- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] [Backport] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
by Lin Ruifeng 15 Jan '25

15 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.15.174 commit f5804567cf9605d6e5ec46c0bb786f7d50f18c13 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBX6 CVE: CVE-2024-56777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Acked-by: Alain Volmat <alain.volmat(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/gpu/drm/sti/sti_gdp.c [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c index 2d5a2b5b78b8..c268a2ef1431 100644 --- a/drivers/gpu/drm/sti/sti_gdp.c +++ b/drivers/gpu/drm/sti/sti_gdp.c @@ -634,6 +634,9 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane, mixer = to_sti_mixer(crtc); crtc_state = drm_atomic_get_crtc_state(state->state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = state->crtc_x; dst_y = state->crtc_y; -- 2.22.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 15 Jan '25

15 Jan '25

您好！ Kernel 邀请您参加 2025-01-17 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申报，也可直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/988444011 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-01-17 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申报，也可直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/988444011. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3bfb552dbcbc9d1f3e9eb36c119271a0d590e7f8
by kernel test robot 14 Jan '25

14 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3bfb552dbcbc9d1f3e9eb36c119271a0d590e7f8 !14740 NFSv4: Fix deadlock during the running of state manager Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250114 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250114 | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) |-- arm64-randconfig-003-20250114 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250114 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250114 | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ov2680.o:warning:objtool:missing-symbol-for-section-.init.text | |-- kernel-trace-preemptirq_delay_test.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250114 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250114 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250114 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250114 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250114 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-crypto-ccree-cc_debugfs.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-crypto-ccree-cc_hash.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-fme-mgr.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-pci.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-cdns-dsi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-panel-panel-ilitek-ili9881c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ov2680.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-video-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pci-ats.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-watchdog-menz69_wdt.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-defconfig |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions elapsed time: 729m configs tested: 15 configs skipped: 108 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250114 gcc-14.2.0 arm64 randconfig-002-20250114 gcc-14.2.0 arm64 randconfig-003-20250114 gcc-14.2.0 arm64 randconfig-004-20250114 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250114 clang-19 x86_64 buildonly-randconfig-002-20250114 clang-19 x86_64 buildonly-randconfig-003-20250114 clang-19 x86_64 buildonly-randconfig-004-20250114 clang-19 x86_64 buildonly-randconfig-005-20250114 clang-19 x86_64 buildonly-randconfig-006-20250114 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 44e699017cdc4881f46ede1e7b88fde9f037766c
by kernel test robot 14 Jan '25

14 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 44e699017cdc4881f46ede1e7b88fde9f037766c !14838 v2 fs: Filter specific inodes to prevent UAF issues Error/Warning (recently discovered and may have been fixed): drivers/mtd/nand/raw/nand_macronix.o: warning: objtool: nand_power_down_op()+0x1de: unreachable instruction net/hsr/hsr_device.o: warning: objtool: hsr_check_carrier_and_operstate()+0xea: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-defconfig | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- arm64-randconfig-003-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-allnoconfig | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-001-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-buildonly-randconfig-002-20241228 | |-- drivers-mtd-nand-raw-nand_macronix.o:warning:objtool:nand_power_down_op:unreachable-instruction | `-- net-hsr-hsr_device.o:warning:objtool:hsr_check_carrier_and_operstate:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20250114 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_object_max_active | `-- fs-fscache-main.c:warning:unused-variable-fscache_min_op_max_active |-- x86_64-buildonly-randconfig-004-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-buildonly-randconfig-005-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data `-- x86_64-randconfig-r062-20250114 |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character elapsed time: 732m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250114 clang-17 arm64 randconfig-002-20250114 clang-19 arm64 randconfig-003-20250114 gcc-14.2.0 arm64 randconfig-004-20250114 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250114 clang-19 x86_64 buildonly-randconfig-002-20250114 clang-19 x86_64 buildonly-randconfig-003-20250114 clang-19 x86_64 buildonly-randconfig-004-20250114 clang-19 x86_64 buildonly-randconfig-005-20250114 clang-19 x86_64 buildonly-randconfig-006-20250114 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/sti: avoid potential dereference of error pointers
by Li Huafei 14 Jan '25

