- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] uio: Fix use-after-free in uio_open
by Guo Mengqi 23 Feb '24

23 Feb '24

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v4.19.306 commit 3174e0f7de1ba392dc191625da83df02d695b60c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXN CVE: CVE-2023-52439 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream. core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered") Cc: stable <stable(a)kernel.org> Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@li… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index f43498e5cfb8..facccb36f692 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -464,13 +464,13 @@ static int uio_open(struct inode *inode, struct file *filep) mutex_lock(&minor_lock); idev = idr_find(&uio_idr, iminor(inode)); - mutex_unlock(&minor_lock); if (!idev) { ret = -ENODEV; + mutex_unlock(&minor_lock); goto out; } - get_device(&idev->dev); + mutex_unlock(&minor_lock); if (!try_module_get(idev->owner)) { ret = -ENODEV; @@ -1024,9 +1024,8 @@ void uio_unregister_device(struct uio_info *info) wake_up_interruptible(&idev->wait); kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); - device_unregister(&idev->dev); - uio_free_minor(minor); + device_unregister(&idev->dev); return; } -- 2.17.1

2 1

[PATCH OLK-6.6 0/3] audit: Backport mainline patches
by GUO Zihua 23 Feb '24

23 Feb '24

This series backports mainline bugfixes for audit. Jan Kara (3): audit_tree: Remove mark->lock locking audit: Fix possible spurious -ENOSPC error audit: Fix possible tagging failures kernel/audit_tree.c | 61 ++++++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 34 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/1] keys: safe concurrent user->{session,uid}_keyring access
by GUO Zihua 23 Feb '24

23 Feb '24

This patch backports mainline bugfix commit 0b9dc6c9f01c ("keys: safe concurrent user->{session,uid}_keyring access") Jann Horn (1): keys: safe concurrent user->{session,uid}_keyring access include/linux/sched/user.h | 7 +++++++ security/keys/process_keys.c | 31 +++++++++++++++++-------------- security/keys/request_key.c | 5 +++-- 3 files changed, 27 insertions(+), 16 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] keys: safe concurrent user->{session,uid}_keyring access
by GUO Zihua 23 Feb '24

23 Feb '24

This patch backports mainline bugfix commit 0b9dc6c9f01c ("keys: safe concurrent user->{session,uid}_keyring access") Jann Horn (1): keys: safe concurrent user->{session,uid}_keyring access include/linux/sched/user.h | 7 +++++++ security/keys/process_keys.c | 31 +++++++++++++++++-------------- security/keys/request_key.c | 5 +++-- 3 files changed, 27 insertions(+), 16 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/3] audit: Backport mainline patches
by GUO Zihua 23 Feb '24

23 Feb '24

Backported mainline bugfix for audit. Jan Kara (3): audit_tree: Remove mark->lock locking audit: Fix possible spurious -ENOSPC error audit: Fix possible tagging failures kernel/audit_tree.c | 61 ++++++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 34 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 1/5] driver/svm: support SVSP feature, interface definition
by Yuan Can 23 Feb '24

23 Feb '24

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> ascend inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I931MI CVE: NA ----------------------------------------------------------------- In the SVA scenario, the master device of the SMMU can access the address space of the process by the operation of binding process. The page table of the process is shared by the MMU and SMMU, In this case, if some addrss range cannot be accessed through the MMU, access to this address range needs to be isolated from the process page table. If the default domain of the SMMU is used, the isolation can be achieved. However, the address space created by default domain do not like the address space of the process which can be shared by multiple SMMUs. Therefore, we add a shadow virtual space of process. This address space is used only by the SMMU. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> --- arch/arm64/Kconfig | 15 +++++++++++++++ kernel/fork.c | 1 + mm/mmap.c | 1 + 3 files changed, 17 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 67bc2ad13453..3e84b2572827 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -2455,6 +2455,21 @@ config DMI However, even with this option, the resultant kernel should continue to boot on existing non-UEFI platforms. +config ASCEND_SVSP + bool "Enable support for SVSP" + default n + depends on ARM_SMMU_V3_SVA + help + SVSP means Shadow Virtual Space of Process, which is an IO space used for + master device of SMMU. + + This space is only used for the master device, since the target address + after traslation by MMU is not an accessible physical address, but can + accessible by SMMU. + + Therefore, in the sva scenario, an svsp is created for each target process + address space. + endmenu # "Boot options" config COMPAT diff --git a/kernel/fork.c b/kernel/fork.c index 00e5886c9e04..735bc670b49e 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1373,6 +1373,7 @@ struct mm_struct *mm_alloc(void) memset(mm, 0, sizeof(*mm)); return mm_init(mm, current, current_user_ns()); } +EXPORT_SYMBOL_GPL(mm_alloc); static inline void __mmput(struct mm_struct *mm) { diff --git a/mm/mmap.c b/mm/mmap.c index 21d1fc39bf21..5d78ebaeed60 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2684,6 +2684,7 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len, return do_vmi_munmap(&vmi, mm, start, len, uf, false); } +EXPORT_SYMBOL(do_munmap); static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, unsigned long addr, -- 2.17.1

3 7

[PATCH OLK-5.10 v3 0/2] CVE-2023-52435
by Ziyang Xuan 23 Feb '24

23 Feb '24

Patchset for CVE-2023-52435. v3: - Fix comment head of patch 2. v2: - Fix comment head of patch 1. - Fix compile warning of patch 1. Eric Dumazet (1): net: prevent mss overflow in skb_segment() Ziyang Xuan (1): net: Fix compile warning in skb_segment() net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/9] Support PV sched feature
by lishusen 22 Feb '24

22 Feb '24

PV sched supports the vCPU preemption check to enhance lock performance on overcommitted hosts. Paravirtualized spinlocks allow a pvops backend to replace the spinlock implementation with something virtualization-friendly. PV qspinlock has a minimal impact on native kernels and gives a nice performance benefit on paravirtualized KVM kernels. Zengruan Ye (9): KVM: arm64: Document PV-sched interface KVM: arm64: Implement PV_SCHED_FEATURES call KVM: arm64: Support pvsched preempted via shared structure KVM: arm64: Add interface to support vCPU preempted check KVM: arm64: Support the vCPU preemption check KVM: arm64: Add SMCCC PV-sched to kick cpu KVM: arm64: Implement PV_SCHED_KICK_CPU call KVM: arm64: Enable PV qspinlock KVM: arm64: Add tracepoints for PV qspinlock Documentation/virt/kvm/arm/pvsched.rst | 74 ++++++++ arch/arm64/Kconfig | 24 +++ arch/arm64/include/asm/Kbuild | 1 - arch/arm64/include/asm/kvm_host.h | 38 ++++ arch/arm64/include/asm/paravirt.h | 49 +++++ arch/arm64/include/asm/pvsched-abi.h | 16 ++ arch/arm64/include/asm/qspinlock.h | 48 +++++ arch/arm64/include/asm/qspinlock_paravirt.h | 12 ++ arch/arm64/include/asm/spinlock.h | 11 ++ arch/arm64/kernel/Makefile | 3 +- arch/arm64/kernel/paravirt-spinlocks.c | 21 +++ arch/arm64/kernel/paravirt.c | 187 ++++++++++++++++++++ arch/arm64/kernel/trace-paravirt.h | 66 +++++++ arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arm.c | 15 +- arch/arm64/kvm/handle_exit.c | 1 + arch/arm64/kvm/hypercalls.c | 20 +++ arch/arm64/kvm/pvsched.c | 82 +++++++++ arch/arm64/kvm/trace_arm.h | 18 ++ include/linux/arm-smccc.h | 25 +++ include/linux/cpuhotplug.h | 1 + 21 files changed, 710 insertions(+), 4 deletions(-) create mode 100644 Documentation/virt/kvm/arm/pvsched.rst create mode 100644 arch/arm64/include/asm/pvsched-abi.h create mode 100644 arch/arm64/include/asm/qspinlock.h create mode 100644 arch/arm64/include/asm/qspinlock_paravirt.h create mode 100644 arch/arm64/kernel/paravirt-spinlocks.c create mode 100644 arch/arm64/kernel/trace-paravirt.h create mode 100644 arch/arm64/kvm/pvsched.c -- 2.33.0

2 10

[openeuler:OLK-6.6 2392/3331] arch/arm64/kernel/ipi_nmi.c:39:9: error: implicit declaration of function '__printk_safe_enter'
by kernel test robot 22 Feb '24

22 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0b30804544e281a67d384ea10249544d92a69e2f commit: 5e3e94b1477ca3f6cb47ae8137a4a99fe0ef6147 [2392/3331] arm64: Add non nmi ipi backtrace support config: arm64-randconfig-r064-20240222 (https://download.01.org/0day-ci/archive/20240222/202402222006.PH9PlsbP-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240222/202402222006.PH9PlsbP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402222006.PH9PlsbP-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kernel/ipi_nmi.c: In function 'ipi_cpu_backtrace': >> arch/arm64/kernel/ipi_nmi.c:39:9: error: implicit declaration of function '__printk_safe_enter' [-Werror=implicit-function-declaration] 39 | __printk_safe_enter(); | ^~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/ipi_nmi.c:41:9: error: implicit declaration of function '__printk_safe_exit' [-Werror=implicit-function-declaration] 41 | __printk_safe_exit(); | ^~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/__printk_safe_enter +39 arch/arm64/kernel/ipi_nmi.c 35 36 #ifdef CONFIG_NON_NMI_IPI_BACKTRACE 37 static void ipi_cpu_backtrace(void *info) 38 { > 39 __printk_safe_enter(); 40 nmi_cpu_backtrace(get_irq_regs()); > 41 __printk_safe_exit(); 42 } 43 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2532/3331] dtbs_check: Documentation/devicetree/bindings/gpu/phytium,dc.yaml:40:8: [warning] wrong indentation: expected 2 but found 7 (indentation)
by kernel test robot 22 Feb '24

