- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] hwmon: (lm95234) Fix underflows seen when writing limit attributes
by Xiongfeng Wang 27 Sep '24

27 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> mainline inclusion from mainline-v6.11-rc1 commit af64e3e1537896337405f880c1e9ac1f8c0c6198 category: bugfix bugzilla: hhttps://gitee.com/src-openeuler/kernel/issues/IAS0PZ CVE: CVE-2024-46758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/lm95234.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/lm95234.c b/drivers/hwmon/lm95234.c index c7fcc9e7f57a..13912ac7c69f 100644 --- a/drivers/hwmon/lm95234.c +++ b/drivers/hwmon/lm95234.c @@ -310,7 +310,8 @@ static ssize_t set_tcrit2(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, index ? 255 : 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, (index ? 255 : 127) * 1000), + 1000); mutex_lock(&data->update_lock); data->tcrit2[index] = val; @@ -359,7 +360,7 @@ static ssize_t set_tcrit1(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000); mutex_lock(&data->update_lock); data->tcrit1[index] = val; @@ -400,7 +401,7 @@ static ssize_t set_tcrit1_hyst(struct device *dev, if (ret < 0) return ret; - val = DIV_ROUND_CLOSEST(val, 1000); + val = DIV_ROUND_CLOSEST(clamp_val(val, -255000, 255000), 1000); val = clamp_val((int)data->tcrit1[index] - val, 0, 31); mutex_lock(&data->update_lock); @@ -440,7 +441,7 @@ static ssize_t set_offset(struct device *dev, struct device_attribute *attr, return ret; /* Accuracy is 1/2 degrees C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 500), -128, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, -64000, 63500), 500); mutex_lock(&data->update_lock); data->toffset[index] = val; -- 2.20.1

2 1

[PATCH OLK-6.6] hwmon: (lm95234) Fix underflows seen when writing limit attributes
by Xiongfeng Wang 27 Sep '24

27 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> mainline inclusion from mainline-v6.11-rc1 commit af64e3e1537896337405f880c1e9ac1f8c0c6198 category: bugfix bugzilla: hhttps://gitee.com/src-openeuler/kernel/issues/IAS0PZ CVE: CVE-2024-46758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/hwmon/lm95234.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/lm95234.c b/drivers/hwmon/lm95234.c index 67b9d7636ee4..37e8e9679aeb 100644 --- a/drivers/hwmon/lm95234.c +++ b/drivers/hwmon/lm95234.c @@ -301,7 +301,8 @@ static ssize_t tcrit2_store(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, index ? 255 : 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, (index ? 255 : 127) * 1000), + 1000); mutex_lock(&data->update_lock); data->tcrit2[index] = val; @@ -350,7 +351,7 @@ static ssize_t tcrit1_store(struct device *dev, struct device_attribute *attr, if (ret < 0) return ret; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000); mutex_lock(&data->update_lock); data->tcrit1[index] = val; @@ -391,7 +392,7 @@ static ssize_t tcrit1_hyst_store(struct device *dev, if (ret < 0) return ret; - val = DIV_ROUND_CLOSEST(val, 1000); + val = DIV_ROUND_CLOSEST(clamp_val(val, -255000, 255000), 1000); val = clamp_val((int)data->tcrit1[index] - val, 0, 31); mutex_lock(&data->update_lock); @@ -431,7 +432,7 @@ static ssize_t offset_store(struct device *dev, struct device_attribute *attr, return ret; /* Accuracy is 1/2 degrees C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 500), -128, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, -64000, 63500), 500); mutex_lock(&data->update_lock); data->toffset[index] = val; -- 2.20.1

2 1

[PATCH OLK-6.6] btrfs: fix race between direct IO write and fsync when using same fd
by Xiongfeng Wang 27 Sep '24

27 Sep '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v6.6.51 commit 7b5595f33c3c273613b590892a578d78186bb400 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1Z CVE: CVE-2024-46734 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit cd9253c23aedd61eb5ff11f37a36247cd46faf86 upstream. If we have 2 threads that are using the same file descriptor and one of them is doing direct IO writes while the other is doing fsync, we have a race where we can end up either: 1) Attempt a fsync without holding the inode's lock, triggering an assertion failures when assertions are enabled; 2) Do an invalid memory access from the fsync task because the file private points to memory allocated on stack by the direct IO task and it may be used by the fsync task after the stack was destroyed. The race happens like this: 1) A user space program opens a file descriptor with O_DIRECT; 2) The program spawns 2 threads using libpthread for example; 3) One of the threads uses the file descriptor to do direct IO writes, while the other calls fsync using the same file descriptor. 4) Call task A the thread doing direct IO writes and task B the thread doing fsyncs; 5) Task A does a direct IO write, and at btrfs_direct_write() sets the file's private to an on stack allocated private with the member 'fsync_skip_inode_lock' set to true; 6) Task B enters btrfs_sync_file() and sees that there's a private structure associated to the file which has 'fsync_skip_inode_lock' set to true, so it skips locking the inode's VFS lock; 7) Task A completes the direct IO write, and resets the file's private to NULL since it had no prior private and our private was stack allocated. Then it unlocks the inode's VFS lock; 8) Task B enters btrfs_get_ordered_extents_for_logging(), then the assertion that checks the inode's VFS lock is held fails, since task B never locked it and task A has already unlocked it. The stack trace produced is the following: assertion failed: inode_is_locked(&inode->vfs_inode), in fs/btrfs/ordered-data.c:983 ------------[ cut here ]------------ kernel BUG at fs/btrfs/ordered-data.c:983! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 9 PID: 5072 Comm: worker Tainted: G U OE 6.10.5-1-default #1 openSUSE Tumbleweed 69f48d427608e1c09e60ea24c6c55e2ca1b049e8 Hardware name: Acer Predator PH315-52/Covini_CFS, BIOS V1.12 07/28/2020 RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs] Code: 50 d6 86 c0 e8 (...) RSP: 0018:ffff9e4a03dcfc78 EFLAGS: 00010246 RAX: 0000000000000054 RBX: ffff9078a9868e98 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff907dce4a7800 RDI: ffff907dce4a7800 RBP: ffff907805518800 R08: 0000000000000000 R09: ffff9e4a03dcfb38 R10: ffff9e4a03dcfb30 R11: 0000000000000003 R12: ffff907684ae7800 R13: 0000000000000001 R14: ffff90774646b600 R15: 0000000000000000 FS: 00007f04b96006c0(0000) GS:ffff907dce480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0 Call Trace: <TASK> ? __die_body.cold+0x14/0x24 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x6a/0x90 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? exc_invalid_op+0x50/0x70 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? asm_exc_invalid_op+0x1a/0x20 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] btrfs_sync_file+0x21a/0x4d0 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? __seccomp_filter+0x31d/0x4f0 __x64_sys_fdatasync+0x4f/0x90 do_syscall_64+0x82/0x160 ? do_futex+0xcb/0x190 ? __x64_sys_futex+0x10e/0x1d0 ? switch_fpu_return+0x4f/0xd0 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e Another problem here is if task B grabs the private pointer and then uses it after task A has finished, since the private was allocated in the stack of task A, it results in some invalid memory access with a hard to predict result. This issue, triggering the assertion, was observed with QEMU workloads by two users in the Link tags below. Fix this by not relying on a file's private to pass information to fsync that it should skip locking the inode and instead pass this information through a special value stored in current->journal_info. This is safe because in the relevant section of the direct IO write path we are not holding a transaction handle, so current->journal_info is NULL. The following C program triggers the issue: $ cat repro.c /* Get the O_DIRECT definition. */ #ifndef _GNU_SOURCE #define _GNU_SOURCE #endif #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <stdint.h> #include <fcntl.h> #include <errno.h> #include <string.h> #include <pthread.h> static int fd; static ssize_t do_write(int fd, const void *buf, size_t count, off_t offset) { while (count > 0) { ssize_t ret; ret = pwrite(fd, buf, count, offset); if (ret < 0) { if (errno == EINTR) continue; return ret; } count -= ret; buf += ret; } return 0; } static void *fsync_loop(void *arg) { while (1) { int ret; ret = fsync(fd); if (ret != 0) { perror("Fsync failed"); exit(6); } } } int main(int argc, char *argv[]) { long pagesize; void *write_buf; pthread_t fsyncer; int ret; if (argc != 2) { fprintf(stderr, "Use: %s <file path>\n", argv[0]); return 1; } fd = open(argv[1], O_WRONLY | O_CREAT | O_TRUNC | O_DIRECT, 0666); if (fd == -1) { perror("Failed to open/create file"); return 1; } pagesize = sysconf(_SC_PAGE_SIZE); if (pagesize == -1) { perror("Failed to get page size"); return 2; } ret = posix_memalign(&write_buf, pagesize, pagesize); if (ret) { perror("Failed to allocate buffer"); return 3; } ret = pthread_create(&fsyncer, NULL, fsync_loop, NULL); if (ret != 0) { fprintf(stderr, "Failed to create writer thread: %d\n", ret); return 4; } while (1) { ret = do_write(fd, write_buf, pagesize, 0); if (ret != 0) { perror("Write failed"); exit(5); } } return 0; } $ mkfs.btrfs -f /dev/sdi $ mount /dev/sdi /mnt/sdi $ timeout 10 ./repro /mnt/sdi/foo Usually the race is triggered within less than 1 second. A test case for fstests will follow soon. Reported-by: Paulo Dias <paulo.miguel.dias(a)gmail.com> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219187 Reported-by: Andreas Jahn <jahn-andi(a)web.de> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219199 Reported-by: syzbot+4704b3cc972bd76024f1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/00000000000044ff540620d7dee2@google.com/ Fixes: 939b656bc8ab ("btrfs: fix corruption after buffer fault in during direct IO append write") CC: stable(a)vger.kernel.org # 5.15+ Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- fs/btrfs/ctree.h | 1 - fs/btrfs/file.c | 25 ++++++++++--------------- fs/btrfs/transaction.h | 6 ++++++ 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h index 86c7f8ce1715..06333a74d6c4 100644 --- a/fs/btrfs/ctree.h +++ b/fs/btrfs/ctree.h @@ -445,7 +445,6 @@ struct btrfs_file_private { void *filldir_buf; u64 last_index; struct extent_state *llseek_cached_state; - bool fsync_skip_inode_lock; }; static inline u32 BTRFS_LEAF_DATA_SIZE(const struct btrfs_fs_info *info) diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c index 952cf145c629..15fd8c00f4c0 100644 --- a/fs/btrfs/file.c +++ b/fs/btrfs/file.c @@ -1543,13 +1543,6 @@ static ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) if (IS_ERR_OR_NULL(dio)) { err = PTR_ERR_OR_ZERO(dio); } else { - struct btrfs_file_private stack_private = { 0 }; - struct btrfs_file_private *private; - const bool have_private = (file->private_data != NULL); - - if (!have_private) - file->private_data = &stack_private; - /* * If we have a synchoronous write, we must make sure the fsync * triggered by the iomap_dio_complete() call below doesn't @@ -1558,13 +1551,10 @@ static ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from) * partial writes due to the input buffer (or parts of it) not * being already faulted in. */ - private = file->private_data; - private->fsync_skip_inode_lock = true; + ASSERT(current->journal_info == NULL); + current->journal_info = BTRFS_TRANS_DIO_WRITE_STUB; err = iomap_dio_complete(dio); - private->fsync_skip_inode_lock = false; - - if (!have_private) - file->private_data = NULL; + current->journal_info = NULL; } /* No increment (+=) because iomap returns a cumulative value. */ @@ -1796,7 +1786,6 @@ static inline bool skip_inode_logging(const struct btrfs_log_ctx *ctx) */ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) { - struct btrfs_file_private *private = file->private_data; struct dentry *dentry = file_dentry(file); struct inode *inode = d_inode(dentry); struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); @@ -1806,7 +1795,13 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) int ret = 0, err; u64 len; bool full_sync; - const bool skip_ilock = (private ? private->fsync_skip_inode_lock : false); + bool skip_ilock = false; + + if (current->journal_info == BTRFS_TRANS_DIO_WRITE_STUB) { + skip_ilock = true; + current->journal_info = NULL; + lockdep_assert_held(&inode->i_rwsem); + } trace_btrfs_sync_file(file, datasync); diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h index 238a0ab85df9..7623db359881 100644 --- a/fs/btrfs/transaction.h +++ b/fs/btrfs/transaction.h @@ -12,6 +12,12 @@ #include "ctree.h" #include "misc.h" +/* + * Signal that a direct IO write is in progress, to avoid deadlock for sync + * direct IO writes when fsync is called during the direct IO write path. + */ +#define BTRFS_TRANS_DIO_WRITE_STUB ((void *) 1) + /* Radix-tree tag for roots that are part of the trasaction. */ #define BTRFS_ROOT_TRANS_TAG 0 -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS 0/3] dhugetlb: make spin_lock irq save
by Liu Shixin 27 Sep '24

