jan '25

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v6.6.64 commit a17b9afe58c474657449cf87e238b1788200576b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAE5 CVE: CVE-2024-56538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e07c88914fc5289c21820b1aa94f058feb38197 ] Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver's internals. Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem") Closes: https://lore.kernel.org/dri-devel/4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linu… Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240809193600.3360015-2-sean… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/gpu/drm/xlnx/zynqmp_kms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xlnx/zynqmp_kms.c b/drivers/gpu/drm/xlnx/zynqmp_kms.c index 44d4a510ad7d..ccb6e065dc6d 100644 --- a/drivers/gpu/drm/xlnx/zynqmp_kms.c +++ b/drivers/gpu/drm/xlnx/zynqmp_kms.c @@ -533,7 +533,7 @@ void zynqmp_dpsub_drm_cleanup(struct zynqmp_dpsub *dpsub) { struct drm_device *drm = &dpsub->drm->dev; - drm_dev_unregister(drm); + drm_dev_unplug(drm); drm_atomic_helper_shutdown(drm); drm_encoder_cleanup(&dpsub->drm->encoder); drm_kms_helper_poll_fini(drm); -- 2.39.2

2 1

[PATCH OLK-6.6] block: fix uaf for flush rq while iterating tags
by Zheng Qixing 04 Jan '25

04 Jan '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 3802f73bd80766d70f319658f334754164075bc3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF4 CVE: CVE-2024-53170 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------- blk_mq_clear_flush_rq_mapping() is not called during scsi probe, by checking blk_queue_init_done(). However, QUEUE_FLAG_INIT_DONE is cleared in del_gendisk by commit aec89dc5d421 ("block: keep q_usage_counter in atomic mode after del_gendisk"), hence for disk like scsi, following blk_mq_destroy_queue() will not clear flush rq from tags->rqs[] as well, cause following uaf that is found by our syzkaller for v6.6: ================================================================== BUG: KASAN: slab-use-after-free in blk_mq_find_and_get_req+0x16e/0x1a0 block/blk-mq-tag.c:261 Read of size 4 at addr ffff88811c969c20 by task kworker/1:2H/224909 CPU: 1 PID: 224909 Comm: kworker/1:2H Not tainted 6.6.0-ga836a5060850 #32 Workqueue: kblockd blk_mq_timeout_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description.constprop.0+0x66/0x300 mm/kasan/report.c:364 print_report+0x3e/0x70 mm/kasan/report.c:475 kasan_report+0xb8/0xf0 mm/kasan/report.c:588 blk_mq_find_and_get_req+0x16e/0x1a0 block/blk-mq-tag.c:261 bt_iter block/blk-mq-tag.c:288 [inline] __sbitmap_for_each_set include/linux/sbitmap.h:295 [inline] sbitmap_for_each_set include/linux/sbitmap.h:316 [inline] bt_for_each+0x455/0x790 block/blk-mq-tag.c:325 blk_mq_queue_tag_busy_iter+0x320/0x740 block/blk-mq-tag.c:534 blk_mq_timeout_work+0x1a3/0x7b0 block/blk-mq.c:1673 process_one_work+0x7c4/0x1450 kernel/workqueue.c:2631 process_scheduled_works kernel/workqueue.c:2704 [inline] worker_thread+0x804/0xe40 kernel/workqueue.c:2785 kthread+0x346/0x450 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:293 Allocated by task 942: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc mm/kasan/common.c:383 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:198 [inline] __do_kmalloc_node mm/slab_common.c:1007 [inline] __kmalloc_node+0x69/0x170 mm/slab_common.c:1014 kmalloc_node include/linux/slab.h:620 [inline] kzalloc_node include/linux/slab.h:732 [inline] blk_alloc_flush_queue+0x144/0x2f0 block/blk-flush.c:499 blk_mq_alloc_hctx+0x601/0x940 block/blk-mq.c:3788 blk_mq_alloc_and_init_hctx+0x27f/0x330 block/blk-mq.c:4261 blk_mq_realloc_hw_ctxs+0x488/0x5e0 block/blk-mq.c:4294 blk_mq_init_allocated_queue+0x188/0x860 block/blk-mq.c:4350 blk_mq_init_queue_data block/blk-mq.c:4166 [inline] blk_mq_init_queue+0x8d/0x100 block/blk-mq.c:4176 scsi_alloc_sdev+0x843/0xd50 drivers/scsi/scsi_scan.c:335 scsi_probe_and_add_lun+0x77c/0xde0 drivers/scsi/scsi_scan.c:1189 __scsi_scan_target+0x1fc/0x5a0 drivers/scsi/scsi_scan.c:1727 scsi_scan_channel drivers/scsi/scsi_scan.c:1815 [inline] scsi_scan_channel+0x14b/0x1e0 drivers/scsi/scsi_scan.c:1791 scsi_scan_host_selected+0x2fe/0x400 drivers/scsi/scsi_scan.c:1844 scsi_scan+0x3a0/0x3f0 drivers/scsi/scsi_sysfs.c:151 store_scan+0x2a/0x60 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x5c/0x90 drivers/base/core.c:2388 sysfs_kf_write+0x11c/0x170 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x3fc/0x610 fs/kernfs/file.c:338 call_write_iter include/linux/fs.h:2083 [inline] new_sync_write+0x1b4/0x2d0 fs/read_write.c:493 vfs_write+0x76c/0xb00 fs/read_write.c:586 ksys_write+0x127/0x250 fs/read_write.c:639 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Freed by task 244687: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] __kasan_slab_free+0x12a/0x1b0 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1815 [inline] slab_free_freelist_hook mm/slub.c:1841 [inline] slab_free mm/slub.c:3807 [inline] __kmem_cache_free+0xe4/0x520 mm/slub.c:3820 blk_free_flush_queue+0x40/0x60 block/blk-flush.c:520 blk_mq_hw_sysfs_release+0x4a/0x170 block/blk-mq-sysfs.c:37 kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x119/0x140 lib/kobject.c:737 blk_mq_release+0x24f/0x3f0 block/blk-mq.c:4144 blk_free_queue block/blk-core.c:298 [inline] blk_put_queue+0xe2/0x180 block/blk-core.c:314 blkg_free_workfn+0x376/0x6e0 block/blk-cgroup.c:144 process_one_work+0x7c4/0x1450 kernel/workqueue.c:2631 process_scheduled_works kernel/workqueue.c:2704 [inline] worker_thread+0x804/0xe40 kernel/workqueue.c:2785 kthread+0x346/0x450 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:293 Other than blk_mq_clear_flush_rq_mapping(), the flag is only used in blk_register_queue() from initialization path, hence it's safe not to clear the flag in del_gendisk. And since QUEUE_FLAG_REGISTERED already make sure that queue should only be registered once, there is no need to test the flag as well. Fixes: 6cfeadbff3f8 ("blk-mq: don't clear flush_rq from tags->rqs[]") Depends-on: commit aec89dc5d421 ("block: keep q_usage_counter in atomic mode after del_gendisk") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20241104110005.1412161-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/genhd.c [Context conflict.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-sysfs.c | 6 ++---- block/genhd.c | 9 +++------ 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 7a38a1d5dceb..2de6c14dfecf 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -894,10 +894,8 @@ int blk_register_queue(struct gendisk *disk) * faster to shut down and is made fully functional here as * request_queues for non-existent devices never get registered. */ - if (!blk_queue_init_done(q)) { - blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q); - percpu_ref_switch_to_percpu(&q->q_usage_counter); - } + blk_queue_flag_set(QUEUE_FLAG_INIT_DONE, q); + percpu_ref_switch_to_percpu(&q->q_usage_counter); return ret; diff --git a/block/genhd.c b/block/genhd.c index de21c79cbda6..28fb6476ee7f 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -710,13 +710,10 @@ void del_gendisk(struct gendisk *disk) * If the disk does not own the queue, allow using passthrough requests * again. Else leave the queue frozen to fail all I/O. */ - if (!test_bit(GD_OWNS_QUEUE, &disk->state)) { - blk_queue_flag_clear(QUEUE_FLAG_INIT_DONE, q); + if (!test_bit(GD_OWNS_QUEUE, &disk->state)) __blk_mq_unfreeze_queue(q, true); - } else { - if (queue_is_mq(q)) - blk_mq_exit_queue(q); - } + else if (queue_is_mq(q)) + blk_mq_exit_queue(q); } EXPORT_SYMBOL(del_gendisk); -- 2.39.2

2 1

[PATCH OLK-5.10] scsi: sg: Fix slab-use-after-free read in sg_release()
by Zheng Qixing 04 Jan '25

04 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> mainline inclusion from mainline-v6.13-rc2 commit f10593ad9bc36921f623361c9e3dd96bd52d85ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN7 CVE: CVE-2024-56631 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5838 __mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912 sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407 In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is called before releasing the open_rel_lock mutex. The kref_put() call may decrement the reference count of sfp to zero, triggering its cleanup through sg_remove_sfp(). This cleanup includes scheduling deferred work via sg_remove_sfp_usercontext(), which ultimately frees sfp. After kref_put(), sg_release() continues to unlock open_rel_lock and may reference sfp or sdp. If sfp has already been freed, this results in a slab-use-after-free error. Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the open_rel_lock mutex. This ensures: - No references to sfp or sdp occur after the reference count is decremented. - Cleanup functions such as sg_remove_sfp() and sg_remove_sfp_usercontext() can safely execute without impacting the mutex handling in sg_release(). The fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures proper sequencing of resource cleanup and mutex operations, eliminating the risk of use-after-free errors in sg_release(). Reported-by: syzbot+7efb5850a17ba6ce098b(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7efb5850a17ba6ce098b Tested-by: syzbot+7efb5850a17ba6ce098b(a)syzkaller.appspotmail.com Fixes: cc833acbee9d ("sg: O_EXCL and other lock handling") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Link: https://lore.kernel.org/r/20241120125944.88095-1-surajsonawane0215@gmail.com Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/sg.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/sg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index e1c086ac8a60..91cbf45cf880 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -390,7 +390,6 @@ sg_release(struct inode *inode, struct file *filp) mutex_lock(&sdp->open_rel_lock); scsi_autopm_put_device(sdp->device); - kref_put(&sfp->f_ref, sg_remove_sfp); sdp->open_cnt--; /* possibly many open()s waiting on exlude clearing, start many; @@ -402,6 +401,7 @@ sg_release(struct inode *inode, struct file *filp) wake_up_interruptible(&sdp->open_wait); } mutex_unlock(&sdp->open_rel_lock); + kref_put(&sfp->f_ref, sg_remove_sfp); return 0; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: sg: Fix slab-use-after-free read in sg_release()
by Zheng Qixing 04 Jan '25

04 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> mainline inclusion from mainline-v6.13-rc2 commit f10593ad9bc36921f623361c9e3dd96bd52d85ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN7 CVE: CVE-2024-56631 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5838 __mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912 sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407 In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is called before releasing the open_rel_lock mutex. The kref_put() call may decrement the reference count of sfp to zero, triggering its cleanup through sg_remove_sfp(). This cleanup includes scheduling deferred work via sg_remove_sfp_usercontext(), which ultimately frees sfp. After kref_put(), sg_release() continues to unlock open_rel_lock and may reference sfp or sdp. If sfp has already been freed, this results in a slab-use-after-free error. Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the open_rel_lock mutex. This ensures: - No references to sfp or sdp occur after the reference count is decremented. - Cleanup functions such as sg_remove_sfp() and sg_remove_sfp_usercontext() can safely execute without impacting the mutex handling in sg_release(). The fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures proper sequencing of resource cleanup and mutex operations, eliminating the risk of use-after-free errors in sg_release(). Reported-by: syzbot+7efb5850a17ba6ce098b(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7efb5850a17ba6ce098b Tested-by: syzbot+7efb5850a17ba6ce098b(a)syzkaller.appspotmail.com Fixes: cc833acbee9d ("sg: O_EXCL and other lock handling") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Link: https://lore.kernel.org/r/20241120125944.88095-1-surajsonawane0215@gmail.com Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/sg.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/sg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index e1c086ac8a60..91cbf45cf880 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -390,7 +390,6 @@ sg_release(struct inode *inode, struct file *filp) mutex_lock(&sdp->open_rel_lock); scsi_autopm_put_device(sdp->device); - kref_put(&sfp->f_ref, sg_remove_sfp); sdp->open_cnt--; /* possibly many open()s waiting on exlude clearing, start many; @@ -402,6 +401,7 @@ sg_release(struct inode *inode, struct file *filp) wake_up_interruptible(&sdp->open_wait); } mutex_unlock(&sdp->open_rel_lock); + kref_put(&sfp->f_ref, sg_remove_sfp); return 0; } -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: sg: Fix slab-use-after-free read in sg_release()
by Zheng Qixing 04 Jan '25

04 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> stable inclusion from stable-v6.6.66 commit 59b30afa578637169e2819536bb66459fdddc39d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN7 CVE: CVE-2024-56631 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f10593ad9bc36921f623361c9e3dd96bd52d85ee ] Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5838 __mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912 sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407 In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is called before releasing the open_rel_lock mutex. The kref_put() call may decrement the reference count of sfp to zero, triggering its cleanup through sg_remove_sfp(). This cleanup includes scheduling deferred work via sg_remove_sfp_usercontext(), which ultimately frees sfp. After kref_put(), sg_release() continues to unlock open_rel_lock and may reference sfp or sdp. If sfp has already been freed, this results in a slab-use-after-free error. Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the open_rel_lock mutex. This ensures: - No references to sfp or sdp occur after the reference count is decremented. - Cleanup functions such as sg_remove_sfp() and sg_remove_sfp_usercontext() can safely execute without impacting the mutex handling in sg_release(). The fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures proper sequencing of resource cleanup and mutex operations, eliminating the risk of use-after-free errors in sg_release(). Reported-by: syzbot+7efb5850a17ba6ce098b(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7efb5850a17ba6ce098b Tested-by: syzbot+7efb5850a17ba6ce098b(a)syzkaller.appspotmail.com Fixes: cc833acbee9d ("sg: O_EXCL and other lock handling") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Link: https://lore.kernel.org/r/20241120125944.88095-1-surajsonawane0215@gmail.com Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/sg.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/sg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index e6d8beb87776..59de84387def 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -393,7 +393,6 @@ sg_release(struct inode *inode, struct file *filp) mutex_lock(&sdp->open_rel_lock); scsi_autopm_put_device(sdp->device); - kref_put(&sfp->f_ref, sg_remove_sfp); sdp->open_cnt--; /* possibly many open()s waiting on exlude clearing, start many; @@ -405,6 +404,7 @@ sg_release(struct inode *inode, struct file *filp) wake_up_interruptible(&sdp->open_wait); } mutex_unlock(&sdp->open_rel_lock); + kref_put(&sfp->f_ref, sg_remove_sfp); return 0; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-56724
by Liao Chen 04 Jan '25

04 Jan '25

fix CVE-2024-56724 Andy Shevchenko (1): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 33 +++++++++++++------------- drivers/platform/x86/intel_bxtwc_tmu.c | 22 +++++------------ 2 files changed, 23 insertions(+), 32 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-56724
by Liao Chen 04 Jan '25

04 Jan '25

fix CVE-2024-56724 Andy Shevchenko (1): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 33 +++++++++++++------------- drivers/platform/x86/intel_bxtwc_tmu.c | 22 +++++------------ 2 files changed, 23 insertions(+), 32 deletions(-) -- 2.34.1

2 2

[openeuler:OLK-5.10 2626/2626] ld.lld: error: undefined symbol: latency_fsnotify
by kernel test robot 04 Jan '25

04 Jan '25

Hi Daniel, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d51fb86ce6a3a3e59d7cba58738b63903b8cb37c commit: d11dbe8b4e8ad4c5bd90147912352ef6f13a2bb6 [2626/2626] trace: Add osnoise tracer config: x86_64-randconfig-104-20250103 (https://download.01.org/0day-ci/archive/20250104/202501041734.WciMoLAr-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250104/202501041734.WciMoLAr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501041734.WciMoLAr-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: latency_fsnotify >>> referenced by trace_osnoise.c:933 (kernel/trace/trace_osnoise.c:933) >>> trace/trace_osnoise.o:(run_osnoise) in archive kernel/built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] RDMA/mlx5: Move events notifier registration to be after device registration
by Pu Lehui 04 Jan '25

04 Jan '25

From: Patrisious Haddad <phaddad(a)nvidia.com> stable inclusion from stable-v6.6.64 commit 921fcf2971a1e8d3b904ba2c2905b96f4ec3d4ad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADY CVE: CVE-2024-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 ] Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]--- Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Michael Guralnik <michaelgur(a)nvidia.com> Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.173149694… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 40 +++++++++++++--------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- 2 files changed, 20 insertions(+), 22 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index bc38af6cda6e..c510484e024b 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2899,7 +2899,6 @@ int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev) static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; int ret; if (!MLX5_CAP_GEN(dev->mdev, xrc)) @@ -2915,10 +2914,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) return ret; } - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - INIT_WORK(&devr->ports[port].pkey_change_work, - pkey_change_handler); - mutex_init(&devr->cq_lock); mutex_init(&devr->srq_lock); @@ -2928,16 +2923,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; - - /* - * Make sure no change P_Key work items are still executing. - * - * At this stage, the mlx5_ib_event should be unregistered - * and it ensures that no new works are added. - */ - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - cancel_work_sync(&devr->ports[port].pkey_change_work); /* After s0/s1 init, they are not unset during the device lifetime. */ if (devr->s1) { @@ -4201,6 +4186,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev) static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + INIT_WORK(&devr->ports[port].pkey_change_work, + pkey_change_handler); + dev->mdev_events.notifier_call = mlx5_ib_event; mlx5_notifier_register(dev->mdev, &dev->mdev_events); @@ -4211,8 +4203,14 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + mlx5r_macsec_event_unregister(dev); mlx5_notifier_unregister(dev->mdev, &dev->mdev_events); + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + cancel_work_sync(&devr->ports[port].pkey_change_work); } void __mlx5_ib_remove(struct mlx5_ib_dev *dev, @@ -4286,9 +4284,6 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_ODP, mlx5_ib_odp_init_one, mlx5_ib_odp_cleanup_one), @@ -4313,6 +4308,9 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), @@ -4349,9 +4347,6 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_COUNTERS, mlx5_ib_counters_init, mlx5_ib_counters_cleanup), @@ -4373,6 +4368,9 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h index 1c83d132197f..94678e5c59dd 100644 --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -954,7 +954,6 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_QP, MLX5_IB_STAGE_SRQ, MLX5_IB_STAGE_DEVICE_RESOURCES, - MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_ODP, MLX5_IB_STAGE_COUNTERS, MLX5_IB_STAGE_CONG_DEBUGFS, @@ -963,6 +962,7 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_PRE_IB_REG_UMR, MLX5_IB_STAGE_WHITELIST_UID, MLX5_IB_STAGE_IB_REG, + MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_POST_IB_REG_UMR, MLX5_IB_STAGE_DELAY_DROP, MLX5_IB_STAGE_RESTRACK, -- 2.34.1

2 1

[PATCH OLK-6.6 0/6] merge mainline patches into OLK-6.6
by Kaixiong Yu 04 Jan '25

04 Jan '25

merge mainline patches into OLK-6.6 Jeongjun Park (1): mm: migrate: annotate data-race in migrate_folio_unmap() Kefeng Wang (1): tmpfs: don't enable large folios if not supported Pei Li (1): mm: ignore data-race in __swap_writepage Sergey Senozhatsky (1): mm: Kconfig: fixup zsmalloc configuration Wei Xu (1): mm/mglru: reset page lru tier bits when activating Zeng Jingxiang (1): mm/vmscan: wake up flushers conditionally to avoid cgroup OOM include/linux/mm_inline.h | 15 ++++++++++++++- include/linux/mmzone.h | 2 ++ mm/Kconfig | 2 +- mm/migrate.c | 2 +- mm/page_io.c | 7 ++++++- mm/shmem.c | 5 ++++- mm/vmscan.c | 33 ++++++++++++++++++++++++++------- 7 files changed, 54 insertions(+), 12 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 0/1] CVE-2024-56724
by Liao Chen 04 Jan '25

04 Jan '25

fix CVE-2024-56724 Andy Shevchenko (1): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 31 ++++++++++++++------------ drivers/platform/x86/intel/bxtwc_tmu.c | 22 +++++------------- 2 files changed, 23 insertions(+), 30 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-56724
by Liao Chen 04 Jan '25

04 Jan '25

fix CVE-2024-56724 Andy Shevchenko (1): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 31 ++++++++++++++------------ drivers/platform/x86/intel/bxtwc_tmu.c | 22 +++++------------- 2 files changed, 23 insertions(+), 30 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] scsi: qla2xxx: Fix use after free on unload
by Yu Kuai 04 Jan '25

04 Jan '25

From: Quinn Tran <qutran(a)marvell.com> stable inclusion from stable-v6.6.66 commit 15369e774f27ec790f207de87c0b541e3f90b22d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOL CVE: CVE-2024-56623 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 07c903db0a2ff84b68efa1a74a4de353ea591eb0 upstream. System crash is observed with stack trace warning of use after free. There are 2 signals to tell dpc_thread to terminate (UNLOADING flag and kthread_stop). On setting the UNLOADING flag when dpc_thread happens to run at the time and sees the flag, this causes dpc_thread to exit and clean up itself. When kthread_stop is called for final cleanup, this causes use after free. Remove UNLOADING signal to terminate dpc_thread. Use the kthread_stop as the main signal to exit dpc_thread. [596663.812935] kernel BUG at mm/slub.c:294! [596663.812950] invalid opcode: 0000 [#1] SMP PTI [596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G IOE --------- - - 4.18.0-240.el8.x86_64 #1 [596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012 [596663.812974] RIP: 0010:__slab_free+0x17d/0x360 ... [596663.813008] Call Trace: [596663.813022] ? __dentry_kill+0x121/0x170 [596663.813030] ? _cond_resched+0x15/0x30 [596663.813034] ? _cond_resched+0x15/0x30 [596663.813039] ? wait_for_completion+0x35/0x190 [596663.813048] ? try_to_wake_up+0x63/0x540 [596663.813055] free_task+0x5a/0x60 [596663.813061] kthread_stop+0xf3/0x100 [596663.813103] qla2x00_remove_one+0x284/0x440 [qla2xxx] Cc: stable(a)vger.kernel.org Signed-off-by: Quinn Tran <qutran(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20241115130313.46826-3-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/scsi/qla2xxx/qla_os.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index da8331dbb01c..91d12198cc6c 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -6899,12 +6899,15 @@ qla2x00_do_dpc(void *data) set_user_nice(current, MIN_NICE); set_current_state(TASK_INTERRUPTIBLE); - while (!kthread_should_stop()) { + while (1) { ql_dbg(ql_dbg_dpc, base_vha, 0x4000, "DPC handler sleeping.\n"); schedule(); + if (kthread_should_stop()) + break; + if (test_and_clear_bit(DO_EEH_RECOVERY, &base_vha->dpc_flags)) qla_pci_set_eeh_busy(base_vha); @@ -6917,15 +6920,16 @@ qla2x00_do_dpc(void *data) goto end_loop; } + if (test_bit(UNLOADING, &base_vha->dpc_flags)) + /* don't do any work. Wait to be terminated by kthread_stop */ + goto end_loop; + ha->dpc_active = 1; ql_dbg(ql_dbg_dpc + ql_dbg_verbose, base_vha, 0x4001, "DPC handler waking up, dpc_flags=0x%lx.\n", base_vha->dpc_flags); - if (test_bit(UNLOADING, &base_vha->dpc_flags)) - break; - if (IS_P3P_TYPE(ha)) { if (IS_QLA8044(ha)) { if (test_and_clear_bit(ISP_UNRECOVERABLE, @@ -7238,9 +7242,6 @@ qla2x00_do_dpc(void *data) */ ha->dpc_active = 0; - /* Cleanup any residual CTX SRBs. */ - qla2x00_abort_all_cmds(base_vha, DID_NO_CONNECT << 16); - return 0; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-56701
by Liao Chen 04 Jan '25

04 Jan '25

fix CVE-2024-56701 Michael Ellerman (1): powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore arch/powerpc/include/asm/dtl.h | 4 ++-- arch/powerpc/platforms/pseries/dtl.c | 8 ++++---- arch/powerpc/platforms/pseries/lpar.c | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] scsi: qla2xxx: Fix use after free on unload
by Yu Kuai 04 Jan '25

04 Jan '25

From: Quinn Tran <qutran(a)marvell.com> stable inclusion from stable-v5.10.231 commit 12f04fc8580eafb0510f805749553eb6213f323e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOL CVE: CVE-2024-56623 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 07c903db0a2ff84b68efa1a74a4de353ea591eb0 upstream. System crash is observed with stack trace warning of use after free. There are 2 signals to tell dpc_thread to terminate (UNLOADING flag and kthread_stop). On setting the UNLOADING flag when dpc_thread happens to run at the time and sees the flag, this causes dpc_thread to exit and clean up itself. When kthread_stop is called for final cleanup, this causes use after free. Remove UNLOADING signal to terminate dpc_thread. Use the kthread_stop as the main signal to exit dpc_thread. [596663.812935] kernel BUG at mm/slub.c:294! [596663.812950] invalid opcode: 0000 [#1] SMP PTI [596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G IOE --------- - - 4.18.0-240.el8.x86_64 #1 [596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012 [596663.812974] RIP: 0010:__slab_free+0x17d/0x360 ... [596663.813008] Call Trace: [596663.813022] ? __dentry_kill+0x121/0x170 [596663.813030] ? _cond_resched+0x15/0x30 [596663.813034] ? _cond_resched+0x15/0x30 [596663.813039] ? wait_for_completion+0x35/0x190 [596663.813048] ? try_to_wake_up+0x63/0x540 [596663.813055] free_task+0x5a/0x60 [596663.813061] kthread_stop+0xf3/0x100 [596663.813103] qla2x00_remove_one+0x284/0x440 [qla2xxx] Cc: stable(a)vger.kernel.org Signed-off-by: Quinn Tran <qutran(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20241115130313.46826-3-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/scsi/qla2xxx/qla_os.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index 00b971d1c419..a6ecb4bb7456 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -6655,12 +6655,15 @@ qla2x00_do_dpc(void *data) set_user_nice(current, MIN_NICE); set_current_state(TASK_INTERRUPTIBLE); - while (!kthread_should_stop()) { + while (1) { ql_dbg(ql_dbg_dpc, base_vha, 0x4000, "DPC handler sleeping.\n"); schedule(); + if (kthread_should_stop()) + break; + if (test_and_clear_bit(DO_EEH_RECOVERY, &base_vha->dpc_flags)) qla_pci_set_eeh_busy(base_vha); @@ -6673,15 +6676,16 @@ qla2x00_do_dpc(void *data) goto end_loop; } + if (test_bit(UNLOADING, &base_vha->dpc_flags)) + /* don't do any work. Wait to be terminated by kthread_stop */ + goto end_loop; + ha->dpc_active = 1; ql_dbg(ql_dbg_dpc + ql_dbg_verbose, base_vha, 0x4001, "DPC handler waking up, dpc_flags=0x%lx.\n", base_vha->dpc_flags); - if (test_bit(UNLOADING, &base_vha->dpc_flags)) - break; - if (IS_P3P_TYPE(ha)) { if (IS_QLA8044(ha)) { if (test_and_clear_bit(ISP_UNRECOVERABLE, @@ -6999,9 +7003,6 @@ qla2x00_do_dpc(void *data) */ ha->dpc_active = 0; - /* Cleanup any residual CTX SRBs. */ - qla2x00_abort_all_cmds(base_vha, DID_NO_CONNECT << 16); - return 0; } -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
by Yu Kuai 04 Jan '25

04 Jan '25

From: Zhen Lei <thunder.leizhen(a)huawei.com> stable inclusion from stable-v6.6.64 commit 10a6fc486ac40a410f0fb84cc15161238eccd20a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGL CVE: CVE-2024-56747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 95bbdca4999bc59a72ebab01663d421d6ce5775d ] Hook "qedi_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.") Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Link: https://lore.kernel.org/r/20241026125711.484-3-thunder.leizhen@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/scsi/qedi/qedi_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c index cd0180b1f5b9..ede8d1f6ae23 100644 --- a/drivers/scsi/qedi/qedi_main.c +++ b/drivers/scsi/qedi/qedi_main.c @@ -369,6 +369,7 @@ static int qedi_alloc_and_init_sb(struct qedi_ctx *qedi, ret = qedi_ops->common->sb_init(qedi->cdev, sb_info, sb_virt, sb_phys, sb_id, QED_SB_TYPE_STORAGE); if (ret) { + dma_free_coherent(&qedi->pdev->dev, sizeof(*sb_virt), sb_virt, sb_phys); QEDI_ERR(&qedi->dbg_ctx, "Status block initialization failed for id = %d.\n", sb_id); -- 2.39.2

2 1

[PATCH OLK-5.10] scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
by Yu Kuai 04 Jan '25

04 Jan '25

From: Zhen Lei <thunder.leizhen(a)huawei.com> stable inclusion from stable-v5.10.231 commit a4d2011cbe039b25024831427b60ab91ee247066 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGL CVE: CVE-2024-56747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 95bbdca4999bc59a72ebab01663d421d6ce5775d ] Hook "qedi_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.") Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Link: https://lore.kernel.org/r/20241026125711.484-3-thunder.leizhen@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/scsi/qedi/qedi_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c index 96e470746767..3bf75d466b2c 100644 --- a/drivers/scsi/qedi/qedi_main.c +++ b/drivers/scsi/qedi/qedi_main.c @@ -371,6 +371,7 @@ static int qedi_alloc_and_init_sb(struct qedi_ctx *qedi, ret = qedi_ops->common->sb_init(qedi->cdev, sb_info, sb_virt, sb_phys, sb_id, QED_SB_TYPE_STORAGE); if (ret) { + dma_free_coherent(&qedi->pdev->dev, sizeof(*sb_virt), sb_virt, sb_phys); QEDI_ERR(&qedi->dbg_ctx, "Status block initialization failed for id = %d.\n", sb_id); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
by Yu Kuai 04 Jan '25

04 Jan '25

From: Zhen Lei <thunder.leizhen(a)huawei.com> stable inclusion from stable-v4.19.325 commit 4e48e5b26b3edc0e1dd329201ffc924a7a1f9337 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGL CVE: CVE-2024-56747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 95bbdca4999bc59a72ebab01663d421d6ce5775d ] Hook "qedi_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.") Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Link: https://lore.kernel.org/r/20241026125711.484-3-thunder.leizhen@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/scsi/qedi/qedi_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c index 756e0ccc37fb..04aa7953c0c4 100644 --- a/drivers/scsi/qedi/qedi_main.c +++ b/drivers/scsi/qedi/qedi_main.c @@ -357,6 +357,7 @@ static int qedi_alloc_and_init_sb(struct qedi_ctx *qedi, ret = qedi_ops->common->sb_init(qedi->cdev, sb_info, sb_virt, sb_phys, sb_id, QED_SB_TYPE_STORAGE); if (ret) { + dma_free_coherent(&qedi->pdev->dev, sizeof(*sb_virt), sb_virt, sb_phys); QEDI_ERR(&qedi->dbg_ctx, "Status block initialization failed for id = %d.\n", sb_id); -- 2.39.2

2 1

[PATCH OLK-6.6] blk-cgroup: Fix UAF in blkcg_unpin_online()
by Yu Kuai 04 Jan '25

04 Jan '25

From: Tejun Heo <tj(a)kernel.org> stable inclusion from stable-v6.6.67 commit 5baa28569c924d9a90d036c2aaab79f791fedaf8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAKO CVE: CVE-2024-56672 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 86e6ca55b83c575ab0f2e105cf08f98e58d3d7af upstream. blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF: ================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117 CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> ... Freed by task 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online(). Fix it by reading the parent pointer before destroying the blkcg's blkg's. Signed-off-by: Tejun Heo <tj(a)kernel.org> Reported-by: Abagail ren <renzezhongucas(a)gmail.com> Suggested-by: Linus Torvalds <torvalds(a)linuxfoundation.org> Fixes: 4308a434e5e0 ("blkcg: don't offline parent blkcg first") Cc: stable(a)vger.kernel.org # v5.7+ Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> --- block/blk-cgroup.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index cd3e8ac50fd0..7809546cd418 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1325,10 +1325,14 @@ void blkcg_unpin_online(struct cgroup_subsys_state *blkcg_css) struct blkcg *blkcg = css_to_blkcg(blkcg_css); do { + struct blkcg *parent; + if (!refcount_dec_and_test(&blkcg->online_pin)) break; + + parent = blkcg_parent(blkcg); blkcg_destroy_blkgs(blkcg); - blkcg = blkcg_parent(blkcg); + blkcg = parent; } while (blkcg); } -- 2.39.2

2 1

[PATCH OLK-5.10] nvme-pci: fix freeing of the HMB descriptor table
by Yu Kuai 04 Jan '25

04 Jan '25

From: Christoph Hellwig <hch(a)lst.de> stable inclusion from stable-v5.10.231 commit 452f9ddd12bebc04cef741e8ba3806bf0e1fd015 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGM CVE: CVE-2024-56756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a ] The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent. In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page. Fixes: 87ad72a59a38 ("nvme-pci: implement host memory buffer support") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/nvme/host/pci.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index da624c4f2a5f..b397370ba36a 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -147,6 +147,7 @@ struct nvme_dev { /* host memory buffer support: */ u64 host_mem_size; u32 nr_host_mem_descs; + u32 host_mem_descs_size; dma_addr_t host_mem_descs_dma; struct nvme_host_mem_buf_desc *host_mem_descs; void **host_mem_desc_bufs; @@ -1926,10 +1927,10 @@ static void nvme_free_host_mem(struct nvme_dev *dev) kfree(dev->host_mem_desc_bufs); dev->host_mem_desc_bufs = NULL; - dma_free_coherent(dev->dev, - dev->nr_host_mem_descs * sizeof(*dev->host_mem_descs), + dma_free_coherent(dev->dev, dev->host_mem_descs_size, dev->host_mem_descs, dev->host_mem_descs_dma); dev->host_mem_descs = NULL; + dev->host_mem_descs_size = 0; dev->nr_host_mem_descs = 0; } @@ -1937,7 +1938,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, u32 chunk_size) { struct nvme_host_mem_buf_desc *descs; - u32 max_entries, len; + u32 max_entries, len, descs_size; dma_addr_t descs_dma; int i = 0; void **bufs; @@ -1950,8 +1951,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries) max_entries = dev->ctrl.hmmaxd; - descs = dma_alloc_coherent(dev->dev, max_entries * sizeof(*descs), - &descs_dma, GFP_KERNEL); + descs_size = max_entries * sizeof(*descs); + descs = dma_alloc_coherent(dev->dev, descs_size, &descs_dma, + GFP_KERNEL); if (!descs) goto out; @@ -1980,6 +1982,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, dev->host_mem_size = size; dev->host_mem_descs = descs; dev->host_mem_descs_dma = descs_dma; + dev->host_mem_descs_size = descs_size; dev->host_mem_desc_bufs = bufs; return 0; @@ -1994,8 +1997,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, kfree(bufs); out_free_descs: - dma_free_coherent(dev->dev, max_entries * sizeof(*descs), descs, - descs_dma); + dma_free_coherent(dev->dev, descs_size, descs, descs_dma); out: dev->host_mem_descs = NULL; return -ENOMEM; -- 2.39.2

2 1

[PATCH OLK-6.6] blk-cgroup: Fix UAF in blkcg_unpin_online()
by Yu Kuai 04 Jan '25

04 Jan '25

From: Tejun Heo <tj(a)kernel.org> stable inclusion from stable-v6.6.67 commit 5baa28569c924d9a90d036c2aaab79f791fedaf8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAKO CVE: CVE-2024-56672 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 86e6ca55b83c575ab0f2e105cf08f98e58d3d7af upstream. blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF: ================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117 CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> ... Freed by task 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online(). Fix it by reading the parent pointer before destroying the blkcg's blkg's. Signed-off-by: Tejun Heo <tj(a)kernel.org> Reported-by: Abagail ren <renzezhongucas(a)gmail.com> Suggested-by: Linus Torvalds <torvalds(a)linuxfoundation.org> Fixes: 4308a434e5e0 ("blkcg: don't offline parent blkcg first") Cc: stable(a)vger.kernel.org # v5.7+ Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> --- block/blk-cgroup.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index cd3e8ac50fd0..7809546cd418 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1325,10 +1325,14 @@ void blkcg_unpin_online(struct cgroup_subsys_state *blkcg_css) struct blkcg *blkcg = css_to_blkcg(blkcg_css); do { + struct blkcg *parent; + if (!refcount_dec_and_test(&blkcg->online_pin)) break; + + parent = blkcg_parent(blkcg); blkcg_destroy_blkgs(blkcg); - blkcg = blkcg_parent(blkcg); + blkcg = parent; } while (blkcg); } -- 2.39.2