22 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0b30804544e281a67d384ea10249544d92a69e2f commit: ab9ff1e38569313e41ba5a036591f93cb55e5d87 [2532/3331] DRM: Phytium display DRM doc compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240222/202402222050.6bOkmhbV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402222050.6bOkmhbV-lkp@intel.com/ dtcheck warnings: (new ones prefixed by >>) >> Documentation/devicetree/bindings/gpu/phytium,dc.yaml:40:8: [warning] wrong indentation: expected 2 but found 7 (indentation) Documentation/devicetree/bindings/arm/arm,mpam-msc.yaml:76:15: [error] string value is redundantly quoted with any quotes (quoted-strings) Documentation/devicetree/bindings/arm/arm,mpam-msc.yaml:82:15: [error] string value is redundantly quoted with any quotes (quoted-strings) -- Documentation/devicetree/bindings/iio/pressure/honeywell,mprls0025pa.yaml: properties:honeywell,pmin-pascal: '$ref' should not be valid under {'const': '$ref'} hint: Standard unit suffix properties don't need a type $ref from schema $id: http://devicetree.org/meta-schemas/core.yaml# Documentation/devicetree/bindings/iio/pressure/honeywell,mprls0025pa.yaml: properties:honeywell,pmax-pascal: '$ref' should not be valid under {'const': '$ref'} hint: Standard unit suffix properties don't need a type $ref from schema $id: http://devicetree.org/meta-schemas/core.yaml# >> Documentation/devicetree/bindings/gpu/phytium,dc.yaml: properties:clocks:items: 'anyOf' conditional failed, one must be fixed: ['description:Display controller reference clock source'] is not of type 'object', 'boolean' 'description:Display controller reference clock source' is not of type 'object', 'boolean' from schema $id: http://json-schema.org/draft-07/schema# >> Documentation/devicetree/bindings/gpu/phytium,dc.yaml: properties:clocks: 'oneOf' conditional failed, one must be fixed: ['description:Display controller reference clock source'] is too short False schema does not allow 1 hint: "minItems" is only needed if less than the "items" list length from schema $id: http://devicetree.org/meta-schemas/items.yaml# >> Documentation/devicetree/bindings/gpu/phytium,dc.yaml: properties:reg: 'oneOf' conditional failed, one must be fixed: [{'description': 'Offset and length of the memory mapped registers'}] is too short False schema does not allow 1 hint: "minItems" is only needed if less than the "items" list length from schema $id: http://devicetree.org/meta-schemas/items.yaml# >> Documentation/devicetree/bindings/gpu/phytium,dc.yaml: 'Example' is not one of ['$id', '$schema', 'title', 'description', 'examples', 'required', 'allOf', 'anyOf', 'oneOf', 'definitions', '$defs', 'additionalProperties', 'dependencies', 'dependentRequired', 'dependentSchemas', 'patternProperties', 'properties', 'not', 'if', 'then', 'else', 'unevaluatedProperties', 'deprecated', 'maintainers', 'select', '$ref'] from schema $id: http://devicetree.org/meta-schemas/base.yaml# >> Documentation/devicetree/bindings/gpu/phytium,dc.yaml: properties:clocks: 'oneOf' conditional failed, one must be fixed: >> Documentation/devicetree/bindings/gpu/phytium,dc.yaml: properties:clocks: 'anyOf' conditional failed, one must be fixed: 'maxItems' is a required property hint: Only "maxItems" is required for a single entry if there are no constraints defined for the values. 'minItems' is not one of ['maxItems', 'description', 'deprecated'] hint: Only "maxItems" is required for a single entry if there are no constraints defined for the values. 'items' is not one of ['maxItems', 'description', 'deprecated'] hint: Only "maxItems" is required for a single entry if there are no constraints defined for the values. 'minItems' is not one of ['description', 'deprecated', 'const', 'enum', 'minimum', 'maximum', 'multipleOf', 'default', '$ref', 'oneOf'] 'items' is not one of ['description', 'deprecated', 'const', 'enum', 'minimum', 'maximum', 'multipleOf', 'default', '$ref', 'oneOf'] ['description:Display controller reference clock source'] is valid under each of {'type': 'array', 'maxItems': 1, 'items': {'allOf': [{'$ref': '#/array'}], 'required': ['items']}}, {'type': 'array', 'items': {'$ref': '#/single'}} hint: "items" can be a list defining each entry or a schema applying to all items. A list has an implicit size. A schema requires minItems/maxItems to define the size. hint: cell array properties must define how many entries and what the entries are when there is more than one entry. from schema $id: http://devicetree.org/meta-schemas/clocks.yaml# 'minItems' is not one of ['type', 'description', 'dependencies', 'dependentRequired', 'dependentSchemas', 'properties', 'patternProperties', 'additionalProperties', 'unevaluatedProperties', 'deprecated', 'required', 'not', 'allOf', 'anyOf', 'oneOf', '$ref'] 'items' is not one of ['type', 'description', 'dependencies', 'dependentRequired', 'dependentSchemas', 'properties', 'patternProperties', 'additionalProperties', 'unevaluatedProperties', 'deprecated', 'required', 'not', 'allOf', 'anyOf', 'oneOf', '$ref'] 'type' is a required property hint: DT nodes ("object" type in schemas) can only use a subset of json-schema keywords from schema $id: http://devicetree.org/meta-schemas/clocks.yaml# >> Documentation/devicetree/bindings/gpu/phytium,dc.yaml: $id: Cannot determine base path from $id, relative path/filename doesn't match actual path or filename $id: http://devicetree.org/schemas/dc/snps,dc.yaml file: Documentation/devicetree/bindings/gpu/phytium,dc.yaml -- >> Documentation/devicetree/bindings/gpu/phytium,dc.yaml: ignoring, error in schema: properties: clocks: items /usr/local/lib/python3.11/dist-packages/dtschema/schemas/reserved-memory/memory-region.yaml: warning: ignoring duplicate '$id' value 'http://devicetree.org/schemas/reserved-memory/memory-region.yaml#' /usr/local/lib/python3.11/dist-packages/dtschema/schemas/reserved-memory/framebuffer.yaml: warning: ignoring duplicate '$id' value 'http://devicetree.org/schemas/reserved-memory/framebuffer.yaml#' /usr/local/lib/python3.11/dist-packages/dtschema/schemas/reserved-memory/shared-dma-pool.yaml: warning: ignoring duplicate '$id' value 'http://devicetree.org/schemas/reserved-memory/shared-dma-pool.yaml#' /usr/local/lib/python3.11/dist-packages/dtschema/schemas/reserved-memory/reserved-memory.yaml: warning: ignoring duplicate '$id' value 'http://devicetree.org/schemas/reserved-memory/reserved-memory.yaml#' Documentation/devicetree/bindings/media/i2c/ti,ds90ub960.yaml: i2c-alias: missing type definition Documentation/devicetree/bindings/net/snps,dwmac.yaml: mac-mode: missing type definition Documentation/devicetree/bindings/display/panel/advantech,idk-2121wr.yaml: dual-lvds-odd-pixels: missing type definition Documentation/devicetree/bindings/display/panel/advantech,idk-2121wr.yaml: dual-lvds-even-pixels: missing type definition Documentation/devicetree/bindings/sound/audio-graph.yaml: convert-sample-format: missing type definition vim +40 Documentation/devicetree/bindings/gpu/phytium,dc.yaml 33 34 required: 35 - compatible 36 - reg 37 - interrupts 38 39 Example: > 40 /memreserve/ 0xf4000000 0x4000000; // (optional) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v2 0/2] CVE-2023-52435
by Ziyang Xuan 22 Feb '24

22 Feb '24

Patchset for CVE-2023-52435. v2: - Fix comment head of patch 1. - Fix compile warning of patch 1. Eric Dumazet (1): net: prevent mss overflow in skb_segment() Ziyang Xuan (1): net: Fix compile warning in skb_segment() net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] CVE-2023-52435
by Ziyang Xuan 22 Feb '24

22 Feb '24

Patchset for CVE-2023-52435. v2: - Fix comment head of patch 1. - Fix compile warning of patch 1. Eric Dumazet (1): net: prevent mss overflow in skb_segment() Ziyang Xuan (1): net: Fix compile warning in skb_segment() net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[OLK-6.6 00/14] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 22 Feb '24

22 Feb '24

Bibo Mao (1): LoongArch: Implement constant timer shutdown interface Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (3): LoongArch: fix compile error caused by arch_trigger_cpumask_backtrace usb: xhci: add XHCI_NO_SOFT_RETRY quirk for EJ188 net: stmmac: fix potential double free of dma descriptor resources Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1577 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 3 +- arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/process.c | 3 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- arch/loongarch/kernel/time.c | 23 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + drivers/usb/host/xhci-pci.c | 6 + kernel/irq/Kconfig | 4 +- 19 files changed, 1639 insertions(+), 201 deletions(-) -- 2.33.0

1 14

[PATCH OLK-5.10] net: prevent mss overflow in skb_segment()
by Ziyang Xuan 22 Feb '24

22 Feb '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.7-rc6 commit 23d05d563b7e7b0314e65c8e882bc27eac2da8e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXW CVE: CVE-2023-52435 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a forbidden value, but unfortunately the following computation in skb_segment() can reach it quite easily : mss = mss * partial_segs; 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to a bad final result. Make sure to limit segmentation so that the new mss value is smaller than GSO_BY_FRAGS. [1] general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 5079 Comm: syz-executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626 __dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f8692032aa9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff8d685418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9 RDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000000f4240 R08: 0000000020000540 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480 R13: 0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://lore.kernel.org/r/20231212164621.4131800-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index b5f01cebbb72..db6301c492c9 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3955,8 +3955,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, /* GSO partial only requires that we trim off any excess that * doesn't fit into an MSS sized block, so take care of that * now. + * Cap len to not accidentally hit GSO_BY_FRAGS. */ - partial_segs = len / mss; + partial_segs = min(len, GSO_BY_FRAGS - 1) / mss; if (partial_segs > 1) mss *= partial_segs; else -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: prevent mss overflow in skb_segment()
by Ziyang Xuan 22 Feb '24

22 Feb '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.7-rc6 commit 23d05d563b7e7b0314e65c8e882bc27eac2da8e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXW CVE: CVE-2023-52435 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a forbidden value, but unfortunately the following computation in skb_segment() can reach it quite easily : mss = mss * partial_segs; 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to a bad final result. Make sure to limit segmentation so that the new mss value is smaller than GSO_BY_FRAGS. [1] general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 5079 Comm: syz-executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626 __dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f8692032aa9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff8d685418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9 RDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000000f4240 R08: 0000000020000540 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480 R13: 0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://lore.kernel.org/r/20231212164621.4131800-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index e03cd719b86b..c93662512d02 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3625,8 +3625,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, /* GSO partial only requires that we trim off any excess that * doesn't fit into an MSS sized block, so take care of that * now. + * Cap len to not accidentally hit GSO_BY_FRAGS. */ - partial_segs = len / mss; + partial_segs = min(len, GSO_BY_FRAGS - 1) / mss; if (partial_segs > 1) mss *= partial_segs; else -- 2.25.1

2 1

[PATCH 1/2] Update kernel headers
by Chengchang Tang 22 Feb '24

22 Feb '24

From: Yixing Liu <liuyixing1(a)huawei.com> To commit ?? ("RDMA/hns: Support DSCP of userspace"). Signed-off-by: Yixing Liu <liuyixing1(a)huawei.com> --- kernel-headers/rdma/hns-abi.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/kernel-headers/rdma/hns-abi.h b/kernel-headers/rdma/hns-abi.h index c996e15..f77697c 100644 --- a/kernel-headers/rdma/hns-abi.h +++ b/kernel-headers/rdma/hns-abi.h @@ -95,6 +95,12 @@ struct hns_roce_ib_create_qp_resp { __aligned_u64 dwqe_mmap_key; }; +struct hns_roce_ib_modify_qp_resp { + __u8 tc_mode; + __u8 priority; + __u8 reserved[6]; +}; + enum { HNS_ROCE_EXSGE_FLAGS = 1 << 0, HNS_ROCE_RQ_INLINE_FLAGS = 1 << 1, @@ -127,7 +133,8 @@ struct hns_roce_ib_alloc_pd_resp { struct hns_roce_ib_create_ah_resp { __u8 dmac[6]; - __u8 reserved[2]; + __u8 priority; + __u8 tc_mode; }; #endif /* HNS_ABI_USER_H */ -- 2.30.0