27 Sep '24

Liu Shixin (3): dhugetlb: Use helper function to lock/unlock dhugetlb: avoid lockdep warning with spin_lock_nested dhugetlb: make free_huge_page_to_dhugetlb_pool irq safe include/linux/hugetlb.h | 2 + mm/hugetlb.c | 115 ++++++++++++++++++++++++++-------------- mm/memcontrol.c | 8 +-- 3 files changed, 78 insertions(+), 47 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] ethtool: check device is present when getting link settings
by Wang Liang 27 Sep '24

27 Sep '24

From: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> stable inclusion from stable-v5.10.225 commit 842a40c7273ba1c1cb30dda50405b328de1d860e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4EU CVE: CVE-2024-46679 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a699781c79ecf6cfe67fb00a0331b4088c7c8466 ] A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg: [exception RIP: qed_get_current_link+17] #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede] #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3 #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4 #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300 #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3 #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1 #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb crash> struct net_device.state ffff9a9d21336000 state = 5, state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100). The device is not present, note lack of __LINK_STATE_PRESENT (0b10). This is the same sort of panic as observed in commit 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show"). There are many other callers of __ethtool_get_link_ksettings() which don't have a device presence check. Move this check into ethtool to protect all callers. Fixes: d519e17e2d01 ("net: export device speed and duplex via sysfs") Fixes: 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show") Signed-off-by: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> Link: https://patch.msgid.link/8bae218864beaa44ed01628140475b9bf641c5b0.172439367… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 989b3f7ee85f..99303897b7bb 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -213,7 +213,7 @@ static ssize_t speed_show(struct device *dev, if (!rtnl_trylock()) return restart_syscall(); - if (netif_running(netdev) && netif_device_present(netdev)) { + if (netif_running(netdev)) { struct ethtool_link_ksettings cmd; if (!__ethtool_get_link_ksettings(netdev, &cmd)) diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 63a88b3e861d..f11b5e3a78b1 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -432,6 +432,9 @@ int __ethtool_get_link_ksettings(struct net_device *dev, if (!dev->ethtool_ops->get_link_ksettings) return -EOPNOTSUPP; + if (!netif_device_present(dev)) + return -ENODEV; + memset(link_ksettings, 0, sizeof(*link_ksettings)); return dev->ethtool_ops->get_link_ksettings(dev, link_ksettings); } -- 2.34.1

2 1

[PATCH OLK-5.10] ethtool: check device is present when getting link settings
by Wang Liang 27 Sep '24

27 Sep '24

From: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> stable inclusion from stable-v5.10.225 commit 842a40c7273ba1c1cb30dda50405b328de1d860e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4EU CVE: CVE-2024-46679 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a699781c79ecf6cfe67fb00a0331b4088c7c8466 ] A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg: [exception RIP: qed_get_current_link+17] #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede] #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3 #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4 #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300 #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3 #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1 #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb crash> struct net_device.state ffff9a9d21336000 state = 5, state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100). The device is not present, note lack of __LINK_STATE_PRESENT (0b10). This is the same sort of panic as observed in commit 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show"). There are many other callers of __ethtool_get_link_ksettings() which don't have a device presence check. Move this check into ethtool to protect all callers. Fixes: d519e17e2d01 ("net: export device speed and duplex via sysfs") Fixes: 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show") Signed-off-by: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> Link: https://patch.msgid.link/8bae218864beaa44ed01628140475b9bf641c5b0.172439367… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 989b3f7ee85f..99303897b7bb 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -213,7 +213,7 @@ static ssize_t speed_show(struct device *dev, if (!rtnl_trylock()) return restart_syscall(); - if (netif_running(netdev) && netif_device_present(netdev)) { + if (netif_running(netdev)) { struct ethtool_link_ksettings cmd; if (!__ethtool_get_link_ksettings(netdev, &cmd)) diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 61a002f5dec6..bc956c346037 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -432,6 +432,9 @@ int __ethtool_get_link_ksettings(struct net_device *dev, if (!dev->ethtool_ops->get_link_ksettings) return -EOPNOTSUPP; + if (!netif_device_present(dev)) + return -ENODEV; + memset(link_ksettings, 0, sizeof(*link_ksettings)); return dev->ethtool_ops->get_link_ksettings(dev, link_ksettings); } -- 2.34.1