2 1

[PATCH OLK-5.10 0/1] CVE-2024-56701
by Liao Chen 04 Jan '25

04 Jan '25

fix CVE-2024-56701 Michael Ellerman (1): powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore arch/powerpc/include/asm/dtl.h | 4 ++-- arch/powerpc/platforms/pseries/dtl.c | 8 ++++---- arch/powerpc/platforms/pseries/lpar.c | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] blk-cgroup: Fix UAF in blkcg_unpin_online()
by Yu Kuai 04 Jan '25

04 Jan '25

From: Tejun Heo <tj(a)kernel.org> mainline inclusion from mainline-v6.13-rc3 commit 86e6ca55b83c575ab0f2e105cf08f98e58d3d7af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAKO CVE: CVE-2024-56672 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF: ================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117 CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> ... Freed by task 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online(). Fix it by reading the parent pointer before destroying the blkcg's blkg's. Signed-off-by: Tejun Heo <tj(a)kernel.org> Reported-by: Abagail ren <renzezhongucas(a)gmail.com> Suggested-by: Linus Torvalds <torvalds(a)linuxfoundation.org> Fixes: 4308a434e5e0 ("blkcg: don't offline parent blkcg first") Cc: stable(a)vger.kernel.org # v5.7+ Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: include/linux/blk-cgroup.h block/blk-cgroup.c [blkcg_unpin_online() is inline function defined in blk-cgroup.h] Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- include/linux/blk-cgroup.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h index 1fe9574b4a77..0c14b195c0c2 100644 --- a/include/linux/blk-cgroup.h +++ b/include/linux/blk-cgroup.h @@ -425,10 +425,14 @@ static inline void blkcg_pin_online(struct blkcg *blkcg) static inline void blkcg_unpin_online(struct blkcg *blkcg) { do { + struct blkcg *parent; + if (!refcount_dec_and_test(&blkcg->online_pin)) break; + + parent = blkcg_parent(blkcg); blkcg_destroy_blkgs(blkcg); - blkcg = blkcg_parent(blkcg); + blkcg = parent; } while (blkcg); } -- 2.39.2

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56701
by Liao Chen 04 Jan '25

04 Jan '25

fix CVE-2024-56701 Michael Ellerman (1): powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore arch/powerpc/include/asm/dtl.h | 4 ++-- arch/powerpc/platforms/pseries/dtl.c | 8 ++++---- arch/powerpc/platforms/pseries/lpar.c | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
by Yu Kuai 04 Jan '25

04 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.325 commit 3993edf44d3df7b6e8c753eac6ac8783473fcbab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFS CVE: CVE-2024-56531 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c ] The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. This patch also splits the code to the disconnect and the free phases; the former is called immediately at the USB disconnect callback while the latter is called from the card destructor. Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://patch.msgid.link/20241113111042.15058-5-tiwai@suse.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> --- sound/usb/caiaq/audio.c | 10 ++++++++-- sound/usb/caiaq/audio.h | 1 + sound/usb/caiaq/device.c | 19 +++++++++++++++---- sound/usb/caiaq/input.c | 12 +++++++++--- sound/usb/caiaq/input.h | 1 + 5 files changed, 34 insertions(+), 9 deletions(-) diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c index c6108a3d7f8f..9c6a2295d45a 100644 --- a/sound/usb/caiaq/audio.c +++ b/sound/usb/caiaq/audio.c @@ -890,14 +890,20 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev) return 0; } -void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev) +void snd_usb_caiaq_audio_disconnect(struct snd_usb_caiaqdev *cdev) { struct device *dev = caiaqdev_to_dev(cdev); dev_dbg(dev, "%s(%p)\n", __func__, cdev); stream_stop(cdev); +} + +void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev) +{ + struct device *dev = caiaqdev_to_dev(cdev); + + dev_dbg(dev, "%s(%p)\n", __func__, cdev); free_urbs(cdev->data_urbs_in); free_urbs(cdev->data_urbs_out); kfree(cdev->data_cb_info); } - diff --git a/sound/usb/caiaq/audio.h b/sound/usb/caiaq/audio.h index 869bf6264d6a..07f5d064456c 100644 --- a/sound/usb/caiaq/audio.h +++ b/sound/usb/caiaq/audio.h @@ -3,6 +3,7 @@ #define CAIAQ_AUDIO_H int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev); +void snd_usb_caiaq_audio_disconnect(struct snd_usb_caiaqdev *cdev); void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev); #endif /* CAIAQ_AUDIO_H */ diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index d55ca48de3ea..4df7f37aa670 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -402,6 +402,17 @@ static void setup_card(struct snd_usb_caiaqdev *cdev) dev_err(dev, "Unable to set up control system (ret=%d)\n", ret); } +static void card_free(struct snd_card *card) +{ + struct snd_usb_caiaqdev *cdev = caiaqdev(card); + +#ifdef CONFIG_SND_USB_CAIAQ_INPUT + snd_usb_caiaq_input_free(cdev); +#endif + snd_usb_caiaq_audio_free(cdev); + usb_reset_device(cdev->chip.dev); +} + static int create_card(struct usb_device *usb_dev, struct usb_interface *intf, struct snd_card **cardp) @@ -515,6 +526,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) cdev->vendor_name, cdev->product_name, usbpath); setup_card(cdev); + card->private_free = card_free; return 0; err_kill_urb: @@ -560,15 +572,14 @@ static void snd_disconnect(struct usb_interface *intf) snd_card_disconnect(card); #ifdef CONFIG_SND_USB_CAIAQ_INPUT - snd_usb_caiaq_input_free(cdev); + snd_usb_caiaq_input_disconnect(cdev); #endif - snd_usb_caiaq_audio_free(cdev); + snd_usb_caiaq_audio_disconnect(cdev); usb_kill_urb(&cdev->ep1_in_urb); usb_kill_urb(&cdev->midi_out_urb); - snd_card_free(card); - usb_reset_device(interface_to_usbdev(intf)); + snd_card_free_when_closed(card); } diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c index e883659ea6e7..3adaf35b0c15 100644 --- a/sound/usb/caiaq/input.c +++ b/sound/usb/caiaq/input.c @@ -841,15 +841,21 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev) return ret; } -void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev) +void snd_usb_caiaq_input_disconnect(struct snd_usb_caiaqdev *cdev) { if (!cdev || !cdev->input_dev) return; usb_kill_urb(cdev->ep4_in_urb); + input_unregister_device(cdev->input_dev); +} + +void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev) +{ + if (!cdev || !cdev->input_dev) + return; + usb_free_urb(cdev->ep4_in_urb); cdev->ep4_in_urb = NULL; - - input_unregister_device(cdev->input_dev); cdev->input_dev = NULL; } diff --git a/sound/usb/caiaq/input.h b/sound/usb/caiaq/input.h index c42891e7be88..fbe267f85d02 100644 --- a/sound/usb/caiaq/input.h +++ b/sound/usb/caiaq/input.h @@ -4,6 +4,7 @@ void snd_usb_caiaq_input_dispatch(struct snd_usb_caiaqdev *cdev, char *buf, unsigned int len); int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev); +void snd_usb_caiaq_input_disconnect(struct snd_usb_caiaqdev *cdev); void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev); #endif -- 2.39.2

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56701
by Liao Chen 04 Jan '25

04 Jan '25

fix CVE-2024-56701 Michael Ellerman (1): powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore arch/powerpc/include/asm/dtl.h | 4 ++-- arch/powerpc/platforms/pseries/dtl.c | 8 ++++---- arch/powerpc/platforms/pseries/lpar.c | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] RDMA/mlx5: Move events notifier registration to be after device registration
by Pu Lehui 04 Jan '25

04 Jan '25

From: Patrisious Haddad <phaddad(a)nvidia.com> stable inclusion from stable-v6.6.64 commit 921fcf2971a1e8d3b904ba2c2905b96f4ec3d4ad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADY CVE: CVE-2024-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 ] Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]--- Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Michael Guralnik <michaelgur(a)nvidia.com> Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.173149694… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 40 +++++++++++++--------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- 2 files changed, 20 insertions(+), 22 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index bc38af6cda6e..c510484e024b 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2899,7 +2899,6 @@ int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev) static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; int ret; if (!MLX5_CAP_GEN(dev->mdev, xrc)) @@ -2915,10 +2914,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) return ret; } - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - INIT_WORK(&devr->ports[port].pkey_change_work, - pkey_change_handler); - mutex_init(&devr->cq_lock); mutex_init(&devr->srq_lock); @@ -2928,16 +2923,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; - - /* - * Make sure no change P_Key work items are still executing. - * - * At this stage, the mlx5_ib_event should be unregistered - * and it ensures that no new works are added. - */ - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - cancel_work_sync(&devr->ports[port].pkey_change_work); /* After s0/s1 init, they are not unset during the device lifetime. */ if (devr->s1) { @@ -4201,6 +4186,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev) static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + INIT_WORK(&devr->ports[port].pkey_change_work, + pkey_change_handler); + dev->mdev_events.notifier_call = mlx5_ib_event; mlx5_notifier_register(dev->mdev, &dev->mdev_events); @@ -4211,8 +4203,14 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + mlx5r_macsec_event_unregister(dev); mlx5_notifier_unregister(dev->mdev, &dev->mdev_events); + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + cancel_work_sync(&devr->ports[port].pkey_change_work); } void __mlx5_ib_remove(struct mlx5_ib_dev *dev, @@ -4286,9 +4284,6 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_ODP, mlx5_ib_odp_init_one, mlx5_ib_odp_cleanup_one), @@ -4313,6 +4308,9 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), @@ -4349,9 +4347,6 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_COUNTERS, mlx5_ib_counters_init, mlx5_ib_counters_cleanup), @@ -4373,6 +4368,9 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h index 1c83d132197f..94678e5c59dd 100644 --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -954,7 +954,6 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_QP, MLX5_IB_STAGE_SRQ, MLX5_IB_STAGE_DEVICE_RESOURCES, - MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_ODP, MLX5_IB_STAGE_COUNTERS, MLX5_IB_STAGE_CONG_DEBUGFS, @@ -963,6 +962,7 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_PRE_IB_REG_UMR, MLX5_IB_STAGE_WHITELIST_UID, MLX5_IB_STAGE_IB_REG, + MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_POST_IB_REG_UMR, MLX5_IB_STAGE_DELAY_DROP, MLX5_IB_STAGE_RESTRACK, -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2024-56702
by Pu Lehui 04 Jan '25

04 Jan '25

From: Pu Lehui <pulehui(a)huaweicloud.com> Kumar Kartikeya Dwivedi (3): bpf: Mark raw_tp arguments with PTR_MAYBE_NULL bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL" bpf: Augment raw_tp arguments with PTR_MAYBE_NULL kernel/bpf/btf.c | 138 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 138 insertions(+) -- 2.34.1

2 4

[PATCH OLK-6.6 0/1] Fix CVE-2024-56744
by Hongbo Li 04 Jan '25

04 Jan '25

Fix CVE-2024-56744. Chao Yu (1): f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() fs/f2fs/checkpoint.c | 2 +- fs/f2fs/f2fs.h | 3 +-- fs/f2fs/super.c | 13 +++++++------ 3 files changed, 9 insertions(+), 9 deletions(-) -- 2.34.1

2 2

[openeuler:OLK-5.10 2597/2597] kernel/watchdog_hld.c:502:12: sparse: sparse: symbol '__hardlockup_detector_perf_init' was not declared. Should it be static?
by kernel test robot 04 Jan '25

04 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d51fb86ce6a3a3e59d7cba58738b63903b8cb37c commit: 364de98eacea8dbfe4f926f62085aebf8534f403 [2597/2597] watchdog: Fix sleeping function called from atomic context config: x86_64-randconfig-123-20241225 (https://download.01.org/0day-ci/archive/20250104/202501040718.qdbBTetA-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250104/202501040718.qdbBTetA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501040718.qdbBTetA-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/watchdog_hld.c:502:12: sparse: sparse: symbol '__hardlockup_detector_perf_init' was not declared. Should it be static? vim +/__hardlockup_detector_perf_init +502 kernel/watchdog_hld.c 501 > 502 int __init __hardlockup_detector_perf_init(void *not_used) 503 { 504 int ret = hardlockup_detector_event_create(); 505 506 if (ret) { 507 pr_info("Perf NMI watchdog permanently disabled\n"); 508 } else { 509 perf_event_release_kernel(this_cpu_read(watchdog_ev)); 510 this_cpu_write(watchdog_ev, NULL); 511 } 512 return ret; 513 } 514 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2610/2610] mm/vmscan.c:4737 get_swapcache_reclaim_num() warn: unsigned 'swapcache_watermark[0]' is never less than zero.
by kernel test robot 04 Jan '25

04 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d51fb86ce6a3a3e59d7cba58738b63903b8cb37c commit: abfd8691d951fb037506e1ee52ed39abee8430fa [2610/2610] etmem: add swapcache reclaim to etmem config: x86_64-randconfig-161-20241231 (https://download.01.org/0day-ci/archive/20250104/202501040621.5WmwOLsx-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501040621.5WmwOLsx-lkp@intel.com/ smatch warnings: mm/vmscan.c:4737 get_swapcache_reclaim_num() warn: unsigned 'swapcache_watermark[0]' is never less than zero. vim +4737 mm/vmscan.c 4733 4734 static unsigned long get_swapcache_reclaim_num(unsigned long *swapcache_watermark) 4735 { 4736 return total_swapcache_pages() > > 4737 swapcache_watermark[ETMEM_SWAPCACHE_WMARK_LOW] ? 4738 (total_swapcache_pages() - swapcache_watermark[ETMEM_SWAPCACHE_WMARK_LOW]) : 0; 4739 } 4740 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 604e996dd0189ddb0875f389b87fa2084b3a9424
by kernel test robot 04 Jan '25

04 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 604e996dd0189ddb0875f389b87fa2084b3a9424 !14475 ext4: correct behaviors under errors=remount-ro mode Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501031701.nFiZOCS8-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501031900.rHaRpOIu-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501031919.9n6qbVhX-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501032032.1nlRwHlW-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501032202.oO79Fo9u-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501032224.CjyqUkQC-lkp@intel.com arch/x86/kernel/cpu/hygon.c:480:6: warning: no previous prototype for 'set_c86_features_para_invalid' [-Wmissing-prototypes] arch/x86/kernel/cpu/hygon.c:485:14: warning: no previous prototype for 'get_nt_block_copy_mini_len' [-Wmissing-prototypes] arch/x86/kernel/fpu/core.c:466:14: warning: no previous prototype for 'get_fpustate_free_space' [-Wmissing-prototypes] arch/x86/kvm/svm/sev.c:2200:18: error: no member named 'false' in 'struct hygon_kvm_hooks_table' arch/x86/kvm/svm/sev.c:2200:32: error: cannot take the address of an rvalue of type 'int' drivers/i2c/busses/i2c-zhaoxin-smbus.c:367:36: warning: 'zxsmb_acpi_match' defined but not used [-Wunused-const-variable=] drivers/net/ethernet/nebula-matrix/nbl/nbl_core.o: warning: objtool: .text.nbl_dev_start_user_dev: unexpected end of section drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c:458:6: error: incompatible integer to pointer conversion assigning to 'struct eventfd_ctx *' from 'int' [-Wint-conversion] drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c:458:8: error: call to undeclared function 'eventfd_ctx_fileget'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] fs/jffs2/jffs2.o: warning: objtool: .text.jffs2_erase_pending_blocks: unexpected end of section Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 |-- arm64-randconfig-r111-20241227 | |-- drivers-i2c-busses-i2c-zhaoxin-smbus.c:warning:zxsmb_acpi_match-defined-but-not-used | `-- fs-proc-etmem_scan.c:sparse:sparse:cast-removes-address-space-__rcu-of-expression |-- loongarch-allmodconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:mq-poll-directive-output-may-be-truncated-writing-bytes-into-a-region-of-size-between-and | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:implicit-declaration-of-function-pmd_mkhuge | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-allyesconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:mq-poll-directive-output-may-be-truncated-writing-bytes-into-a-region-of-size-between-and | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-randconfig-r112-20250103 | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-unsigned-int-noderef-__percpu | |-- arch-loongarch-kvm-tlb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu | |-- arch-loongarch-kvm-tlb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-unsigned-int-noderef-__percpu | |-- arch-loongarch-kvm-vcpu.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu | |-- arch-loongarch-kvm-vcpu.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-unsigned-int-noderef-__percpu | |-- drivers-gpu-drm-loongson-ast_old-ast_mode.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | `-- drivers-gpu-drm-loongson-ast_old-ast_mode.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-dstxor-got-unsigned-char-usertype |-- loongarch-randconfig-r131-20241226 | |-- arch-loongarch-kernel-legacy_boot.c:sparse:sparse:symbol-pchlpc_default-was-not-declared.-Should-it-be-static | `-- kernel-trace-trace.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu |-- x86_64-allnoconfig | |-- drivers-scsi-leapioraid-leapioraid_app.c:leapioraid_func.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-VFIO_MDEV-when-selected-by-CRYPTO_DEV_HCT | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-get_nt_block_copy_mini_len | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-set_c86_features_para_invalid | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpustate_free_space | |-- arch-x86-kvm-svm-csv.c:warning:no-previous-prototype-for-function-csv_vm_attestation | |-- arch-x86-kvm-svm-sev.c:warning:no-previous-prototype-for-function-sev_install_hooks | |-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-dcn30-display_mode_vba_30.c:warning:stack-frame-size-()-exceeds-limit-()-in-dml30_ModeSupportAndSystemConfigurationFull | |-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_setup_strp | `-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_stream_read |-- x86_64-buildonly-randconfig-002-20250103 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-004-20250103 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-006-20250103 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-randconfig-102-20241227 | |-- arch-x86-kvm-svm-sev.c:error:cannot-take-the-address-of-an-rvalue-of-type-int | `-- arch-x86-kvm-svm-sev.c:error:no-member-named-false-in-struct-hygon_kvm_hooks_table |-- x86_64-randconfig-103-20241226 | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_dev_user.c:error:call-to-undeclared-function-eventfd_ctx_fileget-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_dev_user.c:error:incompatible-integer-to-pointer-conversion-assigning-to-struct-eventfd_ctx-from-int |-- x86_64-randconfig-103-20250103 | `-- fs-jffs2-jffs2.o:warning:objtool:.text.jffs2_erase_pending_blocks:unexpected-end-of-section |-- x86_64-randconfig-121-20250101 | |-- arch-x86-kernel-cpu-hygon.c:sparse:sparse:symbol-hygon_c86_attr_group-was-not-declared.-Should-it-be-static | |-- arch-x86-kernel-cpu-hygon.c:sparse:sparse:symbol-set_c86_features_para_invalid-was-not-declared.-Should-it-be-static | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-get_nt_block_copy_mini_len | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-set_c86_features_para_invalid | |-- arch-x86-kernel-fpu-core.c:sparse:sparse:symbol-get_fpustate_free_space-was-not-declared.-Should-it-be-static | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-get_fpustate_free_space | `-- mm-dynamic_pool.c:sparse:sparse:symbol-pagelist_dpool_ops-was-not-declared.-Should-it-be-static `-- x86_64-randconfig-123-20241226 |-- arch-x86-kernel-zhaoxin_kh40000.c:sparse:sparse:symbol-kh40000_dma_direct_ops-was-not-declared.-Should-it-be-static |-- drivers-iommu-amd-iommu.c:sparse:sparse:symbol-amd_dirty_ops-was-not-declared.-Should-it-be-static `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.o:warning:objtool:.text.nbl_dev_start_user_dev:unexpected-end-of-section elapsed time: 722m configs tested: 19 configs skipped: 124 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250103 clang-19 arm64 randconfig-002-20250103 clang-20 arm64 randconfig-003-20250103 clang-19 arm64 randconfig-004-20250103 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250103 gcc-14.2.0 loongarch randconfig-002-20250103 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250103 gcc-12 x86_64 buildonly-randconfig-002-20250103 clang-19 x86_64 buildonly-randconfig-003-20250103 gcc-12 x86_64 buildonly-randconfig-004-20250103 clang-19 x86_64 buildonly-randconfig-005-20250103 clang-19 x86_64 buildonly-randconfig-006-20250103 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION d51fb86ce6a3a3e59d7cba58738b63903b8cb37c
by kernel test robot 04 Jan '25

04 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: d51fb86ce6a3a3e59d7cba58738b63903b8cb37c !14366 EDAC/bluefield: Fix potential integer overflow Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501031923.x0AUCg7R-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501040206.QD8GJyq4-lkp@intel.com https://lore.kernel.org/oe-kbuild/202501031939.oFEiUJOt-lkp@intel.com fs/btrfs/tree-log.o: warning: objtool: btrfs_log_holes()+0x28e: unreachable instruction fs/cachefiles/xattr.c:221:5: warning: no previous prototype for 'cachefiles_check_old_object_xattr' [-Wmissing-prototypes] kernel/sched/core.o: warning: objtool: sched_set_fifo()+0x4b: unreachable instruction ld: mm/vmscan.c:3467: undefined reference to `kernel_swap_enabled' mm/memcontrol.c:4167:5: warning: no previous prototype for 'memcg_swapmax_read' [-Wmissing-prototypes] mm/vmscan.c:3467: undefined reference to `kernel_swap_enabled' Unverified Error/Warning (likely false positive, kindly check if interested): arch/arm64/kernel/mpam/mpam_device.c:1838:1-33: WARNING: Function "for_each_available_child_of_node" should have of_node_put() before break around line 1841. drivers/iio/temperature/ltc2983.c:396 __ltc2983_custom_sensor_new() warn: assigning (-38) to unsigned variable 'n_entries' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-001-20250103 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-002-20250103 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20250103 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-004-20241230 | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr |-- arm64-randconfig-r052-20250101 | |-- arch-arm64-kernel-mpam-mpam_device.c:WARNING:Function-for_each_available_child_of_node-should-have-of_node_put()-before-break-around-line-. | `-- mm-memcontrol.c:warning:no-previous-prototype-for-memcg_swapmax_read |-- arm64-randconfig-r133-20241227 | |-- arch-arm64-include-asm-cmpxchg.h:sparse:sparse:cast-truncates-bits-from-constant-value-(3fff-becomes-ff) | |-- arch-arm64-mm-init.c:sparse:sparse:symbol-ascend_enable_all_features-was-not-declared.-Should-it-be-static | |-- mm-clear_freelist_page.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | `-- mm-clear_freelist_page.c:sparse:sparse:incorrect-type-in-initializer-(incompatible-argument-(different-address-spaces))-expected-int-(-usertype-proc_handler-)(-...-)-got-int-(-)(-...-) |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:address-of-array-chip_node-rt_cmd-will-always-evaluate-to-true | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-hashlen_t-is-a-C11-feature | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-page_info_t-is-a-C11-feature | `-- fs-eulerfs-namei.c:warning:variable-de-is-uninitialized-when-used-here |-- x86_64-buildonly-randconfig-001-20250103 | `-- sound-soc-rockchip-rockchip_spdif.c:warning:rk_spdif_match-defined-but-not-used |-- x86_64-buildonly-randconfig-002-20250103 | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20241230 | `-- fs-btrfs-tree-log.o:warning:objtool:btrfs_log_holes:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20250103 | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250103 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20250103 | `-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union |-- x86_64-defconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | `-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp |-- x86_64-randconfig-101-20241228 | `-- kernel-stackleak.c:opportunity-for-str_enabled_disabled(state) |-- x86_64-randconfig-104-20241225 | `-- kernel-sched-core.o:warning:objtool:sched_set_fifo:unreachable-instruction |-- x86_64-randconfig-121-20241228 | |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-from-restricted-__virtio16 | `-- drivers-vdpa-vdpa.c:sparse:sparse:cast-to-restricted-__le16 `-- x86_64-randconfig-161-20241231 |-- drivers-iio-temperature-ltc2983.c-__ltc2983_custom_sensor_new()-warn:assigning-to-unsigned-variable-n_entries |-- ld:mm-vmscan.c:undefined-reference-to-kernel_swap_enabled `-- mm-vmscan.c:undefined-reference-to-kernel_swap_enabled elapsed time: 726m configs tested: 15 configs skipped: 118 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250103 clang-19 arm64 randconfig-002-20250103 clang-20 arm64 randconfig-003-20250103 clang-19 arm64 randconfig-004-20250103 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250103 gcc-12 x86_64 buildonly-randconfig-002-20250103 clang-19 x86_64 buildonly-randconfig-003-20250103 gcc-12 x86_64 buildonly-randconfig-004-20250103 clang-19 x86_64 buildonly-randconfig-005-20250103 clang-19 x86_64 buildonly-randconfig-006-20250103 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 21eb7b92f86861232fed9eff3c46634d7535ef8a
by kernel test robot 04 Jan '25

04 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 21eb7b92f86861232fed9eff3c46634d7535ef8a !14500 sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK Error/Warning (recently discovered and may have been fixed): block/blk-io-hierarchy/debugfs.c:63:2: error: implicit declaration of function 'hierarchy_show_slow_io' [-Werror,-Wimplicit-function-declaration] drivers/char/hw_random/phytium-rng.c:137:34: warning: unused variable 'phytium_rng_dt_ids' [-Wunused-const-variable] fs/debugfs/file.o: warning: objtool: full_proxy_open()+0x55a: unreachable instruction kernel/bpf/verifier.o: warning: objtool: missing symbol for section .text Unverified Error/Warning (likely false positive, kindly check if interested): drivers/dma/ti/edma.c:1962:35-51: opportunity for str_yes_no(ecc -> chmap_exist) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250103 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250103 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20250103 | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250103 | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-r054-20241226 | `-- drivers-dma-ti-edma.c:opportunity-for-str_yes_no(ecc-chmap_exist) |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-net-ethernet-hisilicon-hns3-hns3_extension-hns3_enet_it.c:warning:no-previous-prototype-for-function-hns3_nic_select_queue_it | `-- samples-vfio-mdev-.tmp_mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20241231 | |-- block-blk-io-hierarchy-debugfs.c:error:implicit-declaration-of-function-hierarchy_show_slow_io-Werror-Wimplicit-function-declaration | `-- drivers-char-hw_random-phytium-rng.c:warning:unused-variable-phytium_rng_dt_ids |-- x86_64-buildonly-randconfig-001-20250103 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-002-20250103 | |-- arch-x86-kernel-unwind_orc.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-bcma-driver_chipcommon_pflash.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-input-rmi4-rmi_2d_sensor.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pci-ats.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-gcov-base.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | |-- net-ipv4-metrics.o:warning:objtool:missing-symbol-for-section-.text | |-- net-ipv4-netlink.o:warning:objtool:missing-symbol-for-section-.text | |-- net-tls-tls_device.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-drivers-opl3-opl3_synth.o:warning:objtool:missing-symbol-for-section-.text | `-- sound-drivers-vx-vx_core.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20250103 | |-- arch-x86-kernel-idt.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-bcma-driver_chipcommon_pflash.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-hwtracing-intel_th-debug.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-input-rmi4-rmi_2d_sensor.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-usb-dwc2-hcd_ddma.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-bpf-verifier.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-sparse.o:warning:objtool:missing-symbol-for-section-.init.text | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-004-20250103 | |-- arch-x86-events-zhaoxin-core.c:warning:attribute-declaration-must-precede-definition | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250103 | |-- drivers-bcma-driver_chipcommon_pflash.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-char-ipmi-kcs_bmc_npcm7xx.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-fme-mgr.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-nouveau-dispnv50-base.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-core.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-core507d.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-curs.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-oimm.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-oimm507b.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-ovly.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-dispnv50-wimm.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvif-disp.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvif-fifo.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvif-user.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvkm-engine-disp-hdmigv100.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvkm-engine-gr-ctxgf117.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-leds-leds-lm3601x.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-video-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-tuners-qm1d1b0004.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-mtd-nand-spi-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pci-hotplug-pciehp_core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pci-pcie-dpc.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-video-backlight-otm3225a.o:warning:objtool:missing-symbol-for-section-.init.text | |-- kernel-sched-pelt.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | |-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-drivers-opl3-opl3_midi.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-drivers-opl3-opl3_seq.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-drivers-opl3-opl3_synth.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-firewire-dice-dice-alesis.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-firewire-dice-dice-extension.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-firewire-dice-dice-mytek.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-firewire-dice-dice-tcelectronic.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-soc-codecs-rt1305.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-soc-codecs-rt5668.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-soc-codecs-ssm2305.o:warning:objtool:missing-symbol-for-section-.init.text | `-- sound-soc-codecs-tscs454.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20250103 | |-- drivers-crypto-ccree-cc_hash.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-fme-mgr.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-fme-region.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-cdns-dsi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-nouveau-nvif-fifo.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvif-user.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-nouveau-nvkm-engine-disp-hdmigv100.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-panel-panel-ilitek-ili9881c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-ad5696-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-ti-dac5571.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-leds-leds-lm3601x.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-tuners-qm1d1b0004.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-xen-mem-reservation.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- kernel-sched-pelt.o:warning:objtool:missing-symbol-for-section-.text | |-- net-ipv4-metrics.o:warning:objtool:missing-symbol-for-section-.text | `-- net-ipv4-netlink.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-randconfig-101-20250103 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-102-20250103 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-103-20250103 | `-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace |-- x86_64-randconfig-104-20250103 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-121-20250103 | |-- drivers-video-fbdev-ssd1307fb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-to-got-unsigned-char-noderef-usertype-__iomem-dst | |-- drivers-video-fbdev-ssd1307fb.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-dst-got-void | |-- drivers-video-fbdev-ssd1307fb.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-char-usertype-vmem-got-char-noderef-__iomem-screen_base | |-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_get_timespec64-was-not-declared.-Should-it-be-static | |-- kernel-time-time.c:sparse:sparse:symbol-__compat_put_timespec64-was-not-declared.-Should-it-be-static | |-- lib-kobject.c:sparse:sparse:symbol-kset_get_ownership-was-not-declared.-Should-it-be-static | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | |-- net-core-sock.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-socket_wq-noderef-__rcu-sk_wq-got-struct-socket_wq-wq | |-- net-ipv4-route.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be16-usertype-len-got-unsigned-long | `-- net-mac80211-rx.c:sparse:sparse:dubious:x-y |-- x86_64-randconfig-122-20241226 | `-- fs-debugfs-file.o:warning:objtool:full_proxy_open:unreachable-instruction |-- x86_64-randconfig-122-20250103 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-123-20250103 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20250103 |-- block-blk-io-hierarchy-debugfs.c:error:implicit-declaration-of-function-hierarchy_show_slow_io-Werror-Wimplicit-function-declaration |-- drivers-gpu-drm-nouveau-nvkm-subdev-clk-nv50.o:warning:objtool:nv50_clk_read:can-t-find-switch-jump-table |-- drivers-gpu-drm-nouveau-nvkm-subdev-therm-temp.o:warning:objtool:nvkm_therm_sensor_event:can-t-find-switch-jump-table |-- drivers-media-i2c-saa7115.o:warning:objtool:saa711x_querystd:can-t-find-switch-jump-table |-- drivers-of-dynamic.o:warning:objtool:of_reconfig_get_state_change:can-t-find-switch-jump-table |-- fs-select.o:warning:objtool:poll_select_finish:can-t-find-switch-jump-table |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 721m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250103 gcc-14.2.0 arm64 randconfig-002-20250103 gcc-14.2.0 arm64 randconfig-003-20250103 gcc-14.2.0 arm64 randconfig-004-20250103 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250103 gcc-12 x86_64 buildonly-randconfig-002-20250103 clang-19 x86_64 buildonly-randconfig-003-20250103 gcc-12 x86_64 buildonly-randconfig-004-20250103 clang-19 x86_64 buildonly-randconfig-005-20250103 clang-19 x86_64 buildonly-randconfig-006-20250103 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2601/2601] drivers/vdpa/vdpa.c:759:19: sparse: sparse: cast to restricted __le16
by kernel test robot 04 Jan '25

04 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d51fb86ce6a3a3e59d7cba58738b63903b8cb37c commit: 661b972e802c8e252911361538651db906c084bb [2601/2601] vdpa: Introduce query of device config layout config: x86_64-randconfig-121-20241228 (https://download.01.org/0day-ci/archive/20250104/202501040206.QD8GJyq4-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250104/202501040206.QD8GJyq4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501040206.QD8GJyq4-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/vdpa/vdpa.c:759:19: sparse: sparse: cast to restricted __le16 >> drivers/vdpa/vdpa.c:759:19: sparse: sparse: cast from restricted __virtio16 drivers/vdpa/vdpa.c:775:19: sparse: sparse: cast to restricted __le16 drivers/vdpa/vdpa.c:775:19: sparse: sparse: cast from restricted __virtio16 drivers/vdpa/vdpa.c:779:19: sparse: sparse: cast to restricted __le16 drivers/vdpa/vdpa.c:779:19: sparse: sparse: cast from restricted __virtio16 vim +759 drivers/vdpa/vdpa.c 749 750 static int vdpa_dev_net_mq_config_fill(struct vdpa_device *vdev, 751 struct sk_buff *msg, u64 features, 752 const struct virtio_net_config *config) 753 { 754 u16 val_u16; 755 756 if ((features & (1ULL << VIRTIO_NET_F_MQ)) == 0) 757 return 0; 758 > 759 val_u16 = le16_to_cpu(config->max_virtqueue_pairs); 760 return nla_put_u16(msg, VDPA_ATTR_DEV_NET_CFG_MAX_VQP, val_u16); 761 } 762 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1693/1693] fs/jffs2/jffs2.o: warning: objtool: .text.jffs2_erase_pending_blocks: unexpected end of section
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 604e996dd0189ddb0875f389b87fa2084b3a9424 commit: 349fde599db65d4827820ef6553e3f9ee75b8c7c [1693/1693] arch: enable HAS_LTO_CLANG with KASAN and KCOV config: x86_64-randconfig-103-20250103 (https://download.01.org/0day-ci/archive/20250103/202501032202.oO79Fo9u-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250103/202501032202.oO79Fo9u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501032202.oO79Fo9u-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/jffs2/jffs2.o: warning: objtool: .text.jffs2_erase_pending_blocks: unexpected end of section -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1693/1693] arch/loongarch/kvm/vcpu.c:224:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 03 Jan '25