1 1

[OLK-6.6 v3 1/2] RDMA/hns: Append SCC context to the raw dump of QP Resource
by Chengchang Tang 22 Feb '24

22 Feb '24

From: wenglianfa <wenglianfa(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8B8HH -------------------------------------------------------------------------- SCCC (SCC Context) is a context with QP granularity that contains information about congestion control. Dump SCCC and QPC together to improve troubleshooting. When dumping raw QPC with rdmatool, there will be a total of 576B data output, where the first 512B is QPC and the last 64B is SCCC. When congestion control is disabled, the 64B SCCC will be all 0. Example: $rdma res show qp -jpr [ { "ifindex": 0, "ifname": "hns_0", "data": [ 67,0,0,0... 512bytes 4,0,2... 64bytes] },... } ] Signed-off-by: wenglianfa <wenglianfa(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_cmd.h | 3 +++ drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 25 +++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 6 +++++ drivers/infiniband/hw/hns/hns_roce_restrack.c | 24 +++++++++++++++--- 5 files changed, 56 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_cmd.h b/drivers/infiniband/hw/hns/hns_roce_cmd.h index 052a3d60905a..11dbbabebdc9 100644 --- a/drivers/infiniband/hw/hns/hns_roce_cmd.h +++ b/drivers/infiniband/hw/hns/hns_roce_cmd.h @@ -108,6 +108,9 @@ enum { HNS_ROCE_CMD_QUERY_CEQC = 0x92, HNS_ROCE_CMD_DESTROY_CEQC = 0x93, + /* SCC CTX commands */ + HNS_ROCE_CMD_QUERY_SCCC = 0xa2, + /* SCC CTX BT commands */ HNS_ROCE_CMD_READ_SCCC_BT0 = 0xa4, HNS_ROCE_CMD_WRITE_SCCC_BT0 = 0xa5, diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 1a8516019516..2de432ebf711 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -944,6 +944,7 @@ struct hns_roce_hw { int (*query_cqc)(struct hns_roce_dev *hr_dev, u32 cqn, void *buffer); int (*query_qpc)(struct hns_roce_dev *hr_dev, u32 qpn, void *buffer); int (*query_mpt)(struct hns_roce_dev *hr_dev, u32 key, void *buffer); + int (*query_sccc)(struct hns_roce_dev *hr_dev, u32 qpn, void *buffer); int (*query_srqc)(struct hns_roce_dev *hr_dev, u32 srqn, void *buffer); int (*query_hw_counter)(struct hns_roce_dev *hr_dev, u64 *stats, u32 port, int *hw_counters); diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index de56dc6e3226..9dc5957c0d2f 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -5321,6 +5321,30 @@ static int hns_roce_v2_query_srqc(struct hns_roce_dev *hr_dev, u32 srqn, return ret; } +static int hns_roce_v2_query_sccc(struct hns_roce_dev *hr_dev, u32 qpn, + void *buffer) +{ + struct hns_roce_v2_scc_context *context; + struct hns_roce_cmd_mailbox *mailbox; + int ret; + + mailbox = hns_roce_alloc_cmd_mailbox(hr_dev); + if (IS_ERR(mailbox)) + return PTR_ERR(mailbox); + + ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, HNS_ROCE_CMD_QUERY_SCCC, + qpn); + if (ret) + goto out; + + context = mailbox->buf; + memcpy(buffer, context, sizeof(*context)); + +out: + hns_roce_free_cmd_mailbox(hr_dev, mailbox); + return ret; +} + static u8 get_qp_timeout_attr(struct hns_roce_dev *hr_dev, struct hns_roce_v2_qp_context *context) { @@ -6712,6 +6736,7 @@ static const struct hns_roce_hw hns_roce_hw_v2 = { .query_cqc = hns_roce_v2_query_cqc, .query_qpc = hns_roce_v2_query_qpc, .query_mpt = hns_roce_v2_query_mpt, + .query_sccc = hns_roce_v2_query_sccc, .query_srqc = hns_roce_v2_query_srqc, .query_hw_counter = hns_roce_hw_v2_query_counter, .hns_roce_dev_ops = &hns_roce_v2_dev_ops, diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index cd97cbee682a..3fe2d9467612 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -646,6 +646,12 @@ struct hns_roce_v2_qp_context { #define QPCEX_SQ_RQ_NOT_FORBID_EN QPCEX_FIELD_LOC(23, 23) #define QPCEX_STASH QPCEX_FIELD_LOC(82, 82) +#define SCC_CONTEXT_SIZE 16 + +struct hns_roce_v2_scc_context { + __le32 data[SCC_CONTEXT_SIZE]; +}; + #define V2_QP_RWE_S 1 /* rdma write enable */ #define V2_QP_RRE_S 2 /* rdma read enable */ #define V2_QP_ATE_S 3 /* rdma atomic enable */ diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c index f7f3c4cc7426..34b8e4f85961 100644 --- a/drivers/infiniband/hw/hns/hns_roce_restrack.c +++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c @@ -97,16 +97,34 @@ int hns_roce_fill_res_qp_entry_raw(struct sk_buff *msg, struct ib_qp *ib_qp) { struct hns_roce_dev *hr_dev = to_hr_dev(ib_qp->device); struct hns_roce_qp *hr_qp = to_hr_qp(ib_qp); - struct hns_roce_v2_qp_context context; + struct hns_roce_full_qp_ctx { + struct hns_roce_v2_qp_context qpc; + struct hns_roce_v2_scc_context sccc; + } context = {}; int ret; if (!hr_dev->hw->query_qpc) return -EINVAL; - ret = hr_dev->hw->query_qpc(hr_dev, hr_qp->qpn, &context); + ret = hr_dev->hw->query_qpc(hr_dev, hr_qp->qpn, &context.qpc); if (ret) - return -EINVAL; + return ret; + + if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL) || + !hr_dev->hw->query_sccc) + goto out; + + /* The scc may not exist. If the scc query fails, + * only the qpc content is displayed, and the + * scc value is all 0. + */ + ret = hr_dev->hw->query_sccc(hr_dev, hr_qp->qpn, &context.sccc); + if (ret) + ibdev_warn_ratelimited(&hr_dev->ib_dev, + "failed to query SCCC, ret = %d.\n", + ret); +out: ret = nla_put(msg, RDMA_NLDEV_ATTR_RES_RAW, sizeof(context), &context); return ret; -- 2.30.0

1 1

[PATCH OLK-5.10] arm64/mpam: update reminder message about MBHDL option
by Zeng Heng 22 Feb '24

22 Feb '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I91YTV CVE: NA ---------------------------------------- Corrected debugging reminder information about MBHDL option of schemata interface. # echo "MBHDL:1=2" > schemata -bash: echo: write error: Invalid argument # cat info/last_cmd_status MB value 2 exceed 1 Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_resctrl.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 174f84893ee5..bc314b181132 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -340,15 +340,16 @@ parse_bw(char *buf, struct resctrl_resource *r, return -EINVAL; } + if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { + rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); + return -EINVAL; + } + switch (rr->ctrl_features[type].evt) { case QOS_MBA_MAX_EVENT_ID: case QOS_MBA_PBM_EVENT_ID: case QOS_MBA_MIN_EVENT_ID: - if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { - rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); - return -EINVAL; - } - if (data < r->mbw.min_bw) { + if (data < r->mbw.min_bw || data >= rr->ctrl_features[type].max_wd) { rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", data, r->mbw.min_bw, rr->ctrl_features[type].max_wd - 1); return -EINVAL; @@ -356,19 +357,14 @@ parse_bw(char *buf, struct resctrl_resource *r, data = roundup(data, r->mbw.bw_gran); break; default: - if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { - rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); + if (data >= rr->ctrl_features[type].max_wd) { + rdt_last_cmd_printf("MB value %ld exceed %d\n", data, + rr->ctrl_features[type].max_wd - 1); return -EINVAL; } break; } - if (data >= rr->ctrl_features[type].max_wd) { - rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", data, - r->mbw.min_bw, rr->ctrl_features[type].max_wd - 1); - return -EINVAL; - } - cfg->new_ctrl[type] = data; cfg->ctrl_updated[type] = true; cfg->have_new_ctrl = true; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 5071/21630] net/appletalk/sysctl_net_atalk.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 22 Feb '24

22 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: caea2096c89e8d8cbaffde0d33f3c6d748c4d0c5 commit: 26179c0fe28fb046069105a0069632eb8e36a5ea [5071/21630] appletalk: Fix use-after-free in atalk_proc_exit config: x86_64-buildonly-randconfig-004-20240220 (https://download.01.org/0day-ci/archive/20240222/202402221413.OLVDezAt-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240222/202402221413.OLVDezAt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402221413.OLVDezAt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/appletalk/sysctl_net_atalk.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 01/14] LoongArch: fix compile error caused by arch_trigger_cpumask_backtrace
by Hongchen Zhang 22 Feb '24

22 Feb '24

LoongArch inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9187I -------------------------------- Fixes: 491a30c1b02f ("nmi: backtrace: Allow runtime arch specific override") Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/include/asm/irq.h | 2 +- arch/loongarch/kernel/process.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/loongarch/include/asm/irq.h b/arch/loongarch/include/asm/irq.h index 722eb1aa726f..e1b0195e0edf 100644 --- a/arch/loongarch/include/asm/irq.h +++ b/arch/loongarch/include/asm/irq.h @@ -40,7 +40,7 @@ void spurious_interrupt(void); #define NR_IRQS_LEGACY 16 #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace -void arch_trigger_cpumask_backtrace(const struct cpumask *mask, int exclude_cpu); +bool arch_trigger_cpumask_backtrace(const struct cpumask *mask, int exclude_cpu); #define MAX_IO_PICS 2 #define NR_IRQS (64 + (256 * MAX_IO_PICS)) diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c index 767d94cce0de..5342338e2075 100644 --- a/arch/loongarch/kernel/process.c +++ b/arch/loongarch/kernel/process.c @@ -348,9 +348,10 @@ static void raise_backtrace(cpumask_t *mask) } } -void arch_trigger_cpumask_backtrace(const cpumask_t *mask, int exclude_cpu) +bool arch_trigger_cpumask_backtrace(const cpumask_t *mask, int exclude_cpu) { nmi_trigger_cpumask_backtrace(mask, exclude_cpu, raise_backtrace); + return true; } #ifdef CONFIG_64BIT -- 2.33.0

2 15

[PATCH OLK-5.10] binder: fix use-after-free in shinker's callback
by Ze Zuo 22 Feb '24

