- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 14671/15255] arch/x86/kvm/../../../virt/kvm/vfio.c:519: warning: Function parameter or member 'dev' not described in 'find_arm_smmu_domain'
by kernel test robot 23 Oct '24

23 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e7bc79687a034a22f94328123d5cf8c4d4436c35 commit: ad540a13eb8292fc92651b3bf281088a502a85f9 [14671/15255] virtcca feature: fix msi iova map config: x86_64-kexec (https://download.01.org/0day-ci/archive/20241023/202410232346.tk5fQNpz-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241023/202410232346.tk5fQNpz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410232346.tk5fQNpz-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kvm/../../../virt/kvm/vfio.c:416: warning: Function parameter or member 'kv' not described in 'cvm_vfio_add_kvm_to_smmu_domain' arch/x86/kvm/../../../virt/kvm/vfio.c:416: warning: Excess function parameter 'kvm' description in 'cvm_vfio_add_kvm_to_smmu_domain' >> arch/x86/kvm/../../../virt/kvm/vfio.c:519: warning: Function parameter or member 'dev' not described in 'find_arm_smmu_domain' >> arch/x86/kvm/../../../virt/kvm/vfio.c:519: warning: Function parameter or member 'data' not described in 'find_arm_smmu_domain' >> arch/x86/kvm/../../../virt/kvm/vfio.c:519: warning: Excess function parameter 'kvf' description in 'find_arm_smmu_domain' >> arch/x86/kvm/../../../virt/kvm/vfio.c:519: warning: Excess function parameter 'smmu_domain_group_list' description in 'find_arm_smmu_domain' vim +519 arch/x86/kvm/../../../virt/kvm/vfio.c c57a5a1f767336 yangxiangkai 2024-09-11 512 c57a5a1f767336 yangxiangkai 2024-09-11 513 /** c57a5a1f767336 yangxiangkai 2024-09-11 514 * find_arm_smmu_domain - Find smmu domain list from kvm vfio file c57a5a1f767336 yangxiangkai 2024-09-11 515 * @kvf: Kvm vfio file c57a5a1f767336 yangxiangkai 2024-09-11 516 * @smmu_domain_group_list: List of smmu domain group c57a5a1f767336 yangxiangkai 2024-09-11 517 */ ad540a13eb8292 yangxiangkai 2024-09-20 518 int find_arm_smmu_domain(struct device *dev, void *data) c57a5a1f767336 yangxiangkai 2024-09-11 @519 { c57a5a1f767336 yangxiangkai 2024-09-11 520 int ret = 0; ad540a13eb8292 yangxiangkai 2024-09-20 521 struct iommu_domain *domain = NULL; c57a5a1f767336 yangxiangkai 2024-09-11 522 struct arm_smmu_domain *arm_smmu_domain = NULL; c57a5a1f767336 yangxiangkai 2024-09-11 523 struct arm_smmu_domain *arm_smmu_domain_node = NULL; ad540a13eb8292 yangxiangkai 2024-09-20 524 struct list_head *smmu_domain_group_list = (struct list_head *)data; c57a5a1f767336 yangxiangkai 2024-09-11 525 ad540a13eb8292 yangxiangkai 2024-09-20 526 domain = iommu_get_domain_for_dev(dev); ad540a13eb8292 yangxiangkai 2024-09-20 527 arm_smmu_domain = to_smmu_domain(domain); c57a5a1f767336 yangxiangkai 2024-09-11 528 list_for_each_entry(arm_smmu_domain_node, c57a5a1f767336 yangxiangkai 2024-09-11 529 smmu_domain_group_list, node) { c57a5a1f767336 yangxiangkai 2024-09-11 530 if (arm_smmu_domain_node == arm_smmu_domain) { c57a5a1f767336 yangxiangkai 2024-09-11 531 ret = -1; c57a5a1f767336 yangxiangkai 2024-09-11 532 break; c57a5a1f767336 yangxiangkai 2024-09-11 533 } c57a5a1f767336 yangxiangkai 2024-09-11 534 } c57a5a1f767336 yangxiangkai 2024-09-11 535 if (!ret) c57a5a1f767336 yangxiangkai 2024-09-11 536 list_add_tail(&arm_smmu_domain->node, smmu_domain_group_list); ad540a13eb8292 yangxiangkai 2024-09-20 537 ad540a13eb8292 yangxiangkai 2024-09-20 538 return 1; c57a5a1f767336 yangxiangkai 2024-09-11 539 } c57a5a1f767336 yangxiangkai 2024-09-11 540 :::::: The code at line 519 was first introduced by commit :::::: c57a5a1f767336eff9721cb833c067657ade31de virtcca feature: activate confidential vm to set security device s_s2ttbr :::::: TO: yangxiangkai <yangxiangkai(a)huawei.com> :::::: CC: yangxiangkai <yangxiangkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] LoongArch: fix some 3C6000&LS7A related problems
by Hongchen Zhang 23 Oct '24