03 Jan '25

Hi Song, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 604e996dd0189ddb0875f389b87fa2084b3a9424 commit: 031d5914323febe9668956dfa7fe8443b7dc597c [1693/1693] LoongArch: KVM: Add PMU support for guest config: loongarch-randconfig-r112-20250103 (https://download.01.org/0day-ci/archive/20250103/202501032224.CjyqUkQC-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250103/202501032224.CjyqUkQC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501032224.CjyqUkQC-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/loongarch/kvm/vcpu.c:17:49: sparse: sparse: array of flexible structures arch/loongarch/kvm/vcpu.c: note: in included file: include/linux/kvm_host.h:2045:56: sparse: sparse: array of flexible structures arch/loongarch/kvm/vcpu.c:104:15: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_d' arch/loongarch/kvm/vcpu.c:106:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:124:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' >> arch/loongarch/kvm/vcpu.c:224:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/vcpu.c:224:9: sparse: expected void *ptr arch/loongarch/kvm/vcpu.c:224:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/vcpu.c:224:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/vcpu.c:224:9: sparse: expected void *ptr arch/loongarch/kvm/vcpu.c:224:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/vcpu.c:224:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/vcpu.c:224:9: sparse: expected void *ptr arch/loongarch/kvm/vcpu.c:224:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/vcpu.c:224:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/vcpu.c:224:9: sparse: expected void *ptr arch/loongarch/kvm/vcpu.c:224:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/vcpu.c:224:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/vcpu.c:224:9: sparse: expected void *ptr arch/loongarch/kvm/vcpu.c:224:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/vcpu.c:224:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/vcpu.c:224:9: sparse: expected void *ptr arch/loongarch/kvm/vcpu.c:224:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/vcpu.c:224:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/vcpu.c:224:9: sparse: expected void *ptr arch/loongarch/kvm/vcpu.c:224:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/vcpu.c:224:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/vcpu.c:224:9: sparse: expected void *ptr arch/loongarch/kvm/vcpu.c:224:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/vcpu.c:290:42: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_d' arch/loongarch/kvm/vcpu.c:1442:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_w' arch/loongarch/kvm/vcpu.c:1529:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:1578:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:1671:42: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_d' arch/loongarch/kvm/vcpu.c:40:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_d' arch/loongarch/kvm/vcpu.c:41:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_d' arch/loongarch/kvm/vcpu.c:42:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_d' arch/loongarch/kvm/vcpu.c:43:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_d' arch/loongarch/kvm/vcpu.c:44:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:45:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:46:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:47:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:55:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:56:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:57:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:58:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:59:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:60:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:61:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c:62:9: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c: note: in included file (through arch/loongarch/include/asm/loongarch.h, arch/loongarch/include/asm/cpu-info.h, ...): ../lib/gcc/loongarch64-linux/14.2.0/include/larchintrin.h:107:10: sparse: sparse: undefined identifier '__builtin_loongarch_cpucfg' arch/loongarch/kvm/vcpu.c: note: in included file (through arch/loongarch/include/asm/cpu-info.h, arch/loongarch/include/asm/processor.h, ...): arch/loongarch/include/asm/loongarch.h:1282:1: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_w' arch/loongarch/include/asm/loongarch.h:1282:1: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_w' arch/loongarch/include/asm/loongarch.h:1282:1: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_w' arch/loongarch/include/asm/loongarch.h:1282:1: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_w' arch/loongarch/kvm/vcpu.c: note: in included file (through arch/loongarch/kvm/trace.h): arch/loongarch/include/asm/kvm_csr.h:167:1: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_d' arch/loongarch/include/asm/kvm_csr.h:167:1: sparse: sparse: undefined identifier '__builtin_loongarch_csrwr_d' arch/loongarch/kvm/vcpu.c: note: in included file: arch/loongarch/include/asm/fpu.h:76:17: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_w' arch/loongarch/include/asm/fpu.h:85:17: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_w' vim +224 arch/loongarch/kvm/vcpu.c 3ec7320b0a2844 Tianrui Zhao 2023-10-02 221 3f5dde7efb48ae Bibo Mao 2024-07-09 222 static void kvm_late_check_requests(struct kvm_vcpu *vcpu) 3f5dde7efb48ae Bibo Mao 2024-07-09 223 { 3f5dde7efb48ae Bibo Mao 2024-07-09 @224 lockdep_assert_irqs_disabled(); 3f5dde7efb48ae Bibo Mao 2024-07-09 225 if (kvm_check_request(KVM_REQ_TLB_FLUSH_GPA, vcpu)) 3f5dde7efb48ae Bibo Mao 2024-07-09 226 if (vcpu->arch.flush_gpa != INVALID_GPA) { 3f5dde7efb48ae Bibo Mao 2024-07-09 227 kvm_flush_tlb_gpa(vcpu, vcpu->arch.flush_gpa); 3f5dde7efb48ae Bibo Mao 2024-07-09 228 vcpu->arch.flush_gpa = INVALID_GPA; 3f5dde7efb48ae Bibo Mao 2024-07-09 229 } 3f5dde7efb48ae Bibo Mao 2024-07-09 230 } 3f5dde7efb48ae Bibo Mao 2024-07-09 231 :::::: The code at line 224 was first introduced by commit :::::: 3f5dde7efb48ae2725aebecfbd47aacfa3def181 LoongArch: KVM: Delay secondary mmu tlb flush until guest entry :::::: TO: Bibo Mao <maobibo(a)loongson.cn> :::::: CC: Xianglai Li <lixianglai(a)loongson.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1693/1693] arch/loongarch/kvm/tlb.c:26:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 604e996dd0189ddb0875f389b87fa2084b3a9424 commit: 3f5dde7efb48ae2725aebecfbd47aacfa3def181 [1693/1693] LoongArch: KVM: Delay secondary mmu tlb flush until guest entry config: loongarch-randconfig-r112-20250103 (https://download.01.org/0day-ci/archive/20250103/202501032032.1nlRwHlW-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250103/202501032032.1nlRwHlW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501032032.1nlRwHlW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/loongarch/kvm/tlb.c:26:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/tlb.c:26:9: sparse: expected void *ptr arch/loongarch/kvm/tlb.c:26:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/tlb.c:26:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/tlb.c:26:9: sparse: expected void *ptr arch/loongarch/kvm/tlb.c:26:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/tlb.c:26:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/tlb.c:26:9: sparse: expected void *ptr arch/loongarch/kvm/tlb.c:26:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/tlb.c:26:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/tlb.c:26:9: sparse: expected void *ptr arch/loongarch/kvm/tlb.c:26:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/tlb.c:26:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/tlb.c:26:9: sparse: expected void *ptr arch/loongarch/kvm/tlb.c:26:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/tlb.c:26:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/tlb.c:26:9: sparse: expected void *ptr arch/loongarch/kvm/tlb.c:26:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/tlb.c:26:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/tlb.c:26:9: sparse: expected void *ptr arch/loongarch/kvm/tlb.c:26:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/tlb.c:26:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/tlb.c:26:9: sparse: expected void *ptr arch/loongarch/kvm/tlb.c:26:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/tlb.c:28:33: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_d' vim +26 arch/loongarch/kvm/tlb.c 23 24 void kvm_flush_tlb_gpa(struct kvm_vcpu *vcpu, unsigned long gpa) 25 { > 26 lockdep_assert_irqs_disabled(); -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] [Backport] btrfs: fix use-after-free in btrfs_encoded_read_endio()
by Yongjian Sun 03 Jan '25

03 Jan '25

From: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> mainline inclusion from mainline-v6.12-rc3 commit 05b36b04d74a517d6675bf2f90829ff1ac7e28dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOP CVE: CVE-2024-56582 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Shinichiro reported the following use-after free that sometimes is happening in our CI system when running fstests' btrfs/284 on a TCMU runner device: BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780 Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219 CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15 Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020 Workqueue: btrfs-endio btrfs_end_bio_work [btrfs] Call Trace: <TASK> dump_stack_lvl+0x6e/0xa0 ? lock_release+0x708/0x780 print_report+0x174/0x505 ? lock_release+0x708/0x780 ? __virt_addr_valid+0x224/0x410 ? lock_release+0x708/0x780 kasan_report+0xda/0x1b0 ? lock_release+0x708/0x780 ? __wake_up+0x44/0x60 lock_release+0x708/0x780 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? lock_is_held_type+0x9a/0x110 _raw_spin_unlock_irqrestore+0x1f/0x60 __wake_up+0x44/0x60 btrfs_encoded_read_endio+0x14b/0x190 [btrfs] btrfs_check_read_bio+0x8d9/0x1360 [btrfs] ? lock_release+0x1b0/0x780 ? trace_lock_acquire+0x12f/0x1a0 ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs] ? process_one_work+0x7e3/0x1460 ? lock_acquire+0x31/0xc0 ? process_one_work+0x7e3/0x1460 process_one_work+0x85c/0x1460 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x16c/0x240 worker_thread+0x5e6/0xfc0 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c3/0x3a0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs] send_extent_data+0xf0f/0x24a0 [btrfs] process_extent+0x48a/0x1830 [btrfs] changed_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x4f/0x70 kfree+0x143/0x490 btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs] send_extent_data+0xf0f/0x24a0 [btrfs] process_extent+0x48a/0x1830 [btrfs] changed_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e The buggy address belongs to the object at ffff888106a83f00 which belongs to the cache kmalloc-rnd-07-96 of size 96 The buggy address is located 24 bytes inside of freed 96-byte region [ffff888106a83f00, ffff888106a83f60) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83 flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004 raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Further analyzing the trace and the crash dump's vmcore file shows that the wake_up() call in btrfs_encoded_read_endio() is calling wake_up() on the wait_queue that is in the private data passed to the end_io handler. Commit 4ff47df40447 ("btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages()") moved 'struct btrfs_encoded_read_private' off the stack. Before that commit one can see a corruption of the private data when analyzing the vmcore after a crash: *(struct btrfs_encoded_read_private *)0xffff88815626eec8 = { .wait = (wait_queue_head_t){ .lock = (spinlock_t){ .rlock = (struct raw_spinlock){ .raw_lock = (arch_spinlock_t){ .val = (atomic_t){ .counter = (int)-2005885696, }, .locked = (u8)0, .pending = (u8)157, .locked_pending = (u16)40192, .tail = (u16)34928, }, .magic = (unsigned int)536325682, .owner_cpu = (unsigned int)29, .owner = (void *)__SCT__tp_func_btrfs_transaction_commit+0x0 = 0x0, .dep_map = (struct lockdep_map){ .key = (struct lock_class_key *)0xffff8881575a3b6c, .class_cache = (struct lock_class *[2]){ 0xffff8882a71985c0, 0xffffea00066f5d40 }, .name = (const char *)0xffff88815626f100 = "", .wait_type_outer = (u8)37, .wait_type_inner = (u8)178, .lock_type = (u8)154, }, }, .__padding = (u8 [24]){ 0, 157, 112, 136, 50, 174, 247, 31, 29 }, .dep_map = (struct lockdep_map){ .key = (struct lock_class_key *)0xffff8881575a3b6c, .class_cache = (struct lock_class *[2]){ 0xffff8882a71985c0, 0xffffea00066f5d40 }, .name = (const char *)0xffff88815626f100 = "", .wait_type_outer = (u8)37, .wait_type_inner = (u8)178, .lock_type = (u8)154, }, }, .head = (struct list_head){ .next = (struct list_head *)0x112cca, .prev = (struct list_head *)0x47, }, }, .pending = (atomic_t){ .counter = (int)-1491499288, }, .status = (blk_status_t)130, } Here we can see several indicators of in-memory data corruption, e.g. the large negative atomic values of ->pending or ->wait->lock->rlock->raw_lock->val, as well as the bogus spinlock magic 0x1ff7ae32 (decimal 536325682 above) instead of 0xdead4ead or the bogus pointer values for ->wait->head. To fix this, change atomic_dec_return() to atomic_dec_and_test() to fix the corruption, as atomic_dec_return() is defined as two instructions on x86_64, whereas atomic_dec_and_test() is defined as a single atomic operation. This can lead to a situation where counter value is already decremented but the if statement in btrfs_encoded_read_endio() is not completely processed, i.e. the 0 test has not completed. If another thread continues executing btrfs_encoded_read_regular_fill_pages() the atomic_dec_return() there can see an already updated ->pending counter and continues by freeing the private data. Continuing in the endio handler the test for 0 succeeds and the wait_queue is woken up, resulting in a use-after-free. Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Suggested-by: Damien Le Moal <Damien.LeMoal(a)wdc.com> Fixes: 1881fba89bd5 ("btrfs: add BTRFS_IOC_ENCODED_READ ioctl") CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sun Yongjian <sunyongjian1(a)huawei.com> --- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index fae45b8d485e..1511405abfe0 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -9974,7 +9974,7 @@ static void btrfs_encoded_read_endio(struct btrfs_bio *bbio) */ WRITE_ONCE(priv->status, bbio->bio.bi_status); } - if (!atomic_dec_return(&priv->pending)) + if (!atomic_dec_and_test(&priv->pending)) wake_up(&priv->wait); bio_put(&bbio->bio); } -- 2.39.2

2 9

[PATCH openEuler-22.03-LTS-SP1] [Backport] jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
by Yongjian Sun 03 Jan '25

03 Jan '25

From: Nihar Chaithanya <niharchaithanya(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit a174706ba4dad895c40b1d2277bade16dfacdcd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOK CVE: CVE-2024-56595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bail out. Reported-by: syzbot+412dea214d8baa3f7483(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=412dea214d8baa3f7483 Tested-by: syzbot+412dea214d8baa3f7483(a)syzkaller.appspotmail.com Signed-off-by: Nihar Chaithanya <niharchaithanya(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sun Yongjian <sunyongjian1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 24bd3591c8e0..5ecd79e5c74b 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2945,6 +2945,9 @@ static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) /* bubble the new value up the tree as required. */ for (k = 0; k < le32_to_cpu(tp->dmt_height); k++) { + if (lp == 0) + break; + /* get the index of the first leaf of the 4 leaf * group containing the specified leaf (leafno). */ -- 2.39.2

2 5

[PATCH OLK-5.10] [Backport] jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
by Yongjian Sun 03 Jan '25

03 Jan '25

From: Nihar Chaithanya <niharchaithanya(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit a174706ba4dad895c40b1d2277bade16dfacdcd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOK CVE: CVE-2024-56595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bail out. Reported-by: syzbot+412dea214d8baa3f7483(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=412dea214d8baa3f7483 Tested-by: syzbot+412dea214d8baa3f7483(a)syzkaller.appspotmail.com Signed-off-by: Nihar Chaithanya <niharchaithanya(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sun Yongjian <sunyongjian1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index bf1f3d4d23f2..aa72e09d4be8 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2955,6 +2955,9 @@ static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) /* bubble the new value up the tree as required. */ for (k = 0; k < le32_to_cpu(tp->dmt_height); k++) { + if (lp == 0) + break; + /* get the index of the first leaf of the 4 leaf * group containing the specified leaf (leafno). */ -- 2.39.2

2 5

[PATCH openEuler-22.03-LTS-SP1] io_uring: check for overflows in io_pin_pages
by Long Li 03 Jan '25

03 Jan '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 0c0a4eae26ac78379d0c1db053de168a8febc6c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFR CVE: CVE-2024-53187 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 Call Trace: <TASK> __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183 io_rings_map io_uring/io_uring.c:2611 [inline] io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470 io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692 io_uring_setup io_uring/io_uring.c:3781 [inline] ... </TASK> io_pin_pages()'s uaddr parameter came directly from the user and can be garbage. Don't just add size to it as it can overflow. Cc: stable(a)vger.kernel.org Reported-by: syzbot+2159cbb522b02847c053(a)syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/1b7520ddb168e1d537d64be47414a0629d0d8f8f.17325810… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c io_uring/memmap.c [Conflicts due to d8c2237d0aa9 ("io_uring: add io_pin_pages() helper")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 4d69fb4cf803..c048cd9f531f 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -8690,7 +8690,7 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, struct iovec *iov, struct io_mapped_ubuf *imu = NULL; struct vm_area_struct **vmas = NULL; struct page **pages = NULL; - unsigned long off, start, end, ubuf; + unsigned long off, start, end, ubuf, len; size_t size; int ret, pret, nr_pages, i; @@ -8700,7 +8700,13 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, struct iovec *iov, } ubuf = (unsigned long) iov->iov_base; - end = (ubuf + iov->iov_len + PAGE_SIZE - 1) >> PAGE_SHIFT; + len = (unsigned long) iov->iov_len; + if (check_add_overflow(ubuf, len, &end)) + return -EOVERFLOW; + if (check_add_overflow(end, PAGE_SIZE - 1, &end)) + return -EOVERFLOW; + + end = end >> PAGE_SHIFT; start = ubuf >> PAGE_SHIFT; nr_pages = end - start; -- 2.39.2

2 1

[PATCH OLK-5.10] io_uring: check for overflows in io_pin_pages
by Long Li 03 Jan '25

03 Jan '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 0c0a4eae26ac78379d0c1db053de168a8febc6c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFR CVE: CVE-2024-53187 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 Call Trace: <TASK> __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183 io_rings_map io_uring/io_uring.c:2611 [inline] io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470 io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692 io_uring_setup io_uring/io_uring.c:3781 [inline] ... </TASK> io_pin_pages()'s uaddr parameter came directly from the user and can be garbage. Don't just add size to it as it can overflow. Cc: stable(a)vger.kernel.org Reported-by: syzbot+2159cbb522b02847c053(a)syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/1b7520ddb168e1d537d64be47414a0629d0d8f8f.17325810… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c io_uring/memmap.c [Conflicts due to d8c2237d0aa9 ("io_uring: add io_pin_pages() helper")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 6e5e00a7692c..a7e52a8b0b5f 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -8886,7 +8886,7 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, struct iovec *iov, struct io_mapped_ubuf *imu = NULL; struct vm_area_struct **vmas = NULL; struct page **pages = NULL; - unsigned long off, start, end, ubuf; + unsigned long off, start, end, ubuf, len; size_t size; int ret, pret, nr_pages, i; @@ -8896,7 +8896,13 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, struct iovec *iov, } ubuf = (unsigned long) iov->iov_base; - end = (ubuf + iov->iov_len + PAGE_SIZE - 1) >> PAGE_SHIFT; + len = (unsigned long) iov->iov_len; + if (check_add_overflow(ubuf, len, &end)) + return -EOVERFLOW; + if (check_add_overflow(end, PAGE_SIZE - 1, &end)) + return -EOVERFLOW; + + end = end >> PAGE_SHIFT; start = ubuf >> PAGE_SHIFT; nr_pages = end - start; -- 2.39.2

2 1

[openeuler:OLK-6.6 1693/1693] drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:19: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 604e996dd0189ddb0875f389b87fa2084b3a9424 commit: 2815e6db6a7a2f0759dfc574e28b3b807a1a3377 [1693/1693] drm/loongson: use old version of ast driver for LoongArch platform config: loongarch-randconfig-r112-20250103 (https://download.01.org/0day-ci/archive/20250103/202501031900.rHaRpOIu-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250103/202501031900.rHaRpOIu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031900.rHaRpOIu-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:19: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:16: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *dstxor @@ got unsigned char [usertype] * @@ drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:16: sparse: expected unsigned char [noderef] [usertype] __iomem *dstxor drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:16: sparse: got unsigned char [usertype] * drivers/gpu/drm/loongson/ast_old/ast_mode.c: note: in included file (through arch/loongarch/include/asm/cpu-info.h, arch/loongarch/include/asm/processor.h, ...): arch/loongarch/include/asm/loongarch.h:1136:16: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_w' vim +/__iomem +746 drivers/gpu/drm/loongson/ast_old/ast_mode.c 719 720 /* 721 * Cursor plane 722 */ 723 724 static void ast_update_cursor_image(u8 __iomem *dst, const u8 *src, int width, 725 int height) 726 { 727 union { 728 u32 ul; 729 u8 b[4]; 730 } srcdata32[2], data32; 731 union { 732 u16 us; 733 u8 b[2]; 734 } data16; 735 u32 csum = 0; 736 s32 alpha_dst_delta, last_alpha_dst_delta; 737 u8 __iomem *dstxor; 738 const u8 *srcxor; 739 int i, j; 740 u32 per_pixel_copy, two_pixel_copy; 741 742 alpha_dst_delta = AST_MAX_HWC_WIDTH << 1; 743 last_alpha_dst_delta = alpha_dst_delta - (width << 1); 744 745 srcxor = src; > 746 dstxor = (u8 *)dst + last_alpha_dst_delta + 747 (AST_MAX_HWC_HEIGHT - height) * alpha_dst_delta; 748 per_pixel_copy = width & 1; 749 two_pixel_copy = width >> 1; 750 751 for (j = 0; j < height; j++) { 752 for (i = 0; i < two_pixel_copy; i++) { 753 srcdata32[0].ul = *((u32 *)srcxor) & 0xf0f0f0f0; 754 srcdata32[1].ul = *((u32 *)(srcxor + 4)) & 0xf0f0f0f0; 755 data32.b[0] = srcdata32[0].b[1] | 756 (srcdata32[0].b[0] >> 4); 757 data32.b[1] = srcdata32[0].b[3] | 758 (srcdata32[0].b[2] >> 4); 759 data32.b[2] = srcdata32[1].b[1] | 760 (srcdata32[1].b[0] >> 4); 761 data32.b[3] = srcdata32[1].b[3] | 762 (srcdata32[1].b[2] >> 4); 763 764 writel(data32.ul, dstxor); 765 csum += data32.ul; 766 767 dstxor += 4; 768 srcxor += 8; 769 } 770 771 for (i = 0; i < per_pixel_copy; i++) { 772 srcdata32[0].ul = *((u32 *)srcxor) & 0xf0f0f0f0; 773 data16.b[0] = srcdata32[0].b[1] | 774 (srcdata32[0].b[0] >> 4); 775 data16.b[1] = srcdata32[0].b[3] | 776 (srcdata32[0].b[2] >> 4); 777 writew(data16.us, dstxor); 778 csum += (u32)data16.us; 779 780 dstxor += 2; 781 srcxor += 4; 782 } 783 dstxor += last_alpha_dst_delta; 784 } 785 786 /* write checksum + signature */ 787 dst += AST_HWC_SIZE; 788 writel(csum, dst); 789 writel(width, dst + AST_HWC_SIGNATURE_SizeX); 790 writel(height, dst + AST_HWC_SIGNATURE_SizeY); 791 writel(0, dst + AST_HWC_SIGNATURE_HOTSPOTX); 792 writel(0, dst + AST_HWC_SIGNATURE_HOTSPOTY); 793 } 794 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/16] net:yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 03 Jan '25

03 Jan '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (16): motorcomm:yt6801: Add support for a pci table in this module motorcomm:yt6801: Implement pci_driver shutdown motorcomm:yt6801: Implement the fxgmac_drv_probe function motorcomm:yt6801: Implement the .ndo_open function motorcomm:yt6801: Implement the fxgmac_start function motorcomm:yt6801: Implement the poll functions motorcomm:yt6801: Implement the fxgmac_init function motorcomm:yt6801: Implement the fxgmac_read_mac_addr function motorcomm:yt6801: Implement some hw_ops function motorcomm:yt6801: Implement .ndo_start_xmit function motorcomm:yt6801: Implement some net_device_ops function motorcomm:yt6801: Implement .ndo_tx_timeout and .ndo_change_mtu functions motorcomm:yt6801: Implement some ethtool_ops function motorcomm:yt6801: Implement the WOL function of ethtool_ops motorcomm:yt6801: Implement pci_driver suspend and resume motorcomm:yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 8 + arch/arm64/configs/openeuler_defconfig | 2 + arch/riscv/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 9 + .../net/ethernet/motorcomm/yt6801/yt6801.h | 617 +++ .../ethernet/motorcomm/yt6801/yt6801_desc.c | 638 ++++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 39 + .../motorcomm/yt6801/yt6801_ethtool.c | 838 ++++ .../net/ethernet/motorcomm/yt6801/yt6801_hw.c | 3383 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.c | 2908 ++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.h | 32 + .../ethernet/motorcomm/yt6801/yt6801_pci.c | 191 + .../ethernet/motorcomm/yt6801/yt6801_type.h | 1398 +++++++ 18 files changed, 10102 insertions(+) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_ethtool.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_hw.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_pci.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

2 17

[openeuler:OLK-5.10 2601/2601] kernel/stackleak.c:42:5-10: opportunity for str_enabled_disabled(state)
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d51fb86ce6a3a3e59d7cba58738b63903b8cb37c commit: 9d423ac5414e69a36e95dc0b77392429c507cbe1 [2601/2601] gcc-plugins: simplify GCC plugin-dev capability test config: x86_64-randconfig-101-20241228 (https://download.01.org/0day-ci/archive/20250103/202501031923.x0AUCg7R-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031923.x0AUCg7R-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> kernel/stackleak.c:42:5-10: opportunity for str_enabled_disabled(state) vim +42 kernel/stackleak.c 964c9dff009189 Alexander Popov 2018-08-17 21 964c9dff009189 Alexander Popov 2018-08-17 22 int stack_erasing_sysctl(struct ctl_table *table, int write, 4773ef33fc6e59 Tobias Klauser 2020-09-18 23 void *buffer, size_t *lenp, loff_t *ppos) 964c9dff009189 Alexander Popov 2018-08-17 24 { 964c9dff009189 Alexander Popov 2018-08-17 25 int ret = 0; 964c9dff009189 Alexander Popov 2018-08-17 26 int state = !static_branch_unlikely(&stack_erasing_bypass); 964c9dff009189 Alexander Popov 2018-08-17 27 int prev_state = state; 964c9dff009189 Alexander Popov 2018-08-17 28 964c9dff009189 Alexander Popov 2018-08-17 29 table->data = &state; 964c9dff009189 Alexander Popov 2018-08-17 30 table->maxlen = sizeof(int); 964c9dff009189 Alexander Popov 2018-08-17 31 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 964c9dff009189 Alexander Popov 2018-08-17 32 state = !!state; 964c9dff009189 Alexander Popov 2018-08-17 33 if (ret || !write || state == prev_state) 964c9dff009189 Alexander Popov 2018-08-17 34 return ret; 964c9dff009189 Alexander Popov 2018-08-17 35 964c9dff009189 Alexander Popov 2018-08-17 36 if (state) 964c9dff009189 Alexander Popov 2018-08-17 37 static_branch_disable(&stack_erasing_bypass); 964c9dff009189 Alexander Popov 2018-08-17 38 else 964c9dff009189 Alexander Popov 2018-08-17 39 static_branch_enable(&stack_erasing_bypass); 964c9dff009189 Alexander Popov 2018-08-17 40 964c9dff009189 Alexander Popov 2018-08-17 41 pr_warn("stackleak: kernel stack erasing is %s\n", 964c9dff009189 Alexander Popov 2018-08-17 @42 state ? "enabled" : "disabled"); 964c9dff009189 Alexander Popov 2018-08-17 43 return ret; 964c9dff009189 Alexander Popov 2018-08-17 44 } 964c9dff009189 Alexander Popov 2018-08-17 45 :::::: The code at line 42 was first introduced by commit :::::: 964c9dff0091893a9a74a88edf984c6da0b779f7 stackleak: Allow runtime disabling of kernel stack erasing :::::: TO: Alexander Popov <alex.popov(a)linux.com> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1682/1682] mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static?
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 604e996dd0189ddb0875f389b87fa2084b3a9424 commit: cf98ffbc116bc49dc4506c68e20b02e26519ad35 [1682/1682] mm/dynamic_pool: fill dpool with pagelist config: x86_64-randconfig-121-20250101 (https://download.01.org/0day-ci/archive/20250103/202501031919.9n6qbVhX-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250103/202501031919.9n6qbVhX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031919.9n6qbVhX-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/dynamic_pool.c:999:55: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] __rcu * @@ mm/dynamic_pool.c:999:55: sparse: expected struct cgroup_subsys_state *css mm/dynamic_pool.c:999:55: sparse: got struct cgroup_subsys_state [noderef] __rcu * >> mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static? vim +/pagelist_dpool_ops +1577 mm/dynamic_pool.c 1576 > 1577 struct dynamic_pool_ops pagelist_dpool_ops = { 1578 .fill_pool = dpool_fill_from_pagelist, 1579 .drain_pool = dpool_drain_to_pagelist, 1580 .restore_pool = dpool_migrate_used_pages, 1581 }; 1582 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1693/1693] arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 03 Jan '25

03 Jan '25

Hi Tianrui, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 604e996dd0189ddb0875f389b87fa2084b3a9424 commit: 07db411edd838080fb7c42b9f56bc08dd60d9af6 [1693/1693] LoongArch: KVM: Enable kvm config and add the makefile config: loongarch-randconfig-r112-20250103 (https://download.01.org/0day-ci/archive/20250103/202501031701.nFiZOCS8-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250103/202501031701.nFiZOCS8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031701.nFiZOCS8-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/loongarch/kvm/../../../virt/kvm/kvm_main.c: note: in included file: include/linux/kvm_host.h:1946:54: sparse: sparse: array of flexible structures include/linux/kvm_host.h:1948:56: sparse: sparse: array of flexible structures >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_change_pte' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_invalidate_range_start' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_invalidate_range_end' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_clear_flush_young' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_clear_young' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_test_young' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c: note: in included file (through include/linux/mutex.h, include/linux/kvm_types.h, include/kvm/iodev.h): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:1973:49: sparse: sparse: self-comparison always evaluates to false arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:1979:37: sparse: sparse: self-comparison always evaluates to false arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:2678:9: sparse: sparse: context imbalance in 'hva_to_pfn_remapped' - unexpected unlock include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true vim +5340 arch/loongarch/kvm/../../../virt/kvm/kvm_main.c 9a2b85c620b977 drivers/kvm/kvm_main.c Rusty Russell 2007-07-17 5328 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5329 static int kvm_suspend(void) 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5330 { 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5331 /* 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5332 * Secondary CPUs and CPU hotplug are disabled across the suspend/resume 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5333 * callbacks, i.e. no need to acquire kvm_lock to ensure the usage count 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5334 * is stable. Assert that kvm_lock is not held to ensure the system 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5335 * isn't suspended while KVM is enabling hardware. Hardware enabling 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5336 * can be preempted, but the task cannot be frozen until it has dropped 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5337 * all locks (userspace tasks are frozen via a fake signal). 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5338 */ 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5339 lockdep_assert_not_held(&kvm_lock); 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 @5340 lockdep_assert_irqs_disabled(); 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5341 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5342 if (kvm_usage_count) 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5343 hardware_disable_nolock(NULL); 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5344 return 0; 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5345 } 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5346 :::::: The code at line 5340 was first introduced by commit :::::: 35774a9f94db08df78e1c08d2b097666deec4e76 KVM: Register syscore (suspend/resume) ops early in kvm_init() :::::: TO: Sean Christopherson <seanjc(a)google.com> :::::: CC: Paolo Bonzini <pbonzini(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
by Pu Lehui 03 Jan '25

03 Jan '25

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit cb4158ce8ec8a5bb528cc1693356a5eb8058094d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDPP CVE: CVE-2024-56702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Arguments to a raw tracepoint are tagged as trusted, which carries the semantics that the pointer will be non-NULL. However, in certain cases, a raw tracepoint argument may end up being NULL. More context about this issue is available in [0]. Thus, there is a discrepancy between the reality, that raw_tp arguments can actually be NULL, and the verifier's knowledge, that they are never NULL, causing explicit NULL checks to be deleted, and accesses to such pointers potentially crashing the kernel. To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special case the dereference and pointer arithmetic to permit it, and allow passing them into helpers/kfuncs; these exceptions are made for raw_tp programs only. Ensure that we don't do this when ref_obj_id > 0, as in that case this is an acquired object and doesn't need such adjustment. The reason we do mask_raw_tp_trusted_reg logic is because other will recheck in places whether the register is a trusted_reg, and then consider our register as untrusted when detecting the presence of the PTR_MAYBE_NULL flag. To allow safe dereference, we enable PROBE_MEM marking when we see loads into trusted pointers with PTR_MAYBE_NULL. While trusted raw_tp arguments can also be passed into helpers or kfuncs where such broken assumption may cause issues, a future patch set will tackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can already be passed into helpers and causes similar problems. Thus, they are left alone for now. It is possible that these checks also permit passing non-raw_tp args that are trusted PTR_TO_BTF_ID with null marking. In such a case, allowing dereference when pointer is NULL expands allowed behavior, so won't regress existing programs, and the case of passing these into helpers is the same as above and will be dealt with later. Also update the failure case in tp_btf_nullable selftest to capture the new behavior, as the verifier will no longer cause an error when directly dereference a raw tracepoint argument marked as __nullable. [0]: https://lore.kernel.org/bpf/ZrCZS6nisraEqehw@jlelli-thinkpadt14gen4.remote.… Reviewed-by: Jiri Olsa <jolsa(a)kernel.org> Reported-by: Juri Lelli <juri.lelli(a)redhat.com> Tested-by: Juri Lelli <juri.lelli(a)redhat.com> Fixes: 3f00c5239344 ("bpf: Allow trusted pointers to be passed to KF_TRUSTED_ARGS kfuncs") Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Link: https://lore.kernel.org/r/20241104171959.2938862-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c [The conflicts were due to not merge commit e2b3c4ff5d18 and 2060f07f861a2] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/bpf.h | 6 ++++ kernel/bpf/btf.c | 4 +++ kernel/bpf/verifier.c | 77 ++++++++++++++++++++++++++++++++++++++----- 3 files changed, 79 insertions(+), 8 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 73ef8dda7ada..7e7a2507a3e5 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -3322,4 +3322,10 @@ static inline gfp_t bpf_memcg_flags(gfp_t flags) return flags; } +static inline bool bpf_prog_is_raw_tp(const struct bpf_prog *prog) +{ + return prog->type == BPF_PROG_TYPE_TRACING && + prog->expected_attach_type == BPF_TRACE_RAW_TP; +} + #endif /* _LINUX_BPF_H */ diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 7a82194ad51d..a54a7fdf99cd 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -6076,6 +6076,10 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, if (prog_args_trusted(prog)) info->reg_type |= PTR_TRUSTED; + /* Raw tracepoint arguments always get marked as maybe NULL */ + if (bpf_prog_is_raw_tp(prog)) + info->reg_type |= PTR_MAYBE_NULL; + if (tgt_prog) { enum bpf_prog_type tgt_type; diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 8fa7b37152c0..fe0c8bf97663 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -495,6 +495,25 @@ static struct btf_record *reg_btf_record(const struct bpf_reg_state *reg) return rec; } +static bool mask_raw_tp_reg_cond(const struct bpf_verifier_env *env, struct bpf_reg_state *reg) { + return reg->type == (PTR_TO_BTF_ID | PTR_TRUSTED | PTR_MAYBE_NULL) && + bpf_prog_is_raw_tp(env->prog) && !reg->ref_obj_id; +} + +static bool mask_raw_tp_reg(const struct bpf_verifier_env *env, struct bpf_reg_state *reg) +{ + if (!mask_raw_tp_reg_cond(env, reg)) + return false; + reg->type &= ~PTR_MAYBE_NULL; + return true; +} + +static void unmask_raw_tp_reg(struct bpf_reg_state *reg, bool result) +{ + if (result) + reg->type |= PTR_MAYBE_NULL; +} + static bool subprog_is_global(const struct bpf_verifier_env *env, int subprog) { struct bpf_func_info_aux *aux = env->prog->aux->func_info_aux; @@ -6458,6 +6477,7 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env, const char *field_name = NULL; enum bpf_type_flag flag = 0; u32 btf_id = 0; + bool mask; int ret; if (!env->allow_ptr_leaks) { @@ -6529,7 +6549,21 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env, if (ret < 0) return ret; - + /* For raw_tp progs, we allow dereference of PTR_MAYBE_NULL + * trusted PTR_TO_BTF_ID, these are the ones that are possibly + * arguments to the raw_tp. Since internal checks in for trusted + * reg in check_ptr_to_btf_access would consider PTR_MAYBE_NULL + * modifier as problematic, mask it out temporarily for the + * check. Don't apply this to pointers with ref_obj_id > 0, as + * those won't be raw_tp args. + * + * We may end up applying this relaxation to other trusted + * PTR_TO_BTF_ID with maybe null flag, since we cannot + * distinguish PTR_MAYBE_NULL tagged for arguments vs normal + * tagging, but that should expand allowed behavior, and not + * cause regression for existing behavior. + */ + mask = mask_raw_tp_reg(env, reg); if (ret != PTR_TO_BTF_ID) { /* just mark; */ @@ -6590,8 +6624,13 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env, clear_trusted_flags(&flag); } - if (atype == BPF_READ && value_regno >= 0) + if (atype == BPF_READ && value_regno >= 0) { mark_btf_ld_reg(env, regs, value_regno, ret, reg->btf, btf_id, flag); + /* We've assigned a new type to regno, so don't undo masking. */ + if (regno == value_regno) + mask = false; + } + unmask_raw_tp_reg(reg, mask); return 0; } @@ -6963,7 +7002,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn if (!err && t == BPF_READ && value_regno >= 0) mark_reg_unknown(env, regs, value_regno); } else if (base_type(reg->type) == PTR_TO_BTF_ID && - !type_may_be_null(reg->type)) { + (mask_raw_tp_reg_cond(env, reg) || !type_may_be_null(reg->type))) { err = check_ptr_to_btf_access(env, regs, regno, off, size, t, value_regno); } else if (reg->type == CONST_PTR_TO_MAP) { @@ -8515,6 +8554,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, enum bpf_reg_type type = reg->type; u32 *arg_btf_id = NULL; int err = 0; + bool mask; if (arg_type == ARG_DONTCARE) return 0; @@ -8555,11 +8595,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, base_type(arg_type) == ARG_PTR_TO_SPIN_LOCK) arg_btf_id = fn->arg_btf_id[arg]; + mask = mask_raw_tp_reg(env, reg); err = check_reg_type(env, regno, arg_type, arg_btf_id, meta); - if (err) - return err; - err = check_func_arg_reg_off(env, reg, regno, arg_type); + err = err ?: check_func_arg_reg_off(env, reg, regno, arg_type); + unmask_raw_tp_reg(reg, mask); if (err) return err; @@ -11366,6 +11406,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ enum bpf_arg_type arg_type = ARG_DONTCARE; u32 regno = i + 1, ref_id, type_size; bool is_ret_buf_sz = false; + bool mask = false; int kf_arg_type; t = btf_type_skip_modifiers(btf, args[i].type, NULL); @@ -11424,11 +11465,14 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ return -EINVAL; } + mask = mask_raw_tp_reg(env, reg); if ((is_kfunc_trusted_args(meta) || is_kfunc_rcu(meta)) && (register_is_null(reg) || type_may_be_null(reg->type))) { verbose(env, "Possibly NULL pointer passed to trusted arg%d\n", i); + unmask_raw_tp_reg(reg, mask); return -EACCES; } + unmask_raw_tp_reg(reg, mask); if (reg->ref_obj_id) { if (is_kfunc_release(meta) && meta->ref_obj_id) { @@ -11455,17 +11499,24 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ if (!is_kfunc_trusted_args(meta) && !is_kfunc_rcu(meta)) break; + /* Allow passing maybe NULL raw_tp arguments to + * kfuncs for compatibility. Don't apply this to + * arguments with ref_obj_id > 0. + */ + mask = mask_raw_tp_reg(env, reg); if (!is_trusted_reg(reg)) { if (!is_kfunc_rcu(meta)) { verbose(env, "R%d must be referenced or trusted\n", regno); + unmask_raw_tp_reg(reg, mask); return -EINVAL; } if (!is_rcu_reg(reg)) { verbose(env, "R%d must be a rcu pointer\n", regno); + unmask_raw_tp_reg(reg, mask); return -EINVAL; } } - + unmask_raw_tp_reg(reg, mask); fallthrough; case KF_ARG_PTR_TO_CTX: /* Trusted arguments have the same offset checks as release arguments */ @@ -11490,7 +11541,9 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ if (is_kfunc_release(meta) && reg->ref_obj_id) arg_type |= OBJ_RELEASE; + mask = mask_raw_tp_reg(env, reg); ret = check_func_arg_reg_off(env, reg, regno, arg_type); + unmask_raw_tp_reg(reg, mask); if (ret < 0) return ret; @@ -11651,6 +11704,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ return ret; break; case KF_ARG_PTR_TO_BTF_ID: + mask = mask_raw_tp_reg(env, reg); /* Only base_type is checked, further checks are done here */ if ((base_type(reg->type) != PTR_TO_BTF_ID || (bpf_type_has_unsafe_modifiers(reg->type) && !is_rcu_reg(reg))) && @@ -11659,9 +11713,11 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ verbose(env, "expected %s or socket\n", reg_type_str(env, base_type(reg->type) | (type_flag(reg->type) & BPF_REG_TRUSTED_MODIFIERS))); + unmask_raw_tp_reg(reg, mask); return -EINVAL; } ret = process_kf_arg_ptr_to_btf_id(env, reg, ref_t, ref_tname, ref_id, meta, i); + unmask_raw_tp_reg(reg, mask); if (ret < 0) return ret; break; @@ -12548,7 +12604,7 @@ static int sanitize_check_bounds(struct bpf_verifier_env *env, */ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, struct bpf_insn *insn, - const struct bpf_reg_state *ptr_reg, + struct bpf_reg_state *ptr_reg, const struct bpf_reg_state *off_reg) { struct bpf_verifier_state *vstate = env->cur_state; @@ -12562,6 +12618,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, struct bpf_sanitize_info info = {}; u8 opcode = BPF_OP(insn->code); u32 dst = insn->dst_reg; + bool mask; int ret; dst_reg = &regs[dst]; @@ -12588,11 +12645,14 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, return -EACCES; } + mask = mask_raw_tp_reg(env, ptr_reg); if (ptr_reg->type & PTR_MAYBE_NULL) { verbose(env, "R%d pointer arithmetic on %s prohibited, null-check it first\n", dst, reg_type_str(env, ptr_reg->type)); + unmask_raw_tp_reg(ptr_reg, mask); return -EACCES; } + unmask_raw_tp_reg(ptr_reg, mask); switch (base_type(ptr_reg->type)) { case PTR_TO_FLOW_KEYS: @@ -18455,6 +18515,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env) * for this case. */ case PTR_TO_BTF_ID | MEM_ALLOC | PTR_UNTRUSTED: + case PTR_TO_BTF_ID | PTR_TRUSTED | PTR_MAYBE_NULL: if (type == BPF_READ) { if (BPF_MODE(insn->code) == BPF_MEM) insn->code = BPF_LDX | BPF_PROBE_MEM | -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] etmem: fix use-after-free of mm in the scan release process
by chenrenhui 03 Jan '25