22 Feb '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.209 commit c8c1158ffb007197f31f9d9170cf13e4f34cbb5c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXG CVE: CVE-2023-52438 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3f489c2067c5824528212b0fc18b28d51332d906 upstream. The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated. I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF: ================================================================== BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c Fix this issue by performing instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade. Note that this option has better performance than upgrading to a mmap write lock which would increase contention. Plus, mmap_write_trylock() has been recently removed anyway. Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") Cc: stable(a)vger.kernel.org Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Minchan Kim <minchan(a)kernel.org> Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-3-cmllamas@google.com [cmllamas: use find_vma() instead of vma_lookup() as commit ce6d42f2e4a2 is missing in v5.10. This only works because we check the vma against our cached alloc->vma pointer.] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/android/binder_alloc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index a77ed66425f2..3c93e6c05c4d 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -1002,7 +1002,9 @@ enum lru_status binder_alloc_free_page(struct list_head *item, goto err_mmget; if (!mmap_read_trylock(mm)) goto err_mmap_read_lock_failed; - vma = binder_alloc_get_vma(alloc); + vma = find_vma(mm, page_addr); + if (vma && vma != binder_alloc_get_vma(alloc)) + goto err_invalid_vma; list_lru_isolate(lru, item); spin_unlock(lock); @@ -1028,6 +1030,8 @@ enum lru_status binder_alloc_free_page(struct list_head *item, mutex_unlock(&alloc->mutex); return LRU_REMOVED_RETRY; +err_invalid_vma: + mmap_read_unlock(mm); err_mmap_read_lock_failed: mmput_async(mm); err_mmget: -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 2828/21630] net/mac80211/rx.c:574:29: sparse: sparse: dubious: x & !y
by kernel test robot 22 Feb '24

22 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: caea2096c89e8d8cbaffde0d33f3c6d748c4d0c5 commit: 9baadf685a5618364776aed92067526bb40c137d [2828/21630] build_bug.h: remove most of dummy BUILD_BUG_ON stubs for Sparse config: x86_64-randconfig-123-20240220 (https://download.01.org/0day-ci/archive/20240222/202402221156.4n4BOuxm-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240222/202402221156.4n4BOuxm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402221156.4n4BOuxm-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/mac80211/rx.c:574:29: sparse: sparse: dubious: x & !y net/mac80211/rx.c: In function 'ieee80211_handle_mu_mimo_mon': net/mac80211/rx.c:224:9: warning: alignment 1 of 'struct <anonymous>' is less than 2 [-Wpacked-not-aligned] 224 | } __packed action; | ^ net/mac80211/rx.c: In function 'ieee80211_add_rx_radiotap_header': net/mac80211/rx.c:307:22: warning: taking address of packed member of 'struct ieee80211_radiotap_header' may result in an unaligned pointer value [-Waddress-of-packed-member] 307 | it_present = &rthdr->it_present; | ^~~~~~~~~~~~~~~~~~ net/mac80211/rx.o: warning: objtool: sta_ps_start()+0x30f: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_process_sa_query_req()+0x7a8: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_rx_h_decrypt()+0xb52: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_rx_h_defragment()+0x118c: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_rx_h_mesh_fwding()+0x83a: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_deliver_skb()+0x6ce: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_rx_h_action()+0x99c: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_add_rx_radiotap_header()+0x1c1c: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_rx_monitor()+0x98: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_release_reorder_frame.constprop.0()+0x9c2: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_sta_reorder_release.isra.0()+0xbe: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_release_reorder_frames.isra.0()+0xee: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_sta_manage_reorder_buf.isra.0()+0x16a: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_rx_reorder_ampdu()+0x1db: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_rx_h_ctrl()+0x52f: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_accept_frame()+0x991: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_rx_handlers()+0x1b2: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_prepare_and_rx_handle()+0x144: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_rx_napi()+0x13a: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_mark_rx_ba_filtered_frames()+0x44d: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_release_reorder_timeout()+0x3fc: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_check_fast_rx()+0x592: sibling call from callable instruction with modified stack frame net/mac80211/rx.o: warning: objtool: ieee80211_clear_fast_rx()+0x28: sibling call from callable instruction with modified stack frame vim +574 net/mac80211/rx.c 41cbb0f5a29592 Luca Coelho 2018-06-09 554 41cbb0f5a29592 Luca Coelho 2018-06-09 555 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) { 41cbb0f5a29592 Luca Coelho 2018-06-09 556 he.data6 |= HE_PREP(DATA6_NSTS, 41cbb0f5a29592 Luca Coelho 2018-06-09 557 FIELD_GET(RX_ENC_FLAG_STBC_MASK, 41cbb0f5a29592 Luca Coelho 2018-06-09 558 status->enc_flags)); 41cbb0f5a29592 Luca Coelho 2018-06-09 559 he.data3 |= HE_PREP(DATA3_STBC, 1); 41cbb0f5a29592 Luca Coelho 2018-06-09 560 } else { 41cbb0f5a29592 Luca Coelho 2018-06-09 561 he.data6 |= HE_PREP(DATA6_NSTS, status->nss); 41cbb0f5a29592 Luca Coelho 2018-06-09 562 } 41cbb0f5a29592 Luca Coelho 2018-06-09 563 41cbb0f5a29592 Luca Coelho 2018-06-09 564 #define CHECK_GI(s) \ 41cbb0f5a29592 Luca Coelho 2018-06-09 565 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \ 41cbb0f5a29592 Luca Coelho 2018-06-09 566 (int)NL80211_RATE_INFO_HE_GI_##s) 41cbb0f5a29592 Luca Coelho 2018-06-09 567 41cbb0f5a29592 Luca Coelho 2018-06-09 568 CHECK_GI(0_8); 41cbb0f5a29592 Luca Coelho 2018-06-09 569 CHECK_GI(1_6); 41cbb0f5a29592 Luca Coelho 2018-06-09 570 CHECK_GI(3_2); 41cbb0f5a29592 Luca Coelho 2018-06-09 571 41cbb0f5a29592 Luca Coelho 2018-06-09 572 he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx); 41cbb0f5a29592 Luca Coelho 2018-06-09 573 he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm); 41cbb0f5a29592 Luca Coelho 2018-06-09 @574 he.data3 |= HE_PREP(DATA3_CODING, 41cbb0f5a29592 Luca Coelho 2018-06-09 575 !!(status->enc_flags & RX_ENC_FLAG_LDPC)); 41cbb0f5a29592 Luca Coelho 2018-06-09 576 41cbb0f5a29592 Luca Coelho 2018-06-09 577 he.data5 |= HE_PREP(DATA5_GI, status->he_gi); 41cbb0f5a29592 Luca Coelho 2018-06-09 578 41cbb0f5a29592 Luca Coelho 2018-06-09 579 switch (status->bw) { 41cbb0f5a29592 Luca Coelho 2018-06-09 580 case RATE_INFO_BW_20: 41cbb0f5a29592 Luca Coelho 2018-06-09 581 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 41cbb0f5a29592 Luca Coelho 2018-06-09 582 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ); 41cbb0f5a29592 Luca Coelho 2018-06-09 583 break; 41cbb0f5a29592 Luca Coelho 2018-06-09 584 case RATE_INFO_BW_40: 41cbb0f5a29592 Luca Coelho 2018-06-09 585 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 41cbb0f5a29592 Luca Coelho 2018-06-09 586 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ); 41cbb0f5a29592 Luca Coelho 2018-06-09 587 break; 41cbb0f5a29592 Luca Coelho 2018-06-09 588 case RATE_INFO_BW_80: 41cbb0f5a29592 Luca Coelho 2018-06-09 589 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 41cbb0f5a29592 Luca Coelho 2018-06-09 590 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ); 41cbb0f5a29592 Luca Coelho 2018-06-09 591 break; 41cbb0f5a29592 Luca Coelho 2018-06-09 592 case RATE_INFO_BW_160: 41cbb0f5a29592 Luca Coelho 2018-06-09 593 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 41cbb0f5a29592 Luca Coelho 2018-06-09 594 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ); 41cbb0f5a29592 Luca Coelho 2018-06-09 595 break; 41cbb0f5a29592 Luca Coelho 2018-06-09 596 case RATE_INFO_BW_HE_RU: 41cbb0f5a29592 Luca Coelho 2018-06-09 597 #define CHECK_RU_ALLOC(s) \ 41cbb0f5a29592 Luca Coelho 2018-06-09 598 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \ 41cbb0f5a29592 Luca Coelho 2018-06-09 599 NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4) 41cbb0f5a29592 Luca Coelho 2018-06-09 600 41cbb0f5a29592 Luca Coelho 2018-06-09 601 CHECK_RU_ALLOC(26); 41cbb0f5a29592 Luca Coelho 2018-06-09 602 CHECK_RU_ALLOC(52); 41cbb0f5a29592 Luca Coelho 2018-06-09 603 CHECK_RU_ALLOC(106); 41cbb0f5a29592 Luca Coelho 2018-06-09 604 CHECK_RU_ALLOC(242); 41cbb0f5a29592 Luca Coelho 2018-06-09 605 CHECK_RU_ALLOC(484); 41cbb0f5a29592 Luca Coelho 2018-06-09 606 CHECK_RU_ALLOC(996); 41cbb0f5a29592 Luca Coelho 2018-06-09 607 CHECK_RU_ALLOC(2x996); 41cbb0f5a29592 Luca Coelho 2018-06-09 608 41cbb0f5a29592 Luca Coelho 2018-06-09 609 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 41cbb0f5a29592 Luca Coelho 2018-06-09 610 status->he_ru + 4); 41cbb0f5a29592 Luca Coelho 2018-06-09 611 break; 41cbb0f5a29592 Luca Coelho 2018-06-09 612 default: 41cbb0f5a29592 Luca Coelho 2018-06-09 613 WARN_ONCE(1, "Invalid SU BW %d\n", status->bw); 41cbb0f5a29592 Luca Coelho 2018-06-09 614 } 41cbb0f5a29592 Luca Coelho 2018-06-09 615 41cbb0f5a29592 Luca Coelho 2018-06-09 616 /* ensure 2 byte alignment */ 41cbb0f5a29592 Luca Coelho 2018-06-09 617 while ((pos - (u8 *)rthdr) & 1) 41cbb0f5a29592 Luca Coelho 2018-06-09 618 pos++; 41cbb0f5a29592 Luca Coelho 2018-06-09 619 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_HE); 41cbb0f5a29592 Luca Coelho 2018-06-09 620 memcpy(pos, &he, sizeof(he)); 41cbb0f5a29592 Luca Coelho 2018-06-09 621 pos += sizeof(he); 41cbb0f5a29592 Luca Coelho 2018-06-09 622 } 41cbb0f5a29592 Luca Coelho 2018-06-09 623 41cbb0f5a29592 Luca Coelho 2018-06-09 624 if (status->encoding == RX_ENC_HE && 41cbb0f5a29592 Luca Coelho 2018-06-09 625 status->flag & RX_FLAG_RADIOTAP_HE_MU) { 41cbb0f5a29592 Luca Coelho 2018-06-09 626 /* ensure 2 byte alignment */ 41cbb0f5a29592 Luca Coelho 2018-06-09 627 while ((pos - (u8 *)rthdr) & 1) 41cbb0f5a29592 Luca Coelho 2018-06-09 628 pos++; 41cbb0f5a29592 Luca Coelho 2018-06-09 629 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_HE_MU); 41cbb0f5a29592 Luca Coelho 2018-06-09 630 memcpy(pos, &he_mu, sizeof(he_mu)); 41cbb0f5a29592 Luca Coelho 2018-06-09 631 pos += sizeof(he_mu); 41cbb0f5a29592 Luca Coelho 2018-06-09 632 } 41cbb0f5a29592 Luca Coelho 2018-06-09 633 a144f378a489b5 Johannes Berg 2013-07-03 634 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { a144f378a489b5 Johannes Berg 2013-07-03 635 *pos++ = status->chain_signal[chain]; a144f378a489b5 Johannes Berg 2013-07-03 636 *pos++ = chain; a144f378a489b5 Johannes Berg 2013-07-03 637 } 1f7bba79af57ce Johannes Berg 2014-11-06 638 1f7bba79af57ce Johannes Berg 2014-11-06 639 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 1f7bba79af57ce Johannes Berg 2014-11-06 640 /* ensure 2 byte alignment for the vendor field as required */ 1f7bba79af57ce Johannes Berg 2014-11-06 641 if ((pos - (u8 *)rthdr) & 1) 1f7bba79af57ce Johannes Berg 2014-11-06 642 *pos++ = 0; 1f7bba79af57ce Johannes Berg 2014-11-06 643 *pos++ = rtap.oui[0]; 1f7bba79af57ce Johannes Berg 2014-11-06 644 *pos++ = rtap.oui[1]; 1f7bba79af57ce Johannes Berg 2014-11-06 645 *pos++ = rtap.oui[2]; 1f7bba79af57ce Johannes Berg 2014-11-06 646 *pos++ = rtap.subns; 1f7bba79af57ce Johannes Berg 2014-11-06 647 put_unaligned_le16(rtap.len, pos); 1f7bba79af57ce Johannes Berg 2014-11-06 648 pos += 2; 1f7bba79af57ce Johannes Berg 2014-11-06 649 /* align the actual payload as requested */ 1f7bba79af57ce Johannes Berg 2014-11-06 650 while ((pos - (u8 *)rthdr) & (rtap.align - 1)) 1f7bba79af57ce Johannes Berg 2014-11-06 651 *pos++ = 0; 1f7bba79af57ce Johannes Berg 2014-11-06 652 /* data (and possible padding) already follows */ 1f7bba79af57ce Johannes Berg 2014-11-06 653 } 601ae7f25aea58 Bruno Randolf 2008-05-08 654 } 601ae7f25aea58 Bruno Randolf 2008-05-08 655 :::::: The code at line 574 was first introduced by commit :::::: 41cbb0f5a29592874355e4159489eb08337cd50e mac80211: add support for HE :::::: TO: Luca Coelho <luciano.coelho(a)intel.com> :::::: CC: Johannes Berg <johannes.berg(a)intel.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/14] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 22 Feb '24