2 1

[PATCH OLK-6.6] ethtool: check device is present when getting link settings
by Wang Liang 27 Sep '24

27 Sep '24

From: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> stable inclusion from stable-v6.6.49 commit 94ab317024ba373d37340893d1c0358638935fbb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4EU CVE: CVE-2024-46679 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a699781c79ecf6cfe67fb00a0331b4088c7c8466 ] A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg: [exception RIP: qed_get_current_link+17] #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede] #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3 #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4 #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300 #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3 #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1 #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb crash> struct net_device.state ffff9a9d21336000 state = 5, state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100). The device is not present, note lack of __LINK_STATE_PRESENT (0b10). This is the same sort of panic as observed in commit 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show"). There are many other callers of __ethtool_get_link_ksettings() which don't have a device presence check. Move this check into ethtool to protect all callers. Fixes: d519e17e2d01 ("net: export device speed and duplex via sysfs") Fixes: 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show") Signed-off-by: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> Link: https://patch.msgid.link/8bae218864beaa44ed01628140475b9bf641c5b0.172439367… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 5a9487af44e0..f7404bc67974 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -216,7 +216,7 @@ static ssize_t speed_show(struct device *dev, if (!rtnl_trylock()) return restart_syscall(); - if (netif_running(netdev) && netif_device_present(netdev)) { + if (netif_running(netdev)) { struct ethtool_link_ksettings cmd; if (!__ethtool_get_link_ksettings(netdev, &cmd)) diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 7cb23bcf8ef7..4486cbe2faf0 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -438,6 +438,9 @@ int __ethtool_get_link_ksettings(struct net_device *dev, if (!dev->ethtool_ops->get_link_ksettings) return -EOPNOTSUPP; + if (!netif_device_present(dev)) + return -ENODEV; + memset(link_ksettings, 0, sizeof(*link_ksettings)); return dev->ethtool_ops->get_link_ksettings(dev, link_ksettings); } -- 2.34.1

2 1

[PATCH OLK-5.10] sched: fix a deadlock in task_net_group()
by Hui Tang 27 Sep '24

27 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATU6E CVE: NA -------------------------------- If req->tx_pid == req->tx_pid when sched_net_relationship_submit() called, which cause rship->net_lock AA deadlock in task_net_group(). Fixes: 2ac826b258e9 ("sched: Introduce task relationship by net and memory") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/relationship.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/sched/relationship.c b/kernel/sched/relationship.c index 515c913aeb33..d17041585c39 100644 --- a/kernel/sched/relationship.c +++ b/kernel/sched/relationship.c @@ -141,6 +141,9 @@ int sched_net_relationship_submit(struct net_relationship_req *req) req->net_rship_type == NET_RS_TYPE_TX) return remote_rxtx_process(req); + if (req->rx_pid == req->tx_pid) + return -EINVAL; + rcu_read_lock(); rx_tsk = find_task_by_pid_ns(req->rx_pid, &init_pid_ns); -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: fix double put of @cfile in smb2_set_path_size()
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Paulo Alcantara <pc(a)manguebit.com> stable inclusion from stable-v6.6.51 commit 5a72d1edb0843e4c927a4096f81e631031c25c28 category: kasan bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWCG CVE: CVE-2024-46796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f9c169b51b6ce20394594ef674d6b10efba31220 upstream. If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retrying it as the reference of @cfile was already dropped by previous call. This fixes the following KASAN splat when running fstests generic/013 against Windows Server 2022: CIFS: Attempting to mount //w22-fs0/scratch run fstests generic/013 at 2024-09-02 19:48:59 ================================================================== BUG: KASAN: slab-use-after-free in detach_if_pending+0xab/0x200 Write of size 8 at addr ffff88811f1a3730 by task kworker/3:2/176 CPU: 3 UID: 0 PID: 176 Comm: kworker/3:2 Not tainted 6.11.0-rc6 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Workqueue: cifsoplockd cifs_oplock_break [cifs] Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? detach_if_pending+0xab/0x200 print_report+0x156/0x4d9 ? detach_if_pending+0xab/0x200 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? detach_if_pending+0xab/0x200 kasan_report+0xda/0x110 ? detach_if_pending+0xab/0x200 detach_if_pending+0xab/0x200 timer_delete+0x96/0xe0 ? __pfx_timer_delete+0x10/0x10 ? rcu_is_watching+0x20/0x50 try_to_grab_pending+0x46/0x3b0 __cancel_work+0x89/0x1b0 ? __pfx___cancel_work+0x10/0x10 ? kasan_save_track+0x14/0x30 cifs_close_deferred_file+0x110/0x2c0 [cifs] ? __pfx_cifs_close_deferred_file+0x10/0x10 [cifs] ? __pfx_down_read+0x10/0x10 cifs_oplock_break+0x4c1/0xa50 [cifs] ? __pfx_cifs_oplock_break+0x10/0x10 [cifs] ? lock_is_held_type+0x85/0xf0 ? mark_held_locks+0x1a/0x90 process_one_work+0x4c6/0x9f0 ? find_held_lock+0x8a/0xa0 ? __pfx_process_one_work+0x10/0x10 ? lock_acquired+0x220/0x550 ? __list_add_valid_or_report+0x37/0x100 worker_thread+0x2e4/0x570 ? __kthread_parkme+0xd1/0xf0 ? __pfx_worker_thread+0x10/0x10 kthread+0x17f/0x1c0 ? kthread+0xda/0x1c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1118: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 cifs_new_fileinfo+0xc8/0x9d0 [cifs] cifs_atomic_open+0x467/0x770 [cifs] lookup_open.isra.0+0x665/0x8b0 path_openat+0x4c3/0x1380 do_filp_open+0x167/0x270 do_sys_openat2+0x129/0x160 __x64_sys_creat+0xad/0xe0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 83: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 poison_slab_object+0xe9/0x160 __kasan_slab_free+0x32/0x50 kfree+0xf2/0x300 process_one_work+0x4c6/0x9f0 worker_thread+0x2e4/0x570 kthread+0x17f/0x1c0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x30/0x50 __kasan_record_aux_stack+0xad/0xc0 insert_work+0x29/0xe0 __queue_work+0x5ea/0x760 queue_work_on+0x6d/0x90 _cifsFileInfo_put+0x3f6/0x770 [cifs] smb2_compound_op+0x911/0x3940 [cifs] smb2_set_path_size+0x228/0x270 [cifs] cifs_set_file_size+0x197/0x460 [cifs] cifs_setattr+0xd9c/0x14b0 [cifs] notify_change+0x4e3/0x740 do_truncate+0xfa/0x180 vfs_truncate+0x195/0x200 __x64_sys_truncate+0x109/0x150 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 71f15c90e785 ("smb: client: retry compound request without reusing lease") Cc: stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Cc: David Howells <dhowells(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/smb/client/smb2inode.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c index 28031c7ba6b1..c51ec2e1adb0 100644 --- a/fs/smb/client/smb2inode.c +++ b/fs/smb/client/smb2inode.c @@ -1148,6 +1148,7 @@ smb2_set_path_size(const unsigned int xid, struct cifs_tcon *tcon, cfile, NULL, NULL, dentry); if (rc == -EINVAL) { cifs_dbg(FYI, "invalid lease key, resending request without lease"); + cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms, &in_iov, &(int){SMB2_OP_SET_EOF}, 1, -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] ksmbd: unset the binding mark of a reused connection
by Long Li 27 Sep '24

27 Sep '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.166 commit 9914f1bd61d5e838bb1ab15a71076d37a6db65d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWIK CVE: CVE-2024-46795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 ] Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..f4aeca5e7e57 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1704,6 +1704,8 @@ int smb2_sess_setup(struct ksmbd_work *work) rc = ksmbd_session_register(conn, sess); if (rc) goto out_err; + + conn->binding = false; } else if (conn->dialect >= SMB30_PROT_ID && (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { @@ -1782,6 +1784,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess = NULL; goto out_err; } + + conn->binding = false; } work->sess = sess; -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] ext4: dax: Fix inconsistent isize during writing
by Zhihao Cheng 27 Sep '24