03 Jan '25

etmem: fix use-after-free of mm in the scan release process chenrenhui (1): etmem: fix use-after-free of mm in the scan release process fs/proc/task_mmu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6] ALSA: pcm: Add sanity NULL check for the default mmap fault handler
by Xiongfeng Wang 03 Jan '25

03 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.64 commit bc200027ee92fba84f1826494735ed675f3aa911 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADU CVE: CVE-2024-53180 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d2913a07d9037fe7aed4b7e680684163eaed6bc4 upstream. A driver might allow the mmap access before initializing its runtime->dma_area properly. Add a proper NULL check before passing to virt_to_page() for avoiding a panic. Reported-by: syzbot+4bf62a7b1d0f4fdb7ae2(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20241120141104.7060-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- sound/core/pcm_native.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index cc21c483c4a5..e40de64ec85c 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -3794,9 +3794,11 @@ static vm_fault_t snd_pcm_mmap_data_fault(struct vm_fault *vmf) return VM_FAULT_SIGBUS; if (substream->ops->page) page = substream->ops->page(substream, offset); - else if (!snd_pcm_get_dma_buf(substream)) + else if (!snd_pcm_get_dma_buf(substream)) { + if (WARN_ON_ONCE(!runtime->dma_area)) + return VM_FAULT_SIGBUS; page = virt_to_page(runtime->dma_area + offset); - else + } else page = snd_sgbuf_get_page(snd_pcm_get_dma_buf(substream), offset); if (!page) return VM_FAULT_SIGBUS; -- 2.20.1

2 5

[PATCH OLK-6.6] RDMA/rxe: Fix the qp flush warnings in req
by Xiongfeng Wang 03 Jan '25

03 Jan '25

From: Zhu Yanjun <yanjun.zhu(a)linux.dev> stable inclusion from stable-v6.6.64 commit 31978d5c5aef034d96fc53b4a9cb3c6e11dbb94d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFD CVE: CVE-2024-53229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ea4c990fa9e19ffef0648e40c566b94ba5ab31be ] When the qp is in error state, the status of WQEs in the queue should be set to error. Or else the following will appear. [ 920.617269] WARNING: CPU: 1 PID: 21 at drivers/infiniband/sw/rxe/rxe_comp.c:756 rxe_completer+0x989/0xcc0 [rdma_rxe] [ 920.617744] Modules linked in: rnbd_client(O) rtrs_client(O) rtrs_core(O) rdma_ucm rdma_cm iw_cm ib_cm crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel ib_uverbs ib_core loop brd null_blk ipv6 [ 920.618516] CPU: 1 PID: 21 Comm: ksoftirqd/1 Tainted: G O 6.1.113-storage+ #65 [ 920.618986] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 920.619396] RIP: 0010:rxe_completer+0x989/0xcc0 [rdma_rxe] [ 920.619658] Code: 0f b6 84 24 3a 02 00 00 41 89 84 24 44 04 00 00 e9 2a f7 ff ff 39 ca bb 03 00 00 00 b8 0e 00 00 00 48 0f 45 d8 e9 15 f7 ff ff <0f> 0b e9 cb f8 ff ff 41 bf f5 ff ff ff e9 08 f8 ff ff 49 8d bc 24 [ 920.620482] RSP: 0018:ffff97b7c00bbc38 EFLAGS: 00010246 [ 920.620817] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000008 [ 920.621183] RDX: ffff960dc396ebc0 RSI: 0000000000005400 RDI: ffff960dc4e2fbac [ 920.621548] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffffac406450 [ 920.621884] R10: ffffffffac4060c0 R11: 0000000000000001 R12: ffff960dc4e2f800 [ 920.622254] R13: ffff960dc4e2f928 R14: ffff97b7c029c580 R15: 0000000000000000 [ 920.622609] FS: 0000000000000000(0000) GS:ffff960ef7d00000(0000) knlGS:0000000000000000 [ 920.622979] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 920.623245] CR2: 00007fa056965e90 CR3: 00000001107f1000 CR4: 00000000000006e0 [ 920.623680] Call Trace: [ 920.623815] <TASK> [ 920.623933] ? __warn+0x79/0xc0 [ 920.624116] ? rxe_completer+0x989/0xcc0 [rdma_rxe] [ 920.624356] ? report_bug+0xfb/0x150 [ 920.624594] ? handle_bug+0x3c/0x60 [ 920.624796] ? exc_invalid_op+0x14/0x70 [ 920.624976] ? asm_exc_invalid_op+0x16/0x20 [ 920.625203] ? rxe_completer+0x989/0xcc0 [rdma_rxe] [ 920.625474] ? rxe_completer+0x329/0xcc0 [rdma_rxe] [ 920.625749] rxe_do_task+0x80/0x110 [rdma_rxe] [ 920.626037] rxe_requester+0x625/0xde0 [rdma_rxe] [ 920.626310] ? rxe_cq_post+0xe2/0x180 [rdma_rxe] [ 920.626583] ? do_complete+0x18d/0x220 [rdma_rxe] [ 920.626812] ? rxe_completer+0x1a3/0xcc0 [rdma_rxe] [ 920.627050] rxe_do_task+0x80/0x110 [rdma_rxe] [ 920.627285] tasklet_action_common.constprop.0+0xa4/0x120 [ 920.627522] handle_softirqs+0xc2/0x250 [ 920.627728] ? sort_range+0x20/0x20 [ 920.627942] run_ksoftirqd+0x1f/0x30 [ 920.628158] smpboot_thread_fn+0xc7/0x1b0 [ 920.628334] kthread+0xd6/0x100 [ 920.628504] ? kthread_complete_and_exit+0x20/0x20 [ 920.628709] ret_from_fork+0x1f/0x30 [ 920.628892] </TASK> Fixes: ae720bdb703b ("RDMA/rxe: Generate error completion for error requester QP state") Signed-off-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Link: https://patch.msgid.link/20241025152036.121417-1-yanjun.zhu@linux.dev Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_req.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c index 7a36080d2bae..7ff152ffe15b 100644 --- a/drivers/infiniband/sw/rxe/rxe_req.c +++ b/drivers/infiniband/sw/rxe/rxe_req.c @@ -693,10 +693,12 @@ int rxe_requester(struct rxe_qp *qp) if (unlikely(qp_state(qp) == IB_QPS_ERR)) { wqe = __req_next_wqe(qp); spin_unlock_irqrestore(&qp->state_lock, flags); - if (wqe) + if (wqe) { + wqe->status = IB_WC_WR_FLUSH_ERR; goto err; - else + } else { goto exit; + } } if (unlikely(qp_state(qp) == IB_QPS_RESET)) { -- 2.20.1

2 5

[PATCH OLK-5.10] PCI: Fix use-after-free of slot->bus on hot remove
by Xiongfeng Wang 03 Jan '25

03 Jan '25

From: Lukas Wunner <lukas(a)wunner.de> stable inclusion from stable-v5.10.231 commit da6e6ff1f6c57f16e07af955e0e997fc90dd1e75 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF8 CVE: CVE-2024-53194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c7acef99642b763ba585f4a43af999fcdbcc3dc4 upstream. Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver. The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock. The crash occurs when pciehp is unbound from one of the dock's Downstream Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus. In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device(). However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device(). In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free. One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming. If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change. Abridged stacktrace: pcieport 0000:00:07.0: PME: Signaling with IRQ 156 pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12 pcieport 0000:00:07.0: pciehp: Slot(12): Card not present ... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0 Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Link: https://lore.kernel.org/r/4bfd4c0e976c1776cd08e76603903b338cf25729.17285792… Reported-by: Dennis Wassenberg <Dennis.Wassenberg(a)secunet.com> Closes: https://lore.kernel.org/r/6de4b45ff2b32dd91a805ec02ec8ec73ef411bf6.camel@se… Tested-by: Dennis Wassenberg <Dennis.Wassenberg(a)secunet.com> Signed-off-by: Lukas Wunner <lukas(a)wunner.de> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/slot.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c index ed2077e7470ae..a42e2cf774fd8 100644 --- a/drivers/pci/slot.c +++ b/drivers/pci/slot.c @@ -79,6 +79,7 @@ static void pci_slot_release(struct kobject *kobj) up_read(&pci_bus_sem); list_del(&slot->list); + pci_bus_put(slot->bus); kfree(slot); } @@ -260,7 +261,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, goto err; } - slot->bus = parent; + slot->bus = pci_bus_get(parent); slot->number = slot_nr; slot->kobj.kset = pci_slots_kset; @@ -268,6 +269,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, slot_name = make_slot_name(name); if (!slot_name) { err = -ENOMEM; + pci_bus_put(slot->bus); kfree(slot); goto err; } -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1] PCI: Fix use-after-free of slot->bus on hot remove
by Xiongfeng Wang 03 Jan '25

03 Jan '25

From: Lukas Wunner <lukas(a)wunner.de> stable inclusion from stable-v5.10.231 commit da6e6ff1f6c57f16e07af955e0e997fc90dd1e75 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF8 CVE: CVE-2024-53194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c7acef99642b763ba585f4a43af999fcdbcc3dc4 upstream. Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver. The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock. The crash occurs when pciehp is unbound from one of the dock's Downstream Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus. In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device(). However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device(). In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free. One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming. If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change. Abridged stacktrace: pcieport 0000:00:07.0: PME: Signaling with IRQ 156 pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12 pcieport 0000:00:07.0: pciehp: Slot(12): Card not present ... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0 Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Link: https://lore.kernel.org/r/4bfd4c0e976c1776cd08e76603903b338cf25729.17285792… Reported-by: Dennis Wassenberg <Dennis.Wassenberg(a)secunet.com> Closes: https://lore.kernel.org/r/6de4b45ff2b32dd91a805ec02ec8ec73ef411bf6.camel@se… Tested-by: Dennis Wassenberg <Dennis.Wassenberg(a)secunet.com> Signed-off-by: Lukas Wunner <lukas(a)wunner.de> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/slot.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c index ed2077e7470ae..a42e2cf774fd8 100644 --- a/drivers/pci/slot.c +++ b/drivers/pci/slot.c @@ -79,6 +79,7 @@ static void pci_slot_release(struct kobject *kobj) up_read(&pci_bus_sem); list_del(&slot->list); + pci_bus_put(slot->bus); kfree(slot); } @@ -260,7 +261,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, goto err; } - slot->bus = parent; + slot->bus = pci_bus_get(parent); slot->number = slot_nr; slot->kobj.kset = pci_slots_kset; @@ -268,6 +269,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, slot_name = make_slot_name(name); if (!slot_name) { err = -ENOMEM; + pci_bus_put(slot->bus); kfree(slot); goto err; } -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] PCI: Fix use-after-free of slot->bus on hot remove
by Xiongfeng Wang 03 Jan '25

03 Jan '25

From: Lukas Wunner <lukas(a)wunner.de> stable inclusion from stable-v4.19.325 commit 50473dd3b2a08601a078f852ea05572de9b1f86c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF8 CVE: CVE-2024-53194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c7acef99642b763ba585f4a43af999fcdbcc3dc4 upstream. Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver. The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock. The crash occurs when pciehp is unbound from one of the dock's Downstream Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus. In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device(). However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device(). In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free. One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming. If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change. Abridged stacktrace: pcieport 0000:00:07.0: PME: Signaling with IRQ 156 pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12 pcieport 0000:00:07.0: pciehp: Slot(12): Card not present ... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0 Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Link: https://lore.kernel.org/r/4bfd4c0e976c1776cd08e76603903b338cf25729.17285792… Reported-by: Dennis Wassenberg <Dennis.Wassenberg(a)secunet.com> Closes: https://lore.kernel.org/r/6de4b45ff2b32dd91a805ec02ec8ec73ef411bf6.camel@se… Tested-by: Dennis Wassenberg <Dennis.Wassenberg(a)secunet.com> Signed-off-by: Lukas Wunner <lukas(a)wunner.de> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/slot.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c index 19de071ca698..ddc0e962285f 100644 --- a/drivers/pci/slot.c +++ b/drivers/pci/slot.c @@ -79,6 +79,7 @@ static void pci_slot_release(struct kobject *kobj) up_read(&pci_bus_sem); list_del(&slot->list); + pci_bus_put(slot->bus); kfree(slot); } @@ -260,7 +261,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, goto err; } - slot->bus = parent; + slot->bus = pci_bus_get(parent); slot->number = slot_nr; slot->kobj.kset = pci_slots_kset; @@ -268,6 +269,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, slot_name = make_slot_name(name); if (!slot_name) { err = -ENOMEM; + pci_bus_put(slot->bus); kfree(slot); goto err; } -- 2.20.1

2 1

[PATCH OLK-6.6] PCI: Fix use-after-free of slot->bus on hot remove
by Xiongfeng Wang 03 Jan '25

03 Jan '25

From: Lukas Wunner <lukas(a)wunner.de> stable inclusion from stable-v6.6.64 commit e5d5c04aac71bf1476dc44b56f2206a4c2facca8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF8 CVE: CVE-2024-53194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c7acef99642b763ba585f4a43af999fcdbcc3dc4 upstream. Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver. The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock. The crash occurs when pciehp is unbound from one of the dock's Downstream Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus. In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device(). However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device(). In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free. One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming. If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change. Abridged stacktrace: pcieport 0000:00:07.0: PME: Signaling with IRQ 156 pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12 pcieport 0000:00:07.0: pciehp: Slot(12): Card not present ... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0 Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Link: https://lore.kernel.org/r/4bfd4c0e976c1776cd08e76603903b338cf25729.17285792… Reported-by: Dennis Wassenberg <Dennis.Wassenberg(a)secunet.com> Closes: https://lore.kernel.org/r/6de4b45ff2b32dd91a805ec02ec8ec73ef411bf6.camel@se… Tested-by: Dennis Wassenberg <Dennis.Wassenberg(a)secunet.com> Signed-off-by: Lukas Wunner <lukas(a)wunner.de> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/slot.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c index 0f87cade10f7..ed645c7a4e4b 100644 --- a/drivers/pci/slot.c +++ b/drivers/pci/slot.c @@ -79,6 +79,7 @@ static void pci_slot_release(struct kobject *kobj) up_read(&pci_bus_sem); list_del(&slot->list); + pci_bus_put(slot->bus); kfree(slot); } @@ -261,7 +262,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, goto err; } - slot->bus = parent; + slot->bus = pci_bus_get(parent); slot->number = slot_nr; slot->kobj.kset = pci_slots_kset; @@ -269,6 +270,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, slot_name = make_slot_name(name); if (!slot_name) { err = -ENOMEM; + pci_bus_put(slot->bus); kfree(slot); goto err; } -- 2.20.1

2 1

[PATCH OLK-6.6] wifi: ath12k: fix warning when unbinding
by Xiongfeng Wang 03 Jan '25

03 Jan '25

From: Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> stable inclusion from stable-v6.6.64 commit 223b546c6222d42147eff034433002ca5e2e7e09 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF7 CVE: CVE-2024-53191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca68ce0d9f4bcd032fd1334441175ae399642a06 upstream. If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is unbinded (ath12k_pci), and we get: WARNING: CPU: 0 PID: 2098 at mm/slub.c:4689 free_large_kmalloc+0x4d/0x80 Call Trace: free_large_kmalloc ath12k_dp_free ath12k_core_deinit ath12k_pci_remove ... The issue is always reproducible from a VM because the MSI addressing initialization is failing. In order to fix the issue, just set the buffers to NULL after releasing in order to avoid the double free. cc: stable(a)vger.kernel.org Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> Link: https://patch.msgid.link/20241017181004.199589-3-jtornosm@redhat.com Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/net/wireless/ath/ath12k/dp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c index 907655c45a4b..8f85d6504e5f 100644 --- a/drivers/net/wireless/ath/ath12k/dp.c +++ b/drivers/net/wireless/ath/ath12k/dp.c @@ -1249,8 +1249,10 @@ void ath12k_dp_free(struct ath12k_base *ab) ath12k_dp_rx_reo_cmd_list_cleanup(ab); - for (i = 0; i < ab->hw_params->max_tx_ring; i++) + for (i = 0; i < ab->hw_params->max_tx_ring; i++) { kfree(dp->tx_ring[i].tx_status); + dp->tx_ring[i].tx_status = NULL; + } ath12k_dp_rx_free(ab); /* Deinit any SOC level resource */ -- 2.20.1

2 2

[PATCH openEuler-1.0-LTS] vfio/pci: Properly hide first-in-list PCIe extended capability
by Liu Shixin 03 Jan '25

03 Jan '25

From: Avihai Horon <avihaih(a)nvidia.com> stable inclusion from stable-v4.19.325 commit 4464e5aa3aa4574063640f1082f7d7e323af8eb4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFO CVE: CVE-2024-53214 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fe4bf8d0b6716a423b16495d55b35d3fe515905d ] There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability (i.e., capability with ID greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally chosen to be hidden from the user. Hiding a capability is done by virtualizing and modifying the 'Next Capability Offset' field of the previous capability so it points to the capability after the one that should be hidden. The special case where the first capability in the list should be hidden is handled differently because there is no previous capability that can be modified. In this case, the capability ID and version are zeroed while leaving the next pointer intact. This hides the capability and leaves an anchor for the rest of the capability list. However, today, hiding the first capability in the list is not done properly if the capability is unknown, as struct vfio_pci_core_device->pci_config_map is set to the capability ID during initialization but the capability ID is not properly checked later when used in vfio_config_do_rw(). This leads to the following warning [1] and to an out-of-bounds access to ecap_perms array. Fix it by checking cap_id in vfio_config_do_rw(), and if it is greater than PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct read only access instead of the ecap_perms array. Note that this is safe since the above is the only case where cap_id can exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which are already checked before). [1] WARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] CPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1 (snip) Call Trace: <TASK> ? show_regs+0x69/0x80 ? __warn+0x8d/0x140 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? report_bug+0x18f/0x1a0 ? handle_bug+0x63/0xa0 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core] vfio_pci_rw+0x101/0x1b0 [vfio_pci_core] vfio_pci_core_read+0x1d/0x30 [vfio_pci_core] vfio_device_fops_read+0x27/0x40 [vfio] vfs_read+0xbd/0x340 ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio] ? __rseq_handle_notify_resume+0xa4/0x4b0 __x64_sys_pread64+0x96/0xc0 x64_sys_call+0x1c3d/0x20d0 do_syscall_64+0x4d/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver") Signed-off-by: Avihai Horon <avihaih(a)nvidia.com> Reviewed-by: Yi Liu <yi.l.liu(a)intel.com> Tested-by: Yi Liu <yi.l.liu(a)intel.com> Link: https://lore.kernel.org/r/20241124142739.21698-1-avihaih@nvidia.com Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/vfio/pci/vfio_pci_config.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c index 86e917f1cc21..0f20e2d977d4 100644 --- a/drivers/vfio/pci/vfio_pci_config.c +++ b/drivers/vfio/pci/vfio_pci_config.c @@ -315,6 +315,10 @@ static int vfio_virt_config_read(struct vfio_pci_device *vdev, int pos, return count; } +static struct perm_bits direct_ro_perms = { + .readfn = vfio_direct_config_read, +}; + /* Default capability regions to read-only, no-virtualization */ static struct perm_bits cap_perms[PCI_CAP_ID_MAX + 1] = { [0 ... PCI_CAP_ID_MAX] = { .readfn = vfio_direct_config_read } @@ -1837,9 +1841,17 @@ static ssize_t vfio_config_do_rw(struct vfio_pci_device *vdev, char __user *buf, cap_start = *ppos; } else { if (*ppos >= PCI_CFG_SPACE_SIZE) { - WARN_ON(cap_id > PCI_EXT_CAP_ID_MAX); + /* + * We can get a cap_id that exceeds PCI_EXT_CAP_ID_MAX + * if we're hiding an unknown capability at the start + * of the extended capability list. Use default, ro + * access, which will virtualize the id and next values. + */ + if (cap_id > PCI_EXT_CAP_ID_MAX) + perm = &direct_ro_perms; + else + perm = &ecap_perms[cap_id]; - perm = &ecap_perms[cap_id]; cap_start = vfio_find_cap_start(vdev, *ppos); } else { WARN_ON(cap_id > PCI_CAP_ID_MAX); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] um: net: Do not use drvdata in release
by Liu Shixin 03 Jan '25

03 Jan '25

From: Tiwei Bie <tiwei.btw(a)antgroup.com> stable inclusion from stable-v4.19.325 commit b174ab33aaafd556a1ead72fa8e35d70b6fb1e39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEL CVE: CVE-2024-53183 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d1db692a9be3b4bd3473b64fcae996afaffe8438 upstream. The drvdata is not available in release. Let's just use container_of() to get the uml_net instance. Otherwise, removing a network device will result in a crash: RIP: 0033:net_device_release+0x10/0x6f RSP: 00000000e20c7c40 EFLAGS: 00010206 RAX: 000000006002e4e7 RBX: 00000000600f1baf RCX: 00000000624074e0 RDX: 0000000062778000 RSI: 0000000060551c80 RDI: 00000000627af028 RBP: 00000000e20c7c50 R08: 00000000603ad594 R09: 00000000e20c7b70 R10: 000000000000135a R11: 00000000603ad422 R12: 0000000000000000 R13: 0000000062c7af00 R14: 0000000062406d60 R15: 00000000627700b6 Kernel panic - not syncing: Segfault with no mm CPU: 0 UID: 0 PID: 29 Comm: kworker/0:2 Not tainted 6.12.0-rc6-g59b723cd2adb #1 Workqueue: events mc_work_proc Stack: 627af028 62c7af00 e20c7c80 60276fcd 62778000 603f5820 627af028 00000000 e20c7cb0 603a2bcd 627af000 62770010 Call Trace: [<60276fcd>] device_release+0x70/0xba [<603a2bcd>] kobject_put+0xba/0xe7 [<60277265>] put_device+0x19/0x1c [<60281266>] platform_device_put+0x26/0x29 [<60281e5f>] platform_device_unregister+0x2c/0x2e [<6002ec9c>] net_remove+0x63/0x69 [<60031316>] ? mconsole_reply+0x0/0x50 [<600310c8>] mconsole_remove+0x160/0x1cc [<60087d40>] ? __remove_hrtimer+0x38/0x74 [<60087ff8>] ? hrtimer_try_to_cancel+0x8c/0x98 [<6006b3cf>] ? dl_server_stop+0x3f/0x48 [<6006b390>] ? dl_server_stop+0x0/0x48 [<600672e8>] ? dequeue_entities+0x327/0x390 [<60038fa6>] ? um_set_signals+0x0/0x43 [<6003070c>] mc_work_proc+0x77/0x91 [<60057664>] process_scheduled_works+0x1b3/0x2dd [<60055f32>] ? assign_work+0x0/0x58 [<60057f0a>] worker_thread+0x1e9/0x293 [<6005406f>] ? set_pf_worker+0x0/0x64 [<6005d65d>] ? arch_local_irq_save+0x0/0x2d [<6005d748>] ? kthread_exit+0x0/0x3a [<60057d21>] ? worker_thread+0x0/0x293 [<6005dbf1>] kthread+0x126/0x12b [<600219c5>] new_thread_handler+0x85/0xb6 Cc: stable(a)vger.kernel.org Signed-off-by: Tiwei Bie <tiwei.btw(a)antgroup.com> Acked-By: Anton Ivanov <anton.ivanov(a)cambridgegreys.com> Link: https://patch.msgid.link/20241104163203.435515-4-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- arch/um/drivers/net_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c index 3ef1b48e064a..19779e38e077 100644 --- a/arch/um/drivers/net_kern.c +++ b/arch/um/drivers/net_kern.c @@ -349,7 +349,7 @@ static struct platform_driver uml_net_driver = { static void net_device_release(struct device *dev) { - struct uml_net *device = dev_get_drvdata(dev); + struct uml_net *device = container_of(dev, struct uml_net, pdev.dev); struct net_device *netdev = device->dev; struct uml_net_private *lp = netdev_priv(netdev); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
by Wupeng Ma 03 Jan '25

03 Jan '25

From: Alper Nebi Yasak <alpernebiyasak(a)gmail.com> stable inclusion from stable-v4.19.325 commit a09760c513ae0f98c7082a1deace7fb6284ee866 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAE6 CVE: CVE-2024-56539 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d241a139c2e9f8a479f25c75ebd5391e6a448500 ] Replace one-element array with a flexible-array member in `struct mwifiex_ie_types_wildcard_ssid_params` to fix the following warning on a MT8173 Chromebook (mt8173-elm-hana): [ 356.775250] ------------[ cut here ]------------ [ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1) [ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex] The "(size 6)" above is exactly the length of the SSID of the network this device was connected to. The source of the warning looks like: ssid_len = user_scan_in->ssid_list[i].ssid_len; [...] memcpy(wildcard_ssid_tlv->ssid, user_scan_in->ssid_list[i].ssid, ssid_len); There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this struct, but it already didn't account for the size of the one-element array, so it doesn't need to be changed. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Alper Nebi Yasak <alpernebiyasak(a)gmail.com> Acked-by: Brian Norris <briannorris(a)chromium.org> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://patch.msgid.link/20241007222301.24154-1-alpernebiyasak@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h index 1fb76d2f5d3f..4842942c550e 100644 --- a/drivers/net/wireless/marvell/mwifiex/fw.h +++ b/drivers/net/wireless/marvell/mwifiex/fw.h @@ -852,7 +852,7 @@ struct mwifiex_ietypes_chanstats { struct mwifiex_ie_types_wildcard_ssid_params { struct mwifiex_ie_types_header header; u8 max_ssid_length; - u8 ssid[1]; + u8 ssid[]; } __packed; #define TSF_DATA_SIZE 8 -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] f2fs: fix to do sanity check on node blkaddr in truncate_node()
by Yifan Qiao 03 Jan '25

03 Jan '25

From: Chao Yu <chao(a)kernel.org> mainline inclusion from mainline-v6.13-rc1 commit 6babe00ccd34fc65b78ef8b99754e32b4385f23d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDP8 CVE: CVE-2024-56692 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reports a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace: truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909 f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288 f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856 evict+0x4e8/0x9b0 fs/inode.c:723 f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986 f2fs_create+0x357/0x530 fs/f2fs/namei.c:394 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let's add sanity check on nat blkaddr in truncate_node(). Reported-by: syzbot+33379ce4ac76acf7d0c7(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/0000000000009a6cd706224ca720@googl… Cc: stable(a)vger.kernel.org Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/node.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index c63274d4b74b..97c5e521acae 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -838,6 +838,15 @@ static int truncate_node(struct dnode_of_data *dn) if (err) return err; + if (ni.blk_addr != NEW_ADDR && + !f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC_ENHANCE)) { + f2fs_err(sbi, + "nat entry is corrupted, run fsck to fix it, ino:%u, " + "nid:%u, blkaddr:%u", ni.ino, ni.nid, ni.blk_addr); + set_sbi_flag(sbi, SBI_NEED_FSCK); + return -EFSCORRUPTED; + } + /* Deallocate node address */ f2fs_invalidate_blocks(sbi, ni.blk_addr); dec_valid_node_count(sbi, dn->inode, dn->nid == dn->inode->i_ino); -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: fix to do sanity check on node blkaddr in truncate_node()
by Yifan Qiao 03 Jan '25

03 Jan '25

From: Chao Yu <chao(a)kernel.org> mainline inclusion from mainline-v6.13-rc1 commit 6babe00ccd34fc65b78ef8b99754e32b4385f23d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDP8 CVE: CVE-2024-56692 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reports a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace: truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909 f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288 f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856 evict+0x4e8/0x9b0 fs/inode.c:723 f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986 f2fs_create+0x357/0x530 fs/f2fs/namei.c:394 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let's add sanity check on nat blkaddr in truncate_node(). Reported-by: syzbot+33379ce4ac76acf7d0c7(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/0000000000009a6cd706224ca720@googl… Cc: stable(a)vger.kernel.org Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/node.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index 62af4c40eae2..7a4426aeca52 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -838,6 +838,15 @@ static int truncate_node(struct dnode_of_data *dn) if (err) return err; + if (ni.blk_addr != NEW_ADDR && + !f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC_ENHANCE)) { + f2fs_err(sbi, + "nat entry is corrupted, run fsck to fix it, ino:%u, " + "nid:%u, blkaddr:%u", ni.ino, ni.nid, ni.blk_addr); + set_sbi_flag(sbi, SBI_NEED_FSCK); + return -EFSCORRUPTED; + } + /* Deallocate node address */ f2fs_invalidate_blocks(sbi, ni.blk_addr); dec_valid_node_count(sbi, dn->inode, dn->nid == dn->inode->i_ino); -- 2.39.2

2 1

[PATCH OLK-6.6] f2fs: fix to do sanity check on node blkaddr in truncate_node()
by Yifan Qiao 03 Jan '25

03 Jan '25

From: Chao Yu <chao(a)kernel.org> mainline inclusion from mainline-v6.13-rc1 commit 6babe00ccd34fc65b78ef8b99754e32b4385f23d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDP8 CVE: CVE-2024-56692 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reports a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace: truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909 f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288 f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856 evict+0x4e8/0x9b0 fs/inode.c:723 f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986 f2fs_create+0x357/0x530 fs/f2fs/namei.c:394 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let's add sanity check on nat blkaddr in truncate_node(). Reported-by: syzbot+33379ce4ac76acf7d0c7(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/0000000000009a6cd706224ca720@googl… Cc: stable(a)vger.kernel.org Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/node.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index c765bda3beaa..a9ab93d30dce 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -905,6 +905,16 @@ static int truncate_node(struct dnode_of_data *dn) if (err) return err; + if (ni.blk_addr != NEW_ADDR && + !f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC_ENHANCE)) { + f2fs_err_ratelimited(sbi, + "nat entry is corrupted, run fsck to fix it, ino:%u, " + "nid:%u, blkaddr:%u", ni.ino, ni.nid, ni.blk_addr); + set_sbi_flag(sbi, SBI_NEED_FSCK); + f2fs_handle_error(sbi, ERROR_INCONSISTENT_NAT); + return -EFSCORRUPTED; + } + /* Deallocate node address */ f2fs_invalidate_blocks(sbi, ni.blk_addr); dec_valid_node_count(sbi, dn->inode, dn->nid == dn->inode->i_ino); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] RDMA/mlx5: Move events notifier registration to be after device registration
by Pu Lehui 03 Jan '25

03 Jan '25

From: Patrisious Haddad <phaddad(a)nvidia.com> mainline inclusion from mainline-v6.13-rc1 commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADY CVE: CVE-2024-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]--- Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Michael Guralnik <michaelgur(a)nvidia.com> Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.173149694… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/mlx5/main.c drivers/infiniband/hw/mlx5/mlx5_ib.h [The conflicts were due to some minor issue] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 35 +++++++++++++++------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index eb69bec77e5d..afb65ab64a4e 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -3029,7 +3029,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) struct ib_srq_init_attr attr; struct ib_device *ibdev; struct ib_cq_init_attr cq_attr = {.cqe = 1}; - int port; int ret = 0; ibdev = &dev->ib_dev; @@ -3118,10 +3117,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) atomic_inc(&devr->p0->usecnt); atomic_set(&devr->s1->usecnt, 0); - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - INIT_WORK(&devr->ports[port].pkey_change_work, - pkey_change_handler); - return 0; error6: @@ -3148,7 +3143,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; mlx5_ib_destroy_srq(devr->s1, NULL); kfree(devr->s1); @@ -3160,10 +3154,6 @@ static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) kfree(devr->c0); mlx5_ib_dealloc_pd(devr->p0, NULL); kfree(devr->p0); - - /* Make sure no change P_Key work items are still executing */ - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - cancel_work_sync(&devr->ports[port].pkey_change_work); } static u32 get_core_cap_flags(struct ib_device *ibdev, @@ -4562,6 +4552,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev) static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + INIT_WORK(&devr->ports[port].pkey_change_work, + pkey_change_handler); + dev->mdev_events.notifier_call = mlx5_ib_event; mlx5_notifier_register(dev->mdev, &dev->mdev_events); return 0; @@ -4569,7 +4566,13 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + mlx5_notifier_unregister(dev->mdev, &dev->mdev_events); + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + cancel_work_sync(&devr->ports[port].pkey_change_work); } void __mlx5_ib_remove(struct mlx5_ib_dev *dev, @@ -4640,9 +4643,6 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_ODP, mlx5_ib_odp_init_one, mlx5_ib_odp_cleanup_one), @@ -4667,6 +4667,9 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), @@ -4703,9 +4706,6 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_COUNTERS, mlx5_ib_counters_init, mlx5_ib_counters_cleanup), @@ -4727,6 +4727,9 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h index b1f2b34e5955..15afc11bdd6e 100644 --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -826,7 +826,6 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_QP, MLX5_IB_STAGE_SRQ, MLX5_IB_STAGE_DEVICE_RESOURCES, - MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_ODP, MLX5_IB_STAGE_COUNTERS, MLX5_IB_STAGE_CONG_DEBUGFS, @@ -835,6 +834,7 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_PRE_IB_REG_UMR, MLX5_IB_STAGE_WHITELIST_UID, MLX5_IB_STAGE_IB_REG, + MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_POST_IB_REG_UMR, MLX5_IB_STAGE_DELAY_DROP, MLX5_IB_STAGE_RESTRACK, -- 2.34.1