22 Feb '24

Bibo Mao (1): LoongArch: Implement constant timer shutdown interface Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (3): LoongArch: fix compile error caused by arch_trigger_cpumask_backtrace usb: xhci: add XHCI_NO_SOFT_RETRY quirk for EJ188 net: stmmac: fix potential double free of dma descriptor resources Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1577 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 3 +- arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/process.c | 3 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- arch/loongarch/kernel/time.c | 23 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + drivers/usb/host/xhci-pci.c | 6 + kernel/irq/Kconfig | 4 +- 19 files changed, 1639 insertions(+), 201 deletions(-) -- 2.33.0

1 13

[PATCH OLK-5.10] f2fs: explicitly null-terminate the xattr list
by Zizhi Wo 22 Feb '24

22 Feb '24

From: Eric Biggers <ebiggers(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit e26b6d39270f5eab0087453d9b544189a38c8564 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXK CVE: CVE-2023-52436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index f44c60114379..dd50b747b671 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -741,6 +741,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, memcpy(pval, value, size); last->e_value_size = cpu_to_le16(size); new_hsize += newsize; + /* + * Explicitly add the null terminator. The unused xattr space + * is supposed to always be zeroed, which would make this + * unnecessary, but don't depend on that. + */ + *(u32 *)((u8 *)last + newsize) = 0; } error = write_all_xattrs(inode, new_hsize, base_addr, ipage); -- 2.39.2

2 1

[PATCH OLK-6.6] f2fs: explicitly null-terminate the xattr list
by Zizhi Wo 22 Feb '24

22 Feb '24

From: Eric Biggers <ebiggers(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit e26b6d39270f5eab0087453d9b544189a38c8564 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXK CVE: CVE-2023-52436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index 465d145360de..e197657db36b 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -754,6 +754,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, memcpy(pval, value, size); last->e_value_size = cpu_to_le16(size); new_hsize += newsize; + /* + * Explicitly add the null terminator. The unused xattr space + * is supposed to always be zeroed, which would make this + * unnecessary, but don't depend on that. + */ + *(u32 *)((u8 *)last + newsize) = 0; } error = write_all_xattrs(inode, new_hsize, base_addr, ipage); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] f2fs: explicitly null-terminate the xattr list
by Zizhi Wo 22 Feb '24

22 Feb '24

From: Eric Biggers <ebiggers(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit e26b6d39270f5eab0087453d9b544189a38c8564 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXK CVE: CVE-2023-52436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index 1858c66d871d..eef2b05fd7e1 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -718,6 +718,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, memcpy(pval, value, size); last->e_value_size = cpu_to_le16(size); new_hsize += newsize; + /* + * Explicitly add the null terminator. The unused xattr space + * is supposed to always be zeroed, which would make this + * unnecessary, but don't depend on that. + */ + *(u32 *)((u8 *)last + newsize) = 0; } error = write_all_xattrs(inode, new_hsize, base_addr, ipage); -- 2.39.2

2 1

[openeuler:OLK-5.10] BUILD SUCCESS c6bcd1627d0536d828594764c2e77b18d3c2c640
by kernel test robot 22 Feb '24

22 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c6bcd1627d0536d828594764c2e77b18d3c2c640 !4220 backport some patches for kunpeng hccs Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-defconfig `-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_mbx.c:warning:unused-variable-hdev elapsed time: 723m configs tested: 27 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240221 gcc arm64 randconfig-002-20240221 gcc arm64 randconfig-003-20240221 gcc arm64 randconfig-004-20240221 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240222 clang x86_64 buildonly-randconfig-002-20240222 clang x86_64 buildonly-randconfig-003-20240222 gcc x86_64 buildonly-randconfig-004-20240222 clang x86_64 buildonly-randconfig-005-20240222 gcc x86_64 buildonly-randconfig-006-20240222 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240222 clang x86_64 randconfig-002-20240222 clang x86_64 randconfig-003-20240222 clang x86_64 randconfig-004-20240222 clang x86_64 randconfig-005-20240222 gcc x86_64 randconfig-006-20240222 gcc x86_64 randconfig-011-20240222 clang x86_64 randconfig-012-20240222 gcc x86_64 randconfig-013-20240222 clang x86_64 randconfig-014-20240222 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 8d757f9866d24f61f34a4d4639ff0395322c2f5c
by kernel test robot 22 Feb '24

22 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 8d757f9866d24f61f34a4d4639ff0395322c2f5c !4598 [OLK-6.6] Add iommu support for Phytium S2500 Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202402212124.9Ot7vWp2-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) kernel/cgroup/cgroup.c:3968:15: error: use of undeclared identifier 'cgroup_psi_stat_show'; did you mean 'cgroup_stat_show'? Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-001-20240221 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-002-20240221 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-003-20240221 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-allmodconfig | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-allnoconfig | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-randconfig-001-20240221 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-randconfig-002-20240221 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-002-20240221 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-003-20240221 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-randconfig-002-20240221 `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device clang_recent_errors |-- arm64-allmodconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:resctrl_init-(section:.text)-rdtgroup_setup_default-(section:.init.text) | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_cursor_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_spread_is_enable | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_connector_add | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_display_register | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_adjust_link_train_parameter | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_coding_8b10b_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_dpcd_sink_dpms | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_fast_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_get_link_train_fallback_values | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hpd_poll_handler | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_config_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_audio | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_hpd_irq_setup | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_init | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_output_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_video_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_scrambled_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_start_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_encoder_mode_valid | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_get_encoder_crtc_mask | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_fini | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_init | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_dma_transfer | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_alloc | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_free | |-- drivers-gpu-drm-phytium-phytium_panel.c:warning:no-previous-prototype-for-function-phytium_dp_panel_release_backlight_funcs | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_hw_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_init | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_set_property | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_destroy | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_fini | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_init | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_clear_msi_irq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_disable | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_dcreq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_reset | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_spread_is_enable | `-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | `-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used |-- x86_64-buildonly-randconfig-001-20240221 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- kernel-sched-core.c:error:call-to-undeclared-function-init_auto_affinity-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- kernel-sched-core.c:error:call-to-undeclared-function-tg_update_affinity_domains-ISO-C99-and-later-do-not-support-implicit-function-declarations |-- x86_64-buildonly-randconfig-004-20240221 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- kernel-cgroup-cgroup.c:error:use-of-undeclared-identifier-cgroup_psi_stat_show |-- x86_64-buildonly-randconfig-005-20240221 | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:resctrl_init-(section:.text)-rdtgroup_setup_default-(section:.init.text) | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 729m configs tested: 24 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240221 gcc arm64 randconfig-002-20240221 gcc arm64 randconfig-003-20240221 gcc arm64 randconfig-004-20240221 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240221 gcc loongarch randconfig-002-20240221 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240221 clang x86_64 buildonly-randconfig-002-20240221 gcc x86_64 buildonly-randconfig-003-20240221 gcc x86_64 buildonly-randconfig-004-20240221 clang x86_64 buildonly-randconfig-005-20240221 clang x86_64 buildonly-randconfig-006-20240221 clang x86_64 defconfig gcc x86_64 randconfig-001-20240221 gcc x86_64 randconfig-002-20240221 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2385/3300] kernel/cgroup/cgroup.c:3968:15: error: use of undeclared identifier 'cgroup_psi_stat_show'; did you mean 'cgroup_stat_show'?
by kernel test robot 21 Feb '24