27 Sep '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> Zhihao Cheng (1): ext4: dax: fix overflowing extents beyond inode size when partially writing yangerkun (1): ext4: dax: keep orphan list before truncate overflow allocated blocks fs/ext4/file.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6] ksmbd: unset the binding mark of a reused connection
by Long Li 27 Sep '24

27 Sep '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.10-rc2 commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWIK CVE: CVE-2024-46795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/server/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 4d91210e6acf..28684316bccb 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -1681,6 +1681,8 @@ int smb2_sess_setup(struct ksmbd_work *work) rc = ksmbd_session_register(conn, sess); if (rc) goto out_err; + + conn->binding = false; } else if (conn->dialect >= SMB30_PROT_ID && (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { @@ -1759,6 +1761,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess = NULL; goto out_err; } + + conn->binding = false; } work->sess = sess; -- 2.39.2

2 1

[PATCH OLK-6.6] HID: amd_sfh: free driver_data after destroying hid device
by He Yujie 27 Sep '24

27 Sep '24

From: Olivier Sobrie <olivier(a)sobrie.be> stable inclusion from stable-v6.6.51 commit 60dc4ee0428d70bcbb41436b6729d29f1cbdfb89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S CVE: CVE-2024-46746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97155021ae17b86985121b33cf8098bcde00d497 ] HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.219696] load_module+0x5011/0x6af0 [ 13.223096] ? kasan_save_stack+0x30/0x50 [ 13.226743] ? kasan_save_track+0x14/0x30 [ 13.230080] ? kasan_save_free_info+0x3b/0x60 [ 13.233323] ? poison_slab_object+0x109/0x180 [ 13.236778] ? __pfx_load_module+0x10/0x10 [ 13.239703] ? poison_slab_object+0x109/0x180 [ 13.243070] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.245924] ? init_module_from_file+0x13d/0x150 [ 13.248745] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.251503] ? init_module_from_file+0xdf/0x150 [ 13.254198] init_module_from_file+0xdf/0x150 [ 13.256826] ? __pfx_init_module_from_file+0x10/0x10 [ 13.259428] ? kasan_save_track+0x14/0x30 [ 13.261959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.264471] ? kasan_save_free_info+0x3b/0x60 [ 13.267026] ? poison_slab_object+0x109/0x180 [ 13.269494] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.271949] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.274324] ? _raw_spin_lock+0x85/0xe0 [ 13.276671] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.278963] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.281193] idempotent_init_module+0x23b/0x650 [ 13.283420] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.285619] ? __pfx___seccomp_filter+0x10/0x10 [ 13.287714] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.289828] ? __fget_light+0x57/0x420 [ 13.291870] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.293880] ? security_capable+0x74/0xb0 [ 13.295820] __x64_sys_finit_module+0xbe/0x130 [ 13.297874] do_syscall_64+0x82/0x190 [ 13.299898] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.301905] ? irqtime_account_irq+0x3d/0x1f0 [ 13.303877] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.305753] ? __irq_exit_rcu+0x4e/0x130 [ 13.307577] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.309489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.311371] RIP: 0033:0x7a21f96ade9d [ 13.313234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.317051] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.319024] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.321100] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.323314] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.325505] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.327637] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.329737] </TASK> [ 13.333945] Allocated by task 139: [ 13.336111] kasan_save_stack+0x30/0x50 [ 13.336121] kasan_save_track+0x14/0x30 [ 13.336125] __kasan_kmalloc+0xaa/0xb0 [ 13.336129] amdtp_hid_probe+0xb1/0x440 [amd_sfh] [ 13.336138] amd_sfh_hid_client_init+0xb8a/0x10f0 [amd_sfh] [ 13.336144] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.336150] process_one_work+0x673/0xeb0 [ 13.336155] worker_thread+0x795/0x1250 [ 13.336160] kthread+0x290/0x350 [ 13.336164] ret_from_fork+0x34/0x70 [ 13.336169] ret_from_fork_asm+0x1a/0x30 [ 13.338175] Freed by task 139: [ 13.340064] kasan_save_stack+0x30/0x50 [ 13.340072] kasan_save_track+0x14/0x30 [ 13.340076] kasan_save_free_info+0x3b/0x60 [ 13.340081] poison_slab_object+0x109/0x180 [ 13.340085] __kasan_slab_free+0x32/0x50 [ 13.340089] kfree+0xe5/0x310 [ 13.340094] amdtp_hid_remove+0xb2/0x160 [amd_sfh] [ 13.340102] amd_sfh_hid_client_deinit+0x324/0x640 [amd_sfh] [ 13.340107] amd_sfh_hid_client_init+0x94a/0x10f0 [amd_sfh] [ 13.340113] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.340118] process_one_work+0x673/0xeb0 [ 13.340123] worker_thread+0x795/0x1250 [ 13.340127] kthread+0x290/0x350 [ 13.340132] ret_from_fork+0x34/0x70 [ 13.340136] ret_from_fork_asm+0x1a/0x30 [ 13.342482] The buggy address belongs to the object at ffff88813152f400 which belongs to the cache kmalloc-64 of size 64 [ 13.347357] The buggy address is located 8 bytes inside of freed 64-byte region [ffff88813152f400, ffff88813152f440) [ 13.347367] The buggy address belongs to the physical page: [ 13.355409] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13152f [ 13.355416] anon flags: 0x2ffff8000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 13.355423] page_type: 0xffffefff(slab) [ 13.355429] raw: 02ffff8000000000 ffff8881000428c0 ffffea0004c43a00 0000000000000005 [ 13.355435] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 [ 13.355439] page dumped because: kasan: bad access detected [ 13.357295] Memory state around the buggy address: [ 13.357299] ffff88813152f300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357303] ffff88813152f380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357306] >ffff88813152f400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357309] ^ [ 13.357311] ffff88813152f480: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 13.357315] ffff88813152f500: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc [ 13.357318] ================================================================== [ 13.357405] Disabling lock debugging due to kernel taint [ 13.383534] Oops: general protection fault, probably for non-canonical address 0xe0a1bc4140000013: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 13.383544] KASAN: maybe wild-memory-access in range [0x050e020a00000098-0x050e020a0000009f] [ 13.383551] CPU: 3 PID: 479 Comm: (udev-worker) Tainted: G B 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.383561] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.383565] RIP: 0010:amd_sfh_get_report+0x81/0x530 [amd_sfh] [ 13.383580] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 78 03 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 08 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 45 8b 74 24 10 45 [ 13.383585] RSP: 0018:ffff8881261f7388 EFLAGS: 00010212 [ 13.383592] RAX: dffffc0000000000 RBX: ffff88813152f400 RCX: 0000000000000002 [ 13.383597] RDX: 00a1c04140000013 RSI: 0000000000000008 RDI: 050e020a0000009b [ 13.383600] RBP: ffff88814d010000 R08: 0000000000000002 R09: fffffbfff3ddb8c0 [ 13.383604] R10: ffffffff9eedc607 R11: ffff88810ce98000 R12: 050e020a0000008b [ 13.383607] R13: ffff88814d010000 R14: dffffc0000000000 R15: 0000000000000004 [ 13.383611] FS: 00007a21f94d0880(0000) GS:ffff8887e7d80000(0000) knlGS:0000000000000000 [ 13.383615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 13.383618] CR2: 00007e0014c438f0 CR3: 000000012614c000 CR4: 0000000000f50ef0 [ 13.383622] PKRU: 55555554 [ 13.383625] Call Trace: [ 13.383629] <TASK> [ 13.383632] ? __die_body.cold+0x19/0x27 [ 13.383644] ? die_addr+0x46/0x70 [ 13.383652] ? exc_general_protection+0x150/0x240 [ 13.383664] ? asm_exc_general_protection+0x26/0x30 [ 13.383674] ? amd_sfh_get_report+0x81/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383686] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383697] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383706] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383713] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.383727] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383739] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383745] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383753] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.383762] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.383768] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.383790] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383795] ? __devm_add_action+0x167/0x1d0 [ 13.383806] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383818] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383826] platform_probe+0xa2/0x150 [ 13.383832] really_probe+0x1e3/0x8a0 [ 13.383838] __driver_probe_device+0x18c/0x370 [ 13.383844] driver_probe_device+0x4a/0x120 [ 13.383851] __driver_attach+0x190/0x4a0 [ 13.383857] ? __pfx___driver_attach+0x10/0x10 [ 13.383863] bus_for_each_dev+0x106/0x180 [ 13.383868] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.383874] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.383880] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383887] bus_add_driver+0x29e/0x4d0 [ 13.383895] driver_register+0x1a5/0x360 [ 13.383902] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383910] do_one_initcall+0xa7/0x380 [ 13.383919] ? __pfx_do_one_initcall+0x10/0x10 [ 13.383927] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383933] ? kasan_unpoison+0x44/0x70 [ 13.383943] do_init_module+0x238/0x750 [ 13.383955] load_module+0x5011/0x6af0 [ 13.383962] ? kasan_save_stack+0x30/0x50 [ 13.383968] ? kasan_save_track+0x14/0x30 [ 13.383973] ? kasan_save_free_info+0x3b/0x60 [ 13.383980] ? poison_slab_object+0x109/0x180 [ 13.383993] ? __pfx_load_module+0x10/0x10 [ 13.384007] ? poison_slab_object+0x109/0x180 [ 13.384012] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384018] ? init_module_from_file+0x13d/0x150 [ 13.384025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384032] ? init_module_from_file+0xdf/0x150 [ 13.384037] init_module_from_file+0xdf/0x150 [ 13.384044] ? __pfx_init_module_from_file+0x10/0x10 [ 13.384050] ? kasan_save_track+0x14/0x30 [ 13.384055] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384060] ? kasan_save_free_info+0x3b/0x60 [ 13.384066] ? poison_slab_object+0x109/0x180 [ 13.384071] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384080] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384085] ? _raw_spin_lock+0x85/0xe0 [ 13.384091] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.384096] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.384106] idempotent_init_module+0x23b/0x650 [ 13.384114] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.384120] ? __pfx___seccomp_filter+0x10/0x10 [ 13.384129] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384135] ? __fget_light+0x57/0x420 [ 13.384142] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384147] ? security_capable+0x74/0xb0 [ 13.384157] __x64_sys_finit_module+0xbe/0x130 [ 13.384164] do_syscall_64+0x82/0x190 [ 13.384174] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384179] ? irqtime_account_irq+0x3d/0x1f0 [ 13.384188] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384193] ? __irq_exit_rcu+0x4e/0x130 [ 13.384201] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384206] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.384212] RIP: 0033:0x7a21f96ade9d [ 13.384263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.384267] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.384273] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.384277] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.384280] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.384284] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.384288] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.384297] </TASK> [ 13.384299] Modules linked in: soundwire_amd(+) hid_sensor_gyro_3d(+) hid_sensor_magn_3d hid_sensor_accel_3d soundwire_generic_allocation amdxcp hid_sensor_trigger drm_exec industrialio_triggered_buffer soundwire_bus gpu_sched kvm_amd kfifo_buf qmi_helpers joydev drm_buddy hid_sensor_iio_common mousedev snd_soc_core industrialio i2c_algo_bit mac80211 snd_compress drm_suballoc_helper kvm snd_hda_intel drm_ttm_helper ac97_bus snd_pcm_dmaengine snd_intel_dspcfg ttm thinkpad_acpi(+) snd_intel_sdw_acpi hid_sensor_hub snd_rpl_pci_acp6x drm_display_helper snd_hda_codec hid_multitouch libarc4 snd_acp_pci platform_profile think_lmi(+) hid_generic firmware_attributes_class wmi_bmof cec snd_acp_legacy_common sparse_keymap rapl snd_hda_core psmouse cfg80211 pcspkr snd_pci_acp6x snd_hwdep video snd_pcm snd_pci_acp5x snd_timer snd_rn_pci_acp3x ucsi_acpi snd_acp_config snd sp5100_tco rfkill snd_soc_acpi typec_ucsi thunderbolt amd_sfh k10temp mhi soundcore i2c_piix4 snd_pci_acp3x typec i2c_hid_acpi roles i2c_hid wmi acpi_tad amd_pmc [ 13.384454] mac_hid i2c_dev crypto_user loop nfnetlink zram ip_tables x_tables dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel serio_raw sha512_ssse3 atkbd sha256_ssse3 libps2 sha1_ssse3 vivaldi_fmap nvme aesni_intel crypto_simd nvme_core cryptd ccp xhci_pci i8042 nvme_auth xhci_pci_renesas serio vfat fat btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq [ 13.384552] ---[ end trace 0000000000000000 ]--- KASAN reports a use-after-free of hid->driver_data in function amd_sfh_get_report(). The backtrace indicates that the function is called by amdtp_hid_request() which is one of the callbacks of hid device. The current make sure that driver_data is freed only once hid_destroy_device() returned. Note that I observed the crash both on v6.9.9 and v6.10.0. The code seems to be as it was from the early days of the driver. Signed-off-by: Olivier Sobrie <olivier(a)sobrie.be> Acked-by: Basavaraj Natikar <Basavaraj.Natikar(a)amd.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c index 705b52337068..81f3024b7b1b 100644 --- a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c +++ b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c @@ -171,11 +171,13 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) void amdtp_hid_remove(struct amdtp_cl_data *cli_data) { int i; + struct amdtp_hid_data *hid_data; for (i = 0; i < cli_data->num_hid_devices; ++i) { if (cli_data->hid_sensor_hubs[i]) { - kfree(cli_data->hid_sensor_hubs[i]->driver_data); + hid_data = cli_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(cli_data->hid_sensor_hubs[i]); + kfree(hid_data); cli_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[PATCH OLK-5.10] ksmbd: unset the binding mark of a reused connection
by Long Li 27 Sep '24