2 1

[openeuler:OLK-6.6 1682/1682] mm/dynamic_pool.c:118:55: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 92381e91108f99289464dbb6fbe45ffc4d6d037b commit: 8822f3476adadcf84c7cb3db0d1a0a39a6fdc398 [1682/1682] mm/dynamic_pool: introduce per-memcg memory pool config: x86_64-randconfig-121-20250101 (https://download.01.org/0day-ci/archive/20250103/202501031628.68zVpLqr-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250103/202501031628.68zVpLqr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031628.68zVpLqr-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/dynamic_pool.c:118:55: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] __rcu * @@ mm/dynamic_pool.c:118:55: sparse: expected struct cgroup_subsys_state *css mm/dynamic_pool.c:118:55: sparse: got struct cgroup_subsys_state [noderef] __rcu * vim +118 mm/dynamic_pool.c 115 116 int dynamic_pool_destroy(struct cgroup *cgrp, bool *clear_css_online) 117 { > 118 struct cgroup_subsys_state *css = cgrp->subsys[memory_cgrp_id]; 119 struct mem_cgroup *memcg = mem_cgroup_from_css(css); 120 struct dynamic_pool *dpool; 121 int ret = 0; 122 123 if (!dpool_enabled || !memcg) 124 return 0; 125 126 mutex_lock(&dpool_mutex); 127 dpool = dpool_get_from_memcg(memcg); 128 if (!dpool) 129 goto unlock; 130 131 if (dpool->memcg != memcg) { 132 memcg->dpool = NULL; 133 goto put; 134 } 135 136 /* A offline dpool is not allowed for allocation */ 137 dpool->online = false; 138 139 memcg->dpool = NULL; 140 141 /* Release the initial reference count */ 142 dpool_put(dpool); 143 144 /* 145 * Since dpool is destroyed and the memcg will be freed then, 146 * clear CSS_ONLINE immediately to prevent race with create. 147 */ 148 if (cgrp->self.flags & CSS_ONLINE) { 149 cgrp->self.flags &= ~CSS_ONLINE; 150 *clear_css_online = true; 151 } 152 153 put: 154 dpool_put(dpool); 155 unlock: 156 mutex_unlock(&dpool_mutex); 157 158 return ret; 159 } 160 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/1] CVE-2024-56567
by Liao Chen 03 Jan '25

03 Jan '25

fix CVE-2024-56567 Zicheng Qu (1): [Backport] ad7780: fix division by zero in ad7780_write_raw() drivers/iio/adc/ad7780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-56567
by Liao Chen 03 Jan '25

03 Jan '25

fix CVE-2024-56567 Zicheng Qu (1): [Backport] ad7780: fix division by zero in ad7780_write_raw() drivers/iio/adc/ad7780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-56677
by Liao Chen 03 Jan '25

03 Jan '25

fix CVE-2024-56677 Ritesh Harjani (IBM) (1): powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() arch/powerpc/include/asm/fadump.h | 7 +++++++ arch/powerpc/kernel/fadump.c | 6 +----- arch/powerpc/kernel/setup-common.c | 6 ++++-- 3 files changed, 12 insertions(+), 7 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] um: ubd: Do not use drvdata in release
by Yuan Can 03 Jan '25

03 Jan '25

From: Tiwei Bie <tiwei.btw(a)antgroup.com> stable inclusion from stable-v4.19.325 commit 23d742a3fcd4781eed015a3a93e6a0e3ab1ef2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEN CVE: CVE-2024-53184 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5bee35e5389f450a7eea7318deb9073e9414d3b1 upstream. The drvdata is not available in release. Let's just use container_of() to get the ubd instance. Otherwise, removing a ubd device will result in a crash: RIP: 0033:blk_mq_free_tag_set+0x1f/0xba RSP: 00000000e2083bf0 EFLAGS: 00010246 RAX: 000000006021463a RBX: 0000000000000348 RCX: 0000000062604d00 RDX: 0000000004208060 RSI: 00000000605241a0 RDI: 0000000000000348 RBP: 00000000e2083c10 R08: 0000000062414010 R09: 00000000601603f7 R10: 000000000000133a R11: 000000006038c4bd R12: 0000000000000000 R13: 0000000060213a5c R14: 0000000062405d20 R15: 00000000604f7aa0 Kernel panic - not syncing: Segfault with no mm CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.8.0-rc3-00107-gba3f67c11638 #1 Workqueue: events mc_work_proc Stack: 00000000 604f7ef0 62c5d000 62405d20 e2083c30 6002c776 6002c755 600e47ff e2083c60 6025ffe3 04208060 603d36e0 Call Trace: [<6002c776>] ubd_device_release+0x21/0x55 [<6002c755>] ? ubd_device_release+0x0/0x55 [<600e47ff>] ? kfree+0x0/0x100 [<6025ffe3>] device_release+0x70/0xba [<60381d6a>] kobject_put+0xb5/0xe2 [<6026027b>] put_device+0x19/0x1c [<6026a036>] platform_device_put+0x26/0x29 [<6026ac5a>] platform_device_unregister+0x2c/0x2e [<6002c52e>] ubd_remove+0xb8/0xd6 [<6002bb74>] ? mconsole_reply+0x0/0x50 [<6002b926>] mconsole_remove+0x160/0x1cc [<6002bbbc>] ? mconsole_reply+0x48/0x50 [<6003379c>] ? um_set_signals+0x3b/0x43 [<60061c55>] ? update_min_vruntime+0x14/0x70 [<6006251f>] ? dequeue_task_fair+0x164/0x235 [<600620aa>] ? update_cfs_group+0x0/0x40 [<603a0e77>] ? __schedule+0x0/0x3ed [<60033761>] ? um_set_signals+0x0/0x43 [<6002af6a>] mc_work_proc+0x77/0x91 [<600520b4>] process_scheduled_works+0x1af/0x2c3 [<6004ede3>] ? assign_work+0x0/0x58 [<600527a1>] worker_thread+0x2f7/0x37a [<6004ee3b>] ? set_pf_worker+0x0/0x64 [<6005765d>] ? arch_local_irq_save+0x0/0x2d [<60058e07>] ? kthread_exit+0x0/0x3a [<600524aa>] ? worker_thread+0x0/0x37a [<60058f9f>] kthread+0x130/0x135 [<6002068e>] new_thread_handler+0x85/0xb6 Cc: stable(a)vger.kernel.org Signed-off-by: Tiwei Bie <tiwei.btw(a)antgroup.com> Acked-By: Anton Ivanov <anton.ivanov(a)cambridgegreys.com> Link: https://patch.msgid.link/20241104163203.435515-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/um/drivers/ubd_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c index 83c470364dfb..709aa3e0af3f 100644 --- a/arch/um/drivers/ubd_kern.c +++ b/arch/um/drivers/ubd_kern.c @@ -854,7 +854,7 @@ static int ubd_open_dev(struct ubd *ubd_dev) static void ubd_device_release(struct device *dev) { - struct ubd *ubd_dev = dev_get_drvdata(dev); + struct ubd *ubd_dev = container_of(dev, struct ubd, pdev.dev); blk_cleanup_queue(ubd_dev->queue); *ubd_dev = ((struct ubd) DEFAULT_UBD); -- 2.22.0

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56677
by Liao Chen 03 Jan '25

03 Jan '25

fix CVE-2024-56677 Ritesh Harjani (IBM) (1): [Backport] powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() arch/powerpc/include/asm/fadump.h | 7 +++++++ arch/powerpc/kernel/fadump.c | 6 +----- arch/powerpc/kernel/setup-common.c | 6 ++++-- 3 files changed, 12 insertions(+), 7 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-53158
by Lin Yujun 03 Jan '25

03 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[openeuler:OLK-6.6 1673/1673] arch/x86/kvm/svm/csv.c:129:52: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c2f1662c3fb301fe7ba127fe06c14538112982d4 commit: 07a18fb6c71ef75cc1205999cd2493b567649466 [1673/1673] KVM: SVM: Prepare memory pool to allocate buffers for KVM_CSV_COMMAND_BATCH config: x86_64-randconfig-121-20241230 (https://download.01.org/0day-ci/archive/20250103/202501031232.HaQu3mzq-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250103/202501031232.HaQu3mzq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031232.HaQu3mzq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/x86/kvm/svm/csv.c:53:5: sparse: sparse: symbol 'csv_vm_attestation' was not declared. Should it be static? >> arch/x86/kvm/svm/csv.c:129:52: sparse: sparse: Using plain integer as NULL pointer >> arch/x86/kvm/svm/csv.c:129:6: sparse: sparse: symbol 'g_trans_mempool' was not declared. Should it be static? vim +129 arch/x86/kvm/svm/csv.c 52 > 53 int csv_vm_attestation(struct kvm *kvm, unsigned long gpa, unsigned long len) 54 { 55 struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; 56 struct sev_data_attestation_report *data = NULL; 57 struct page **pages; 58 unsigned long guest_uaddr, n; 59 int ret = 0, offset, error; 60 61 if (!sev_guest(kvm) || !hygon_kvm_hooks.sev_hooks_installed) 62 return -ENOTTY; 63 64 /* 65 * The physical address of guest must valid and page aligned, and 66 * the length of guest memory region must be page size aligned. 67 */ 68 if (!gpa || (gpa & ~PAGE_MASK) || (len & ~PAGE_MASK)) { 69 pr_err("invalid guest address or length\n"); 70 return -EFAULT; 71 } 72 73 guest_uaddr = gfn_to_hva(kvm, gpa_to_gfn(gpa)); 74 pages = hygon_kvm_hooks.sev_pin_memory(kvm, guest_uaddr, len, &n, 1); 75 if (IS_ERR(pages)) 76 return PTR_ERR(pages); 77 78 /* 79 * The attestation report must be copied into contiguous memory region, 80 * lets verify that userspace memory pages are contiguous before we 81 * issue commmand. 82 */ 83 if (hygon_kvm_hooks.get_num_contig_pages(0, pages, n) != n) { 84 ret = -EINVAL; 85 goto e_unpin_memory; 86 } 87 88 ret = -ENOMEM; 89 data = kzalloc(sizeof(*data), GFP_KERNEL); 90 if (!data) 91 goto e_unpin_memory; 92 93 /* csv_vm_mnonce indicates attestation request from guest */ 94 if (sizeof(csv_vm_mnonce) >= sizeof(data->mnonce)) { 95 ret = -EINVAL; 96 goto e_free; 97 } 98 99 memcpy(data->mnonce, csv_vm_mnonce, sizeof(csv_vm_mnonce)); 100 101 offset = guest_uaddr & (PAGE_SIZE - 1); 102 data->address = __sme_page_pa(pages[0]) + offset; 103 data->len = len; 104 105 data->handle = sev->handle; 106 ret = hygon_kvm_hooks.sev_issue_cmd(kvm, SEV_CMD_ATTESTATION_REPORT, 107 data, &error); 108 109 if (ret) 110 pr_err("vm attestation ret %#x, error %#x\n", ret, error); 111 112 e_free: 113 kfree(data); 114 e_unpin_memory: 115 hygon_kvm_hooks.sev_unpin_memory(kvm, pages, n); 116 return ret; 117 } 118 119 /*--1024--1023--1024--1023--*/ 120 #define TRANS_MEMPOOL_1ST_BLOCK_OFFSET 0 121 #define TRANS_MEMPOOL_2ND_BLOCK_OFFSET (1024 << PAGE_SHIFT) 122 #define TRANS_MEMPOOL_3RD_BLOCK_OFFSET (2047 << PAGE_SHIFT) 123 #define TRANS_MEMPOOL_4TH_BLOCK_OFFSET (3071 << PAGE_SHIFT) 124 #define TRANS_MEMPOOL_BLOCKS_MAX_OFFSET (4094 << PAGE_SHIFT) 125 #define TRANS_MEMPOOL_BLOCK_NUM 4 126 #define TRANS_MEMPOOL_BLOCK_SIZE (1024 * PAGE_SIZE) 127 128 static size_t g_mempool_offset; > 129 void *g_trans_mempool[TRANS_MEMPOOL_BLOCK_NUM] = { 0, }; 130 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1693/1693] drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:19: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c2f1662c3fb301fe7ba127fe06c14538112982d4 commit: 2815e6db6a7a2f0759dfc574e28b3b807a1a3377 [1693/1693] drm/loongson: use old version of ast driver for LoongArch platform config: loongarch-randconfig-r112-20250103 (https://download.01.org/0day-ci/archive/20250103/202501031239.NY9f5zcm-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250103/202501031239.NY9f5zcm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031239.NY9f5zcm-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:19: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:16: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *dstxor @@ got unsigned char [usertype] * @@ drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:16: sparse: expected unsigned char [noderef] [usertype] __iomem *dstxor drivers/gpu/drm/loongson/ast_old/ast_mode.c:746:16: sparse: got unsigned char [usertype] * drivers/gpu/drm/loongson/ast_old/ast_mode.c: note: in included file (through arch/loongarch/include/asm/cpu-info.h, arch/loongarch/include/asm/processor.h, ...): arch/loongarch/include/asm/loongarch.h:1136:16: sparse: sparse: undefined identifier '__builtin_loongarch_csrrd_w' vim +/__iomem +746 drivers/gpu/drm/loongson/ast_old/ast_mode.c 719 720 /* 721 * Cursor plane 722 */ 723 724 static void ast_update_cursor_image(u8 __iomem *dst, const u8 *src, int width, 725 int height) 726 { 727 union { 728 u32 ul; 729 u8 b[4]; 730 } srcdata32[2], data32; 731 union { 732 u16 us; 733 u8 b[2]; 734 } data16; 735 u32 csum = 0; 736 s32 alpha_dst_delta, last_alpha_dst_delta; 737 u8 __iomem *dstxor; 738 const u8 *srcxor; 739 int i, j; 740 u32 per_pixel_copy, two_pixel_copy; 741 742 alpha_dst_delta = AST_MAX_HWC_WIDTH << 1; 743 last_alpha_dst_delta = alpha_dst_delta - (width << 1); 744 745 srcxor = src; > 746 dstxor = (u8 *)dst + last_alpha_dst_delta + 747 (AST_MAX_HWC_HEIGHT - height) * alpha_dst_delta; 748 per_pixel_copy = width & 1; 749 two_pixel_copy = width >> 1; 750 751 for (j = 0; j < height; j++) { 752 for (i = 0; i < two_pixel_copy; i++) { 753 srcdata32[0].ul = *((u32 *)srcxor) & 0xf0f0f0f0; 754 srcdata32[1].ul = *((u32 *)(srcxor + 4)) & 0xf0f0f0f0; 755 data32.b[0] = srcdata32[0].b[1] | 756 (srcdata32[0].b[0] >> 4); 757 data32.b[1] = srcdata32[0].b[3] | 758 (srcdata32[0].b[2] >> 4); 759 data32.b[2] = srcdata32[1].b[1] | 760 (srcdata32[1].b[0] >> 4); 761 data32.b[3] = srcdata32[1].b[3] | 762 (srcdata32[1].b[2] >> 4); 763 764 writel(data32.ul, dstxor); 765 csum += data32.ul; 766 767 dstxor += 4; 768 srcxor += 8; 769 } 770 771 for (i = 0; i < per_pixel_copy; i++) { 772 srcdata32[0].ul = *((u32 *)srcxor) & 0xf0f0f0f0; 773 data16.b[0] = srcdata32[0].b[1] | 774 (srcdata32[0].b[0] >> 4); 775 data16.b[1] = srcdata32[0].b[3] | 776 (srcdata32[0].b[2] >> 4); 777 writew(data16.us, dstxor); 778 csum += (u32)data16.us; 779 780 dstxor += 2; 781 srcxor += 4; 782 } 783 dstxor += last_alpha_dst_delta; 784 } 785 786 /* write checksum + signature */ 787 dst += AST_HWC_SIZE; 788 writel(csum, dst); 789 writel(width, dst + AST_HWC_SIGNATURE_SizeX); 790 writel(height, dst + AST_HWC_SIGNATURE_SizeY); 791 writel(0, dst + AST_HWC_SIGNATURE_HOTSPOTX); 792 writel(0, dst + AST_HWC_SIGNATURE_HOTSPOTY); 793 } 794 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
by Liu Mingrui 03 Jan '25

03 Jan '25

From: Lianqin Hu <hulianqin(a)vivo.com> stable inclusion from stable-v5.10.232 commit 28b3c03a6790de1f6f2683919ad657840f0f0f58 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO8 CVE: CVE-2024-56670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b upstream. Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Thread A is executing the open operation and calling the gs_open, Thread B is executing the disconnect operation and calling the gserial_disconnect function,The port->port_usb pointer will be set to NULL. E.g. Thread A Thread B gs_open() gadget_unbind_driver() gs_start_io() composite_disconnect() gs_start_rx() gserial_disconnect() ... ... spin_unlock(&port->port_lock) status = usb_ep_queue() spin_lock(&port->port_lock) spin_lock(&port->port_lock) port->port_usb = NULL gs_free_requests(port->port_usb->in) spin_unlock(&port->port_lock) Crash This causes thread A to access a null pointer (port->port_usb is null) when calling the gs_free_requests function, causing a crash. If port_usb is NULL, the release request will be skipped as it will be done by gserial_disconnect. So add a null pointer check to gs_start_io before attempting to access the value of the pointer port->port_usb. Call trace: gs_start_io+0x164/0x25c gs_open+0x108/0x13c tty_open+0x314/0x638 chrdev_open+0x1b8/0x258 do_dentry_open+0x2c4/0x700 vfs_open+0x2c/0x3c path_openat+0xa64/0xc60 do_filp_open+0xb8/0x164 do_sys_openat2+0x84/0xf0 __arm64_sys_openat+0x70/0x9c invoke_syscall+0x58/0x114 el0_svc_common+0x80/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x38/0x68 Fixes: c1dca562be8a ("usb gadget: split out serial core") Cc: stable(a)vger.kernel.org Suggested-by: Prashanth K <quic_prashk(a)quicinc.com> Signed-off-by: Lianqin Hu <hulianqin(a)vivo.com> Acked-by: Prashanth K <quic_prashk(a)quicinc.com> Link: https://lore.kernel.org/r/TYUPR06MB62178DC3473F9E1A537DCD02D2362@TYUPR06MB6… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/gadget/function/u_serial.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 2caccbb6e014..b3cb3bef06d2 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -569,9 +569,12 @@ static int gs_start_io(struct gs_port *port) * we didn't in gs_start_tx() */ tty_wakeup(port->port.tty); } else { - gs_free_requests(ep, head, &port->read_allocated); - gs_free_requests(port->port_usb->in, &port->write_pool, - &port->write_allocated); + /* Free reqs only if we are still connected */ + if (port->port_usb) { + gs_free_requests(ep, head, &port->read_allocated); + gs_free_requests(port->port_usb->in, &port->write_pool, + &port->write_allocated); + } status = -EIO; } -- 2.25.1

2 8

[PATCH OLK-5.10] usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
by Liu Mingrui 03 Jan '25

03 Jan '25

From: Lianqin Hu <hulianqin(a)vivo.com> stable inclusion from stable-v5.10.232 commit 28b3c03a6790de1f6f2683919ad657840f0f0f58 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO8 CVE: CVE-2024-56670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b upstream. Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Thread A is executing the open operation and calling the gs_open, Thread B is executing the disconnect operation and calling the gserial_disconnect function,The port->port_usb pointer will be set to NULL. E.g. Thread A Thread B gs_open() gadget_unbind_driver() gs_start_io() composite_disconnect() gs_start_rx() gserial_disconnect() ... ... spin_unlock(&port->port_lock) status = usb_ep_queue() spin_lock(&port->port_lock) spin_lock(&port->port_lock) port->port_usb = NULL gs_free_requests(port->port_usb->in) spin_unlock(&port->port_lock) Crash This causes thread A to access a null pointer (port->port_usb is null) when calling the gs_free_requests function, causing a crash. If port_usb is NULL, the release request will be skipped as it will be done by gserial_disconnect. So add a null pointer check to gs_start_io before attempting to access the value of the pointer port->port_usb. Call trace: gs_start_io+0x164/0x25c gs_open+0x108/0x13c tty_open+0x314/0x638 chrdev_open+0x1b8/0x258 do_dentry_open+0x2c4/0x700 vfs_open+0x2c/0x3c path_openat+0xa64/0xc60 do_filp_open+0xb8/0x164 do_sys_openat2+0x84/0xf0 __arm64_sys_openat+0x70/0x9c invoke_syscall+0x58/0x114 el0_svc_common+0x80/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x38/0x68 Fixes: c1dca562be8a ("usb gadget: split out serial core") Cc: stable(a)vger.kernel.org Suggested-by: Prashanth K <quic_prashk(a)quicinc.com> Signed-off-by: Lianqin Hu <hulianqin(a)vivo.com> Acked-by: Prashanth K <quic_prashk(a)quicinc.com> Link: https://lore.kernel.org/r/TYUPR06MB62178DC3473F9E1A537DCD02D2362@TYUPR06MB6… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/gadget/function/u_serial.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 2caccbb6e014..b3cb3bef06d2 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -569,9 +569,12 @@ static int gs_start_io(struct gs_port *port) * we didn't in gs_start_tx() */ tty_wakeup(port->port.tty); } else { - gs_free_requests(ep, head, &port->read_allocated); - gs_free_requests(port->port_usb->in, &port->write_pool, - &port->write_allocated); + /* Free reqs only if we are still connected */ + if (port->port_usb) { + gs_free_requests(ep, head, &port->read_allocated); + gs_free_requests(port->port_usb->in, &port->write_pool, + &port->write_allocated); + } status = -EIO; } -- 2.25.1

2 9

[PATCH OLK-6.6] usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
by Liu Mingrui 03 Jan '25

03 Jan '25

From: Lianqin Hu <hulianqin(a)vivo.com> stable inclusion from stable-v6.6.67 commit 8ca07a3d18f39b1669927ef536e485787e856df6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO8 CVE: CVE-2024-56670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b upstream. Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Thread A is executing the open operation and calling the gs_open, Thread B is executing the disconnect operation and calling the gserial_disconnect function,The port->port_usb pointer will be set to NULL. E.g. Thread A Thread B gs_open() gadget_unbind_driver() gs_start_io() composite_disconnect() gs_start_rx() gserial_disconnect() ... ... spin_unlock(&port->port_lock) status = usb_ep_queue() spin_lock(&port->port_lock) spin_lock(&port->port_lock) port->port_usb = NULL gs_free_requests(port->port_usb->in) spin_unlock(&port->port_lock) Crash This causes thread A to access a null pointer (port->port_usb is null) when calling the gs_free_requests function, causing a crash. If port_usb is NULL, the release request will be skipped as it will be done by gserial_disconnect. So add a null pointer check to gs_start_io before attempting to access the value of the pointer port->port_usb. Call trace: gs_start_io+0x164/0x25c gs_open+0x108/0x13c tty_open+0x314/0x638 chrdev_open+0x1b8/0x258 do_dentry_open+0x2c4/0x700 vfs_open+0x2c/0x3c path_openat+0xa64/0xc60 do_filp_open+0xb8/0x164 do_sys_openat2+0x84/0xf0 __arm64_sys_openat+0x70/0x9c invoke_syscall+0x58/0x114 el0_svc_common+0x80/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x38/0x68 Fixes: c1dca562be8a ("usb gadget: split out serial core") Cc: stable(a)vger.kernel.org Suggested-by: Prashanth K <quic_prashk(a)quicinc.com> Signed-off-by: Lianqin Hu <hulianqin(a)vivo.com> Acked-by: Prashanth K <quic_prashk(a)quicinc.com> Link: https://lore.kernel.org/r/TYUPR06MB62178DC3473F9E1A537DCD02D2362@TYUPR06MB6… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/gadget/function/u_serial.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 8962f96ae729..729b0472bab0 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -575,9 +575,12 @@ static int gs_start_io(struct gs_port *port) * we didn't in gs_start_tx() */ tty_wakeup(port->port.tty); } else { - gs_free_requests(ep, head, &port->read_allocated); - gs_free_requests(port->port_usb->in, &port->write_pool, - &port->write_allocated); + /* Free reqs only if we are still connected */ + if (port->port_usb) { + gs_free_requests(ep, head, &port->read_allocated); + gs_free_requests(port->port_usb->in, &port->write_pool, + &port->write_allocated); + } status = -EIO; } -- 2.25.1

2 9

[PATCH openEuler-1.0-LTS] selinux: ignore unknown extended permissions
by Gu Bowen 03 Jan '25

03 Jan '25

From: Thiébaud Weksteen <tweek(a)google.com> mainline inclusion from mainline-v6.13-rc4 commit 900f83cf376bdaf798b6f5dcb2eae0c822e908b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEUBD Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels. Cc: stable(a)vger.kernel.org Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") Signed-off-by: Thiébaud Weksteen <tweek(a)google.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Conflicts: security/selinux/ss/services.c [Due to commit d1d991efaf346 ("selinux: Add netlink xperm support") add a new policy and refactored the function, there are context conflicts happened.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/selinux/ss/services.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index a1ea7d90ce4f..83b499980041 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -965,7 +965,10 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, xpermd->driver)) return; } else { - BUG(); + pr_warn_once( + "SELinux: unknown extended permission (%u) will be ignored\n", + node->datum.u.xperms->specified); + return; } if (node->key.specified == AVTAB_XPERMS_ALLOWED) { @@ -1002,7 +1005,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, node->datum.u.xperms->perms.p[i]; } } else { - BUG(); + pr_warn_once("SELinux: unknown specified key (%u)\n", + node->key.specified); } } -- 2.25.1

2 1

[PATCH OLK-6.6] net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Oleksij Rempel <o.rempel(a)pengutronix.de> stable inclusion from stable-v6.6.64 commit a422ebec863d99d5607fb41bb7af3347fcb436d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEY CVE: CVE-2024-53213 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 03819abbeb11117dcbba40bfe322b88c0c88a6b6 ] In lan78xx_probe(), the buffer `buf` was being freed twice: once implicitly through `usb_free_urb(dev->urb_intr)` with the `URB_FREE_BUFFER` flag and again explicitly by `kfree(buf)`. This caused a double free issue. To resolve this, reordered `kmalloc()` and `usb_alloc_urb()` calls to simplify the initialization sequence and removed the redundant `kfree(buf)`. Now, `buf` is allocated after `usb_alloc_urb()`, ensuring it is correctly managed by `usb_fill_int_urb()` and freed by `usb_free_urb()` as intended. Fixes: a6df95cae40b ("lan78xx: Fix memory allocation bug") Cc: John Efstathiades <john.efstathiades(a)pebblebay.com> Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://patch.msgid.link/20241116130558.1352230-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/net/usb/lan78xx.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c index 921ae046f860..2ae33ecb6749 100644 --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c @@ -4414,29 +4414,30 @@ static int lan78xx_probe(struct usb_interface *intf, period = ep_intr->desc.bInterval; maxp = usb_maxpacket(dev->udev, dev->pipe_intr); - buf = kmalloc(maxp, GFP_KERNEL); - if (!buf) { + + dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL); + if (!dev->urb_intr) { ret = -ENOMEM; goto out5; } - dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL); - if (!dev->urb_intr) { + buf = kmalloc(maxp, GFP_KERNEL); + if (!buf) { ret = -ENOMEM; - goto out6; - } else { - usb_fill_int_urb(dev->urb_intr, dev->udev, - dev->pipe_intr, buf, maxp, - intr_complete, dev, period); - dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; + goto free_urbs; } + usb_fill_int_urb(dev->urb_intr, dev->udev, + dev->pipe_intr, buf, maxp, + intr_complete, dev, period); + dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; + dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out); /* Reject broken descriptors. */ if (dev->maxpacket == 0) { ret = -ENODEV; - goto out6; + goto free_urbs; } /* driver requires remote-wakeup capability during autosuspend. */ @@ -4444,7 +4445,7 @@ static int lan78xx_probe(struct usb_interface *intf, ret = lan78xx_phy_init(dev); if (ret < 0) - goto out7; + goto free_urbs; ret = register_netdev(netdev); if (ret != 0) { @@ -4466,10 +4467,8 @@ static int lan78xx_probe(struct usb_interface *intf, out8: phy_disconnect(netdev->phydev); -out7: +free_urbs: usb_free_urb(dev->urb_intr); -out6: - kfree(buf); out5: lan78xx_unbind(dev, intf); out4: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v4.19.325 commit d16109c9fdc1b8cea4fe63b42e06e926c3f68990 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 1cf4019689a5..8b8453dab660 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -472,11 +472,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 2

[PATCH openEuler-22.03-LTS-SP1] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v5.10.231 commit d7408a052aa1b4f6fb6f1c7a8877b84017a07ac9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 6142484d5cb4..d9287a935a9e 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -465,11 +465,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 2

[PATCH OLK-5.10] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v5.10.231 commit d7408a052aa1b4f6fb6f1c7a8877b84017a07ac9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 6142484d5cb4..d9287a935a9e 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -465,11 +465,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 2

[PATCH OLK-6.6] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v6.6.64 commit 378ce4e08ca2b1ac7bbf1d57b68643ca4226c5f8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 3da8e5102bec..1225dab9fc7d 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -466,11 +466,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 3

[openeuler:OLK-6.6 1673/1673] arch/x86/kvm/svm/csv.c:30:5: sparse: sparse: symbol 'csv_vm_attestation' was not declared. Should it be static?
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c2f1662c3fb301fe7ba127fe06c14538112982d4 commit: 0f13b8634792cff1f2fb18bf35e5a24d7a8cbf8e [1673/1673] KVM: x86: Support VM_ATTESTATION hypercall config: x86_64-randconfig-121-20241230 (https://download.01.org/0day-ci/archive/20250103/202501031119.BkQTUZGn-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250103/202501031119.BkQTUZGn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031119.BkQTUZGn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kvm/svm/csv.c:30:5: sparse: sparse: symbol 'csv_vm_attestation' was not declared. Should it be static? vim +/csv_vm_attestation +30 arch/x86/kvm/svm/csv.c 29 > 30 int csv_vm_attestation(struct kvm *kvm, unsigned long gpa, unsigned long len) 31 { 32 struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; 33 struct sev_data_attestation_report *data = NULL; 34 struct page **pages; 35 unsigned long guest_uaddr, n; 36 int ret = 0, offset, error; 37 38 if (!sev_guest(kvm) || !hygon_kvm_hooks.sev_hooks_installed) 39 return -ENOTTY; 40 41 /* 42 * The physical address of guest must valid and page aligned, and 43 * the length of guest memory region must be page size aligned. 44 */ 45 if (!gpa || (gpa & ~PAGE_MASK) || (len & ~PAGE_MASK)) { 46 pr_err("invalid guest address or length\n"); 47 return -EFAULT; 48 } 49 50 guest_uaddr = gfn_to_hva(kvm, gpa_to_gfn(gpa)); 51 pages = hygon_kvm_hooks.sev_pin_memory(kvm, guest_uaddr, len, &n, 1); 52 if (IS_ERR(pages)) 53 return PTR_ERR(pages); 54 55 /* 56 * The attestation report must be copied into contiguous memory region, 57 * lets verify that userspace memory pages are contiguous before we 58 * issue commmand. 59 */ 60 if (hygon_kvm_hooks.get_num_contig_pages(0, pages, n) != n) { 61 ret = -EINVAL; 62 goto e_unpin_memory; 63 } 64 65 ret = -ENOMEM; 66 data = kzalloc(sizeof(*data), GFP_KERNEL); 67 if (!data) 68 goto e_unpin_memory; 69 70 /* csv_vm_mnonce indicates attestation request from guest */ 71 if (sizeof(csv_vm_mnonce) >= sizeof(data->mnonce)) { 72 ret = -EINVAL; 73 goto e_free; 74 } 75 76 memcpy(data->mnonce, csv_vm_mnonce, sizeof(csv_vm_mnonce)); 77 78 offset = guest_uaddr & (PAGE_SIZE - 1); 79 data->address = __sme_page_pa(pages[0]) + offset; 80 data->len = len; 81 82 data->handle = sev->handle; 83 ret = hygon_kvm_hooks.sev_issue_cmd(kvm, SEV_CMD_ATTESTATION_REPORT, 84 data, &error); 85 86 if (ret) 87 pr_err("vm attestation ret %#x, error %#x\n", ret, error); 88 89 e_free: 90 kfree(data); 91 e_unpin_memory: 92 hygon_kvm_hooks.sev_unpin_memory(kvm, pages, n); 93 return ret; 94 } 95 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] um: ubd: Do not use drvdata in release
by Yuan Can 03 Jan '25

03 Jan '25

From: Tiwei Bie <tiwei.btw(a)antgroup.com> stable inclusion from stable-v4.19.325 commit 23d742a3fcd4781eed015a3a93e6a0e3ab1ef2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEN CVE: CVE-2024-53184 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5bee35e5389f450a7eea7318deb9073e9414d3b1 upstream. The drvdata is not available in release. Let's just use container_of() to get the ubd instance. Otherwise, removing a ubd device will result in a crash: RIP: 0033:blk_mq_free_tag_set+0x1f/0xba RSP: 00000000e2083bf0 EFLAGS: 00010246 RAX: 000000006021463a RBX: 0000000000000348 RCX: 0000000062604d00 RDX: 0000000004208060 RSI: 00000000605241a0 RDI: 0000000000000348 RBP: 00000000e2083c10 R08: 0000000062414010 R09: 00000000601603f7 R10: 000000000000133a R11: 000000006038c4bd R12: 0000000000000000 R13: 0000000060213a5c R14: 0000000062405d20 R15: 00000000604f7aa0 Kernel panic - not syncing: Segfault with no mm CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.8.0-rc3-00107-gba3f67c11638 #1 Workqueue: events mc_work_proc Stack: 00000000 604f7ef0 62c5d000 62405d20 e2083c30 6002c776 6002c755 600e47ff e2083c60 6025ffe3 04208060 603d36e0 Call Trace: [<6002c776>] ubd_device_release+0x21/0x55 [<6002c755>] ? ubd_device_release+0x0/0x55 [<600e47ff>] ? kfree+0x0/0x100 [<6025ffe3>] device_release+0x70/0xba [<60381d6a>] kobject_put+0xb5/0xe2 [<6026027b>] put_device+0x19/0x1c [<6026a036>] platform_device_put+0x26/0x29 [<6026ac5a>] platform_device_unregister+0x2c/0x2e [<6002c52e>] ubd_remove+0xb8/0xd6 [<6002bb74>] ? mconsole_reply+0x0/0x50 [<6002b926>] mconsole_remove+0x160/0x1cc [<6002bbbc>] ? mconsole_reply+0x48/0x50 [<6003379c>] ? um_set_signals+0x3b/0x43 [<60061c55>] ? update_min_vruntime+0x14/0x70 [<6006251f>] ? dequeue_task_fair+0x164/0x235 [<600620aa>] ? update_cfs_group+0x0/0x40 [<603a0e77>] ? __schedule+0x0/0x3ed [<60033761>] ? um_set_signals+0x0/0x43 [<6002af6a>] mc_work_proc+0x77/0x91 [<600520b4>] process_scheduled_works+0x1af/0x2c3 [<6004ede3>] ? assign_work+0x0/0x58 [<600527a1>] worker_thread+0x2f7/0x37a [<6004ee3b>] ? set_pf_worker+0x0/0x64 [<6005765d>] ? arch_local_irq_save+0x0/0x2d [<60058e07>] ? kthread_exit+0x0/0x3a [<600524aa>] ? worker_thread+0x0/0x37a [<60058f9f>] kthread+0x130/0x135 [<6002068e>] new_thread_handler+0x85/0xb6 Cc: stable(a)vger.kernel.org Signed-off-by: Tiwei Bie <tiwei.btw(a)antgroup.com> Acked-By: Anton Ivanov <anton.ivanov(a)cambridgegreys.com> Link: https://patch.msgid.link/20241104163203.435515-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/um/drivers/ubd_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c index 83c470364dfb..709aa3e0af3f 100644 --- a/arch/um/drivers/ubd_kern.c +++ b/arch/um/drivers/ubd_kern.c @@ -854,7 +854,7 @@ static int ubd_open_dev(struct ubd *ubd_dev) static void ubd_device_release(struct device *dev) { - struct ubd *ubd_dev = dev_get_drvdata(dev); + struct ubd *ubd_dev = container_of(dev, struct ubd, pdev.dev); blk_cleanup_queue(ubd_dev->queue); *ubd_dev = ((struct ubd) DEFAULT_UBD); -- 2.22.0

2 5

[PATCH openEuler-1.0-LTS] media: wl128x: Fix atomicity violation in fmc_send_cmd()
by dinglongwei 03 Jan '25

03 Jan '25

From: Qiu-ji Chen <chenqiuji666(a)gmail.com> stable inclusion from stable-v4.19.325 commit d16109c9fdc1b8cea4fe63b42e06e926c3f68990 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOW CVE: CVE-2024-56700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca59f9956d4519ab18ab2270be47c6b8c6ced091 upstream. Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev->resp_skb variable is assigned a null value. This results in an invalid fmdev->resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev->resp_skb; when the invalid fmdev->resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb->data; To address this issue, it is recommended to include the validity check of fmdev->resp_skb within the locked section of the function. This modification ensures that the value of fmdev->resp_skb does not change during the validation process, thereby maintaining its validity. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/media/radio/wl128x/fmdrv_common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 1cf4019689a5..8b8453dab660 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -472,11 +472,12 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, jiffies_to_msecs(FM_DRV_TX_TIMEOUT) / 1000); return -ETIMEDOUT; } + spin_lock_irqsave(&fmdev->resp_skb_lock, flags); if (!fmdev->resp_skb) { + spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); fmerr("Response SKB is missing\n"); return -EFAULT; } - spin_lock_irqsave(&fmdev->resp_skb_lock, flags); skb = fmdev->resp_skb; fmdev->resp_skb = NULL; spin_unlock_irqrestore(&fmdev->resp_skb_lock, flags); -- 2.22.0