23 Oct '24

gaojuxin (1): LoongArch: Add workaround for 3C6000 about io wr/rd wusheng (1): pci/quirks: LS7A2000 enble msi zhangtianyang (1): Loongarch: Dynamic enable writecombine zhenghaowei (1): acpi: mcfg quirk: Increased multi-chip support for the 3C6000 arch/loongarch/include/asm/irq.h | 4 +- arch/loongarch/kernel/setup.c | 30 ++++++++++- arch/loongarch/kernel/smp.c | 20 ++++++- drivers/acpi/pci_mcfg.c | 13 +++++ drivers/pci/quirks.c | 13 +++++ include/asm-generic/io.h | 90 ++++++++++++++++++++++++++++++-- include/drm/drm_cache.h | 2 +- 7 files changed, 162 insertions(+), 10 deletions(-) -- 2.33.0

2 5

[openeuler:OLK-6.6 14662/15255] arch/x86/kvm/../../../virt/kvm/vfio.c:184: warning: Function parameter or member 'kv' not described in 'cvm_vfio_add_kvm_to_smmu_domain'
by kernel test robot 23 Oct '24

23 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e7bc79687a034a22f94328123d5cf8c4d4436c35 commit: a8078c65197c6f2034431a431780538c7c324f79 [14662/15255] virtcca feature: bind the kvm handle of cvm with smmu domain config: x86_64-kexec (https://download.01.org/0day-ci/archive/20241023/202410231921.YFrtM1y8-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241023/202410231921.YFrtM1y8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410231921.YFrtM1y8-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kvm/../../../virt/kvm/vfio.c:184: warning: Function parameter or member 'kv' not described in 'cvm_vfio_add_kvm_to_smmu_domain' >> arch/x86/kvm/../../../virt/kvm/vfio.c:184: warning: Excess function parameter 'kvm' description in 'cvm_vfio_add_kvm_to_smmu_domain' vim +184 arch/x86/kvm/../../../virt/kvm/vfio.c 172 173 /** 174 * cvm_vfio_add_kvm_to_smmu_domain - Bind the confidential 175 * virtual machine to smmu domain 176 * @filp: The handle of file 177 * @kvm: The kvm belone to confidential virtual machine 178 * 179 * Returns: 180 * %-ENXIO if set kvm failed or iommu group is null 181 * %0 if set kvm success 182 */ 183 static int cvm_vfio_add_kvm_to_smmu_domain(struct file *filp, struct kvm_vfio *kv) > 184 { 185 struct iommu_group *iommu_group; 186 int ret = 0; 187 188 if (!is_virtcca_cvm_enable()) 189 return ret; 190 191 mutex_unlock(&kv->lock); 192 iommu_group = cvm_vfio_file_iommu_group(filp); 193 if (!iommu_group) { 194 ret = -ENXIO; 195 goto out_lock; 196 } 197 if (cvm_arm_smmu_domain_set_kvm((void *)iommu_group)) { 198 ret = -ENXIO; 199 goto out_lock; 200 } 201 202 out_lock: 203 mutex_lock(&kv->lock); 204 return ret; 205 } 206 #endif 207 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-35990
by Yongqiang Liu 23 Oct '24

23 Oct '24

Sean Anderson (1): dma: xilinx_dpdma: Fix locking drivers/dma/xilinx/xilinx_dpdma.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] of: module: prevent NULL pointer dereference in vsnprintf()
by Chen Jun 23 Oct '24

23 Oct '24

From: Sergey Shtylyov <s.shtylyov(a)omp.ru> mainline inclusion from mainline-v6.9-rc3 commit a1aa5390cc912934fee76ce80af5f940452fa987 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG8R CVE: CVE-2024-35878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In of_modalias(), we can get passed the str and len parameters which would cause a kernel oops in vsnprintf() since it only allows passing a NULL ptr when the length is also 0. Also, we need to filter out the negative values of the len parameter as these will result in a really huge buffer since snprintf() takes size_t parameter while ours is ssize_t... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Signed-off-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/1d211023-3923-685b-20f0-f3f90ea56e1f@omp.ru Signed-off-by: Rob Herring <robh(a)kernel.org> Conflicts: drivers/of/device.c drivers/of/module.c [chenjun: context conflicts. of_modalias() is not extracted from of_device_get_modalias().] Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/of/device.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/of/device.c b/drivers/of/device.c index 93f08f18f6b3..0b1d317acb88 100644 --- a/drivers/of/device.c +++ b/drivers/of/device.c @@ -226,6 +226,14 @@ static ssize_t of_device_get_modalias(struct device *dev, char *str, ssize_t len if ((!dev) || (!dev->of_node)) return -ENODEV; + /* + * Prevent a kernel oops in vsnprintf() -- it only allows passing a + * NULL ptr when the length is also 0. Also filter out the negative + * lengths... + */ + if ((len > 0 && !str) || len < 0) + return -EINVAL; + /* Name & Type */ /* %p eats all alphanum characters, so %c must be used here */ csize = snprintf(str, len, "of:N%pOFn%c%s", dev->of_node, 'T', -- 2.17.1