21 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8d757f9866d24f61f34a4d4639ff0395322c2f5c commit: 4a69b56540f40550585b9f93c35e415ac90bdecc [2385/3300] sched/psi: Introduce pressure.stat in psi config: x86_64-buildonly-randconfig-004-20240221 (https://download.01.org/0day-ci/archive/20240221/202402212124.9Ot7vWp2-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240221/202402212124.9Ot7vWp2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402212124.9Ot7vWp2-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/cgroup/cgroup.c:3968:15: error: use of undeclared identifier 'cgroup_psi_stat_show'; did you mean 'cgroup_stat_show'? 3968 | .seq_show = cgroup_psi_stat_show, | ^~~~~~~~~~~~~~~~~~~~ | cgroup_stat_show kernel/cgroup/cgroup.c:3660:12: note: 'cgroup_stat_show' declared here 3660 | static int cgroup_stat_show(struct seq_file *seq, void *v) | ^ 1 error generated. vim +3968 kernel/cgroup/cgroup.c 3929 3930 struct cftype cgroup_v1_psi_files[] = { 3931 { 3932 .name = "io.pressure", 3933 .flags = CFTYPE_NO_PREFIX, 3934 .seq_show = cgroup_io_pressure_show, 3935 .write = cgroup_io_pressure_write, 3936 .poll = cgroup_pressure_poll, 3937 .release = cgroup_pressure_release, 3938 }, 3939 { 3940 .name = "memory.pressure", 3941 .flags = CFTYPE_NO_PREFIX, 3942 .seq_show = cgroup_memory_pressure_show, 3943 .write = cgroup_memory_pressure_write, 3944 .poll = cgroup_pressure_poll, 3945 .release = cgroup_pressure_release, 3946 }, 3947 { 3948 .name = "cpu.pressure", 3949 .flags = CFTYPE_NO_PREFIX, 3950 .seq_show = cgroup_cpu_pressure_show, 3951 .write = cgroup_cpu_pressure_write, 3952 .poll = cgroup_pressure_poll, 3953 .release = cgroup_pressure_release, 3954 }, 3955 #ifdef CONFIG_IRQ_TIME_ACCOUNTING 3956 { 3957 .name = "irq.pressure", 3958 .flags = CFTYPE_NO_PREFIX, 3959 .seq_show = cgroup_irq_pressure_show, 3960 .write = cgroup_irq_pressure_write, 3961 .poll = cgroup_pressure_poll, 3962 .release = cgroup_pressure_release, 3963 }, 3964 #endif 3965 { 3966 .name = "pressure.stat", 3967 .flags = CFTYPE_NO_PREFIX, > 3968 .seq_show = cgroup_psi_stat_show, 3969 }, 3970 { } /* terminate */ 3971 }; 3972 #endif 3973 #else /* CONFIG_PSI */ 3974 bool cgroup_psi_enabled(void) 3975 { 3976 return false; 3977 } 3978 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION caea2096c89e8d8cbaffde0d33f3c6d748c4d0c5
by kernel test robot 21 Feb '24

21 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: caea2096c89e8d8cbaffde0d33f3c6d748c4d0c5 !4601 v2 xen-netback: don't produce zero-size SKB frags Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202402210911.dCu8im0A-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) aarch64-linux-ld: binfmt_elf32.c:(.text+0x92ac): undefined reference to `elf_core_extra_data_size' aarch64-linux-ld: binfmt_elf32.c:(.text+0x9608): undefined reference to `elf_core_write_extra_phdrs' aarch64-linux-ld: binfmt_elf32.c:(.text+0x9b34): undefined reference to `elf_core_write_extra_data' binfmt_elf32.c:(.text+0x8e0c): undefined reference to `elf_core_extra_phdrs' Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-rtc-rtc-phytium.c:warning:variable-counter-set-but-not-used | |-- drivers-rtc-rtc-phytium.c:warning:variable-rtc_time-set-but-not-used | |-- drivers-rtc-rtc-phytium.c:warning:variable-tmp-set-but-not-used | |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:d-directive-writing-between-and-bytes-into-a-region-of-size | `-- include-asm-generic-bitops-non-atomic.h:warning:array-subscript-long-unsigned-int-is-partly-outside-array-bounds-of-u32-aka-unsigned-int |-- arm64-randconfig-001-20240220 | |-- aarch64-linux-ld:binfmt_elf32.c:(.text):undefined-reference-to-elf_core_extra_data_size | |-- aarch64-linux-ld:binfmt_elf32.c:(.text):undefined-reference-to-elf_core_write_extra_data | |-- aarch64-linux-ld:binfmt_elf32.c:(.text):undefined-reference-to-elf_core_write_extra_phdrs | `-- binfmt_elf32.c:(.text):undefined-reference-to-elf_core_extra_phdrs |-- arm64-randconfig-002-20240220 | |-- arch-arm64-include-asm-irqflags.h:warning:flags-may-be-used-uninitialized | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:inten-may-be-used-uninitialized | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:vendor-may-be-used-uninitialized | |-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant | |-- include-linux-uaccess.h:warning:bind-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:ciov-may-be-used-uninitialized |-- arm64-randconfig-004-20240220 | `-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay |-- x86_64-defconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. `-- x86_64-randconfig-123-20240220 |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- arch-x86-kernel-fpu-signal.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__user-ptr-got-unsigned-int-usertype-__pu_ptr |-- block-blk-cgroup.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): |-- drivers-pci-probe.c:sparse:sparse:symbol-skip_1620_bus_num-was-not-declared.-Should-it-be-static |-- include-linux-prandom.h:sparse:sparse:cast-truncates-bits-from-constant-value-(4f2e5357408c3c09-becomes-408c3c09) |-- kernel-sched-core.c:sparse:sparse:symbol-account_irqtime_to_task-was-not-declared.-Should-it-be-static `-- mm-memory.c:sparse:sparse:Using-plain-integer-as-NULL-pointer clang_recent_errors |-- x86_64-allmodconfig | |-- drivers-net-ethernet-3snic-sssnic-hw-.tmp_sss_hwif_export.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-3snic-sssnic-nic-.tmp_sss_nic_ethtool_stats.o:warning:objtool:sss_nic_get_sset_count:can-t-find-switch-jump-table | `-- drivers-net-ethernet-3snic-sssnic-nic-.tmp_sss_nic_main.o:warning:objtool:sss_nic_event:can-t-find-switch-jump-table |-- x86_64-allnoconfig | `-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- x86_64-allyesconfig | |-- drivers-net-ethernet-3snic-sssnic-hw-.tmp_sss_hwif_export.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-3snic-sssnic-nic-.tmp_sss_nic_ethtool_stats.o:warning:objtool:sss_nic_get_sset_count:can-t-find-switch-jump-table | `-- drivers-net-ethernet-3snic-sssnic-nic-.tmp_sss_nic_main.o:warning:objtool:sss_nic_event:can-t-find-switch-jump-table |-- x86_64-randconfig-121-20240220 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-kernel-fpu-signal.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__user-ptr-got-unsigned-int-usertype-__pu_ptr | |-- drivers-cpufreq-cpufreq_governor.c:sparse:sparse:symbol-cpus_for_counting_load-was-not-declared.-Should-it-be-static | |-- drivers-pci-probe.c:sparse:sparse:symbol-skip_1620_bus_num-was-not-declared.-Should-it-be-static | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group | |-- kernel-sched-core.c:sparse:sparse:symbol-account_irqtime_to_task-was-not-declared.-Should-it-be-static | |-- mm-memory.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() |-- x86_64-randconfig-122-20240220 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- arch-x86-kernel-fpu-signal.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__user-ptr-got-unsigned-int-usertype-__pu_ptr | |-- drivers-iommu-iommu.c:sparse:sparse:dubious:x-y | |-- drivers-pci-probe.c:sparse:sparse:symbol-skip_1620_bus_num-was-not-declared.-Should-it-be-static | |-- drivers-scsi-sd.c:sparse:sparse:incorrect-type-in-return-expression-(different-base-types)-expected-int-got-restricted-blk_status_t-usertype | |-- drivers-vfio-vfio_iommu_type1.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-assigned-arg-got-void | |-- include-linux-prandom.h:sparse:sparse:cast-truncates-bits-from-constant-value-(4f2e5357408c3c09-becomes-408c3c09) | |-- kernel-sched-core.c:sparse:sparse:symbol-account_irqtime_to_task-was-not-declared.-Should-it-be-static | |-- kernel-trace-bpf_trace.c:sparse:sparse:symbol-bpf_event_init-was-not-declared.-Should-it-be-static | |-- kernel-trace-bpf_trace.c:sparse:sparse:symbol-bpf_event_notify-was-not-declared.-Should-it-be-static | |-- mm-memory.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() |-- x86_64-randconfig-161-20240220 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() `-- x86_64-rhel-8.3-rust `-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call elapsed time: 1451m configs tested: 31 configs skipped: 142 tested configs: alpha allnoconfig gcc alpha allyesconfig gcc alpha defconfig gcc arc allnoconfig gcc arc defconfig gcc arm allnoconfig gcc arm defconfig gcc arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240220 gcc arm64 randconfig-002-20240220 gcc arm64 randconfig-003-20240220 gcc arm64 randconfig-004-20240220 gcc csky allnoconfig gcc csky defconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc m68k allnoconfig gcc m68k defconfig gcc microblaze allnoconfig gcc microblaze defconfig gcc mips allnoconfig gcc nios2 allnoconfig gcc nios2 defconfig gcc um allmodconfig gcc um allyesconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] Using smmu IIDR registers
by Zhang Zekun 21 Feb '24

21 Feb '24

Using the smmu registers to identify the problem described in commit 8544c8e14fec ("iommu/arm-smmu-v3: Add a SYNC command to avoid broken page table prefetch") Zhang Zekun (2): Revert "iommu/arm-smmu-v3: Add a SYNC command to avoid broken page table prefetch" iommu/arm-smmu-v3: Enable iotlb_sync_map according to SMMU_IIDR Documentation/arch/arm64/silicon-errata.rst | 1 + arch/arm64/Kconfig | 11 +++++------ arch/arm64/kernel/cpu_errata.c | 14 -------------- arch/arm64/tools/cpucaps | 1 - drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 13 ++++++++++--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + 6 files changed, 17 insertions(+), 24 deletions(-) -- 2.17.1

2 3

openEuler Kernel SIG双周例会
by openEuler conference 21 Feb '24

21 Feb '24

您好！ Kernel 邀请您参加 2024-02-23 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复邮件或填至会议看板）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/980795271 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-02-23 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复邮件或填至会议看板） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/980795271. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] f2fs: explicitly null-terminate the xattr list
by Zizhi Wo 21 Feb '24

21 Feb '24

From: Eric Biggers <ebiggers(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit e26b6d39270f5eab0087453d9b544189a38c8564 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXW CVE: CVE-2023-52436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index 465d145360de..e197657db36b 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -754,6 +754,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, memcpy(pval, value, size); last->e_value_size = cpu_to_le16(size); new_hsize += newsize; + /* + * Explicitly add the null terminator. The unused xattr space + * is supposed to always be zeroed, which would make this + * unnecessary, but don't depend on that. + */ + *(u32 *)((u8 *)last + newsize) = 0; } error = write_all_xattrs(inode, new_hsize, base_addr, ipage); -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: explicitly null-terminate the xattr list
by Zizhi Wo 21 Feb '24

21 Feb '24

From: Eric Biggers <ebiggers(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit e26b6d39270f5eab0087453d9b544189a38c8564 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXW CVE: CVE-2023-52436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index f44c60114379..dd50b747b671 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -741,6 +741,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, memcpy(pval, value, size); last->e_value_size = cpu_to_le16(size); new_hsize += newsize; + /* + * Explicitly add the null terminator. The unused xattr space + * is supposed to always be zeroed, which would make this + * unnecessary, but don't depend on that. + */ + *(u32 *)((u8 *)last + newsize) = 0; } error = write_all_xattrs(inode, new_hsize, base_addr, ipage); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] f2fs: explicitly null-terminate the xattr list
by Zizhi Wo 21 Feb '24