2 5

[PATCH OLK-5.10] RDMA/mlx5: Move events notifier registration to be after device registration
by Pu Lehui 03 Jan '25

03 Jan '25

From: Patrisious Haddad <phaddad(a)nvidia.com> mainline inclusion from mainline-v6.13-rc1 commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADY CVE: CVE-2024-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]--- Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Michael Guralnik <michaelgur(a)nvidia.com> Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.173149694… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/mlx5/main.c drivers/infiniband/hw/mlx5/mlx5_ib.h [The conflicts were due to some minor issue] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 35 +++++++++++++++------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index fc331dd9909b..982be8a8bba8 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -3045,7 +3045,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) struct ib_srq_init_attr attr; struct ib_device *ibdev; struct ib_cq_init_attr cq_attr = {.cqe = 1}; - int port; int ret = 0; ibdev = &dev->ib_dev; @@ -3134,10 +3133,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) atomic_inc(&devr->p0->usecnt); atomic_set(&devr->s1->usecnt, 0); - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - INIT_WORK(&devr->ports[port].pkey_change_work, - pkey_change_handler); - return 0; error6: @@ -3164,7 +3159,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; mlx5_ib_destroy_srq(devr->s1, NULL); kfree(devr->s1); @@ -3176,10 +3170,6 @@ static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) kfree(devr->c0); mlx5_ib_dealloc_pd(devr->p0, NULL); kfree(devr->p0); - - /* Make sure no change P_Key work items are still executing */ - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - cancel_work_sync(&devr->ports[port].pkey_change_work); } static u32 get_core_cap_flags(struct ib_device *ibdev, @@ -4578,6 +4568,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev) static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + INIT_WORK(&devr->ports[port].pkey_change_work, + pkey_change_handler); + dev->mdev_events.notifier_call = mlx5_ib_event; mlx5_notifier_register(dev->mdev, &dev->mdev_events); return 0; @@ -4585,7 +4582,13 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + mlx5_notifier_unregister(dev->mdev, &dev->mdev_events); + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + cancel_work_sync(&devr->ports[port].pkey_change_work); } void __mlx5_ib_remove(struct mlx5_ib_dev *dev, @@ -4656,9 +4659,6 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_ODP, mlx5_ib_odp_init_one, mlx5_ib_odp_cleanup_one), @@ -4683,6 +4683,9 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), @@ -4719,9 +4722,6 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_COUNTERS, mlx5_ib_counters_init, mlx5_ib_counters_cleanup), @@ -4743,6 +4743,9 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h index b1f2b34e5955..15afc11bdd6e 100644 --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -826,7 +826,6 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_QP, MLX5_IB_STAGE_SRQ, MLX5_IB_STAGE_DEVICE_RESOURCES, - MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_ODP, MLX5_IB_STAGE_COUNTERS, MLX5_IB_STAGE_CONG_DEBUGFS, @@ -835,6 +834,7 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_PRE_IB_REG_UMR, MLX5_IB_STAGE_WHITELIST_UID, MLX5_IB_STAGE_IB_REG, + MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_POST_IB_REG_UMR, MLX5_IB_STAGE_DELAY_DROP, MLX5_IB_STAGE_RESTRACK, -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1] RDMA/mlx5: Move events notifier registration to be after device registration
by Pu Lehui 03 Jan '25

03 Jan '25

From: Patrisious Haddad <phaddad(a)nvidia.com> mainline inclusion from mainline-v6.13-rc1 commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADY CVE: CVE-2024-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]--- Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Michael Guralnik <michaelgur(a)nvidia.com> Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.173149694… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/mlx5/main.c drivers/infiniband/hw/mlx5/mlx5_ib.h [The conflicts were due to some minor issue] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 35 +++++++++++++++------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index eb69bec77e5d..afb65ab64a4e 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -3029,7 +3029,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) struct ib_srq_init_attr attr; struct ib_device *ibdev; struct ib_cq_init_attr cq_attr = {.cqe = 1}; - int port; int ret = 0; ibdev = &dev->ib_dev; @@ -3118,10 +3117,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) atomic_inc(&devr->p0->usecnt); atomic_set(&devr->s1->usecnt, 0); - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - INIT_WORK(&devr->ports[port].pkey_change_work, - pkey_change_handler); - return 0; error6: @@ -3148,7 +3143,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev) static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) { struct mlx5_ib_resources *devr = &dev->devr; - int port; mlx5_ib_destroy_srq(devr->s1, NULL); kfree(devr->s1); @@ -3160,10 +3154,6 @@ static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev) kfree(devr->c0); mlx5_ib_dealloc_pd(devr->p0, NULL); kfree(devr->p0); - - /* Make sure no change P_Key work items are still executing */ - for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) - cancel_work_sync(&devr->ports[port].pkey_change_work); } static u32 get_core_cap_flags(struct ib_device *ibdev, @@ -4562,6 +4552,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev) static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + INIT_WORK(&devr->ports[port].pkey_change_work, + pkey_change_handler); + dev->mdev_events.notifier_call = mlx5_ib_event; mlx5_notifier_register(dev->mdev, &dev->mdev_events); return 0; @@ -4569,7 +4566,13 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev) static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev) { + struct mlx5_ib_resources *devr = &dev->devr; + int port; + mlx5_notifier_unregister(dev->mdev, &dev->mdev_events); + + for (port = 0; port < ARRAY_SIZE(devr->ports); ++port) + cancel_work_sync(&devr->ports[port].pkey_change_work); } void __mlx5_ib_remove(struct mlx5_ib_dev *dev, @@ -4640,9 +4643,6 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_ODP, mlx5_ib_odp_init_one, mlx5_ib_odp_cleanup_one), @@ -4667,6 +4667,9 @@ static const struct mlx5_ib_profile pf_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), @@ -4703,9 +4706,6 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES, mlx5_ib_dev_res_init, mlx5_ib_dev_res_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, - mlx5_ib_stage_dev_notifier_init, - mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_COUNTERS, mlx5_ib_counters_init, mlx5_ib_counters_cleanup), @@ -4727,6 +4727,9 @@ const struct mlx5_ib_profile raw_eth_profile = { STAGE_CREATE(MLX5_IB_STAGE_IB_REG, mlx5_ib_stage_ib_reg_init, mlx5_ib_stage_ib_reg_cleanup), + STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER, + mlx5_ib_stage_dev_notifier_init, + mlx5_ib_stage_dev_notifier_cleanup), STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR, mlx5_ib_stage_post_ib_reg_umr_init, NULL), diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h index b1f2b34e5955..15afc11bdd6e 100644 --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -826,7 +826,6 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_QP, MLX5_IB_STAGE_SRQ, MLX5_IB_STAGE_DEVICE_RESOURCES, - MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_ODP, MLX5_IB_STAGE_COUNTERS, MLX5_IB_STAGE_CONG_DEBUGFS, @@ -835,6 +834,7 @@ enum mlx5_ib_stages { MLX5_IB_STAGE_PRE_IB_REG_UMR, MLX5_IB_STAGE_WHITELIST_UID, MLX5_IB_STAGE_IB_REG, + MLX5_IB_STAGE_DEVICE_NOTIFIER, MLX5_IB_STAGE_POST_IB_REG_UMR, MLX5_IB_STAGE_DELAY_DROP, MLX5_IB_STAGE_RESTRACK, -- 2.34.1

2 6

[openeuler:OLK-6.6 1693/1693] arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 03 Jan '25

03 Jan '25

Hi Tianrui, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c2f1662c3fb301fe7ba127fe06c14538112982d4 commit: 07db411edd838080fb7c42b9f56bc08dd60d9af6 [1693/1693] LoongArch: KVM: Enable kvm config and add the makefile config: loongarch-randconfig-r112-20250103 (https://download.01.org/0day-ci/archive/20250103/202501031054.kEd1r4Aw-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250103/202501031054.kEd1r4Aw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501031054.kEd1r4Aw-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/loongarch/kvm/../../../virt/kvm/kvm_main.c: note: in included file: include/linux/kvm_host.h:1946:54: sparse: sparse: array of flexible structures include/linux/kvm_host.h:1948:56: sparse: sparse: array of flexible structures >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got unsigned int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * >> arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5340:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got unsigned int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: expected void *ptr arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:5350:9: sparse: got int [noderef] __percpu * arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_change_pte' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_invalidate_range_start' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_invalidate_range_end' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_clear_flush_young' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_clear_young' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:602:9: sparse: sparse: context imbalance in 'kvm_mmu_notifier_test_young' - different lock contexts for basic block arch/loongarch/kvm/../../../virt/kvm/kvm_main.c: note: in included file (through include/linux/mutex.h, include/linux/kvm_types.h, include/kvm/iodev.h): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:1973:49: sparse: sparse: self-comparison always evaluates to false arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:1979:37: sparse: sparse: self-comparison always evaluates to false arch/loongarch/kvm/../../../virt/kvm/kvm_main.c:2678:9: sparse: sparse: context imbalance in 'hva_to_pfn_remapped' - unexpected unlock include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true vim +5340 arch/loongarch/kvm/../../../virt/kvm/kvm_main.c 9a2b85c620b977 drivers/kvm/kvm_main.c Rusty Russell 2007-07-17 5328 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5329 static int kvm_suspend(void) 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5330 { 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5331 /* 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5332 * Secondary CPUs and CPU hotplug are disabled across the suspend/resume 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5333 * callbacks, i.e. no need to acquire kvm_lock to ensure the usage count 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5334 * is stable. Assert that kvm_lock is not held to ensure the system 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5335 * isn't suspended while KVM is enabling hardware. Hardware enabling 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5336 * can be preempted, but the task cannot be frozen until it has dropped 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5337 * all locks (userspace tasks are frozen via a fake signal). 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5338 */ 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5339 lockdep_assert_not_held(&kvm_lock); 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 @5340 lockdep_assert_irqs_disabled(); 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5341 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5342 if (kvm_usage_count) 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5343 hardware_disable_nolock(NULL); 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5344 return 0; 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5345 } 35774a9f94db08 virt/kvm/kvm_main.c Sean Christopherson 2022-11-30 5346 :::::: The code at line 5340 was first introduced by commit :::::: 35774a9f94db08df78e1c08d2b097666deec4e76 KVM: Register syscore (suspend/resume) ops early in kvm_init() :::::: TO: Sean Christopherson <seanjc(a)google.com> :::::: CC: Paolo Bonzini <pbonzini(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 90884a336c06ff4d4124cd908b66433ea5a2346d
by kernel test robot 03 Jan '25

03 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 90884a336c06ff4d4124cd908b66433ea5a2346d !14371 [OLK-5.10] update AMD Zen5 Turin feature Error/Warning (recently discovered and may have been fixed): fs/btrfs/tree-log.o: warning: objtool: btrfs_log_holes()+0x28e: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-randconfig-001-20250102 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20250102 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-004-20250102 | `-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:address-of-array-chip_node-rt_cmd-will-always-evaluate-to-true | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-hashlen_t-is-a-C11-feature | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-page_info_t-is-a-C11-feature | `-- fs-eulerfs-namei.c:warning:variable-de-is-uninitialized-when-used-here |-- x86_64-buildonly-randconfig-002-20250102 | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- x86_64-buildonly-randconfig-003-20250102 | `-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-004-20241230 | `-- fs-btrfs-tree-log.o:warning:objtool:btrfs_log_holes:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20250102 | |-- drivers-net-ethernet-marvell-mv643xx_eth.o:warning:objtool:mv643xx_eth_xmit:unreachable-instruction | |-- drivers-net-ethernet-samsung-sxgbe-sxgbe_main.o:warning:objtool:sxgbe_xmit:unreachable-instruction | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_object_max_active | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_op_max_active | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250102 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-006-20250102 | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-defconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | `-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp `-- x86_64-randconfig-161-20250103 |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory elapsed time: 726m configs tested: 15 configs skipped: 128 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250102 clang-20 arm64 randconfig-002-20250102 gcc-14.2.0 arm64 randconfig-003-20250102 clang-20 arm64 randconfig-004-20250102 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250102 gcc-12 x86_64 buildonly-randconfig-002-20250102 gcc-12 x86_64 buildonly-randconfig-003-20250102 gcc-12 x86_64 buildonly-randconfig-004-20250102 clang-19 x86_64 buildonly-randconfig-005-20250102 gcc-12 x86_64 buildonly-randconfig-006-20250102 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] CVE-2024-56546
by Lin Yujun 03 Jan '25

03 Jan '25

Gaosheng Cui (1): drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() drivers/soc/xilinx/xlnx_event_manager.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250103/202501030955.epvYv0Bn-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501030955.epvYv0Bn-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/vc4: hdmi: Avoid hang with debug registers when suspended
by Liu Chuang 03 Jan '25

03 Jan '25

From: Dom Cobley <popcornmix(a)gmail.com> stable inclusion from stable-v6.6.64 commit c7d474974954d9af7e0092021223d58f2de128df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDP5 CVE: CVE-2024-56683 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 223ee2567a55e4f80315c768d2969e6a3b9fb23d ] Trying to read /sys/kernel/debug/dri/1/hdmi1_regs when the hdmi is disconnected results in a fatal system hang. This is due to the pm suspend code disabling the dvp clock. That is just a gate of the 108MHz clock in DVP_HT_RPI_MISC_CONFIG, which results in accesses hanging AXI bus. Protect against this. Fixes: 25eb441d55d4 ("drm/vc4: hdmi: Add all the vc5 HDMI registers into the debugfs dumps") Signed-off-by: Dom Cobley <popcornmix(a)gmail.com> Reviewed-by: Maxime Ripard <mripard(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-17-dav… Signed-off-by: Dave Stevenson <dave.stevenson(a)raspberrypi.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c index c6e986f71a26..d4487f4cb303 100644 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -179,6 +179,8 @@ static int vc4_hdmi_debugfs_regs(struct seq_file *m, void *unused) if (!drm_dev_enter(drm, &idx)) return -ENODEV; + WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev)); + drm_print_regset32(&p, &vc4_hdmi->hdmi_regset); drm_print_regset32(&p, &vc4_hdmi->hd_regset); drm_print_regset32(&p, &vc4_hdmi->cec_regset); @@ -188,6 +190,8 @@ static int vc4_hdmi_debugfs_regs(struct seq_file *m, void *unused) drm_print_regset32(&p, &vc4_hdmi->ram_regset); drm_print_regset32(&p, &vc4_hdmi->rm_regset); + pm_runtime_put(&vc4_hdmi->pdev->dev); + drm_dev_exit(idx); return 0; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] sched/deadline: Fix warning in migrate_enable for boosted tasks
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v6.6.66 commit b600d30402854415aa57548a6b53dc6478f65517 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOS CVE: CVE-2024-56583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0664e2c311b9fa43b33e3e81429cd0c2d7f9c638 ] When running the following command: while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done a warning is eventually triggered: WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? enqueue_dl_entity+0x631/0x6e0 ? setup_new_dl_entity+0x13e/0x180 ? __warn+0x7e/0xd0 ? report_bug+0x11a/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 enqueue_dl_entity+0x631/0x6e0 enqueue_task_dl+0x7d/0x120 __do_set_cpus_allowed+0xe3/0x280 __set_cpus_allowed_ptr_locked+0x140/0x1d0 __set_cpus_allowed_ptr+0x54/0xa0 migrate_enable+0x7e/0x150 rt_spin_unlock+0x1c/0x90 group_send_sig_info+0xf7/0x1a0 ? kill_pid_info+0x1f/0x1d0 kill_pid_info+0x78/0x1d0 kill_proc_info+0x5b/0x110 __x64_sys_kill+0x93/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7f0dab31f92b This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call. Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that's the case. Fixes: 295d6d5e3736 ("sched/deadline: Fix switching to -deadline") Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Juri Lelli <juri.lelli(a)redhat.com> Link: https://lore.kernel.org/r/20240724142253.27145-2-wander@redhat.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/deadline.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c index f2a636e7acc4..bac946da756c 100644 --- a/kernel/sched/deadline.c +++ b/kernel/sched/deadline.c @@ -1494,6 +1494,7 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se, int flags) } else if (flags & ENQUEUE_REPLENISH) { replenish_dl_entity(dl_se); } else if ((flags & ENQUEUE_RESTORE) && + !is_dl_boosted(dl_se) && dl_time_before(dl_se->deadline, rq_clock(rq_of_dl_rq(dl_rq_of_se(dl_se))))) { setup_new_dl_entity(dl_se); -- 2.34.1

2 1

[PATCH OLK-6.6] sched/deadline: Fix warning in migrate_enable for boosted tasks
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v6.6.66 commit b600d30402854415aa57548a6b53dc6478f65517 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOS CVE: CVE-2024-56583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0664e2c311b9fa43b33e3e81429cd0c2d7f9c638 ] When running the following command: while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done a warning is eventually triggered: WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? enqueue_dl_entity+0x631/0x6e0 ? setup_new_dl_entity+0x13e/0x180 ? __warn+0x7e/0xd0 ? report_bug+0x11a/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 enqueue_dl_entity+0x631/0x6e0 enqueue_task_dl+0x7d/0x120 __do_set_cpus_allowed+0xe3/0x280 __set_cpus_allowed_ptr_locked+0x140/0x1d0 __set_cpus_allowed_ptr+0x54/0xa0 migrate_enable+0x7e/0x150 rt_spin_unlock+0x1c/0x90 group_send_sig_info+0xf7/0x1a0 ? kill_pid_info+0x1f/0x1d0 kill_pid_info+0x78/0x1d0 kill_proc_info+0x5b/0x110 __x64_sys_kill+0x93/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7f0dab31f92b This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call. Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that's the case. Fixes: 295d6d5e3736 ("sched/deadline: Fix switching to -deadline") Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Juri Lelli <juri.lelli(a)redhat.com> Link: https://lore.kernel.org/r/20240724142253.27145-2-wander@redhat.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/deadline.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c index 89131f4d0c43..dd13bbe8c0e4 100644 --- a/kernel/sched/deadline.c +++ b/kernel/sched/deadline.c @@ -1645,6 +1645,7 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se, int flags) } else if (flags & ENQUEUE_REPLENISH) { replenish_dl_entity(dl_se); } else if ((flags & ENQUEUE_RESTORE) && + !is_dl_boosted(dl_se) && dl_time_before(dl_se->deadline, rq_clock(rq_of_dl_rq(dl_rq_of_se(dl_se))))) { setup_new_dl_entity(dl_se); -- 2.34.1

2 1

[PATCH OLK-5.10] sched/deadline: Fix warning in migrate_enable for boosted tasks
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v6.6.66 commit b600d30402854415aa57548a6b53dc6478f65517 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOS CVE: CVE-2024-56583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0664e2c311b9fa43b33e3e81429cd0c2d7f9c638 ] When running the following command: while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done a warning is eventually triggered: WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? enqueue_dl_entity+0x631/0x6e0 ? setup_new_dl_entity+0x13e/0x180 ? __warn+0x7e/0xd0 ? report_bug+0x11a/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 enqueue_dl_entity+0x631/0x6e0 enqueue_task_dl+0x7d/0x120 __do_set_cpus_allowed+0xe3/0x280 __set_cpus_allowed_ptr_locked+0x140/0x1d0 __set_cpus_allowed_ptr+0x54/0xa0 migrate_enable+0x7e/0x150 rt_spin_unlock+0x1c/0x90 group_send_sig_info+0xf7/0x1a0 ? kill_pid_info+0x1f/0x1d0 kill_pid_info+0x78/0x1d0 kill_proc_info+0x5b/0x110 __x64_sys_kill+0x93/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7f0dab31f92b This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call. Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that's the case. Fixes: 295d6d5e3736 ("sched/deadline: Fix switching to -deadline") Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Juri Lelli <juri.lelli(a)redhat.com> Link: https://lore.kernel.org/r/20240724142253.27145-2-wander@redhat.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/deadline.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c index cff58dba27ff..e765b88b0f7d 100644 --- a/kernel/sched/deadline.c +++ b/kernel/sched/deadline.c @@ -1495,6 +1495,7 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se, int flags) } else if (flags & ENQUEUE_REPLENISH) { replenish_dl_entity(dl_se); } else if ((flags & ENQUEUE_RESTORE) && + !is_dl_boosted(dl_se) && dl_time_before(dl_se->deadline, rq_clock(rq_of_dl_rq(dl_rq_of_se(dl_se))))) { setup_new_dl_entity(dl_se); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amdgpu: set the right AMDGPU sg segment limitation
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Prike Liang <Prike.Liang(a)amd.com> stable inclusion from stable-v5.10.231 commit 13c3a54f48a612a117dfd82a9dd91732261e869d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOA CVE: CVE-2024-56594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ] The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following: WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 [ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [ 364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [ 364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [ 364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [ 364.049605] Call Trace: [ 364.049607] <TASK> [ 364.049609] ? show_regs+0x6d/0x80 [ 364.049614] ? __warn+0x8c/0x140 [ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049621] ? report_bug+0x193/0x1a0 [ 364.049627] ? handle_bug+0x46/0x80 [ 364.049631] ? exc_invalid_op+0x1d/0x80 [ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 [ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049647] __dma_map_sg_attrs+0x90/0xe0 [ 364.049651] dma_map_sgtable+0x25/0x40 [ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] [ 364.049935] ? srso_return_thunk+0x5/0x5f [ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] [ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [ 364.051054] ? srso_return_thunk+0x5/0x5f [ 364.051057] ? tomoyo_file_ioctl+0x20/0x30 [ 364.051063] __x64_sys_ioctl+0x9c/0xd0 [ 364.051068] x64_sys_call+0x1219/0x20d0 [ 364.051073] do_syscall_64+0x51/0x120 [ 364.051077] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.051081] RIP: 0033:0x7fb2d2f1a94f Signed-off-by: Prike Liang <Prike.Liang(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index 7d4a54025e18..06a0cef24c6d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -1885,6 +1885,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev) mutex_init(&adev->mman.gtt_window_lock); + dma_set_max_seg_size(adev->dev, UINT_MAX); /* No others user of address space so set it to 0 */ r = ttm_bo_device_init(&adev->mman.bdev, &amdgpu_bo_driver, -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amdgpu: set the right AMDGPU sg segment limitation
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Prike Liang <Prike.Liang(a)amd.com> stable inclusion from stable-v6.6.66 commit b9e52a96ec92245bf15dabba1d3d862d7a03efb8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOA CVE: CVE-2024-56594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ] The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following: WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 [ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [ 364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [ 364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [ 364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [ 364.049605] Call Trace: [ 364.049607] <TASK> [ 364.049609] ? show_regs+0x6d/0x80 [ 364.049614] ? __warn+0x8c/0x140 [ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049621] ? report_bug+0x193/0x1a0 [ 364.049627] ? handle_bug+0x46/0x80 [ 364.049631] ? exc_invalid_op+0x1d/0x80 [ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 [ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049647] __dma_map_sg_attrs+0x90/0xe0 [ 364.049651] dma_map_sgtable+0x25/0x40 [ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] [ 364.049935] ? srso_return_thunk+0x5/0x5f [ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] [ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [ 364.051054] ? srso_return_thunk+0x5/0x5f [ 364.051057] ? tomoyo_file_ioctl+0x20/0x30 [ 364.051063] __x64_sys_ioctl+0x9c/0xd0 [ 364.051068] x64_sys_call+0x1219/0x20d0 [ 364.051073] do_syscall_64+0x51/0x120 [ 364.051077] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.051081] RIP: 0033:0x7fb2d2f1a94f Signed-off-by: Prike Liang <Prike.Liang(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index 8c3fb1562ffe..281daa55523e 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -1833,6 +1833,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev) mutex_init(&adev->mman.gtt_window_lock); + dma_set_max_seg_size(adev->dev, UINT_MAX); /* No others user of address space so set it to 0 */ r = ttm_device_init(&adev->mman.bdev, &amdgpu_bo_driver, adev->dev, adev_to_drm(adev)->anon_inode->i_mapping, -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-53224
by Pu Lehui 03 Jan '25

03 Jan '25

Jianbo Liu (1): IB/mlx5: Allocate resources just before first QP/SRQ is created Patrisious Haddad (1): RDMA/mlx5: Move events notifier registration to be after device registration drivers/infiniband/hw/mlx5/main.c | 185 ++++++++++++++++++--------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 6 +- drivers/infiniband/hw/mlx5/qp.c | 4 + drivers/infiniband/hw/mlx5/srq.c | 4 + 4 files changed, 136 insertions(+), 63 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] drm/amdgpu: set the right AMDGPU sg segment limitation
by Zicheng Qu 03 Jan '25

03 Jan '25

From: Prike Liang <Prike.Liang(a)amd.com> stable inclusion from stable-v5.10.231 commit 13c3a54f48a612a117dfd82a9dd91732261e869d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOA CVE: CVE-2024-56594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ] The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following: WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 [ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [ 364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [ 364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [ 364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [ 364.049605] Call Trace: [ 364.049607] <TASK> [ 364.049609] ? show_regs+0x6d/0x80 [ 364.049614] ? __warn+0x8c/0x140 [ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049621] ? report_bug+0x193/0x1a0 [ 364.049627] ? handle_bug+0x46/0x80 [ 364.049631] ? exc_invalid_op+0x1d/0x80 [ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 [ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049647] __dma_map_sg_attrs+0x90/0xe0 [ 364.049651] dma_map_sgtable+0x25/0x40 [ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] [ 364.049935] ? srso_return_thunk+0x5/0x5f [ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] [ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [ 364.051054] ? srso_return_thunk+0x5/0x5f [ 364.051057] ? tomoyo_file_ioctl+0x20/0x30 [ 364.051063] __x64_sys_ioctl+0x9c/0xd0 [ 364.051068] x64_sys_call+0x1219/0x20d0 [ 364.051073] do_syscall_64+0x51/0x120 [ 364.051077] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.051081] RIP: 0033:0x7fb2d2f1a94f Signed-off-by: Prike Liang <Prike.Liang(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index 7d4a54025e18..06a0cef24c6d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -1885,6 +1885,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev) mutex_init(&adev->mman.gtt_window_lock); + dma_set_max_seg_size(adev->dev, UINT_MAX); /* No others user of address space so set it to 0 */ r = ttm_bo_device_init(&adev->mman.bdev, &amdgpu_bo_driver, -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-56609
by Zicheng Qu 03 Jan '25

03 Jan '25

CVE-2024-56609 Ping-Ke Shih (2): wifi: mac80211: export ieee80211_purge_tx_queue() for drivers wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb drivers/net/wireless/realtek/rtw88/sdio.c | 6 +++--- drivers/net/wireless/realtek/rtw88/usb.c | 5 +++-- include/net/mac80211.h | 13 +++++++++++++ net/mac80211/ieee80211_i.h | 2 -- net/mac80211/status.c | 1 + 5 files changed, 20 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] The bugfix for LPM trie
by Tengda Wu 03 Jan '25

03 Jan '25

This is a small bugfix for bpf LPM trie. Hou Tao (2): bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie bpf: Handle in-place update for full LPM trie correctly kernel/bpf/lpm_trie.c | 44 +++++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] The bugfix for LPM trie
by Tengda Wu 03 Jan '25

03 Jan '25

This is a small bugfix for LPM trie. Hou Tao (2): bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie bpf: Handle in-place update for full LPM trie correctly kernel/bpf/lpm_trie.c | 44 +++++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-53158
by Lin Yujun 03 Jan '25

03 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] netlink: terminate outstanding dump on socket close
by Wang Liang 03 Jan '25

03 Jan '25

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v4.19.325 commit 114a61d8d94ae3a43b82446cf737fd757021b834 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB956K CVE: CVE-2024-53140 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1904fb9ebf911441f90a68e96b22aa73e4410505 ] Netlink supports iterative dumping of data. It provides the families the following ops: - start - (optional) kicks off the dumping process - dump - actual dump helper, keeps getting called until it returns 0 - done - (optional) pairs with .start, can be used for cleanup The whole process is asynchronous and the repeated calls to .dump don't actually happen in a tight loop, but rather are triggered in response to recvmsg() on the socket. This gives the user full control over the dump, but also means that the user can close the socket without getting to the end of the dump. To make sure .start is always paired with .done we check if there is an ongoing dump before freeing the socket, and if so call .done. The complication is that sockets can get freed from BH and .done is allowed to sleep. So we use a workqueue to defer the call, when needed. Unfortunately this does not work correctly. What we defer is not the cleanup but rather releasing a reference on the socket. We have no guarantee that we own the last reference, if someone else holds the socket they may release it in BH and we're back to square one. The whole dance, however, appears to be unnecessary. Only the user can interact with dumps, so we can clean up when socket is closed. And close always happens in process context. Some async code may still access the socket after close, queue notification skbs to it etc. but no dumps can start, end or otherwise make progress. Delete the workqueue and flush the dump state directly from the release handler. Note that further cleanup is possible in -next, for instance we now always call .done before releasing the main module reference, so dump doesn't have to take a reference of its own. Reported-by: syzkaller <syzkaller(a)googlegroups.com> Fixes: ed5d7788a934 ("netlink: Do not schedule work from sk_destruct") Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241106015235.2458807-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netlink/af_netlink.c | 31 ++++++++----------------------- net/netlink/af_netlink.h | 2 -- 2 files changed, 8 insertions(+), 25 deletions(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 766096493494..9f3cf7e5cce0 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -393,15 +393,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk) static void netlink_sock_destruct(struct sock *sk) { - struct netlink_sock *nlk = nlk_sk(sk); - - if (nlk->cb_running) { - if (nlk->cb.done) - nlk->cb.done(&nlk->cb); - module_put(nlk->cb.module); - kfree_skb(nlk->cb.skb); - } - skb_queue_purge(&sk->sk_receive_queue); if (!sock_flag(sk, SOCK_DEAD)) { @@ -414,14 +405,6 @@ static void netlink_sock_destruct(struct sock *sk) WARN_ON(nlk_sk(sk)->groups); } -static void netlink_sock_destruct_work(struct work_struct *work) -{ - struct netlink_sock *nlk = container_of(work, struct netlink_sock, - work); - - sk_free(&nlk->sk); -} - /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on * SMP. Look, when several writers sleep and reader wakes them up, all but one * immediately hit write lock and grab all the cpus. Exclusive sleep solves @@ -738,12 +721,6 @@ static void deferred_put_nlk_sk(struct rcu_head *head) if (!refcount_dec_and_test(&sk->sk_refcnt)) return; - if (nlk->cb_running && nlk->cb.done) { - INIT_WORK(&nlk->work, netlink_sock_destruct_work); - schedule_work(&nlk->work); - return; - } - sk_free(sk); } @@ -793,6 +770,14 @@ static int netlink_release(struct socket *sock) NETLINK_URELEASE, &n); } + /* Terminate any outstanding dump */ + if (nlk->cb_running) { + if (nlk->cb.done) + nlk->cb.done(&nlk->cb); + module_put(nlk->cb.module); + kfree_skb(nlk->cb.skb); + } + module_put(nlk->module); if (netlink_is_kernel(sk)) { diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h index 962de7b3c023..c61e634693ea 100644 --- a/net/netlink/af_netlink.h +++ b/net/netlink/af_netlink.h @@ -4,7 +4,6 @@ #include <linux/rhashtable.h> #include <linux/atomic.h> -#include <linux/workqueue.h> #include <net/sock.h> /* flags */ @@ -45,7 +44,6 @@ struct netlink_sock { struct rhash_head node; struct rcu_head rcu; - struct work_struct work; }; static inline struct netlink_sock *nlk_sk(struct sock *sk) -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8
by kernel test robot 03 Jan '25

03 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 !14398 printk: Skip log flush in NMI context when logbuf_lock is held Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501022347.2K2GsA8U-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501030757.m59EWrOL-lkp@intel.com drivers/gpu/drm/phytium/phytium_debugfs.c:340:35-56: opportunity for str_yes_no(phytium_dp -> has_audio) drivers/gpu/drm/phytium/phytium_dp.c:1279:10-34: opportunity for str_enable_disable(mode == DRM_MODE_DPMS_ON) drivers/gpu/drm/phytium/phytium_panel.c:79:10-16: opportunity for str_enable_disable(enable) drivers/media/i2c/adv7511-v4l2.o: warning: objtool: adv7511_set_fmt()+0x805: unreachable instruction sound/pci/lola/lola_clock.o: warning: objtool: lola_sample_rate_convert()+0x46: can't find switch jump table Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-defconfig | `-- net-ipv4-route.c:warning:array-subscript-is-outside-array-bounds-of-struct-fib_nh |-- arm64-randconfig-001-20250102 | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ocfs2-alloc.c:warning:array-subscript-idx-is-outside-array-bounds-of-struct-ocfs2_extent_rec | |-- fs-ocfs2-alloc.c:warning:array-subscript-tail_index-is-outside-array-bounds-of-struct-ocfs2_truncate_rec | |-- fs-ocfs2-xattr.c:warning:array-subscript-count-is-outside-array-bounds-of-struct-ocfs2_xattr_entry | |-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | `-- net-ipv4-route.c:warning:array-subscript-is-outside-array-bounds-of-struct-fib_nh |-- arm64-randconfig-002-20250102 | |-- aarch64-linux-ld:binfmt_elf32.c:(.text):undefined-reference-to-elf_core_extra_data_size | |-- aarch64-linux-ld:binfmt_elf32.c:(.text):undefined-reference-to-elf_core_write_extra_data | |-- aarch64-linux-ld:binfmt_elf32.c:(.text):undefined-reference-to-elf_core_write_extra_phdrs | |-- aarch64-linux-ld:super.c:(.init.text):undefined-reference-to-__netlink_kernel_create | |-- aarch64-linux-ld:super.c:(.init.text):undefined-reference-to-init_net | |-- aarch64-linux-ld:super.c:(.text):undefined-reference-to-__nlmsg_put | |-- aarch64-linux-ld:super.c:(.text):undefined-reference-to-kfree_skb | |-- aarch64-linux-ld:super.c:(.text):undefined-reference-to-netlink_broadcast | |-- binfmt_elf32.c:(.text):undefined-reference-to-elf_core_extra_phdrs | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used | |-- super.c:(.exit.text):undefined-reference-to-netlink_kernel_release | |-- super.c:(.init.text):undefined-reference-to-init_net | `-- super.c:(.text):undefined-reference-to-__alloc_skb |-- arm64-randconfig-003-20250102 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | |-- sound-soc-codecs-88pm86-codec.c:warning:aif1_mux-defined-but-not-used | `-- sound-soc-codecs-88pm86-codec.c:warning:pcm_switch_controls-defined-but-not-used |-- arm64-randconfig-004-20250102 | |-- drivers-tty-serial-sc16is7xx.c:warning:label-err_i2c-defined-but-not-used | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-r064-20250103 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:opportunity-for-str_enabled_disabled(phytium_dp-panel-.-backlight_enabled) | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:opportunity-for-str_enabled_disabled(phytium_dp-panel-.-power_enabled) | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:opportunity-for-str_yes_no(phytium_dp-has_audio) | |-- drivers-gpu-drm-phytium-phytium_dp.c:opportunity-for-str_enable_disable(mode-DRM_MODE_DPMS_ON) | |-- drivers-gpu-drm-phytium-phytium_panel.c:opportunity-for-str_enable_disable(enable) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-net-ethernet-hisilicon-hns3-hns3_extension-hns3_enet_it.c:warning:no-previous-prototype-for-function-hns3_nic_select_queue_it | `-- samples-vfio-mdev-.tmp_mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20250102 | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-002-20250102 | |-- arch-x86-kernel-idt.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-char-tpm-eventlog-efi.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-char-tpm-eventlog-of.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-fpga-dfl-fme-mgr.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-panel-panel-ilitek-ili9881c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hwmon-mlxreg-fan.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-hwtracing-intel_th-debug.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-iio-dac-ti-dac5571.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-tsl2772.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-dvb-frontends-dvb-pll.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-dvb-frontends-lgdt33.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-dvb-frontends-mn88443x.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-tuners-qm1d1b0004.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-phy-mdio-mscc-miim.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-autofs-init.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled | `-- net-sched-sch_etf.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20250102 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-004-20250102 | |-- drivers-media-i2c-adv7511-v4l2.o:warning:objtool:adv7511_set_fmt:unreachable-instruction | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250102 | |-- drivers-tty-serial-sc16is7xx.c:warning:label-err_i2c-defined-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-006-20250102 | |-- drivers-char-tpm-eventlog-.tmp_common.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-hwtracing-intel_th-.tmp_msu-sink.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-input-keyboard-.tmp_mtk-pmic-keys.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-mmc-core-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-staging-greybus-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- fs-notify-.tmp_fdinfo.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- kernel-sched-pelt.o:warning:objtool:missing-symbol-for-section-.text | |-- net-ipv4-metrics.o:warning:objtool:missing-symbol-for-section-.text | `-- net-ipv4-netlink.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-randconfig-101-20250103 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-102-20250103 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-103-20250103 | `-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace |-- x86_64-randconfig-104-20250101 | `-- sound-pci-lola-lola_clock.o:warning:objtool:lola_sample_rate_convert:can-t-find-switch-jump-table |-- x86_64-randconfig-104-20250103 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-123-20250102 | `-- sound-usb-validate.c:sparse:sparse:restricted-__le16-degrades-to-integer |-- x86_64-randconfig-161-20250103 | |-- block-blk-io-hierarchy-debugfs.c:error:implicit-declaration-of-function-hierarchy_show_slow_io-Werror-Wimplicit-function-declaration | |-- drivers-gpu-drm-nouveau-nvkm-subdev-clk-nv50.o:warning:objtool:nv50_clk_read:can-t-find-switch-jump-table | |-- drivers-gpu-drm-nouveau-nvkm-subdev-therm-temp.o:warning:objtool:nvkm_therm_sensor_event:can-t-find-switch-jump-table | |-- drivers-media-i2c-saa7115.o:warning:objtool:saa711x_querystd:can-t-find-switch-jump-table | |-- drivers-of-dynamic.o:warning:objtool:of_reconfig_get_state_change:can-t-find-switch-jump-table | |-- fs-select.o:warning:objtool:poll_select_finish:can-t-find-switch-jump-table | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-r054-20250103 | |-- include-linux-kern_levels.h:warning:format-d-expects-argument-of-type-int-but-argument-has-type-long-unsigned-int | |-- include-linux-kern_levels.h:warning:format-lu-expects-argument-of-type-long-unsigned-int-but-argument-has-type-int | |-- include-linux-kern_levels.h:warning:format-lx-expects-argument-of-type-long-unsigned-int-but-argument-has-type-const-long-unsigned-int | |-- include-linux-kern_levels.h:warning:format-p-expects-a-matching-void-argument | |-- include-linux-kern_levels.h:warning:format-p-expects-argument-of-type-void-but-argument-has-type-long-unsigned-int | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled `-- x86_64-randconfig-r062-20250103 |-- block-blk-throttle.c:preceding-lock-on-line |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- kernel-sched-debug.c:error:struct-dyn_affinity_stats-has-no-member-named-nr_wakeups_force_preferred_cpus `-- kernel-sched-debug.c:error:struct-dyn_affinity_stats-has-no-member-named-nr_wakeups_preferred_cpus elapsed time: 725m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250102 gcc-14.2.0 arm64 randconfig-002-20250102 gcc-14.2.0 arm64 randconfig-003-20250102 gcc-14.2.0 arm64 randconfig-004-20250102 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250102 gcc-12 x86_64 buildonly-randconfig-002-20250102 gcc-12 x86_64 buildonly-randconfig-003-20250102 gcc-12 x86_64 buildonly-randconfig-004-20250102 clang-19 x86_64 buildonly-randconfig-005-20250102 gcc-12 x86_64 buildonly-randconfig-006-20250102 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
by Pu Lehui 03 Jan '25