2 1

[PATCH 1/5] pmdomain: ti-sci: Add missing of_node_put() for args.np
by Zhang Zekun 23 Oct '24

23 Oct '24

of_parse_phandle_with_args() need to call of_node_put() to decerement the refcount of args.np. Adding backing the missing of_node_put(). Fixes: efa5c01cd7ee ("soc: ti: ti_sci_pm_domains: switch to use multiple genpds instead of one") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/pmdomain/ti/ti_sci_pm_domains.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/pmdomain/ti/ti_sci_pm_domains.c b/drivers/pmdomain/ti/ti_sci_pm_domains.c index 1510d5ddae3d..0df3eb7ff09a 100644 --- a/drivers/pmdomain/ti/ti_sci_pm_domains.c +++ b/drivers/pmdomain/ti/ti_sci_pm_domains.c @@ -161,6 +161,7 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev) break; if (args.args_count >= 1 && args.np == dev->of_node) { + of_node_put(args.np); if (args.args[0] > max_id) { max_id = args.args[0]; } else { @@ -192,7 +193,10 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev) pm_genpd_init(&pd->pd, NULL, true); list_add(&pd->node, &pd_provider->pd_list); + } else { + of_node_put(args.np); } + index++; } } -- 2.17.1

1 0

[PATCH OLK-5.10] nvmet: fix a possible leak when destroy a ctrl during qp establishment
by Chen Jun 23 Oct '24

23 Oct '24

From: Sagi Grimberg <sagi(a)grimberg.me> stable inclusion from stable-v5.10.222 commit 2f3c22b1d3d7e86712253244797a651998c141fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSQU CVE: CVE-2024-42152 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c758b77d4a0a0ed3a1292b3fd7a2aeccd1a169a4 ] In nvmet_sq_destroy we capture sq->ctrl early and if it is non-NULL we know that a ctrl was allocated (in the admin connect request handler) and we need to release pending AERs, clear ctrl->sqs and sq->ctrl (for nvme-loop primarily), and drop the final reference on the ctrl. However, a small window is possible where nvmet_sq_destroy starts (as a result of the client giving up and disconnecting) concurrently with the nvme admin connect cmd (which may be in an early stage). But *before* kill_and_confirm of sq->ref (i.e. the admin connect managed to get an sq live reference). In this case, sq->ctrl was allocated however after it was captured in a local variable in nvmet_sq_destroy. This prevented the final reference drop on the ctrl. Solve this by re-capturing the sq->ctrl after all inflight request has completed, where for sure sq->ctrl reference is final, and move forward based on that. This issue was observed in an environment with many hosts connecting multiple ctrls simoutanuosly, creating a delay in allocating a ctrl leading up to this race window. Reported-by: Alex Turin <alex(a)vastdata.com> Signed-off-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/nvme/target/core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c index a320eb5b2133..facd49ab3659 100644 --- a/drivers/nvme/target/core.c +++ b/drivers/nvme/target/core.c @@ -795,6 +795,15 @@ void nvmet_sq_destroy(struct nvmet_sq *sq) wait_for_completion(&sq->free_done); percpu_ref_exit(&sq->ref); + /* + * we must reference the ctrl again after waiting for inflight IO + * to complete. Because admin connect may have sneaked in after we + * store sq->ctrl locally, but before we killed the percpu_ref. the + * admin connect allocates and assigns sq->ctrl, which now needs a + * final ref put, as this ctrl is going away. + */ + ctrl = sq->ctrl; + if (ctrl) { /* * The teardown flow may take some time, and the host may not -- 2.17.1

2 1

[PATCH OLK-5.10 0/1] CVE-2024-43894
by Yongqiang Liu 23 Oct '24

23 Oct '24

Ma Ke (1): drm/client: fix null pointer dereference in drm_client_modeset_probe drivers/gpu/drm/drm_client_modeset.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-43894
by Yongqiang Liu 23 Oct '24

23 Oct '24

Ma Ke (1): drm/client: fix null pointer dereference in drm_client_modeset_probe drivers/gpu/drm/drm_client_modeset.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2023-52855
by Yongqiang Liu 23 Oct '24

23 Oct '24

Jia-Ju Bai (1): usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency drivers/usb/dwc2/hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2