14 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v6.6.64 commit 8ab73ac97c0fa528f66eeccd9bb53eb6eb7d20dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLRS CVE: CVE-2024-56776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 831214f77037de02afc287eae93ce97f218d8c04 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Link: https://patchwork.freedesktop.org/patch/msgid/20240913090412.2022848-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/gpu/drm/sti/sti_cursor.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c index db0a1eb53532..c59fcb4dca32 100644 --- a/drivers/gpu/drm/sti/sti_cursor.c +++ b/drivers/gpu/drm/sti/sti_cursor.c @@ -200,6 +200,9 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane, return 0; crtc_state = drm_atomic_get_crtc_state(state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 14 Jan '25

14 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Benoît Sevens <bsevens(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 01b414448312..de8d7e2c6b3a 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -35,6 +35,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -52,36 +56,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 4fbc633527d173d6e350da6be39009c6a449a802
by kernel test robot 14 Jan '25

14 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 4fbc633527d173d6e350da6be39009c6a449a802 !14846 net: stmmac: fix TSO DMA API usage causing oops Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501140558.Dz2Pe9bS-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501140732.yHKX6wmK-lkp@intel.com drivers/i2c/busses/i2c-zhaoxin-smbus.c:367:36: warning: unused variable 'zxsmb_acpi_match' [-Wunused-const-variable] drivers/irqchip/irq-gic-v3.c:1086:43: error: incompatible integer to pointer conversion passing 'int' to parameter of type 'void *' [-Wint-conversion] include/../drivers/pci/msi/msi.h:113:57: warning: declaration of 'struct msix_entry' will not be visible outside of this function [-Wvisibility] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- arm64-randconfig-002-20250114 | |-- drivers-i2c-busses-i2c-zhaoxin-smbus.c:warning:unused-variable-zxsmb_acpi_match | `-- kernel-cgroup-cgroup.c:error:use-of-undeclared-identifier-cgroup_psi_stat_show |-- arm64-randconfig-004-20250114 | |-- drivers-irqchip-irq-gic-v3.c:error:incompatible-integer-to-pointer-conversion-passing-int-to-parameter-of-type-void | `-- include-..-drivers-pci-msi-msi.h:warning:declaration-of-struct-msix_entry-will-not-be-visible-outside-of-this-function |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-002-20250114 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. `-- x86_64-allyesconfig |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put elapsed time: 738m configs tested: 19 configs skipped: 113 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250114 clang-17 arm64 randconfig-002-20250114 clang-19 arm64 randconfig-003-20250114 gcc-14.2.0 arm64 randconfig-004-20250114 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250114 gcc-14.2.0 loongarch randconfig-002-20250114 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250114 clang-19 x86_64 buildonly-randconfig-002-20250114 clang-19 x86_64 buildonly-randconfig-003-20250114 clang-19 x86_64 buildonly-randconfig-004-20250114 clang-19 x86_64 buildonly-randconfig-005-20250114 clang-19 x86_64 buildonly-randconfig-006-20250114 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] sched: psi: fix bogus pressure spikes from aggregation race
by Chen Ridong 14 Jan '25