03 Jan '25

From: Jiri Olsa <jolsa(a)kernel.org> stable inclusion from stable-v6.6.67 commit c2b6b47662d5f2dfce92e5ffbdcac8229f321d9d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN1 CVE: CVE-2024-56665 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 978c4486cca5c7b9253d3ab98a88c8e769cb9bbd upstream. Syzbot reported [1] crash that happens for following tracing scenario: - create tracepoint perf event with attr.inherit=1, attach it to the process and set bpf program to it - attached process forks -> chid creates inherited event the new child event shares the parent's bpf program and tp_event (hence prog_array) which is global for tracepoint - exit both process and its child -> release both events - first perf_event_detach_bpf_prog call will release tp_event->prog_array and second perf_event_detach_bpf_prog will crash, because tp_event->prog_array is NULL The fix makes sure the perf_event_detach_bpf_prog checks prog_array is valid before it tries to remove the bpf program from it. [1] https://lore.kernel.org/bpf/Z1MR6dCIKajNS6nU@krava/T/#m91dbf0688221ec7a7fc9… Fixes: 0ee288e69d03 ("bpf,perf: Fix perf_event_detach_bpf_prog error handling") Reported-by: syzbot+2e0d2840414ce817aaac(a)syzkaller.appspotmail.com Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20241208142507.1207698-1-jolsa@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/bpf_trace.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index b084fe1dbe12..4485f5f383cc 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -2216,6 +2216,9 @@ void perf_event_detach_bpf_prog(struct perf_event *event) goto unlock; old_array = bpf_event_rcu_dereference(event->tp_event->prog_array); + if (!old_array) + goto put; + ret = bpf_prog_array_copy(old_array, event->prog, NULL, 0, &new_array); if (ret < 0) { bpf_prog_array_delete_safe(old_array, event->prog); @@ -2224,6 +2227,7 @@ void perf_event_detach_bpf_prog(struct perf_event *event) bpf_prog_array_free_sleepable(old_array); } +put: /* * It could be that the bpf_prog is not sleepable (and will be freed * via normal RCU), but is called from a point that supports sleepable -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION c2f1662c3fb301fe7ba127fe06c14538112982d4
by kernel test robot 03 Jan '25

03 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: c2f1662c3fb301fe7ba127fe06c14538112982d4 !14102 OLK-6.6-fix-CVE-2024-49906 Error/Warning (recently discovered and may have been fixed): ./samples/trace_events/trace_custom_sched.c: 11 linux/version.h not needed. drivers/net/ethernet/huawei/hinic/hinic_lld.c:2138:10: error: use of undeclared identifier 'disable_vf_load' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 |-- arm64-randconfig-001-20241231 | `-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:error:use-of-undeclared-identifier-disable_vf_load |-- loongarch-allmodconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:mq-poll-directive-output-may-be-truncated-writing-bytes-into-a-region-of-size-between-and | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:implicit-declaration-of-function-pmd_mkhuge | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-allyesconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:mq-poll-directive-output-may-be-truncated-writing-bytes-into-a-region-of-size-between-and | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-defconfig | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | `-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid |-- loongarch-randconfig-001-20250102 | |-- arch-loongarch-kernel-efi.c:error:implicit-declaration-of-function-pmd_mkhuge | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-randconfig-002-20250102 | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-randconfig-r052-20250103 | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kernel-smp.c:WARNING:Unsigned-expression-compared-with-zero:cpu | |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-randconfig-r112-20250103 | |-- arch-loongarch-kernel-dma.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-volatile | |-- arch-loongarch-kernel-efi.c:error:implicit-declaration-of-function-pmd_mkhuge | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- arch-loongarch-kernel-kfpu.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-bool-noderef-__percpu | |-- arch-loongarch-kernel-legacy_boot.c:sparse:sparse:symbol-pchlpc_default-was-not-declared.-Should-it-be-static | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-acpi-pptt.c:sparse:sparse:symbol-acpi_pptt_for_each_container-was-not-declared.-Should-it-be-static | |-- drivers-char-loongson_se.c:sparse:sparse:incorrect-type-in-argument-(different-modifiers)-expected-struct-miscdevice-misc-got-struct-miscdevice-const | |-- drivers-char-lsse_sdf_cdev.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-buf-got-char-noderef-__user-buf | |-- drivers-char-lsse_sdf_cdev.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-char-const-buf-got-char-const-noderef-__user-buf | |-- drivers-char-lsse_sdf_cdev.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-char-const-buf | |-- drivers-char-lsse_sdf_cdev.c:sparse:sparse:incorrect-type-in-argument-(different-modifiers)-expected-struct-miscdevice-misc-got-struct-miscdevice-const | |-- drivers-pci-controller-pci-loongson.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-void-volatile | |-- include-linux-cpuidle.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu | |-- include-linux-cpuidle.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-unsigned-int-noderef-__percpu | |-- include-linux-entry-common.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu | |-- include-linux-entry-common.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-unsigned-int-noderef-__percpu | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | |-- mm-gup.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu | |-- mm-gup.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-unsigned-int-noderef-__percpu | `-- mm-show_mem.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-ptr-got-int-noderef-__percpu |-- x86_64-allnoconfig | |-- drivers-scsi-leapioraid-leapioraid_app.c:leapioraid_func.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-VFIO_MDEV-when-selected-by-CRYPTO_DEV_HCT | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-get_nt_block_copy_mini_len | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-set_c86_features_para_invalid | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpustate_free_space | |-- arch-x86-kvm-svm-csv.c:warning:no-previous-prototype-for-function-csv_vm_attestation | |-- arch-x86-kvm-svm-sev.c:warning:no-previous-prototype-for-function-sev_install_hooks | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages | |-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-dcn30-display_mode_vba_30.c:warning:stack-frame-size-()-exceeds-limit-()-in-dml30_ModeSupportAndSystemConfigurationFull | |-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_setup_strp | `-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_stream_read |-- x86_64-buildonly-randconfig-001-20250102 | `-- vmlinux.o:warning:objtool:.text:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20250102 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-004-20250102 | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode | |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin | `-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages |-- x86_64-buildonly-randconfig-005-20250102 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) `-- x86_64-randconfig-161-20250103 |-- drivers-ata-ahci_zhaoxin_sgpio.c-ahci_wait_em_reset()-warn:variable-dereferenced-before-check-sgpio_zhaoxin-(see-line-) |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-add_sgpio_zhaoxin |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_wait_em_reset |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-ahci_zhaoxin_set_em_sgpio_gpmode |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-remove_sgpio_zhaoxin |-- drivers-ata-ahci_zhaoxin_sgpio.c:warning:no-previous-prototype-for-function-set_em_messages |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dcn32-dcn32_hwseq.c-dcn32_apply_idle_power_optimizations()-warn:variable-dereferenced-before-check-dc-current_state-(see-line-) |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-link-link_dpms.c-link_set_dpms_on()-warn:if-statement-not-indented `-- drivers-gpu-drm-amd-amdgpu-..-display-dc-link-protocols-link_dp_training_dpia.c-dpia_training_eq_non_transparent()-error:uninitialized-symbol-wait_time_microsec-. elapsed time: 722m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250102 clang-20 arm64 randconfig-002-20250102 gcc-14.2.0 arm64 randconfig-003-20250102 clang-20 arm64 randconfig-004-20250102 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250102 gcc-14.2.0 loongarch randconfig-002-20250102 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250102 gcc-12 x86_64 buildonly-randconfig-002-20250102 gcc-12 x86_64 buildonly-randconfig-003-20250102 gcc-12 x86_64 buildonly-randconfig-004-20250102 clang-19 x86_64 buildonly-randconfig-005-20250102 gcc-12 x86_64 buildonly-randconfig-006-20250102 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] kernel/sched/debug.c:990:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_preferred_cpus'
by kernel test robot 03 Jan '25

03 Jan '25

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 commit: ebca52abe099caa97d7669d0acc71209ea80cfec [1365/1365] sched: Add statistics for scheduler dynamic affinity config: x86_64-randconfig-r062-20250103 (https://download.01.org/0day-ci/archive/20250103/202501030826.kEDgBIqw-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250103/202501030826.kEDgBIqw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501030826.kEDgBIqw-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/debug.c:815:6: warning: no previous prototype for 'sysrq_sched_debug_tidy' [-Wmissing-prototypes] 815 | void sysrq_sched_debug_tidy(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/sched/debug.c: In function 'proc_sched_show_task': >> kernel/sched/debug.c:990:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_preferred_cpus' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ^~ kernel/sched/debug.c:21:31: note: in definition of macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ kernel/sched/debug.c:990:17: note: in expansion of macro '__P' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ^~~ In file included from include/linux/kernel.h:14, from arch/x86/include/asm/percpu.h:45, from arch/x86/include/asm/current.h:6, from include/linux/sched.h:12, from kernel/sched/sched.h:5, from kernel/sched/debug.c:12: >> kernel/sched/debug.c:990:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_preferred_cpus' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ^~ include/linux/printk.h:362:33: note: in definition of macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ kernel/sched/debug.c:939:9: note: in expansion of macro 'SEQ_printf' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^~~~~~~~~~ kernel/sched/debug.c:990:17: note: in expansion of macro '__P' 990 | __P(dyn_affi->nr_wakeups_preferred_cpus); | ^~~ >> kernel/sched/debug.c:991:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_force_preferred_cpus' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ^~ kernel/sched/debug.c:21:31: note: in definition of macro 'SEQ_printf' 21 | seq_printf(m, x); \ | ^ kernel/sched/debug.c:991:17: note: in expansion of macro '__P' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ^~~ >> kernel/sched/debug.c:991:29: error: 'struct dyn_affinity_stats' has no member named 'nr_wakeups_force_preferred_cpus' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ^~ include/linux/printk.h:362:33: note: in definition of macro 'pr_cont' 362 | printk(KERN_CONT fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ kernel/sched/debug.c:939:9: note: in expansion of macro 'SEQ_printf' 939 | SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) | ^~~~~~~~~~ kernel/sched/debug.c:991:17: note: in expansion of macro '__P' 991 | __P(dyn_affi->nr_wakeups_force_preferred_cpus); | ^~~ In file included from include/linux/migrate.h:6, from kernel/sched/sched.h:52: include/linux/mempolicy.h: At top level: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +990 kernel/sched/debug.c 814 > 815 void sysrq_sched_debug_tidy(void) 816 { 817 int cpu; 818 819 SEQ_printf(NULL, "Sched Debug Version: v0.11, %s %.*s\n", 820 init_utsname()->release, 821 (int)strcspn(init_utsname()->version, " "), 822 init_utsname()->version); 823 824 for_each_online_cpu(cpu) 825 print_cpu_tidy(NULL, cpu); 826 } 827 828 /* 829 * This itererator needs some explanation. 830 * It returns 1 for the header position. 831 * This means 2 is CPU 0. 832 * In a hotplugged system some CPUs, including CPU 0, may be missing so we have 833 * to use cpumask_* to iterate over the CPUs. 834 */ 835 static void *sched_debug_start(struct seq_file *file, loff_t *offset) 836 { 837 unsigned long n = *offset; 838 839 if (n == 0) 840 return (void *) 1; 841 842 n--; 843 844 if (n > 0) 845 n = cpumask_next(n - 1, cpu_online_mask); 846 else 847 n = cpumask_first(cpu_online_mask); 848 849 *offset = n + 1; 850 851 if (n < nr_cpu_ids) 852 return (void *)(unsigned long)(n + 2); 853 854 return NULL; 855 } 856 857 static void *sched_debug_next(struct seq_file *file, void *data, loff_t *offset) 858 { 859 (*offset)++; 860 return sched_debug_start(file, offset); 861 } 862 863 static void sched_debug_stop(struct seq_file *file, void *data) 864 { 865 } 866 867 static const struct seq_operations sched_debug_sops = { 868 .start = sched_debug_start, 869 .next = sched_debug_next, 870 .stop = sched_debug_stop, 871 .show = sched_debug_show, 872 }; 873 874 static int __init init_sched_debug_procfs(void) 875 { 876 if (!proc_create_seq("sched_debug", 0444, NULL, &sched_debug_sops)) 877 return -ENOMEM; 878 return 0; 879 } 880 881 __initcall(init_sched_debug_procfs); 882 883 #define __P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 884 #define P(F) SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 885 #define __PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 886 #define PN(F) SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 887 888 889 #ifdef CONFIG_NUMA_BALANCING 890 void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, 891 unsigned long tpf, unsigned long gsf, unsigned long gpf) 892 { 893 SEQ_printf(m, "numa_faults node=%d ", node); 894 SEQ_printf(m, "task_private=%lu task_shared=%lu ", tpf, tsf); 895 SEQ_printf(m, "group_private=%lu group_shared=%lu\n", gpf, gsf); 896 } 897 #endif 898 899 900 static void sched_show_numa(struct task_struct *p, struct seq_file *m) 901 { 902 #ifdef CONFIG_NUMA_BALANCING 903 struct mempolicy *pol; 904 905 if (p->mm) 906 P(mm->numa_scan_seq); 907 908 task_lock(p); 909 pol = p->mempolicy; 910 if (pol && !(pol->flags & MPOL_F_MORON)) 911 pol = NULL; 912 mpol_get(pol); 913 task_unlock(p); 914 915 P(numa_pages_migrated); 916 P(numa_preferred_nid); 917 P(total_numa_faults); 918 SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", 919 task_node(p), task_numa_group_id(p)); 920 show_numa_stats(p, m); 921 mpol_put(pol); 922 #endif 923 } 924 925 void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, 926 struct seq_file *m) 927 { 928 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 929 struct dyn_affinity_stats *dyn_affi = p->se.dyn_affi_stats; 930 #endif 931 unsigned long nr_switches; 932 933 SEQ_printf(m, "%s (%d, #threads: %d)\n", p->comm, task_pid_nr_ns(p, ns), 934 get_nr_threads(p)); 935 SEQ_printf(m, 936 "---------------------------------------------------------" 937 "----------\n"); 938 #define __P(F) \ > 939 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)F) 940 #define P(F) \ 941 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)p->F) 942 #define P_SCHEDSTAT(F) \ 943 SEQ_printf(m, "%-45s:%21Ld\n", #F, (long long)schedstat_val(p->F)) 944 #define __PN(F) \ 945 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)F)) 946 #define PN(F) \ 947 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)p->F)) 948 #define PN_SCHEDSTAT(F) \ 949 SEQ_printf(m, "%-45s:%14Ld.%06ld\n", #F, SPLIT_NS((long long)schedstat_val(p->F))) 950 951 PN(se.exec_start); 952 PN(se.vruntime); 953 PN(se.sum_exec_runtime); 954 955 nr_switches = p->nvcsw + p->nivcsw; 956 957 P(se.nr_migrations); 958 959 if (schedstat_enabled()) { 960 u64 avg_atom, avg_per_cpu; 961 962 PN_SCHEDSTAT(se.statistics.sum_sleep_runtime); 963 PN_SCHEDSTAT(se.statistics.wait_start); 964 PN_SCHEDSTAT(se.statistics.sleep_start); 965 PN_SCHEDSTAT(se.statistics.block_start); 966 PN_SCHEDSTAT(se.statistics.sleep_max); 967 PN_SCHEDSTAT(se.statistics.block_max); 968 PN_SCHEDSTAT(se.statistics.exec_max); 969 PN_SCHEDSTAT(se.statistics.slice_max); 970 PN_SCHEDSTAT(se.statistics.wait_max); 971 PN_SCHEDSTAT(se.statistics.wait_sum); 972 P_SCHEDSTAT(se.statistics.wait_count); 973 PN_SCHEDSTAT(se.statistics.iowait_sum); 974 P_SCHEDSTAT(se.statistics.iowait_count); 975 P_SCHEDSTAT(se.statistics.nr_migrations_cold); 976 P_SCHEDSTAT(se.statistics.nr_failed_migrations_affine); 977 P_SCHEDSTAT(se.statistics.nr_failed_migrations_running); 978 P_SCHEDSTAT(se.statistics.nr_failed_migrations_hot); 979 P_SCHEDSTAT(se.statistics.nr_forced_migrations); 980 P_SCHEDSTAT(se.statistics.nr_wakeups); 981 P_SCHEDSTAT(se.statistics.nr_wakeups_sync); 982 P_SCHEDSTAT(se.statistics.nr_wakeups_migrate); 983 P_SCHEDSTAT(se.statistics.nr_wakeups_local); 984 P_SCHEDSTAT(se.statistics.nr_wakeups_remote); 985 P_SCHEDSTAT(se.statistics.nr_wakeups_affine); 986 P_SCHEDSTAT(se.statistics.nr_wakeups_affine_attempts); 987 P_SCHEDSTAT(se.statistics.nr_wakeups_passive); 988 P_SCHEDSTAT(se.statistics.nr_wakeups_idle); 989 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY > 990 __P(dyn_affi->nr_wakeups_preferred_cpus); > 991 __P(dyn_affi->nr_wakeups_force_preferred_cpus); 992 #endif 993 994 avg_atom = p->se.sum_exec_runtime; 995 if (nr_switches) 996 avg_atom = div64_ul(avg_atom, nr_switches); 997 else 998 avg_atom = -1LL; 999 1000 avg_per_cpu = p->se.sum_exec_runtime; 1001 if (p->se.nr_migrations) { 1002 avg_per_cpu = div64_u64(avg_per_cpu, 1003 p->se.nr_migrations); 1004 } else { 1005 avg_per_cpu = -1LL; 1006 } 1007 1008 __PN(avg_atom); 1009 __PN(avg_per_cpu); 1010 } 1011 1012 __P(nr_switches); 1013 SEQ_printf(m, "%-45s:%21Ld\n", 1014 "nr_voluntary_switches", (long long)p->nvcsw); 1015 SEQ_printf(m, "%-45s:%21Ld\n", 1016 "nr_involuntary_switches", (long long)p->nivcsw); 1017 1018 P(se.load.weight); 1019 P(se.runnable_weight); 1020 #ifdef CONFIG_SMP 1021 P(se.avg.load_sum); 1022 P(se.avg.runnable_load_sum); 1023 P(se.avg.util_sum); 1024 P(se.avg.load_avg); 1025 P(se.avg.runnable_load_avg); 1026 P(se.avg.util_avg); 1027 P(se.avg.last_update_time); 1028 P(se.avg.util_est.ewma); 1029 P(se.avg.util_est.enqueued); 1030 #endif 1031 P(policy); 1032 P(prio); 1033 if (task_has_dl_policy(p)) { 1034 P(dl.runtime); 1035 P(dl.deadline); 1036 } 1037 #undef PN_SCHEDSTAT 1038 #undef PN 1039 #undef __PN 1040 #undef P_SCHEDSTAT 1041 #undef P 1042 #undef __P 1043 1044 { 1045 unsigned int this_cpu = raw_smp_processor_id(); 1046 u64 t0, t1; 1047 1048 t0 = cpu_clock(this_cpu); 1049 t1 = cpu_clock(this_cpu); 1050 SEQ_printf(m, "%-45s:%21Ld\n", 1051 "clock-delta", (long long)(t1-t0)); 1052 } 1053 1054 sched_show_numa(p, m); 1055 } 1056 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/gpu/drm/phytium/phytium_debugfs.c:189:34-69: opportunity for str_enabled_disabled(phytium_dp -> panel . backlight_enabled)
by kernel test robot 03 Jan '25

03 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 commit: cad0702e5286d3cc80afe545de027858b855dd5a [1365/1365] DRM: Phytium display DRM driver config: arm64-randconfig-r064-20250103 (https://download.01.org/0day-ci/archive/20250103/202501030757.m59EWrOL-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501030757.m59EWrOL-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/gpu/drm/phytium/phytium_debugfs.c:189:34-69: opportunity for str_enabled_disabled(phytium_dp -> panel . backlight_enabled) >> drivers/gpu/drm/phytium/phytium_debugfs.c:217:30-61: opportunity for str_enabled_disabled(phytium_dp -> panel . power_enabled) >> drivers/gpu/drm/phytium/phytium_debugfs.c:340:35-56: opportunity for str_yes_no(phytium_dp -> has_audio) -- >> drivers/gpu/drm/phytium/phytium_dp.c:1279:10-34: opportunity for str_enable_disable(mode == DRM_MODE_DPMS_ON) -- >> drivers/gpu/drm/phytium/phytium_panel.c:79:10-16: opportunity for str_enable_disable(enable) vim +189 drivers/gpu/drm/phytium/phytium_debugfs.c 179 180 static int phytium_edp_backlight_show(struct seq_file *m, void *data) 181 { 182 struct drm_connector *connector = m->private; 183 struct phytium_dp_device *phytium_dp = connector_to_dp_device(connector); 184 185 if (!phytium_dp->is_edp) 186 return -ENODEV; 187 188 mutex_lock(&phytium_dp->panel.panel_lock); > 189 seq_printf(m, "backlight: %s\n", phytium_dp->panel.backlight_enabled?"enabled":"disabled"); 190 mutex_unlock(&phytium_dp->panel.panel_lock); 191 192 return 0; 193 } 194 195 static int phytium_edp_backlight_open(struct inode *inode, struct file *file) 196 { 197 return single_open(file, phytium_edp_backlight_show, inode->i_private); 198 } 199 200 static const struct file_operations phytium_edp_backlight_fops = { 201 .owner = THIS_MODULE, 202 .open = phytium_edp_backlight_open, 203 .read = seq_read, 204 .llseek = seq_lseek, 205 .release = single_release, 206 }; 207 208 static int phytium_edp_power_show(struct seq_file *m, void *data) 209 { 210 struct drm_connector *connector = m->private; 211 struct phytium_dp_device *phytium_dp = connector_to_dp_device(connector); 212 213 if (!phytium_dp->is_edp) 214 return -ENODEV; 215 216 mutex_lock(&phytium_dp->panel.panel_lock); > 217 seq_printf(m, "power: %s\n", phytium_dp->panel.power_enabled?"enabled":"disabled"); 218 mutex_unlock(&phytium_dp->panel.panel_lock); 219 220 return 0; 221 } 222 223 static int phytium_edp_power_open(struct inode *inode, struct file *file) 224 { 225 return single_open(file, phytium_edp_power_show, inode->i_private); 226 } 227 228 static const struct file_operations phytium_edp_power_fops = { 229 .owner = THIS_MODULE, 230 .open = phytium_edp_power_open, 231 .read = seq_read, 232 .llseek = seq_lseek, 233 .release = single_release, 234 }; 235 236 struct dpcd_block { 237 /* DPCD dump start address. */ 238 unsigned int offset; 239 /* DPCD dump end address, inclusive. If unset, .size will be used. */ 240 unsigned int end; 241 /* DPCD dump size. Used if .end is unset. If unset, defaults to 1. */ 242 size_t size; 243 /* Only valid for eDP. */ 244 bool edp; 245 }; 246 247 static const struct dpcd_block phytium_dpcd_debug[] = { 248 { .offset = DP_DPCD_REV, .size = DP_RECEIVER_CAP_SIZE }, 249 { .offset = DP_PSR_SUPPORT, .end = DP_PSR_CAPS }, 250 { .offset = DP_DOWNSTREAM_PORT_0, .size = 16 }, 251 { .offset = DP_LINK_BW_SET, .end = DP_EDP_CONFIGURATION_SET }, 252 { .offset = DP_SINK_COUNT, .end = DP_ADJUST_REQUEST_LANE2_3 }, 253 { .offset = DP_SET_POWER }, 254 { .offset = DP_EDP_DPCD_REV }, 255 { .offset = DP_EDP_GENERAL_CAP_1, .end = DP_EDP_GENERAL_CAP_3 }, 256 { .offset = DP_EDP_DISPLAY_CONTROL_REGISTER, .end = DP_EDP_BACKLIGHT_FREQ_CAP_MAX_LSB }, 257 { .offset = DP_EDP_DBC_MINIMUM_BRIGHTNESS_SET, .end = DP_EDP_DBC_MAXIMUM_BRIGHTNESS_SET }, 258 { .offset = DP_DEVICE_SERVICE_IRQ_VECTOR, .size = 1 }, 259 { .offset = DP_TEST_REQUEST, .end = DP_TEST_PATTERN }, 260 }; 261 262 static int phytium_dpcd_show(struct seq_file *m, void *data) 263 { 264 struct drm_connector *connector = m->private; 265 struct phytium_dp_device *phytium_dp = connector_to_dp_device(connector); 266 uint8_t buf[16], i; 267 ssize_t err; 268 269 if (connector->status != connector_status_connected) 270 return -ENODEV; 271 272 for (i = 0; i < ARRAY_SIZE(phytium_dpcd_debug); i++) { 273 const struct dpcd_block *b = &phytium_dpcd_debug[i]; 274 size_t size = b->end ? b->end - b->offset + 1 : (b->size ?: 1); 275 276 if (WARN_ON(size > sizeof(buf))) 277 continue; 278 279 err = drm_dp_dpcd_read(&phytium_dp->aux, b->offset, buf, size); 280 if (err <= 0) { 281 DRM_ERROR("dpcd read (%zu bytes at %u) failed (%zd)\n", 282 size, b->offset, err); 283 continue; 284 } 285 286 seq_printf(m, "%04x: %*ph\n", b->offset, (int) size, buf); 287 } 288 289 return 0; 290 } 291 292 static int phytium_dpcd_open(struct inode *inode, struct file *file) 293 { 294 return single_open(file, phytium_dpcd_show, inode->i_private); 295 } 296 297 static const struct file_operations phytium_dpcd_fops = { 298 .owner = THIS_MODULE, 299 .open = phytium_dpcd_open, 300 .read = seq_read, 301 .llseek = seq_lseek, 302 .release = single_release, 303 }; 304 305 static ssize_t 306 phytium_dp_state_write(struct file *filp, 307 const char __user *ubuf, 308 size_t len, 309 loff_t *ppos) 310 { 311 char tmp[16]; 312 313 if (len >= sizeof(tmp)) 314 return -EINVAL; 315 316 memset(tmp, 0, sizeof(tmp)); 317 if (copy_from_user(tmp, ubuf, len)) 318 return -EFAULT; 319 tmp[len] = '\0'; 320 321 return len; 322 } 323 324 static int phytium_dp_state_show(struct seq_file *m, void *data) 325 { 326 struct drm_connector *connector = m->private; 327 struct phytium_dp_device *phytium_dp = connector_to_dp_device(connector); 328 329 seq_printf(m, "port number: %d\n", phytium_dp->port); 330 seq_printf(m, "source_max_lane_count: %d\n", phytium_dp->source_max_lane_count); 331 seq_printf(m, "max_source_rates: %d\n", 332 phytium_dp->source_rates[phytium_dp->num_source_rates-1]); 333 if (connector->status == connector_status_connected) { 334 seq_printf(m, "sink_max_lane_count: %d\n", phytium_dp->sink_max_lane_count); 335 seq_printf(m, "max_sink_rates: %d\n", 336 phytium_dp->sink_rates[phytium_dp->num_sink_rates-1]); 337 seq_printf(m, "link_rate: %d\n", phytium_dp->link_rate); 338 seq_printf(m, "link_lane_count: %d\n", phytium_dp->link_lane_count); 339 seq_printf(m, "train_set[0]: %d\n", phytium_dp->train_set[0]); > 340 seq_printf(m, "has_audio: %s\n", phytium_dp->has_audio?"yes":"no"); 341 } 342 343 return 0; 344 } 345 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1364/1364] sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer
by kernel test robot 02 Jan '25

02 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4c116febc8d53bc1f8f25a3d60db331f17ab8cd8 commit: c6a3607c78f8035db0efc67cb41374fe49e4709d [1364/1364] ALSA: usb-audio: More validations of descriptor units config: x86_64-randconfig-123-20250102 (https://download.01.org/0day-ci/archive/20250102/202501022347.2K2GsA8U-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250102/202501022347.2K2GsA8U-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501022347.2K2GsA8U-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer vim +113 sound/usb/validate.c 67 68 /* both for processing and extension units; covering all UACs */ 69 static bool validate_processing_unit(const void *p, 70 const struct usb_desc_validator *v) 71 { 72 const struct uac_processing_unit_descriptor *d = p; 73 const unsigned char *hdr = p; 74 size_t len, m; 75 76 if (d->bLength < sizeof(*d)) 77 return false; 78 len = d->bLength < sizeof(*d) + d->bNrInPins; 79 if (d->bLength < len) 80 return false; 81 switch (v->protocol) { 82 case UAC_VERSION_1: 83 default: 84 /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */ 85 len += 1 + 2 + 1 + 1; 86 if (d->bLength < len) /* bControlSize */ 87 return false; 88 m = hdr[len]; 89 len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */ 90 break; 91 case UAC_VERSION_2: 92 /* bNrChannels, bmChannelConfig, iChannelNames */ 93 len += 1 + 4 + 1; 94 if (v->type == UAC2_PROCESSING_UNIT_V2) 95 len += 2; /* bmControls -- 2 bytes for PU */ 96 else 97 len += 1; /* bmControls -- 1 byte for EU */ 98 len += 1; /* iProcessing */ 99 break; 100 case UAC_VERSION_3: 101 /* wProcessingDescrStr, bmControls */ 102 len += 2 + 4; 103 break; 104 } 105 if (d->bLength < len) 106 return false; 107 108 switch (v->protocol) { 109 case UAC_VERSION_1: 110 default: 111 if (v->type == UAC1_EXTENSION_UNIT) 112 return true; /* OK */ > 113 switch (d->wProcessType) { 114 case UAC_PROCESS_UP_DOWNMIX: 115 case UAC_PROCESS_DOLBY_PROLOGIC: 116 if (d->bLength < len + 1) /* bNrModes */ 117 return false; 118 m = hdr[len]; 119 len += 1 + m * 2; /* bNrModes, waModes(n) */ 120 break; 121 default: 122 break; 123 } 124 break; 125 case UAC_VERSION_2: 126 if (v->type == UAC2_EXTENSION_UNIT_V2) 127 return true; /* OK */ 128 switch (d->wProcessType) { 129 case UAC2_PROCESS_UP_DOWNMIX: 130 case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */ 131 if (d->bLength < len + 1) /* bNrModes */ 132 return false; 133 m = hdr[len]; 134 len += 1 + m * 4; /* bNrModes, daModes(n) */ 135 break; 136 default: 137 break; 138 } 139 break; 140 case UAC_VERSION_3: 141 if (v->type == UAC3_EXTENSION_UNIT) { 142 len += 2; /* wClusterDescrID */ 143 break; 144 } 145 switch (d->wProcessType) { 146 case UAC3_PROCESS_UP_DOWNMIX: 147 if (d->bLength < len + 1) /* bNrModes */ 148 return false; 149 m = hdr[len]; 150 len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */ 151 break; 152 case UAC3_PROCESS_MULTI_FUNCTION: 153 len += 2 + 4; /* wClusterDescrID, bmAlgorighms */ 154 break; 155 default: 156 break; 157 } 158 break; 159 } 160 if (d->bLength < len) 161 return false; 162 163 return true; 164 } 165 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] hfsplus: don't query the device logical block size multiple times
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v6.6.64 commit 21900e8478126ff6afe3b66679f676e74d1f8830 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADN CVE: CVE-2024-56548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ] Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589] Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h index 583c196ecd52..1473b04fc0f3 100644 --- a/fs/hfsplus/hfsplus_fs.h +++ b/fs/hfsplus/hfsplus_fs.h @@ -156,6 +156,7 @@ struct hfsplus_sb_info { /* Runtime variables */ u32 blockoffset; + u32 min_io_size; sector_t part_start; sector_t sect_count; int fs_shift; @@ -306,7 +307,7 @@ struct hfsplus_readdir_data { */ static inline unsigned short hfsplus_min_io_size(struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size, HFSPLUS_SECTOR_SIZE); } diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c index 0b791adf02e5..a51a58db3fef 100644 --- a/fs/hfsplus/wrapper.c +++ b/fs/hfsplus/wrapper.c @@ -171,6 +171,8 @@ int hfsplus_read_wrapper(struct super_block *sb) if (!blocksize) goto out; + sbi->min_io_size = blocksize; + if (hfsplus_get_last_session(sb, &part_start, &part_size)) goto out; -- 2.25.1

2 1

[PATCH OLK-6.6] scsi: bfa: Fix use-after-free in bfad_im_module_exit()
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Ye Bin <yebin10(a)huawei.com> stable inclusion from stable-v6.6.64 commit c28409f851abd93b37969cac7498828ad533afd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFA CVE: CVE-2024-53227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 178b8f38932d635e90f5f0e9af1986c6f4a89271 ] BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: <TASK> dump_stack_lvl+0x95/0xe0 print_report+0xcb/0x620 kasan_report+0xbd/0xf0 __lock_acquire+0x2aca/0x3a20 lock_acquire+0x19b/0x520 _raw_spin_lock+0x2b/0x40 attribute_container_unregister+0x30/0x160 fc_release_transport+0x19/0x90 [scsi_transport_fc] bfad_im_module_exit+0x23/0x60 [bfa] bfad_init+0xdb/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 fc_attach_transport+0x4f/0x4740 [scsi_transport_fc] bfad_im_module_init+0x17/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x38/0x50 kfree+0x212/0x480 bfad_im_module_init+0x7e/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Above issue happens as follows: bfad_init error = bfad_im_module_init() fc_release_transport(bfad_im_scsi_transport_template); if (error) goto ext; ext: bfad_im_module_exit(); fc_release_transport(bfad_im_scsi_transport_template); --> Trigger double release Don't call bfad_im_module_exit() if bfad_im_module_init() failed. Fixes: 7725ccfda597 ("[SCSI] bfa: Brocade BFA FC SCSI driver") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20241023011809.63466-1-yebin@huaweicloud.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/scsi/bfa/bfad.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c index 62cb7a864fd5..70c7515a822f 100644 --- a/drivers/scsi/bfa/bfad.c +++ b/drivers/scsi/bfa/bfad.c @@ -1693,9 +1693,8 @@ bfad_init(void) error = bfad_im_module_init(); if (error) { - error = -ENOMEM; printk(KERN_WARNING "bfad_im_module_init failure\n"); - goto ext; + return -ENOMEM; } if (strcmp(FCPI_NAME, " fcpim") == 0) -- 2.25.1