27 Sep '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.166 commit 9914f1bd61d5e838bb1ab15a71076d37a6db65d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWIK CVE: CVE-2024-46795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 ] Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..f4aeca5e7e57 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1704,6 +1704,8 @@ int smb2_sess_setup(struct ksmbd_work *work) rc = ksmbd_session_register(conn, sess); if (rc) goto out_err; + + conn->binding = false; } else if (conn->dialect >= SMB30_PROT_ID && (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { @@ -1782,6 +1784,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess = NULL; goto out_err; } + + conn->binding = false; } work->sess = sess; -- 2.39.2

2 1

[PATCH OLK-6.6] HID: amd_sfh: free driver_data after destroying hid device
by He Yujie 27 Sep '24

27 Sep '24

From: Olivier Sobrie <olivier(a)sobrie.be> stable inclusion from stable-v6.6.51 commit 60dc4ee0428d70bcbb41436b6729d29f1cbdfb89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S?from=project-issue CVE: CVE-2024-46746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97155021ae17b86985121b33cf8098bcde00d497 ] HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.219696] load_module+0x5011/0x6af0 [ 13.223096] ? kasan_save_stack+0x30/0x50 [ 13.226743] ? kasan_save_track+0x14/0x30 [ 13.230080] ? kasan_save_free_info+0x3b/0x60 [ 13.233323] ? poison_slab_object+0x109/0x180 [ 13.236778] ? __pfx_load_module+0x10/0x10 [ 13.239703] ? poison_slab_object+0x109/0x180 [ 13.243070] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.245924] ? init_module_from_file+0x13d/0x150 [ 13.248745] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.251503] ? init_module_from_file+0xdf/0x150 [ 13.254198] init_module_from_file+0xdf/0x150 [ 13.256826] ? __pfx_init_module_from_file+0x10/0x10 [ 13.259428] ? kasan_save_track+0x14/0x30 [ 13.261959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.264471] ? kasan_save_free_info+0x3b/0x60 [ 13.267026] ? poison_slab_object+0x109/0x180 [ 13.269494] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.271949] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.274324] ? _raw_spin_lock+0x85/0xe0 [ 13.276671] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.278963] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.281193] idempotent_init_module+0x23b/0x650 [ 13.283420] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.285619] ? __pfx___seccomp_filter+0x10/0x10 [ 13.287714] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.289828] ? __fget_light+0x57/0x420 [ 13.291870] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.293880] ? security_capable+0x74/0xb0 [ 13.295820] __x64_sys_finit_module+0xbe/0x130 [ 13.297874] do_syscall_64+0x82/0x190 [ 13.299898] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.301905] ? irqtime_account_irq+0x3d/0x1f0 [ 13.303877] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.305753] ? __irq_exit_rcu+0x4e/0x130 [ 13.307577] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.309489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.311371] RIP: 0033:0x7a21f96ade9d [ 13.313234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.317051] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.319024] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.321100] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.323314] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.325505] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.327637] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.329737] </TASK> [ 13.333945] Allocated by task 139: [ 13.336111] kasan_save_stack+0x30/0x50 [ 13.336121] kasan_save_track+0x14/0x30 [ 13.336125] __kasan_kmalloc+0xaa/0xb0 [ 13.336129] amdtp_hid_probe+0xb1/0x440 [amd_sfh] [ 13.336138] amd_sfh_hid_client_init+0xb8a/0x10f0 [amd_sfh] [ 13.336144] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.336150] process_one_work+0x673/0xeb0 [ 13.336155] worker_thread+0x795/0x1250 [ 13.336160] kthread+0x290/0x350 [ 13.336164] ret_from_fork+0x34/0x70 [ 13.336169] ret_from_fork_asm+0x1a/0x30 [ 13.338175] Freed by task 139: [ 13.340064] kasan_save_stack+0x30/0x50 [ 13.340072] kasan_save_track+0x14/0x30 [ 13.340076] kasan_save_free_info+0x3b/0x60 [ 13.340081] poison_slab_object+0x109/0x180 [ 13.340085] __kasan_slab_free+0x32/0x50 [ 13.340089] kfree+0xe5/0x310 [ 13.340094] amdtp_hid_remove+0xb2/0x160 [amd_sfh] [ 13.340102] amd_sfh_hid_client_deinit+0x324/0x640 [amd_sfh] [ 13.340107] amd_sfh_hid_client_init+0x94a/0x10f0 [amd_sfh] [ 13.340113] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.340118] process_one_work+0x673/0xeb0 [ 13.340123] worker_thread+0x795/0x1250 [ 13.340127] kthread+0x290/0x350 [ 13.340132] ret_from_fork+0x34/0x70 [ 13.340136] ret_from_fork_asm+0x1a/0x30 [ 13.342482] The buggy address belongs to the object at ffff88813152f400 which belongs to the cache kmalloc-64 of size 64 [ 13.347357] The buggy address is located 8 bytes inside of freed 64-byte region [ffff88813152f400, ffff88813152f440) [ 13.347367] The buggy address belongs to the physical page: [ 13.355409] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13152f [ 13.355416] anon flags: 0x2ffff8000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 13.355423] page_type: 0xffffefff(slab) [ 13.355429] raw: 02ffff8000000000 ffff8881000428c0 ffffea0004c43a00 0000000000000005 [ 13.355435] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 [ 13.355439] page dumped because: kasan: bad access detected [ 13.357295] Memory state around the buggy address: [ 13.357299] ffff88813152f300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357303] ffff88813152f380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357306] >ffff88813152f400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357309] ^ [ 13.357311] ffff88813152f480: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 13.357315] ffff88813152f500: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc [ 13.357318] ================================================================== [ 13.357405] Disabling lock debugging due to kernel taint [ 13.383534] Oops: general protection fault, probably for non-canonical address 0xe0a1bc4140000013: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 13.383544] KASAN: maybe wild-memory-access in range [0x050e020a00000098-0x050e020a0000009f] [ 13.383551] CPU: 3 PID: 479 Comm: (udev-worker) Tainted: G B 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.383561] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.383565] RIP: 0010:amd_sfh_get_report+0x81/0x530 [amd_sfh] [ 13.383580] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 78 03 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 08 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 45 8b 74 24 10 45 [ 13.383585] RSP: 0018:ffff8881261f7388 EFLAGS: 00010212 [ 13.383592] RAX: dffffc0000000000 RBX: ffff88813152f400 RCX: 0000000000000002 [ 13.383597] RDX: 00a1c04140000013 RSI: 0000000000000008 RDI: 050e020a0000009b [ 13.383600] RBP: ffff88814d010000 R08: 0000000000000002 R09: fffffbfff3ddb8c0 [ 13.383604] R10: ffffffff9eedc607 R11: ffff88810ce98000 R12: 050e020a0000008b [ 13.383607] R13: ffff88814d010000 R14: dffffc0000000000 R15: 0000000000000004 [ 13.383611] FS: 00007a21f94d0880(0000) GS:ffff8887e7d80000(0000) knlGS:0000000000000000 [ 13.383615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 13.383618] CR2: 00007e0014c438f0 CR3: 000000012614c000 CR4: 0000000000f50ef0 [ 13.383622] PKRU: 55555554 [ 13.383625] Call Trace: [ 13.383629] <TASK> [ 13.383632] ? __die_body.cold+0x19/0x27 [ 13.383644] ? die_addr+0x46/0x70 [ 13.383652] ? exc_general_protection+0x150/0x240 [ 13.383664] ? asm_exc_general_protection+0x26/0x30 [ 13.383674] ? amd_sfh_get_report+0x81/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383686] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383697] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383706] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383713] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.383727] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383739] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383745] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383753] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.383762] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.383768] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.383790] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383795] ? __devm_add_action+0x167/0x1d0 [ 13.383806] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383818] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383826] platform_probe+0xa2/0x150 [ 13.383832] really_probe+0x1e3/0x8a0 [ 13.383838] __driver_probe_device+0x18c/0x370 [ 13.383844] driver_probe_device+0x4a/0x120 [ 13.383851] __driver_attach+0x190/0x4a0 [ 13.383857] ? __pfx___driver_attach+0x10/0x10 [ 13.383863] bus_for_each_dev+0x106/0x180 [ 13.383868] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.383874] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.383880] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383887] bus_add_driver+0x29e/0x4d0 [ 13.383895] driver_register+0x1a5/0x360 [ 13.383902] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383910] do_one_initcall+0xa7/0x380 [ 13.383919] ? __pfx_do_one_initcall+0x10/0x10 [ 13.383927] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383933] ? kasan_unpoison+0x44/0x70 [ 13.383943] do_init_module+0x238/0x750 [ 13.383955] load_module+0x5011/0x6af0 [ 13.383962] ? kasan_save_stack+0x30/0x50 [ 13.383968] ? kasan_save_track+0x14/0x30 [ 13.383973] ? kasan_save_free_info+0x3b/0x60 [ 13.383980] ? poison_slab_object+0x109/0x180 [ 13.383993] ? __pfx_load_module+0x10/0x10 [ 13.384007] ? poison_slab_object+0x109/0x180 [ 13.384012] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384018] ? init_module_from_file+0x13d/0x150 [ 13.384025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384032] ? init_module_from_file+0xdf/0x150 [ 13.384037] init_module_from_file+0xdf/0x150 [ 13.384044] ? __pfx_init_module_from_file+0x10/0x10 [ 13.384050] ? kasan_save_track+0x14/0x30 [ 13.384055] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384060] ? kasan_save_free_info+0x3b/0x60 [ 13.384066] ? poison_slab_object+0x109/0x180 [ 13.384071] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384080] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384085] ? _raw_spin_lock+0x85/0xe0 [ 13.384091] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.384096] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.384106] idempotent_init_module+0x23b/0x650 [ 13.384114] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.384120] ? __pfx___seccomp_filter+0x10/0x10 [ 13.384129] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384135] ? __fget_light+0x57/0x420 [ 13.384142] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384147] ? security_capable+0x74/0xb0 [ 13.384157] __x64_sys_finit_module+0xbe/0x130 [ 13.384164] do_syscall_64+0x82/0x190 [ 13.384174] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384179] ? irqtime_account_irq+0x3d/0x1f0 [ 13.384188] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384193] ? __irq_exit_rcu+0x4e/0x130 [ 13.384201] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384206] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.384212] RIP: 