14 Jan '25

From: Johannes Weiner <hannes(a)cmpxchg.org> stable inclusion from stable-v6.6.55 commit 1f997b1d13e0b9819468e577622e747b546516fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6YDK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] Brandon reports sporadic, non-sensical spikes in cumulative pressure time (total=) when reading cpu.pressure at a high rate. This is due to a race condition between reader aggregation and tasks changing states. While it affects all states and all resources captured by PSI, in practice it most likely triggers with CPU pressure, since scheduling events are so frequent compared to other resource events. The race context is the live snooping of ongoing stalls during a pressure read. The read aggregates per-cpu records for stalls that have concluded, but will also incorporate ad-hoc the duration of any active state that hasn't been recorded yet. This is important to get timely measurements of ongoing stalls. Those ad-hoc samples are calculated on-the-fly up to the current time on that CPU; since the stall hasn't concluded, it's expected that this is the minimum amount of stall time that will enter the per-cpu records once it does. The problem is that the path that concludes the state uses a CPU clock read that is not synchronized against aggregators; the clock is read outside of the seqlock protection. This allows aggregators to race and snoop a stall with a longer duration than will actually be recorded. With the recorded stall time being less than the last snapshot remembered by the aggregator, a subsequent sample will underflow and observe a bogus delta value, resulting in an erratic jump in pressure. Fix this by moving the clock read of the state change into the seqlock protection. This ensures no aggregation can snoop live stalls past the time that's recorded when the state concludes. Reported-by: Brandon Duffany <brandon(a)buildbuddy.io> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ Fixes: d67515514ca5 ("psi: Reduce calls to sched_clock() in psi") Cc: stable(a)vger.kernel.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Chengming Zhou <chengming.zhou(a)linux.dev> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/sched/psi.c [ Context conflicts and psi_cgroup_restart(re-enable) is not merged. Move the update_psi_stat_delta into the psi_group_change functions ] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- kernel/sched/psi.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 977c973d1e70..b0068145b185 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -962,13 +962,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) } static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, u64 now, + unsigned int clear, unsigned int set, bool wake_clock) { struct psi_group_cpu *groupc; unsigned int t, m; enum psi_states s; u32 state_mask; + u64 now; groupc = per_cpu_ptr(group->pcpu, cpu); @@ -981,7 +982,9 @@ static void psi_group_change(struct psi_group *group, int cpu, * change requested through the @clear and @set bits. */ write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); + update_psi_stat_delta(group, cpu, now); record_times(groupc, now); record_cpu_stat_times(group, cpu); @@ -1110,7 +1113,6 @@ void psi_task_change(struct task_struct *task, int clear, int set) int cpu = task_cpu(task); struct psi_group *group; void *iter = NULL; - u64 now; int stat_set = 0; int stat_clear = 0; @@ -1120,11 +1122,8 @@ void psi_task_change(struct task_struct *task, int clear, int set) psi_flags_change(task, clear, set); psi_stat_flags_change(task, &stat_set, &stat_clear, set, clear); - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, true); + psi_group_change(group, cpu, clear, set, true); psi_group_stat_change(group, cpu, stat_clear, stat_set); } } @@ -1135,7 +1134,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, struct psi_group *group, *common = NULL; int cpu = task_cpu(prev); void *iter; - u64 now = cpu_clock(cpu); if (next->pid) { update_throttle_type(next, cpu, true); @@ -1153,8 +1151,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, break; } - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); + psi_group_change(group, cpu, 0, TSK_ONCPU, true); psi_group_stat_change(group, cpu, 0, 0); } } @@ -1196,8 +1193,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, iter = NULL; while ((group = iterate_groups(prev, &iter)) && group != common) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } #ifdef CONFIG_PSI_FINE_GRAINED @@ -1214,8 +1210,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, memstall_type_change) { clear &= ~TSK_ONCPU; for (; group; group = iterate_groups(prev, &iter)) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } @@ -1238,12 +1233,11 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) if (!task->pid) return; - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { groupc = per_cpu_ptr(group->pcpu, cpu); write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); update_psi_stat_delta(group, cpu, now); record_stat_times(to_psi_group_ext(group), cpu); -- 2.34.1

2 1

[PATCH OLK-6.6] sched: psi: fix bogus pressure spikes from aggregation race
by Chen Ridong 14 Jan '25