21 Feb '24

From: Eric Biggers <ebiggers(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit e26b6d39270f5eab0087453d9b544189a38c8564 category: bugfix bugzilla: 189530 CVE: CVE-2023-52436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index 1858c66d871d..eef2b05fd7e1 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -718,6 +718,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, memcpy(pval, value, size); last->e_value_size = cpu_to_le16(size); new_hsize += newsize; + /* + * Explicitly add the null terminator. The unused xattr space + * is supposed to always be zeroed, which would make this + * unnecessary, but don't depend on that. + */ + *(u32 *)((u8 *)last + newsize) = 0; } error = write_all_xattrs(inode, new_hsize, base_addr, ipage); -- 2.39.2

2 1

[PATCH] f2fs: explicitly null-terminate the xattr list
by Zizhi Wo 21 Feb '24

21 Feb '24

From: Eric Biggers <ebiggers(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit e26b6d39270f5eab0087453d9b544189a38c8564 category: bugfix bugzilla: 189530 CVE: CVE-2023-52436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. Signed-off-by: Eric Biggers <ebiggers(a)google.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index 1858c66d871d..eef2b05fd7e1 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -718,6 +718,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, memcpy(pval, value, size); last->e_value_size = cpu_to_le16(size); new_hsize += newsize; + /* + * Explicitly add the null terminator. The unused xattr space + * is supposed to always be zeroed, which would make this + * unnecessary, but don't depend on that. + */ + *(u32 *)((u8 *)last + newsize) = 0; } error = write_all_xattrs(inode, new_hsize, base_addr, ipage); -- 2.39.2

1 0

[openeuler:OLK-5.10] BUILD REGRESSION ecb0378feba9d5dcb396063918f0be165e3cd625
by kernel test robot 21 Feb '24

21 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: ecb0378feba9d5dcb396063918f0be165e3cd625 !4605 arm64/mpam: support resctrl fs to show mounting option Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_bios_common_reg-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_igu_egu_reg-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_ncsi_reg-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_ppp_reg-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_rcb_reg-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_rpu_reg_0-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_rpu_reg_1-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_rtc_reg-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_ssu_reg_0-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_ssu_reg_1-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_ssu_reg_2-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_debugfs.h:warning:hclge_dbg_tqp_reg-defined-but-not-used | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_main.c:warning:unused-variable-ae_dev | `-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_mbx.c:warning:unused-variable-hdev |-- x86_64-buildonly-randconfig-003-20240221 | |-- drivers-gpio-gpio-hisi.c:warning:variable-clr-set-but-not-used | |-- drivers-gpio-gpio-hisi.c:warning:variable-dat-set-but-not-used | `-- drivers-gpio-gpio-hisi.c:warning:variable-set-set-but-not-used `-- x86_64-randconfig-161-20240221 |-- arch-x86-events-zhaoxin-uncore.c-uncore_pci_probe()-warn:possible-memory-leak-of-boxes |-- arch-x86-events-zhaoxin-uncore.c-uncore_pmu_disable()-warn:can-uncore_pmu-even-be-NULL |-- arch-x86-events-zhaoxin-uncore.c-uncore_pmu_enable()-warn:can-uncore_pmu-even-be-NULL |-- drivers-misc-uacce-uacce.c-uacce_get_ss_dma()-warn:potential-spectre-issue-slice-r-(local-cap) |-- drivers-rtc-rtc-mc146818-lib.c-mc146818_set_time()-error:uninitialized-symbol-save_freq_select-. |-- drivers-scsi-sd.c-sd_spinup_disk()-warn:unsigned-the_result-is-never-less-than-zero. |-- drivers-vfio-vfio_iommu_type1.c-vfio_iommu_bind_group()-error:uninitialized-symbol-ret-. |-- mm-hugetlb.c-hugepages_setup()-warn:potential-spectre-issue-default_hugepages_in_node-w `-- mm-hugetlb.c-hugepages_setup()-warn:potential-spectre-issue-parsed_hstate-max_huge_pages_node-w clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-gpio-gpio-hisi.c:warning:variable-clr-set-but-not-used | |-- drivers-gpio-gpio-hisi.c:warning:variable-dat-set-but-not-used | `-- drivers-gpio-gpio-hisi.c:warning:variable-set-set-but-not-used |-- x86_64-buildonly-randconfig-001-20240221 | `-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init-Werror-Wimplicit-function-declaration `-- x86_64-buildonly-randconfig-006-20240221 |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init-Werror-Wimplicit-function-declaration `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit-Werror-Wimplicit-function-declaration elapsed time: 1111m configs tested: 35 configs skipped: 148 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240220 clang arm64 randconfig-002-20240220 clang arm64 randconfig-003-20240220 clang arm64 randconfig-004-20240220 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240221 clang x86_64 buildonly-randconfig-002-20240221 gcc x86_64 buildonly-randconfig-003-20240221 gcc x86_64 buildonly-randconfig-004-20240221 clang x86_64 buildonly-randconfig-005-20240221 clang x86_64 buildonly-randconfig-006-20240221 clang x86_64 defconfig gcc x86_64 randconfig-001-20240221 gcc x86_64 randconfig-002-20240221 gcc x86_64 randconfig-003-20240221 gcc x86_64 randconfig-004-20240221 gcc x86_64 randconfig-005-20240221 gcc x86_64 randconfig-006-20240221 gcc x86_64 randconfig-011-20240221 clang x86_64 randconfig-012-20240221 gcc x86_64 randconfig-013-20240221 clang x86_64 randconfig-014-20240221 gcc x86_64 randconfig-015-20240221 gcc x86_64 randconfig-016-20240221 gcc x86_64 randconfig-071-20240221 gcc x86_64 randconfig-072-20240221 gcc x86_64 randconfig-073-20240221 gcc x86_64 randconfig-074-20240221 gcc x86_64 randconfig-075-20240221 clang x86_64 randconfig-076-20240221 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/11] Add kabi reserve
by Wang Wensheng 21 Feb '24

21 Feb '24

Wang Wensheng (11): delayacct: Reserve kabi for task_delay_info xarray: Reserve kabi for xa_state sbitmap: Add kabi reserve drm: Add kabi reserve in drm_mode_config.h drm: Add kabi reserve in drm_modeset_lock.h drm: Add kabi reserve in drm_plane.h drm: Add kabi reserve in drm_syncobj.h drm: Add kabi reserve in drm_gpu_scheduler.h drm/ttm: Add kabi reserve in ttm_bo.h drm/ttm: Add kabi reserve in ttm_resource.h drm/ttm: Add kabi reserve in ttm_tt.h include/drm/drm_mode_config.h | 5 +++++ include/drm/drm_modeset_lock.h | 3 +++ include/drm/drm_plane.h | 9 +++++++++ include/drm/drm_syncobj.h | 3 +++ include/drm/gpu_scheduler.h | 15 +++++++++++++++ include/drm/ttm/ttm_bo.h | 7 +++++++ include/drm/ttm/ttm_resource.h | 13 +++++++++++++ include/drm/ttm/ttm_tt.h | 3 +++ include/linux/delayacct.h | 3 +++ include/linux/sbitmap.h | 9 +++++++++ include/linux/xarray.h | 3 +++ 11 files changed, 73 insertions(+) -- 2.17.1

2 12

[openeuler:openEuler-1.0-LTS 13615/21630] binfmt_elf32.c:undefined reference to `elf_core_extra_phdrs'
by kernel test robot 21 Feb '24

21 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: caea2096c89e8d8cbaffde0d33f3c6d748c4d0c5 commit: 63a07568188f27d31954cf24f43540c9c2fa92cd [13615/21630] arm64: introduce binfmt_elf32.c config: arm64-randconfig-001-20240220 (https://download.01.org/0day-ci/archive/20240221/202402210911.dCu8im0A-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240221/202402210911.dCu8im0A-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402210911.dCu8im0A-lkp@intel.com/ All errors (new ones prefixed by >>): aarch64-linux-ld: warning: -z norelro ignored aarch64-linux-ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions aarch64-linux-ld: arch/arm64/kernel/binfmt_elf32.o: in function `elf_core_dump': >> binfmt_elf32.c:(.text+0x8e0c): undefined reference to `elf_core_extra_phdrs' >> aarch64-linux-ld: binfmt_elf32.c:(.text+0x92ac): undefined reference to `elf_core_extra_data_size' >> aarch64-linux-ld: binfmt_elf32.c:(.text+0x9608): undefined reference to `elf_core_write_extra_phdrs' >> aarch64-linux-ld: binfmt_elf32.c:(.text+0x9b34): undefined reference to `elf_core_write_extra_data' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] fs:/dcache.c: fix negative dentry flag warning in dentry_free
by Long Li 21 Feb '24

21 Feb '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8JH5M CVE: NA -------------------------------- While run xfstests generic/429 on ext4, we get following report: WARNING: CPU: 4 PID: 5749 at fs/dcache.c:349 dentry_free.cold+0x20/0x76 CPU: 4 PID: 5749 Comm: t_encrypted_d_r Not tainted 4.19.90-00004-g0ec2c5ee4e0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 RIP: 0010:dentry_free.cold+0x20/0x76 RSP: 0018:ffffbc0944a5bdf0 EFLAGS: 00010202 RAX: 0000000000000024 RBX: ffff955f06e74f30 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff955f3bb168f8 RDI: ffff955f3bb168f8 RBP: ffff955f06e4c6c0 R08: ffff955f3bb168f8 R09: 0000000000000005 R10: 0000000000000c27 R11: ffffffffb57d3bad R12: ffff955f06e4c718 R13: ffff955f06e4c718 R14: ffff955f06e74f30 R15: 0000000000000000 FS: 00007f4ba0307b40(0000) GS:ffff955f3bb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4b9bcd1ff8 CR3: 0000000123666000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __dentry_kill+0x219/0x340 shrink_dentry_list+0xee/0x3e0 shrink_dcache_parent+0x8c/0xc0 vfs_rmdir+0x142/0x230 do_rmdir+0x1c2/0x250 __x64_sys_rmdir+0x1b/0x30 do_syscall_64+0xcb/0x370 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Look at generic/429 test case, removing the directory and accessing the file that do not exist in the directory is done concurrently here. Consider the following concurrent call flow, which triggers the warning of negative dentry flag in dentry_free(). The root cause of the problem is that lack of lock protection when determining whether the dentry needs to make a fast put, it causes that the DCACHE_NEGATIVE_ACCOUNT flag to be set incorrectly. rmdir stat file ------------------------- ------------------------- fast_dput if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry)) shrink_dentry_list spin_lock(&dentry->d_lock) d_shrink_del(dentry) <clear DCACHE_LRU_LIST> __dentry_kill(dentry) dentry_unlist(dentry, parent) dentry->d_flags &= ~DCACHE_NEGATIVE_ACCOUNT <clear DCACHE_NEGATIVE_ACCOUNT> spin_unlock(&dentry->d_lock) spin_lock(&dentry->d_lock) limit_negative_dentry(dentry) <set DCACHE_NEGATIVE_ACCOUNT> spin_unlock(&dentry->d_lock) dentry_free(dentry) WARN_ON(dentry->d_flags & DCACHE_NEGATIVE_ACCOUNT) Fix the problem by checking the dentry is dead before set neagtive flag. Fixes: e91cbe162d54 ("fs:/dcache.c: fix negative dentry limit not complete problem") Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/dcache.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/dcache.c b/fs/dcache.c index ab5f8e954978..36db55960158 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -682,6 +682,10 @@ static inline bool limit_negative_dentry(struct dentry *dentry) { struct dentry *parent; + /* The dentry is now unrecoverably dead, shuoldn't limit */ + if (unlikely(dentry->d_lockref.count < 0)) + return false; + parent = dentry->d_parent; if (unlikely(!parent)) return false; -- 2.31.1