0033:0x7a21f96ade9d [ 13.384263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.384267] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.384273] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.384277] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.384280] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.384284] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.384288] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.384297] </TASK> [ 13.384299] Modules linked in: soundwire_amd(+) hid_sensor_gyro_3d(+) hid_sensor_magn_3d hid_sensor_accel_3d soundwire_generic_allocation amdxcp hid_sensor_trigger drm_exec industrialio_triggered_buffer soundwire_bus gpu_sched kvm_amd kfifo_buf qmi_helpers joydev drm_buddy hid_sensor_iio_common mousedev snd_soc_core industrialio i2c_algo_bit mac80211 snd_compress drm_suballoc_helper kvm snd_hda_intel drm_ttm_helper ac97_bus snd_pcm_dmaengine snd_intel_dspcfg ttm thinkpad_acpi(+) snd_intel_sdw_acpi hid_sensor_hub snd_rpl_pci_acp6x drm_display_helper snd_hda_codec hid_multitouch libarc4 snd_acp_pci platform_profile think_lmi(+) hid_generic firmware_attributes_class wmi_bmof cec snd_acp_legacy_common sparse_keymap rapl snd_hda_core psmouse cfg80211 pcspkr snd_pci_acp6x snd_hwdep video snd_pcm snd_pci_acp5x snd_timer snd_rn_pci_acp3x ucsi_acpi snd_acp_config snd sp5100_tco rfkill snd_soc_acpi typec_ucsi thunderbolt amd_sfh k10temp mhi soundcore i2c_piix4 snd_pci_acp3x typec i2c_hid_acpi roles i2c_hid wmi acpi_tad amd_pmc [ 13.384454] mac_hid i2c_dev crypto_user loop nfnetlink zram ip_tables x_tables dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel serio_raw sha512_ssse3 atkbd sha256_ssse3 libps2 sha1_ssse3 vivaldi_fmap nvme aesni_intel crypto_simd nvme_core cryptd ccp xhci_pci i8042 nvme_auth xhci_pci_renesas serio vfat fat btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq [ 13.384552] ---[ end trace 0000000000000000 ]--- KASAN reports a use-after-free of hid->driver_data in function amd_sfh_get_report(). The backtrace indicates that the function is called by amdtp_hid_request() which is one of the callbacks of hid device. The current make sure that driver_data is freed only once hid_destroy_device() returned. Note that I observed the crash both on v6.9.9 and v6.10.0. The code seems to be as it was from the early days of the driver. Signed-off-by: Olivier Sobrie <olivier(a)sobrie.be> Acked-by: Basavaraj Natikar <Basavaraj.Natikar(a)amd.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c index 705b52337068..81f3024b7b1b 100644 --- a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c +++ b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c @@ -171,11 +171,13 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) void amdtp_hid_remove(struct amdtp_cl_data *cli_data) { int i; + struct amdtp_hid_data *hid_data; for (i = 0; i < cli_data->num_hid_devices; ++i) { if (cli_data->hid_sensor_hubs[i]) { - kfree(cli_data->hid_sensor_hubs[i]->driver_data); + hid_data = cli_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(cli_data->hid_sensor_hubs[i]); + kfree(hid_data); cli_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[openeuler:OLK-6.6 11427/14193] loongarch64-linux-ld: rpm-traces.c:undefined reference to `__trace_trigger_soft_disabled'
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 515984f18a6f359887b37e95ef5a785b04ae2da7 commit: d14435b8c5cdcdadede980b086f439a7d6747d0c [11427/14193] LoongArch: Fix callchain parse error with kernel tracepoint events again config: loongarch-randconfig-002-20240925 (https://download.01.org/0day-ci/archive/20240927/202409271347.SHAKNDVo-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271347.SHAKNDVo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271347.SHAKNDVo-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L572': power-traces.c:(.text+0x359c): undefined reference to `trace_event_printf' loongarch64-linux-ld: power-traces.c:(.text+0x35c0): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L580': power-traces.c:(.text+0x3678): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L581': power-traces.c:(.text+0x36ac): undefined reference to `trace_output_call' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L587': power-traces.c:(.text+0x3788): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_raw_output_pm_qos_update': power-traces.c:(.text+0x37dc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L100011': power-traces.c:(.text+0x39d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L606': power-traces.c:(.text+0x3a3c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_wakeup_source': power-traces.c:(.text+0x3ae8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L615': power-traces.c:(.text+0x3b84): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L613': power-traces.c:(.text+0x3c0c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L638': power-traces.c:(.text+0x3f10): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L654': power-traces.c:(.text+0x3fcc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L659': power-traces.c:(.text+0x40a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L667': power-traces.c:(.text+0x414c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L678': power-traces.c:(.text+0x4230): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L697': power-traces.c:(.text+0x43f4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L690': power-traces.c:(.text+0x4420): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: power-traces.c:(.text+0x4474): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L708': power-traces.c:(.text+0x44c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x138): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x160): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x180): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x1a8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x1c8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x1f0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x210): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x238): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x258): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x280): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x2a0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x2c8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x2e8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x310): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x330): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x358): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x378): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x3a0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x3c0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x3e8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x408): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x430): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_raw_output_rpm_internal': rpm-traces.c:(.text+0x2a4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L49': rpm-traces.c:(.text+0x338): undefined reference to `trace_event_printf' loongarch64-linux-ld: rpm-traces.c:(.text+0x358): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_raw_output_rpm_return_int': rpm-traces.c:(.text+0x384): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: rpm-traces.c:(.text+0x3dc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L55': rpm-traces.c:(.text+0x3fc): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L59': rpm-traces.c:(.text+0x4bc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L62': rpm-traces.c:(.text+0x514): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `perf_trace_rpm_internal': rpm-traces.c:(.text+0x694): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L83': rpm-traces.c:(.text+0x734): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L96': rpm-traces.c:(.text+0x8a4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_event_raw_event_rpm_return_int': rpm-traces.c:(.text+0x8d4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L118': rpm-traces.c:(.text+0x95c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L101': rpm-traces.c:(.text+0x9c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L117': rpm-traces.c:(.text+0xa5c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_event_raw_event_rpm_internal': rpm-traces.c:(.text+0xad4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L130': rpm-traces.c:(.text+0xb5c): undefined reference to `trace_event_buffer_reserve' >> loongarch64-linux-ld: rpm-traces.c:(.text+0xba8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/rseq.o: in function `perf_trace_rseq_update': rseq.c:(.text+0x3d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/rseq.o: in function `.L34': rseq.c:(.text+0x430): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/rseq.o: in function `perf_trace_rseq_ip_fixup': rseq.c:(.text+0x52c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/rseq.o: in function `.L46': rseq.c:(.text+0x568): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/rseq.o: in function `trace_event_raw_event_rseq_update': rseq.c:(.text+0x650): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/rseq.o: in function `.L61': rseq.c:(.text+0x690): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/rseq.o: in function `.L57': rseq.c:(.text+0x6e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/rseq.o: in function `trace_event_raw_event_rseq_ip_fixup': rseq.c:(.text+0x770): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: rseq.c:(.text+0x78c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/rseq.o: in function `.L68': rseq.c:(.text+0x7e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: rseq.c:(.text+0x81c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/rseq.o: in function `trace_raw_output_rseq_update': rseq.c:(.text+0x878): undefined reference to `trace_event_printf' loongarch64-linux-ld: rseq.c:(.text+0x898): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rseq.o: in function `.L84': rseq.c:(.text+0x8c4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/rseq.o: in function `trace_raw_output_rseq_ip_fixup': rseq.c:(.text+0x91c): undefined reference to `trace_event_printf' loongarch64-linux-ld: rseq.c:(.text+0x93c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/filemap.o: in function `perf_trace_mm_filemap_op_page_cache': filemap.c:(.text+0x2ac): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/filemap.o: in function `.L54': filemap.c:(.text+0x390): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/filemap.o: in function `perf_trace_filemap_set_wb_err': filemap.c:(.text+0x494): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/filemap.o: in function `.L68': filemap.c:(.text+0x4e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/filemap.o: in function `perf_trace_file_check_and_advance_wb_err': filemap.c:(.text+0x5d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/filemap.o: in function `.L82': filemap.c:(.text+0x638): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/filemap.o: in function `.L94': filemap.c:(.text+0x720): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/filemap.o: in function `.L99': filemap.c:(.text+0x7e4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/filemap.o: in function `.L95': filemap.c:(.text+0x86c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/filemap.o: in function `.L96': filemap.c:(.text+0x8e8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/filemap.o: in function `trace_event_raw_event_filemap_set_wb_err': filemap.c:(.text+0x918): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/filemap.o: in function `.L115': filemap.c:(.text+0x988): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/filemap.o: in function `.L116': filemap.c:(.text+0x9f8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/filemap.o: in function `trace_event_raw_event_file_check_and_advance_wb_err': filemap.c:(.text+0xa40): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/filemap.o: in function `.L128': filemap.c:(.text+0xaac): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/filemap.o: in function `.L124': filemap.c:(.text+0xae4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/filemap.o: in function `trace_raw_output_mm_filemap_op_page_cache': filemap.c:(.text+0xb6c): undefined reference to `trace_event_printf' loongarch64-linux-ld: filemap.c:(.text+0xb8c): undefined reference to `trace_handle_return' loongarch64-linux-ld: filemap.c:(.text+0xbb4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/filemap.o: in function `.L142': filemap.c:(.text+0xc20): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/filemap.o: in function `trace_raw_output_filemap_set_wb_err': filemap.c:(.text+0xc40): undefined reference to `trace_handle_return' loongarch64-linux-ld: filemap.c:(.text+0xc6c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/filemap.o: in function `.L148': filemap.c:(.text+0xce8): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/filemap.o: in function `trace_raw_output_file_check_and_advance_wb_err': filemap.c:(.text+0xd08): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_oom_score_adj_update': oom_kill.c:(.text+0x4a0): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L83': oom_kill.c:(.text+0x4fc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L82': oom_kill.c:(.text+0x578): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_reclaim_retry_zone': oom_kill.c:(.text+0x66c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L85': oom_kill.c:(.text+0x6c4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_mark_victim': oom_kill.c:(.text+0x7b4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L97': oom_kill.c:(.text+0x7e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_wake_reaper': oom_kill.c:(.text+0x8b4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L109': oom_kill.c:(.text+0x8e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_start_task_reaping': oom_kill.c:(.text+0x9b4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L121': oom_kill.c:(.text+0x9e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_finish_task_reaping': oom_kill.c:(.text+0xab4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: oom_kill.c:(.text+0xae4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_skip_task_reaping': oom_kill.c:(.text+0xbb4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: oom_kill.c:(.text+0xbe4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_compact_retry': oom_kill.c:(.text+0xcdc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: oom_kill.c:(.text+0xd38): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L156': oom_kill.c:(.text+0xe0c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_oom_score_adj_update': oom_kill.c:(.text+0xe40): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L175': oom_kill.c:(.text+0xe8c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_reclaim_retry_zone': oom_kill.c:(.text+0xf30): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0xf6c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L187': oom_kill.c:(.text+0xfe8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L183': oom_kill.c:(.text+0x1058): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0x1068): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_mark_victim': oom_kill.c:(.text+0x10a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L194': oom_kill.c:(.text+0x1118): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0x1128): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_wake_reaper': oom_kill.c:(.text+0x1168): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L205': oom_kill.c:(.text+0x11d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0x11e8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L206': oom_kill.c:(.text+0x1228): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L220': oom_kill.c:(.text+0x1298): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `.L216': oom_kill.c:(.text+0x12a8): undefined reference to `trace_event_buffer_commit' >> loongarch64-linux-ld: oom_kill.c:(.text+0x12e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_finish_task_reaping': oom_kill.c:(.text+0x1358): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `.L231': oom_kill.c:(.text+0x1368): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L227': oom_kill.c:(.text+0x13a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L242': oom_kill.c:(.text+0x1438): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `.L238': oom_kill.c:(.text+0x1474): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_compact_retry': oom_kill.c:(.text+0x14ec): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: oom_kill.c:(.text+0x1524): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L249': oom_kill.c:(.text+0x1578): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1598): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x15c4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_oom_score_adj_update': oom_kill.c:(.text+0x1610): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1630): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x165c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_mark_victim': oom_kill.c:(.text+0x16b0): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x16d0): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x16fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_wake_reaper': oom_kill.c:(.text+0x1750): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1770): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x179c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L280': oom_kill.c:(.text+0x17f0): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_start_task_reaping': oom_kill.c:(.text+0x1810): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x183c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L286': oom_kill.c:(.text+0x1890): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_finish_task_reaping': oom_kill.c:(.text+0x18b0): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x18dc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L292': oom_kill.c:(.text+0x1938): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_skip_task_reaping': oom_kill.c:(.text+0x1970): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1994): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/oom_kill.o: in function `.L298': oom_kill.c:(.text+0x19bc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_reclaim_retry_zone': oom_kill.c:(.text+0x1a28): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: oom_kill.c:(.text+0x1a40): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: mm/oom_kill.o: in function `.L304': oom_kill.c:(.text+0x1a68): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1a94): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x138): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x160): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x180): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x1a8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x1c8): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x1f0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x210): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x238): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/swap.o: in function `.L20': swap.c:(.text+0x13c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: swap.c:(.text+0x1dc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/swap.o: in function `.L32': swap.c:(.text+0x2d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/swap.o: in function `.L38': swap.c:(.text+0x42c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/swap.o: in function `trace_event_raw_event_mm_lru_insertion': swap.c:(.text+0x560): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/swap.o: in function `.L63': swap.c:(.text+0x69c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/swap.o: in function `.L75': swap.c:(.text+0x72c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/swap.o: in function `trace_event_raw_event_mm_lru_activate': swap.c:(.text+0x7c0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/swap.o: in function `.L80': swap.c:(.text+0x844): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/swap.o: in function `.L76': swap.c:(.text+0x8ac): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: swap.c:(.text+0x8e4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/swap.o: in function `.L105': swap.c:(.text+0x978): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/swap.o: in function `.L107': swap.c:(.text+0x998): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/swap.o: in function `.L102': swap.c:(.text+0xa64): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/swap.o: in function `.L100': swap.c:(.text+0xab4): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/swap.o: in function `trace_raw_output_mm_lru_activate': swap.c:(.text+0xad4): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/swap.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/swap.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17806/23779] drivers/powercap/intel_rapl_msr.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f9510969035e796a27375a80d9d6489440e17a1a commit: 0ea5d304521b68fb459c57e55f3f1bd853127bc7 [17806/23779] intel_rapl: abstract RAPL common code config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240927/202409271226.X7vYNpq3-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271226.X7vYNpq3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271226.X7vYNpq3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/powercap/intel_rapl_msr.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 11316/30000] arch/arm64/mm/init.c:730:6: sparse: sparse: symbol 'ascend_enable_all_features' was not declared. Should it be static?
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6be8d57e8dd89fb93f6a1801c246e70ae85fbfaf commit: 66ae8ddda388386daea0623a65ea2ac85c24ca00 [11316/30000] ascend/arm64: Add ascend_enable_all kernel parameter config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240927/202409271256.FaGlmrJY-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240927/202409271256.FaGlmrJY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271256.FaGlmrJY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/arm64/mm/init.c:746:9: sparse: sparse: mixing declarations and code >> arch/arm64/mm/init.c:730:6: sparse: sparse: symbol 'ascend_enable_all_features' was not declared. Should it be static? vim +/ascend_enable_all_features +730 arch/arm64/mm/init.c 729 > 730 void ascend_enable_all_features(void) 731 { 732 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) 733 enable_mmap_dvpp = 1; 734 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13350/23779] ld.lld: error: undefined symbol: kfree_skb
by kernel test robot 27 Sep '24