14 Jan '25

From: Johannes Weiner <hannes(a)cmpxchg.org> stable inclusion from stable-v6.6.55 commit 1f997b1d13e0b9819468e577622e747b546516fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6YDK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] Brandon reports sporadic, non-sensical spikes in cumulative pressure time (total=) when reading cpu.pressure at a high rate. This is due to a race condition between reader aggregation and tasks changing states. While it affects all states and all resources captured by PSI, in practice it most likely triggers with CPU pressure, since scheduling events are so frequent compared to other resource events. The race context is the live snooping of ongoing stalls during a pressure read. The read aggregates per-cpu records for stalls that have concluded, but will also incorporate ad-hoc the duration of any active state that hasn't been recorded yet. This is important to get timely measurements of ongoing stalls. Those ad-hoc samples are calculated on-the-fly up to the current time on that CPU; since the stall hasn't concluded, it's expected that this is the minimum amount of stall time that will enter the per-cpu records once it does. The problem is that the path that concludes the state uses a CPU clock read that is not synchronized against aggregators; the clock is read outside of the seqlock protection. This allows aggregators to race and snoop a stall with a longer duration than will actually be recorded. With the recorded stall time being less than the last snapshot remembered by the aggregator, a subsequent sample will underflow and observe a bogus delta value, resulting in an erratic jump in pressure. Fix this by moving the clock read of the state change into the seqlock protection. This ensures no aggregation can snoop live stalls past the time that's recorded when the state concludes. Reported-by: Brandon Duffany <brandon(a)buildbuddy.io> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ Fixes: df77430639c9 ("psi: Reduce calls to sched_clock() in psi") Cc: stable(a)vger.kernel.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Chengming Zhou <chengming.zhou(a)linux.dev> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/sched/psi.c [ Just context conflicts. ] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> --- kernel/sched/psi.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 9f68756a3bafe..1c8b1f9975138 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -988,13 +988,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) } static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, u64 now, + unsigned int clear, unsigned int set, bool wake_clock) { struct psi_group_cpu *groupc; unsigned int t, m; enum psi_states s; u32 state_mask; + u64 now; groupc = per_cpu_ptr(group->pcpu, cpu); @@ -1008,6 +1009,7 @@ static void psi_group_change(struct psi_group *group, int cpu, * SOME and FULL time these may have resulted in. */ write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); /* * Start with TSK_ONCPU, which doesn't have a corresponding @@ -1150,7 +1152,6 @@ void psi_task_change(struct task_struct *task, int clear, int set) { int cpu = task_cpu(task); struct psi_group *group; - u64 now; int stat_set = 0; int stat_clear = 0; @@ -1160,11 +1161,9 @@ void psi_task_change(struct task_struct *task, int clear, int set) psi_flags_change(task, clear, set); psi_stat_flags_change(task, &stat_set, &stat_clear, set, clear); - now = cpu_clock(cpu); - group = task_psi_group(task); do { - psi_group_change(group, cpu, clear, set, now, true); + psi_group_change(group, cpu, clear, set, true); psi_group_stat_change(group, cpu, stat_clear, stat_set); } while ((group = group->parent)); } @@ -1174,7 +1173,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, { struct psi_group *group, *common = NULL; int cpu = task_cpu(prev); - u64 now = cpu_clock(cpu); if (next->pid) { update_throttle_type(next, cpu, true); @@ -1192,7 +1190,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, break; } - psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); + psi_group_change(group, cpu, 0, TSK_ONCPU, true); psi_group_stat_change(group, cpu, 0, 0); } while ((group = group->parent)); } @@ -1236,7 +1234,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, do { if (group == common) break; - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } while ((group = group->parent)); @@ -1255,7 +1253,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, memstall_type_change) { clear &= ~TSK_ONCPU; for (; group; group = group->parent) { - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } } @@ -1268,7 +1266,6 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) int cpu = task_cpu(task); struct psi_group *group; struct psi_group_cpu *groupc; - u64 now; if (static_branch_likely(&psi_disabled)) return; @@ -1276,14 +1273,15 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) if (!task->pid) return; - now = cpu_clock(cpu); - group = task_psi_group(task); do { + u64 now; + if (!group->enabled) continue; groupc = per_cpu_ptr(group->pcpu, cpu); + now = cpu_clock(cpu); write_seqcount_begin(&groupc->seq); @@ -1497,11 +1495,9 @@ void psi_cgroup_restart(struct psi_group *group) for_each_possible_cpu(cpu) { struct rq *rq = cpu_rq(cpu); struct rq_flags rf; - u64 now; rq_lock_irq(rq, &rf); - now = cpu_clock(cpu); - psi_group_change(group, cpu, 0, 0, now, true); + psi_group_change(group, cpu, 0, 0, true); rq_unlock_irq(rq, &rf); } } -- 2.34.1

2 1

[PATCH OLK-5.10] sched: psi: fix bogus pressure spikes from aggregation race
by Chen Ridong 14 Jan '25