2 1

[PATCH OLK-6.6] f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit b7d0a97b28083084ebdd8e5c6bccd12e6ec18faa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFK CVE: CVE-2024-53221 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] Call Trace: <TASK> f2fs_submit_page_bio+0x126/0x8b0 [f2fs] __get_meta_page+0x1d4/0x920 [f2fs] get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs] validate_checkpoint+0xac/0x290 [f2fs] f2fs_get_valid_checkpoint+0x207/0x950 [f2fs] f2fs_fill_super+0x1007/0x39b0 [f2fs] mount_bdev+0x183/0x250 legacy_get_tree+0xf4/0x1e0 vfs_get_tree+0x88/0x340 do_new_mount+0x283/0x5e0 path_mount+0x2b2/0x15b0 __x64_sys_mount+0x1fe/0x270 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue happens as the biset of the f2fs file system is not initialized before register "f2fs_fs_type". To address above issue just register "f2fs_fs_type" at the last in init_f2fs_fs(). Ensure that all f2fs file system resources are initialized. Fixes: f543805fcd60 ("f2fs: introduce private bioset") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Conflicts: fs/f2fs/super.c [Conflict caused by commit bfcba5ba39cb has not been merged] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/f2fs/super.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index d60ade04854b..a9b300b77368 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -4919,9 +4919,6 @@ static int __init init_f2fs_fs(void) err = register_shrinker(&f2fs_shrinker_info, "f2fs-shrinker"); if (err) goto free_sysfs; - err = register_filesystem(&f2fs_fs_type); - if (err) - goto free_shrinker; f2fs_create_root_stats(); err = f2fs_init_post_read_processing(); if (err) @@ -4944,7 +4941,12 @@ static int __init init_f2fs_fs(void) err = f2fs_create_casefold_cache(); if (err) goto free_compress_cache; + err = register_filesystem(&f2fs_fs_type); + if (err) + goto free_casefold_cache; return 0; +free_casefold_cache: + f2fs_destroy_casefold_cache(); free_compress_cache: f2fs_destroy_compress_cache(); free_compress_mempool: @@ -4959,8 +4961,6 @@ static int __init init_f2fs_fs(void) f2fs_destroy_post_read_processing(); free_root_stats: f2fs_destroy_root_stats(); - unregister_filesystem(&f2fs_fs_type); -free_shrinker: unregister_shrinker(&f2fs_shrinker_info); free_sysfs: f2fs_exit_sysfs(); @@ -4984,6 +4984,7 @@ static int __init init_f2fs_fs(void) static void __exit exit_f2fs_fs(void) { + unregister_filesystem(&f2fs_fs_type); f2fs_destroy_casefold_cache(); f2fs_destroy_compress_cache(); f2fs_destroy_compress_mempool(); @@ -4992,7 +4993,6 @@ static void __exit exit_f2fs_fs(void) f2fs_destroy_iostat_processing(); f2fs_destroy_post_read_processing(); f2fs_destroy_root_stats(); - unregister_filesystem(&f2fs_fs_type); unregister_shrinker(&f2fs_shrinker_info); f2fs_exit_sysfs(); f2fs_destroy_garbage_collection_cache(); -- 2.25.1

2 1

[PATCH OLK-5.10] hfsplus: don't query the device logical block size multiple times
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v5.10.231 commit e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADN CVE: CVE-2024-56548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ] Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589] Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h index c438680ef9f7..fed50472745f 100644 --- a/fs/hfsplus/hfsplus_fs.h +++ b/fs/hfsplus/hfsplus_fs.h @@ -156,6 +156,7 @@ struct hfsplus_sb_info { /* Runtime variables */ u32 blockoffset; + u32 min_io_size; sector_t part_start; sector_t sect_count; int fs_shift; @@ -306,7 +307,7 @@ struct hfsplus_readdir_data { */ static inline unsigned short hfsplus_min_io_size(struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size, HFSPLUS_SECTOR_SIZE); } diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c index 0350dc7821bf..59ba0a30f539 100644 --- a/fs/hfsplus/wrapper.c +++ b/fs/hfsplus/wrapper.c @@ -173,6 +173,8 @@ int hfsplus_read_wrapper(struct super_block *sb) if (!blocksize) goto out; + sbi->min_io_size = blocksize; + if (hfsplus_get_last_session(sb, &part_start, &part_size)) goto out; -- 2.25.1

2 1

[PATCH OLK-5.10] [Backport] hfsplus: don't query the device logical block size multiple times
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> stable inclusion from stable-v5.10.231 commit e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADN CVE: CVE-2024-56548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ] Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589] Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h index c438680ef9f7..fed50472745f 100644 --- a/fs/hfsplus/hfsplus_fs.h +++ b/fs/hfsplus/hfsplus_fs.h @@ -156,6 +156,7 @@ struct hfsplus_sb_info { /* Runtime variables */ u32 blockoffset; + u32 min_io_size; sector_t part_start; sector_t sect_count; int fs_shift; @@ -306,7 +307,7 @@ struct hfsplus_readdir_data { */ static inline unsigned short hfsplus_min_io_size(struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size, HFSPLUS_SECTOR_SIZE); } diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c index 0350dc7821bf..59ba0a30f539 100644 --- a/fs/hfsplus/wrapper.c +++ b/fs/hfsplus/wrapper.c @@ -173,6 +173,8 @@ int hfsplus_read_wrapper(struct super_block *sb) if (!blocksize) goto out; + sbi->min_io_size = blocksize; + if (hfsplus_get_last_session(sb, &part_start, &part_size)) goto out; -- 2.25.1

2 1

[PATCH OLK-5.10] scsi: bfa: Fix use-after-free in bfad_im_module_exit()
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Ye Bin <yebin10(a)huawei.com> stable inclusion from stable-v5.10.231 commit ef2c2580189ea88a0dcaf56eb3a565763a900edb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFA CVE: CVE-2024-53227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 178b8f38932d635e90f5f0e9af1986c6f4a89271 ] BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: <TASK> dump_stack_lvl+0x95/0xe0 print_report+0xcb/0x620 kasan_report+0xbd/0xf0 __lock_acquire+0x2aca/0x3a20 lock_acquire+0x19b/0x520 _raw_spin_lock+0x2b/0x40 attribute_container_unregister+0x30/0x160 fc_release_transport+0x19/0x90 [scsi_transport_fc] bfad_im_module_exit+0x23/0x60 [bfa] bfad_init+0xdb/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 fc_attach_transport+0x4f/0x4740 [scsi_transport_fc] bfad_im_module_init+0x17/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x38/0x50 kfree+0x212/0x480 bfad_im_module_init+0x7e/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Above issue happens as follows: bfad_init error = bfad_im_module_init() fc_release_transport(bfad_im_scsi_transport_template); if (error) goto ext; ext: bfad_im_module_exit(); fc_release_transport(bfad_im_scsi_transport_template); --> Trigger double release Don't call bfad_im_module_exit() if bfad_im_module_init() failed. Fixes: 7725ccfda597 ("[SCSI] bfa: Brocade BFA FC SCSI driver") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20241023011809.63466-1-yebin@huaweicloud.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/scsi/bfa/bfad.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c index 440ef32be048..45b5f83ad6da 100644 --- a/drivers/scsi/bfa/bfad.c +++ b/drivers/scsi/bfa/bfad.c @@ -1705,9 +1705,8 @@ bfad_init(void) error = bfad_im_module_init(); if (error) { - error = -ENOMEM; printk(KERN_WARNING "bfad_im_module_init failure\n"); - goto ext; + return -ENOMEM; } if (strcmp(FCPI_NAME, " fcpim") == 0) -- 2.25.1

2 1

[PATCH OLK-5.10] f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
by Chen Zhongjin 02 Jan '25

02 Jan '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit b7d0a97b28083084ebdd8e5c6bccd12e6ec18faa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFK CVE: CVE-2024-53221 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] Call Trace: <TASK> f2fs_submit_page_bio+0x126/0x8b0 [f2fs] __get_meta_page+0x1d4/0x920 [f2fs] get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs] validate_checkpoint+0xac/0x290 [f2fs] f2fs_get_valid_checkpoint+0x207/0x950 [f2fs] f2fs_fill_super+0x1007/0x39b0 [f2fs] mount_bdev+0x183/0x250 legacy_get_tree+0xf4/0x1e0 vfs_get_tree+0x88/0x340 do_new_mount+0x283/0x5e0 path_mount+0x2b2/0x15b0 __x64_sys_mount+0x1fe/0x270 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue happens as the biset of the f2fs file system is not initialized before register "f2fs_fs_type". To address above issue just register "f2fs_fs_type" at the last in init_f2fs_fs(). Ensure that all f2fs file system resources are initialized. Fixes: f543805fcd60 ("f2fs: introduce private bioset") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Conflicts: fs/f2fs/super.c [Conflict caused by commit 4d9a2bb1a6ba has not been merged] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- fs/f2fs/super.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 42d18166f10a..28f8b88a59ea 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -4116,9 +4116,6 @@ static int __init init_f2fs_fs(void) err = register_shrinker(&f2fs_shrinker_info); if (err) goto free_sysfs; - err = register_filesystem(&f2fs_fs_type); - if (err) - goto free_shrinker; f2fs_create_root_stats(); err = f2fs_init_post_read_processing(); if (err) @@ -4135,7 +4132,12 @@ static int __init init_f2fs_fs(void) err = f2fs_init_compress_cache(); if (err) goto free_compress_mempool; + err = register_filesystem(&f2fs_fs_type); + if (err) + goto free_compress_cache; return 0; +free_compress_cache: + f2fs_destroy_compress_cache(); free_compress_mempool: f2fs_destroy_compress_mempool(); free_bioset: @@ -4146,8 +4148,6 @@ static int __init init_f2fs_fs(void) f2fs_destroy_post_read_processing(); free_root_stats: f2fs_destroy_root_stats(); - unregister_filesystem(&f2fs_fs_type); -free_shrinker: unregister_shrinker(&f2fs_shrinker_info); free_sysfs: f2fs_exit_sysfs(); @@ -4171,13 +4171,13 @@ static int __init init_f2fs_fs(void) static void __exit exit_f2fs_fs(void) { + unregister_filesystem(&f2fs_fs_type); f2fs_destroy_compress_cache(); f2fs_destroy_compress_mempool(); f2fs_destroy_bioset(); f2fs_destroy_bio_entry_cache(); f2fs_destroy_post_read_processing(); f2fs_destroy_root_stats(); - unregister_filesystem(&f2fs_fs_type); unregister_shrinker(&f2fs_shrinker_info); f2fs_exit_sysfs(); f2fs_destroy_garbage_collection_cache(); -- 2.25.1

2 1

[PATCH OLK-6.6 V1] netfilter: nft_inner: incorrect percpu area handling under softirq
by Cheng Yu 02 Jan '25

02 Jan '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.66 commit 53c7314208c865086d78b4e88da53bc33da0b603 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOQ CVE: CVE-2024-56638 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 7b1d83da254be3bf054965c8f3b1ad976f460ae5 ] Softirq can interrupt ongoing packet from process context that is walking over the percpu area that contains inner header offsets. Disable bh and perform three checks before restoring the percpu inner header offsets to validate that the percpu area is valid for this skbuff: 1) If the NFT_PKTINFO_INNER_FULL flag is set on, then this skbuff has already been parsed before for inner header fetching to register. 2) Validate that the percpu area refers to this skbuff using the skbuff pointer as a cookie. If there is a cookie mismatch, then this skbuff needs to be parsed again. 3) Finally, validate if the percpu area refers to this tunnel type. Only after these three checks the percpu area is restored to a on-stack copy and bh is enabled again. After inner header fetching, the on-stack copy is stored back to the percpu area. Fixes: 3a07327d10a0 ("netfilter: nft_inner: support for inner tunnel header matching") Reported-by: syzbot+84d0441b9860f0d63285(a)syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/net/netfilter/nf_tables_core.h | 1 + net/netfilter/nft_inner.c | 57 ++++++++++++++++++++------ 2 files changed, 46 insertions(+), 12 deletions(-) diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h index 780a5f6ad4a6..16855c2a03f8 100644 --- a/include/net/netfilter/nf_tables_core.h +++ b/include/net/netfilter/nf_tables_core.h @@ -161,6 +161,7 @@ enum { }; struct nft_inner_tun_ctx { + unsigned long cookie; u16 type; u16 inner_tunoff; u16 inner_lloff; diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c index 928312d01eb1..817ab978d24a 100644 --- a/net/netfilter/nft_inner.c +++ b/net/netfilter/nft_inner.c @@ -210,35 +210,66 @@ static int nft_inner_parse(const struct nft_inner *priv, struct nft_pktinfo *pkt, struct nft_inner_tun_ctx *tun_ctx) { - struct nft_inner_tun_ctx ctx = {}; u32 off = pkt->inneroff; if (priv->flags & NFT_INNER_HDRSIZE && - nft_inner_parse_tunhdr(priv, pkt, &ctx, &off) < 0) + nft_inner_parse_tunhdr(priv, pkt, tun_ctx, &off) < 0) return -1; if (priv->flags & (NFT_INNER_LL | NFT_INNER_NH)) { - if (nft_inner_parse_l2l3(priv, pkt, &ctx, off) < 0) + if (nft_inner_parse_l2l3(priv, pkt, tun_ctx, off) < 0) return -1; } else if (priv->flags & NFT_INNER_TH) { - ctx.inner_thoff = off; - ctx.flags |= NFT_PAYLOAD_CTX_INNER_TH; + tun_ctx->inner_thoff = off; + tun_ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH; } - *tun_ctx = ctx; tun_ctx->type = priv->type; + tun_ctx->cookie = (unsigned long)pkt->skb; pkt->flags |= NFT_PKTINFO_INNER_FULL; return 0; } +static bool nft_inner_restore_tun_ctx(const struct nft_pktinfo *pkt, + struct nft_inner_tun_ctx *tun_ctx) +{ + struct nft_inner_tun_ctx *this_cpu_tun_ctx; + + local_bh_disable(); + this_cpu_tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx); + if (this_cpu_tun_ctx->cookie != (unsigned long)pkt->skb) { + local_bh_enable(); + return false; + } + *tun_ctx = *this_cpu_tun_ctx; + local_bh_enable(); + + return true; +} + +static void nft_inner_save_tun_ctx(const struct nft_pktinfo *pkt, + const struct nft_inner_tun_ctx *tun_ctx) +{ + struct nft_inner_tun_ctx *this_cpu_tun_ctx; + + local_bh_disable(); + this_cpu_tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx); + if (this_cpu_tun_ctx->cookie != tun_ctx->cookie) + *this_cpu_tun_ctx = *tun_ctx; + local_bh_enable(); +} + static bool nft_inner_parse_needed(const struct nft_inner *priv, const struct nft_pktinfo *pkt, - const struct nft_inner_tun_ctx *tun_ctx) + struct nft_inner_tun_ctx *tun_ctx) { if (!(pkt->flags & NFT_PKTINFO_INNER_FULL)) return true; + if (!nft_inner_restore_tun_ctx(pkt, tun_ctx)) + return true; + if (priv->type != tun_ctx->type) return true; @@ -248,27 +279,29 @@ static bool nft_inner_parse_needed(const struct nft_inner *priv, static void nft_inner_eval(const struct nft_expr *expr, struct nft_regs *regs, const struct nft_pktinfo *pkt) { - struct nft_inner_tun_ctx *tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx); const struct nft_inner *priv = nft_expr_priv(expr); + struct nft_inner_tun_ctx tun_ctx = {}; if (nft_payload_inner_offset(pkt) < 0) goto err; - if (nft_inner_parse_needed(priv, pkt, tun_ctx) && - nft_inner_parse(priv, (struct nft_pktinfo *)pkt, tun_ctx) < 0) + if (nft_inner_parse_needed(priv, pkt, &tun_ctx) && + nft_inner_parse(priv, (struct nft_pktinfo *)pkt, &tun_ctx) < 0) goto err; switch (priv->expr_type) { case NFT_INNER_EXPR_PAYLOAD: - nft_payload_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, tun_ctx); + nft_payload_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, &tun_ctx); break; case NFT_INNER_EXPR_META: - nft_meta_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, tun_ctx); + nft_meta_inner_eval((struct nft_expr *)&priv->expr, regs, pkt, &tun_ctx); break; default: WARN_ON_ONCE(1); goto err; } + nft_inner_save_tun_ctx(pkt, &tun_ctx); + return; err: regs->verdict.code = NFT_BREAK; -- 2.25.1

2 1

[PATCH OLK-5.10 V1] sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
by Cheng Yu 02 Jan '25

02 Jan '25

From: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> stable inclusion from stable-v6.11.10 commit fbfe23012cec509dfbe09852019c4e4bb84999d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB957H CVE: CVE-2024-53128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit fd7b4f9f46d46acbc7af3a439bb0d869efdc5c58 upstream. When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled. Example of the warning: ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364 sp : ffff800082ea7b40 x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534 x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0 x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418 x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000 x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050 Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ Link: https://lkml.kernel.org/r/20241113042544.19095-1-qun-wei.lin@mediatek.com Signed-off-by: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> Cc: Andrew Yang <andrew.yang(a)mediatek.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: Casper Li <casper.li(a)mediatek.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Chinwen Chang <chinwen.chang(a)mediatek.com> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/sched/task_stack.h [Context conflict caused by commit f6120d527b861("task_stack.h: add missing include") has not been merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/linux/sched/task_stack.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h index 879a5c8f930b..547d7cc9097e 100644 --- a/include/linux/sched/task_stack.h +++ b/include/linux/sched/task_stack.h @@ -8,6 +8,7 @@ #include <linux/sched.h> #include <linux/magic.h> +#include <linux/kasan.h> #ifdef CONFIG_THREAD_INFO_IN_TASK @@ -86,6 +87,7 @@ static inline int object_is_on_stack(const void *obj) { void *stack = task_stack_page(current); + obj = kasan_reset_tag(obj); return (obj >= stack) && (obj < (stack + THREAD_SIZE)); } -- 2.25.1

2 1

[PATCH OLK-6.6 V1] sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
by Cheng Yu 02 Jan '25

02 Jan '25

From: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> stable inclusion from stable-v6.11.10 commit fbfe23012cec509dfbe09852019c4e4bb84999d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB957H CVE: CVE-2024-53128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit fd7b4f9f46d46acbc7af3a439bb0d869efdc5c58 upstream. When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled. Example of the warning: ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364 sp : ffff800082ea7b40 x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534 x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0 x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418 x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000 x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050 Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ Link: https://lkml.kernel.org/r/20241113042544.19095-1-qun-wei.lin@mediatek.com Signed-off-by: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> Cc: Andrew Yang <andrew.yang(a)mediatek.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: Casper Li <casper.li(a)mediatek.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Chinwen Chang <chinwen.chang(a)mediatek.com> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/sched/task_stack.h [Context conflict caused by commit f6120d527b861("task_stack.h: add missing include") has not been merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/linux/sched/task_stack.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h index f158b025c175..d2117e1c8fa5 100644 --- a/include/linux/sched/task_stack.h +++ b/include/linux/sched/task_stack.h @@ -8,6 +8,7 @@ #include <linux/sched.h> #include <linux/magic.h> +#include <linux/kasan.h> #ifdef CONFIG_THREAD_INFO_IN_TASK @@ -88,6 +89,7 @@ static inline int object_is_on_stack(const void *obj) { void *stack = task_stack_page(current); + obj = kasan_reset_tag(obj); return (obj >= stack) && (obj < (stack + THREAD_SIZE)); } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 V1] sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
by Cheng Yu 02 Jan '25

02 Jan '25

From: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> stable inclusion from stable-v6.11.10 commit fbfe23012cec509dfbe09852019c4e4bb84999d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB957H CVE: CVE-2024-53128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit fd7b4f9f46d46acbc7af3a439bb0d869efdc5c58 upstream. When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled. Example of the warning: ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364 sp : ffff800082ea7b40 x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534 x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0 x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418 x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000 x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050 Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ Link: https://lkml.kernel.org/r/20241113042544.19095-1-qun-wei.lin@mediatek.com Signed-off-by: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> Cc: Andrew Yang <andrew.yang(a)mediatek.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: Casper Li <casper.li(a)mediatek.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Chinwen Chang <chinwen.chang(a)mediatek.com> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/sched/task_stack.h [Context conflict caused by commit f6120d527b861("task_stack.h: add missing include") has not been merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/linux/sched/task_stack.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h index d10150587d81..4424aff0cfce 100644 --- a/include/linux/sched/task_stack.h +++ b/include/linux/sched/task_stack.h @@ -8,6 +8,7 @@ #include <linux/sched.h> #include <linux/magic.h> +#include <linux/kasan.h> #ifdef CONFIG_THREAD_INFO_IN_TASK @@ -86,6 +87,7 @@ static inline int object_is_on_stack(const void *obj) { void *stack = task_stack_page(current); + obj = kasan_reset_tag(obj); return (obj >= stack) && (obj < (stack + THREAD_SIZE)); } -- 2.25.1

2 1

[PATCH OLK-6.6 V1] sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
by Cheng Yu 02 Jan '25

02 Jan '25

From: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> stable inclusion from stable-v6.11.10 commit fbfe23012cec509dfbe09852019c4e4bb84999d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB957H CVE: CVE-2024-53128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit fd7b4f9f46d46acbc7af3a439bb0d869efdc5c58 upstream. When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while the stack pointer does not have tags. This discrepancy can lead to incorrect stack object detection and subsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled. Example of the warning: ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4 Hardware name: linux,dummy-virt (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __debug_object_init+0x330/0x364 lr : __debug_object_init+0x330/0x364 sp : ffff800082ea7b40 x29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534 x26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0 x23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418 x20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000 x17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e x14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e x11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800 x8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4 x2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050 Call trace: __debug_object_init+0x330/0x364 debug_object_init_on_stack+0x30/0x3c schedule_hrtimeout_range_clock+0xac/0x26c schedule_hrtimeout+0x1c/0x30 wait_task_inactive+0x1d4/0x25c kthread_bind_mask+0x28/0x98 init_rescuer+0x1e8/0x280 workqueue_init+0x1a0/0x3cc kernel_init_freeable+0x118/0x200 kernel_init+0x28/0x1f0 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated. ------------[ cut here ]------------ Link: https://lkml.kernel.org/r/20241113042544.19095-1-qun-wei.lin@mediatek.com Signed-off-by: Qun-Wei Lin <qun-wei.lin(a)mediatek.com> Cc: Andrew Yang <andrew.yang(a)mediatek.com> Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Cc: Casper Li <casper.li(a)mediatek.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Chinwen Chang <chinwen.chang(a)mediatek.com> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/sched/task_stack.h [Context conflict caused by commit f6120d527b861("task_stack.h: add missing include") has not been merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/linux/sched/task_stack.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h index f158b025c175..d2117e1c8fa5 100644 --- a/include/linux/sched/task_stack.h +++ b/include/linux/sched/task_stack.h @@ -8,6 +8,7 @@ #include <linux/sched.h> #include <linux/magic.h> +#include <linux/kasan.h> #ifdef CONFIG_THREAD_INFO_IN_TASK @@ -88,6 +89,7 @@ static inline int object_is_on_stack(const void *obj) { void *stack = task_stack_page(current); + obj = kasan_reset_tag(obj); return (obj >= stack) && (obj < (stack + THREAD_SIZE)); } -- 2.25.1

2 1

[PATCH OLK-6.6] iommufd: Fix out_fput in iommufd_fault_alloc()
by GONG Ruiqi 02 Jan '25

02 Jan '25

From: Nicolin Chen <nicolinc(a)nvidia.com> mainline inclusion from mainline-v6.13-rc2 commit af7f4780514f850322b2959032ecaa96e4b26472 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOW CVE: CVE-2024-56624 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As fput() calls the file->f_op->release op, where fault obj and ictx are getting released, there is no need to release these two after fput() one more time, which would result in imbalanced refcounts: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 48 PID: 2369 at lib/refcount.c:31 refcount_warn_saturate+0x60/0x230 Call trace: refcount_warn_saturate+0x60/0x230 (P) refcount_warn_saturate+0x60/0x230 (L) iommufd_fault_fops_release+0x9c/0xe0 [iommufd] ... VFS: Close: file count is 0 (f_op=iommufd_fops [iommufd]) WARNING: CPU: 48 PID: 2369 at fs/open.c:1507 filp_flush+0x3c/0xf0 Call trace: filp_flush+0x3c/0xf0 (P) filp_flush+0x3c/0xf0 (L) __arm64_sys_close+0x34/0x98 ... imbalanced put on file reference count WARNING: CPU: 48 PID: 2369 at fs/file.c:74 __file_ref_put+0x100/0x138 Call trace: __file_ref_put+0x100/0x138 (P) __file_ref_put+0x100/0x138 (L) __fput_sync+0x4c/0xd0 Drop those two lines to fix the warnings above. Cc: stable(a)vger.kernel.org Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Link: https://patch.msgid.link/r/b5651beb3a6b1adeef26fffac24607353bf67ba1.1733212… Signed-off-by: Nicolin Chen <nicolinc(a)nvidia.com> Reviewed-by: Yi Liu <yi.l.liu(a)intel.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/iommu/iommufd/fault.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/iommu/iommufd/fault.c b/drivers/iommu/iommufd/fault.c index 11c70922ec47..f8c8bbf8e457 100644 --- a/drivers/iommu/iommufd/fault.c +++ b/drivers/iommu/iommufd/fault.c @@ -431,8 +431,6 @@ int iommufd_fault_alloc(struct iommufd_ucmd *ucmd) put_unused_fd(fdno); out_fput: fput(filep); - refcount_dec(&fault->obj.users); - iommufd_ctx_put(fault->ictx); out_abort: iommufd_object_abort_and_destroy(ucmd->ictx, &fault->obj); -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56546
by Lin Yujun 02 Jan '25

02 Jan '25

Gaosheng Cui (1): drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() drivers/soc/xilinx/xlnx_event_manager.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] apparmor: test: Fix memory leak for aa_unpack_strdup()
by Gu Bowen 02 Jan '25

02 Jan '25

From: Jinjie Ruan <ruanjinjie(a)huawei.com> stable inclusion from stable-v6.6.64 commit 2a9b68f2dc6812bd1b8880b5c00e60203d6f61f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGQ CVE: CVE-2024-56741 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7290f59231910ccba427d441a6e8b8c6f6112448 upstream. The string allocated by kmemdup() in aa_unpack_strdup() is not freed and cause following memory leaks, free them to fix it. unreferenced object 0xffffff80c6af8a50 (size 8): comm "kunit_try_catch", pid 225, jiffies 4294894407 hex dump (first 8 bytes): 74 65 73 74 69 6e 67 00 testing. backtrace (crc 5eab668b): [<0000000001e3714d>] kmemleak_alloc+0x34/0x40 [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0 [<000000006870467c>] kmemdup_noprof+0x34/0x60 [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c [<000000008ecde918>] policy_unpack_test_unpack_strdup_with_null_name+0xf8/0x3ec [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000adf936cf>] kthread+0x2e8/0x374 [<0000000041bb1628>] ret_from_fork+0x10/0x20 unreferenced object 0xffffff80c2a29090 (size 8): comm "kunit_try_catch", pid 227, jiffies 4294894409 hex dump (first 8 bytes): 74 65 73 74 69 6e 67 00 testing. backtrace (crc 5eab668b): [<0000000001e3714d>] kmemleak_alloc+0x34/0x40 [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0 [<000000006870467c>] kmemdup_noprof+0x34/0x60 [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c [<0000000046a45c1a>] policy_unpack_test_unpack_strdup_with_name+0xd0/0x3c4 [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000adf936cf>] kthread+0x2e8/0x374 [<0000000041bb1628>] ret_from_fork+0x10/0x20 Cc: stable(a)vger.kernel.org Fixes: 4d944bcd4e73 ("apparmor: add AppArmor KUnit tests for policy unpack") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/apparmor/policy_unpack_test.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c index 2b8003eb4f46..dd551587fe4a 100644 --- a/security/apparmor/policy_unpack_test.c +++ b/security/apparmor/policy_unpack_test.c @@ -281,6 +281,8 @@ static void policy_unpack_test_unpack_strdup_with_null_name(struct kunit *test) ((uintptr_t)puf->e->start <= (uintptr_t)string) && ((uintptr_t)string <= (uintptr_t)puf->e->end)); KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA); + + kfree(string); } static void policy_unpack_test_unpack_strdup_with_name(struct kunit *test) @@ -296,6 +298,8 @@ static void policy_unpack_test_unpack_strdup_with_name(struct kunit *test) ((uintptr_t)puf->e->start <= (uintptr_t)string) && ((uintptr_t)string <= (uintptr_t)puf->e->end)); KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA); + + kfree(string); } static void policy_unpack_test_unpack_strdup_out_of_bounds(struct kunit *test) @@ -313,6 +317,8 @@ static void policy_unpack_test_unpack_strdup_out_of_bounds(struct kunit *test) KUNIT_EXPECT_EQ(test, size, 0); KUNIT_EXPECT_NULL(test, string); KUNIT_EXPECT_PTR_EQ(test, puf->e->pos, start); + + kfree(string); } static void policy_unpack_test_unpack_nameX_with_null_name(struct kunit *test) -- 2.25.1

2 1

[PATCH OLK-5.10] net: phy: dp83869: fix memory corruption when enabling fiber
by Zhang Changzhong 02 Jan '25

02 Jan '25

From: Ingo van Lil <inguin(a)gmx.de> stable inclusion from stable-v5.10.227 commit 21b5af7f0c99b3bf1fd02016e6708b613acbcaf4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUE CVE: CVE-2024-50188 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a842e443ca8184f2dc82ab307b43a8b38defd6a5 ] When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure. Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed. Fixes: a29de52ba2a1 ("net: dp83869: Add ability to advertise Fiber connection") Signed-off-by: Ingo van Lil <inguin(a)gmx.de> Reviewed-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20241002161807.440378-1-inguin@gmx.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/dp83869.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c index 65b69ff..01b593e 100644 --- a/drivers/net/phy/dp83869.c +++ b/drivers/net/phy/dp83869.c @@ -610,7 +610,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev, phydev->supported); linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported); - linkmode_set_bit(ADVERTISED_FIBRE, phydev->advertising); if (dp83869->mode == DP83869_RGMII_1000_BASE) { linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT, -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] net: phy: dp83869: fix memory corruption when enabling fiber
by Zhang Changzhong 02 Jan '25

02 Jan '25

From: Ingo van Lil <inguin(a)gmx.de> stable inclusion from stable-v5.10.227 commit 21b5af7f0c99b3bf1fd02016e6708b613acbcaf4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUE CVE: CVE-2024-50188 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a842e443ca8184f2dc82ab307b43a8b38defd6a5 ] When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure. Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed. Fixes: a29de52ba2a1 ("net: dp83869: Add ability to advertise Fiber connection") Signed-off-by: Ingo van Lil <inguin(a)gmx.de> Reviewed-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20241002161807.440378-1-inguin@gmx.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/dp83869.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c index a9daff8..88d14d0 100644 --- a/drivers/net/phy/dp83869.c +++ b/drivers/net/phy/dp83869.c @@ -612,7 +612,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev, phydev->supported); linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported); - linkmode_set_bit(ADVERTISED_FIBRE, phydev->advertising); if (dp83869->mode == DP83869_RGMII_1000_BASE) { linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT, -- 2.9.5

2 1

[PATCH OLK-6.6] erofs: handle NONHEAD !delta[1] lclusters gracefully
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> stable inclusion from stable-v6.6.64 commit f466641debcbea8bdf78d1b63a6270aadf9301bf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBEAED CVE: CVE-2024-53234 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ] syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. `lclusterbits > 14` is illegal for compact indexes, error out too. Reported-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/67373c0c.050a0220.2a2fcc.0079.GAE@google.com Tested-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Fixes: d95ae5e25326 ("erofs: add support for the full decompressed length") Fixes: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size") Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20241115173651.3339514-1-hsiangkao@linux.alibaba.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/zmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 6bd435a565f6..76566c2cbf63 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -234,7 +234,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, unsigned int amortizedshift; erofs_off_t pos; - if (lcn >= totalidx) + if (lcn >= totalidx || vi->z_logical_clusterbits > 14) return -EINVAL; m->lcn = lcn; @@ -409,7 +409,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits; int err; - do { + while (1) { /* handle the last EOF pcluster (no next HEAD lcluster) */ if ((lcn << lclusterbits) >= inode->i_size) { map->m_llen = inode->i_size - map->m_la; @@ -421,14 +421,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return err; if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) { - DBG_BUGON(!m->delta[1] && - m->clusterofs != 1 << lclusterbits); + /* work around invalid d1 generated by pre-1.0 mkfs */ + if (unlikely(!m->delta[1])) { + m->delta[1] = 1; + DBG_BUGON(1); + } } else if (m->type == Z_EROFS_LCLUSTER_TYPE_PLAIN || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD1 || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD2) { - /* go on until the next HEAD lcluster */ if (lcn != headlcn) - break; + break; /* ends at the next HEAD lcluster */ m->delta[1] = 1; } else { erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu", @@ -437,8 +439,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return -EOPNOTSUPP; } lcn += m->delta[1]; - } while (m->delta[1]); - + } map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la; return 0; } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
by Liu Chuang 02 Jan '25

02 Jan '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v4.19.325 commit 8fbb57eabfc8ae67115cb47f904614c99d626a89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADR CVE: CVE-2022-49034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c891f7c6a4e90bb1199497552f24b26e46383bc upstream. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- Cc: stable(a)vger.kernel.org Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Tested-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- arch/sh/kernel/cpu/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/kernel/cpu/proc.c b/arch/sh/kernel/cpu/proc.c index 85961b4f9c69..136b4aefd73b 100644 --- a/arch/sh/kernel/cpu/proc.c +++ b/arch/sh/kernel/cpu/proc.c @@ -133,7 +133,7 @@ static int show_cpuinfo(struct seq_file *m, void *v) static void *c_start(struct seq_file *m, loff_t *pos) { - return *pos < NR_CPUS ? cpu_data + *pos : NULL; + return *pos < nr_cpu_ids ? cpu_data + *pos : NULL; } static void *c_next(struct seq_file *m, void *v, loff_t *pos) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-45009
by Wang Liang 02 Jan '25

02 Jan '25

Matthieu Baerts (NGI0) (2): mptcp: pm: only decrement add_addr_accepted for MPJ req mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow net/mptcp/pm_netlink.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Qi Han <hanqi(a)vivo.com> stable inclusion from stable-v5.10.231 commit dff561e4060d28edc9a2960d4a87f3c945a96aa3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPF CVE: CVE-2024-56586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace: __die_body+0x15/0x60 die+0x33/0x50 do_trap+0x10a/0x120 f2fs_evict_inode+0x58c/0x610 do_error_trap+0x60/0x80 f2fs_evict_inode+0x58c/0x610 exc_invalid_op+0x53/0x60 f2fs_evict_inode+0x58c/0x610 asm_exc_invalid_op+0x16/0x20 f2fs_evict_inode+0x58c/0x610 evict+0x101/0x260 dispose_list+0x30/0x50 evict_inodes+0x140/0x190 generic_shutdown_super+0x2f/0x150 kill_block_super+0x11/0x40 kill_f2fs_super+0x7d/0x140 deactivate_locked_super+0x2a/0x70 cleanup_mnt+0xb3/0x140 task_work_run+0x61/0x90 The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows: dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir Let's redirty inode when there is not free segments during checkpoint is disable. Signed-off-by: Qi Han <hanqi(a)vivo.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 8f29eb07c296..1fe06f7929fb 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -698,8 +698,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) !is_inode_flag_set(inode, FI_DIRTY_INODE)) return 0; - if (!f2fs_is_checkpoint_ready(sbi)) + if (!f2fs_is_checkpoint_ready(sbi)) { + f2fs_mark_inode_dirty_sync(inode, true); return -ENOSPC; + } /* * We need to balance fs here to prevent from producing dirty node pages -- 2.46.1

2 1

[PATCH OLK-5.10] nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
by Zizhi Wo 02 Jan '25

02 Jan '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.231 commit e3732102a9d638d8627d14fdf7b208462f0520e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANS CVE: CVE-2024-56619 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 985ebec4ab0a28bb5910c3b1481a40fbf7f9e61d upstream. Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required. Link: https://lkml.kernel.org/r/20241119172403.9292-1-konishi.ryusuke@gmail.com Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=96d5d14c47d97015c624 Tested-by: syzbot+96d5d14c47d97015c624(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 760a8bd01ada..f80cb1138f56 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -76,7 +76,7 @@ static inline void nilfs_put_page(struct page *page) */ static unsigned int nilfs_last_byte(struct inode *inode, unsigned long page_nr) { - unsigned int last_byte = inode->i_size; + u64 last_byte = inode->i_size; last_byte -= page_nr << PAGE_SHIFT; if (last_byte > PAGE_SIZE) -- 2.46.1

2 1