2 1

[PATCH OLK-6.6 0/1] Feature: export vcpustat
by liangtian 20 Feb '24

20 Feb '24

2 2

[PATCH OLK-6.6 00/12] Add kabi reserve
by Wang Wensheng 20 Feb '24

20 Feb '24

Wang Wensheng (12): delayacct: Reserve kabi for task_delay_info xarray: Reserve kabi for xa_state sbitmap: Add kabi reserve iommu: Add kabi reserve drm: Add kabi reserve in drm_mode_config.h drm: Add kabi reserve in drm_modeset_lock.h drm: Add kabi reserve in drm_plane.h drm: Add kabi reserve in drm_syncobj.h drm: Add kabi reserve in drm_gpu_scheduler.h drm/ttm: Add kabi reserve in ttm_bo.h drm/ttm: Add kabi reserve in ttm_resource.h drm/ttm: Add kabi reserve in ttm_tt.h include/drm/drm_mode_config.h | 5 +++++ include/drm/drm_modeset_lock.h | 3 +++ include/drm/drm_plane.h | 9 +++++++++ include/drm/drm_syncobj.h | 3 +++ include/drm/gpu_scheduler.h | 15 +++++++++++++++ include/drm/ttm/ttm_bo.h | 7 +++++++ include/drm/ttm/ttm_resource.h | 13 +++++++++++++ include/drm/ttm/ttm_tt.h | 3 +++ include/linux/delayacct.h | 3 +++ include/linux/iommu.h | 17 +++++++++++++++++ include/linux/sbitmap.h | 9 +++++++++ include/linux/xarray.h | 3 +++ 12 files changed, 90 insertions(+) -- 2.17.1

2 13

[PATCH OLK-6.6 0/1] Feature: export vcpustat
by liangtian 20 Feb '24

20 Feb '24

2 2

[PATCH OLK-6.6 0/1] Feature: export vcpustat
by liangtian 20 Feb '24

20 Feb '24

2 2

[PATCH OLK-6.6 0/1] Feature: smart halt poll support for arm
by liangtian 20 Feb '24

20 Feb '24

2 2

[PATCH OLK-5.10] arm64/mpam: update reminder message about MBHDL option
by Zeng Heng 20 Feb '24

20 Feb '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I91YTV CVE: NA ---------------------------------------- Corrected debugging reminder information about MBHDL option of schemata interface. # echo "MBHDL:1=2" > schemata -bash: echo: write error: Invalid argument # cat info/last_cmd_status MB value 2 exceed 1 Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_resctrl.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 174f84893ee5..bc314b181132 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -340,15 +340,16 @@ parse_bw(char *buf, struct resctrl_resource *r, return -EINVAL; } + if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { + rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); + return -EINVAL; + } + switch (rr->ctrl_features[type].evt) { case QOS_MBA_MAX_EVENT_ID: case QOS_MBA_PBM_EVENT_ID: case QOS_MBA_MIN_EVENT_ID: - if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { - rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); - return -EINVAL; - } - if (data < r->mbw.min_bw) { + if (data < r->mbw.min_bw || data >= rr->ctrl_features[type].max_wd) { rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", data, r->mbw.min_bw, rr->ctrl_features[type].max_wd - 1); return -EINVAL; @@ -356,19 +357,14 @@ parse_bw(char *buf, struct resctrl_resource *r, data = roundup(data, r->mbw.bw_gran); break; default: - if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { - rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); + if (data >= rr->ctrl_features[type].max_wd) { + rdt_last_cmd_printf("MB value %ld exceed %d\n", data, + rr->ctrl_features[type].max_wd - 1); return -EINVAL; } break; } - if (data >= rr->ctrl_features[type].max_wd) { - rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", data, - r->mbw.min_bw, rr->ctrl_features[type].max_wd - 1); - return -EINVAL; - } - cfg->new_ctrl[type] = data; cfg->ctrl_updated[type] = true; cfg->have_new_ctrl = true; -- 2.25.1

2 1

[PATCH OLK-6.6] ubi: Check for too small LEB size in VTBL code
by ZhaoLong Wang 20 Feb '24

20 Feb '24

From: Richard Weinberger <richard(a)nod.at> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L79 CVE: CVE-2024-25739 Reference: https://www.spinics.net/lists/kernel/msg5074816.html ---------------------------------------- If the LEB size is smaller than a volume table record we cannot have volumes. In this case abort attaching. Cc: Chenyuan Yang <cy54(a)illinois.edu> Cc: stable(a)vger.kernel.org Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Chenyuan Yang <cy54(a)illinois.edu> Closes: https://lore.kernel.org/linux-mtd/1433EB7A-FC89-47D6-8F47-23BE41B263B3@illi… Signed-off-by: Richard Weinberger <richard(a)nod.at> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/vtbl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c index f700f0e4f2ec..6e5489e233dd 100644 --- a/drivers/mtd/ubi/vtbl.c +++ b/drivers/mtd/ubi/vtbl.c @@ -791,6 +791,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai) * The number of supported volumes is limited by the eraseblock size * and by the UBI_MAX_VOLUMES constant. */ + + if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) { + ubi_err(ubi, "LEB size too small for a volume record"); + return -EINVAL; + } + ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE; if (ubi->vtbl_slots > UBI_MAX_VOLUMES) ubi->vtbl_slots = UBI_MAX_VOLUMES; -- 2.34.3

2 1

[PATCH OLK-5.10] ubi: Check for too small LEB size in VTBL code
by ZhaoLong Wang 20 Feb '24

20 Feb '24

From: Richard Weinberger <richard(a)nod.at> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L79 CVE: CVE-2024-25739 Reference: https://www.spinics.net/lists/kernel/msg5074816.html ---------------------------------------- If the LEB size is smaller than a volume table record we cannot have volumes. In this case abort attaching. Cc: Chenyuan Yang <cy54(a)illinois.edu> Cc: stable(a)vger.kernel.org Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Chenyuan Yang <cy54(a)illinois.edu> Closes: https://lore.kernel.org/linux-mtd/1433EB7A-FC89-47D6-8F47-23BE41B263B3@illi… Signed-off-by: Richard Weinberger <richard(a)nod.at> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/vtbl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c index f700f0e4f2ec..6e5489e233dd 100644 --- a/drivers/mtd/ubi/vtbl.c +++ b/drivers/mtd/ubi/vtbl.c @@ -791,6 +791,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai) * The number of supported volumes is limited by the eraseblock size * and by the UBI_MAX_VOLUMES constant. */ + + if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) { + ubi_err(ubi, "LEB size too small for a volume record"); + return -EINVAL; + } + ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE; if (ubi->vtbl_slots > UBI_MAX_VOLUMES) ubi->vtbl_slots = UBI_MAX_VOLUMES; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] ubi: Check for too small LEB size in VTBL code
by ZhaoLong Wang 20 Feb '24

20 Feb '24

From: Richard Weinberger <richard(a)nod.at> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I91L79 CVE: CVE-2024-25739 Reference: https://www.spinics.net/lists/kernel/msg5074816.html ---------------------------------------- If the LEB size is smaller than a volume table record we cannot have volumes. In this case abort attaching. Cc: Chenyuan Yang <cy54(a)illinois.edu> Cc: stable(a)vger.kernel.org Fixes: 801c135ce73d ("UBI: Unsorted Block Images") Reported-by: Chenyuan Yang <cy54(a)illinois.edu> Closes: https://lore.kernel.org/linux-mtd/1433EB7A-FC89-47D6-8F47-23BE41B263B3@illi… Signed-off-by: Richard Weinberger <richard(a)nod.at> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/vtbl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c index 1bc82154bb18..634ec95a1e71 100644 --- a/drivers/mtd/ubi/vtbl.c +++ b/drivers/mtd/ubi/vtbl.c @@ -804,6 +804,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai) * The number of supported volumes is limited by the eraseblock size * and by the UBI_MAX_VOLUMES constant. */ + + if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) { + ubi_err(ubi, "LEB size too small for a volume record"); + return -EINVAL; + } + ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE; if (ubi->vtbl_slots > UBI_MAX_VOLUMES) ubi->vtbl_slots = UBI_MAX_VOLUMES; -- 2.34.3

2 1

[PATCH OLK-5.10] arm64/mpam: update reminder message about MBHDL option
by Zeng Heng 20 Feb '24

20 Feb '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I91YTV CVE: NA ---------------------------------------- Corrected debugging reminder information about MBHDL option of schemata interface. # echo "MBHDL:1=2" > schemata -bash: echo: write error: Invalid argument # cat info/last_cmd_status MB value 2 exceed 1 Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_resctrl.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 174f84893ee5..bc314b181132 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -340,15 +340,16 @@ parse_bw(char *buf, struct resctrl_resource *r, return -EINVAL; } + if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { + rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); + return -EINVAL; + } + switch (rr->ctrl_features[type].evt) { case QOS_MBA_MAX_EVENT_ID: case QOS_MBA_PBM_EVENT_ID: case QOS_MBA_MIN_EVENT_ID: - if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { - rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); - return -EINVAL; - } - if (data < r->mbw.min_bw) { + if (data < r->mbw.min_bw || data >= rr->ctrl_features[type].max_wd) { rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", data, r->mbw.min_bw, rr->ctrl_features[type].max_wd - 1); return -EINVAL; @@ -356,19 +357,14 @@ parse_bw(char *buf, struct resctrl_resource *r, data = roundup(data, r->mbw.bw_gran); break; default: - if (kstrtoul(buf, rr->ctrl_features[type].base, &data)) { - rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf); + if (data >= rr->ctrl_features[type].max_wd) { + rdt_last_cmd_printf("MB value %ld exceed %d\n", data, + rr->ctrl_features[type].max_wd - 1); return -EINVAL; } break; } - if (data >= rr->ctrl_features[type].max_wd) { - rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", data, - r->mbw.min_bw, rr->ctrl_features[type].max_wd - 1); - return -EINVAL; - } - cfg->new_ctrl[type] = data; cfg->ctrl_updated[type] = true; cfg->have_new_ctrl = true; -- 2.25.1

2 1

2024

2023

2022

2021

2020

2019

Kernel