14 Jan '25

From: Johannes Weiner <hannes(a)cmpxchg.org> stable inclusion from stable-v6.6.55 commit 1f997b1d13e0b9819468e577622e747b546516fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6YDK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] Brandon reports sporadic, non-sensical spikes in cumulative pressure time (total=) when reading cpu.pressure at a high rate. This is due to a race condition between reader aggregation and tasks changing states. While it affects all states and all resources captured by PSI, in practice it most likely triggers with CPU pressure, since scheduling events are so frequent compared to other resource events. The race context is the live snooping of ongoing stalls during a pressure read. The read aggregates per-cpu records for stalls that have concluded, but will also incorporate ad-hoc the duration of any active state that hasn't been recorded yet. This is important to get timely measurements of ongoing stalls. Those ad-hoc samples are calculated on-the-fly up to the current time on that CPU; since the stall hasn't concluded, it's expected that this is the minimum amount of stall time that will enter the per-cpu records once it does. The problem is that the path that concludes the state uses a CPU clock read that is not synchronized against aggregators; the clock is read outside of the seqlock protection. This allows aggregators to race and snoop a stall with a longer duration than will actually be recorded. With the recorded stall time being less than the last snapshot remembered by the aggregator, a subsequent sample will underflow and observe a bogus delta value, resulting in an erratic jump in pressure. Fix this by moving the clock read of the state change into the seqlock protection. This ensures no aggregation can snoop live stalls past the time that's recorded when the state concludes. Reported-by: Brandon Duffany <brandon(a)buildbuddy.io> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ Fixes: df77430639c9 ("psi: Reduce calls to sched_clock() in psi") Cc: stable(a)vger.kernel.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Chengming Zhou <chengming.zhou(a)linux.dev> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/sched/psi.c [ Context conflicts and psi_cgroup_restart(re-enable) is not merged. Move the update_psi_stat_delta into the psi_group_change functions ] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- kernel/sched/psi.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 977c973d1e70..b0068145b185 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -962,13 +962,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) } static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, u64 now, + unsigned int clear, unsigned int set, bool wake_clock) { struct psi_group_cpu *groupc; unsigned int t, m; enum psi_states s; u32 state_mask; + u64 now; groupc = per_cpu_ptr(group->pcpu, cpu); @@ -981,7 +982,9 @@ static void psi_group_change(struct psi_group *group, int cpu, * change requested through the @clear and @set bits. */ write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); + update_psi_stat_delta(group, cpu, now); record_times(groupc, now); record_cpu_stat_times(group, cpu); @@ -1110,7 +1113,6 @@ void psi_task_change(struct task_struct *task, int clear, int set) int cpu = task_cpu(task); struct psi_group *group; void *iter = NULL; - u64 now; int stat_set = 0; int stat_clear = 0; @@ -1120,11 +1122,8 @@ void psi_task_change(struct task_struct *task, int clear, int set) psi_flags_change(task, clear, set); psi_stat_flags_change(task, &stat_set, &stat_clear, set, clear); - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, true); + psi_group_change(group, cpu, clear, set, true); psi_group_stat_change(group, cpu, stat_clear, stat_set); } } @@ -1135,7 +1134,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, struct psi_group *group, *common = NULL; int cpu = task_cpu(prev); void *iter; - u64 now = cpu_clock(cpu); if (next->pid) { update_throttle_type(next, cpu, true); @@ -1153,8 +1151,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, break; } - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); + psi_group_change(group, cpu, 0, TSK_ONCPU, true); psi_group_stat_change(group, cpu, 0, 0); } } @@ -1196,8 +1193,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, iter = NULL; while ((group = iterate_groups(prev, &iter)) && group != common) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } #ifdef CONFIG_PSI_FINE_GRAINED @@ -1214,8 +1210,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, memstall_type_change) { clear &= ~TSK_ONCPU; for (; group; group = iterate_groups(prev, &iter)) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } @@ -1238,12 +1233,11 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) if (!task->pid) return; - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { groupc = per_cpu_ptr(group->pcpu, cpu); write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); update_psi_stat_delta(group, cpu, now); record_stat_times(to_psi_group_ext(group), cpu); -- 2.34.1

2 1