27 Sep '24

Hi Zhao, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f9510969035e796a27375a80d9d6489440e17a1a commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [13350/23779] ext4: report error to userspace by netlink config: x86_64-buildonly-randconfig-002-20240927 (https://download.01.org/0day-ci/archive/20240927/202409271130.zkdDo9UH-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271130.zkdDo9UH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271130.zkdDo9UH-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: __alloc_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: kfree_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: __nlmsg_put >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_broadcast >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: init_net >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: __netlink_kernel_create >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_kernel_release >>> referenced by super.c >>> fs/ext4/super.o:(ext4_exit_fs) in archive built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v4.19.321 commit d237c7d06ffddcdb5d36948c527dc01284388218 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index 0dc7b5a4fea2..0378fd3eb039 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -652,6 +652,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -659,6 +660,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v5.10.225 commit 9e96dea7eff6f2bbcd0b42a098012fc66af9eb69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index 355b16f0b145..34e45c87cae0 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH OLK-5.10] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v5.10.225 commit 9e96dea7eff6f2bbcd0b42a098012fc66af9eb69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index 355b16f0b145..34e45c87cae0 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2022-48878
by Yuan Can 27 Sep '24

27 Sep '24

Fix patch of CVE-2022-48878 and its pre requests. Krzysztof Kozlowski (1): Bluetooth: hci_qca: Fix driver shutdown on closed serdev Venkata Lakshmi Narayana Gubba (1): Bluetooth: hci_qca: Wait for timeout during suspend Yang Yingliang (1): Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() drivers/bluetooth/hci_qca.c | 57 ++++++++++++++++++++++++++++++------- 1 file changed, 47 insertions(+), 10 deletions(-) -- 2.17.1

2 4

[PATCH OLK-6.6] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v6.6.49 commit 8a3995a3ffeca280a961b59f5c99843d81b15929 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index bd99c5492b7d..0f64b0244303 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH OLK-6.6] tracing/osnoise: Use a cpumask to know what threads are kthreads
by Zheng Yejian 27 Sep '24

27 Sep '24

From: Steven Rostedt <rostedt(a)goodmis.org> stable inclusion from stable-v6.6.51 commit 7a5f01828edf152c144d27cf63de446fdf2dc222 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYEK CVE: CVE-2024-46788 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 177e1cc2f41235c145041eed03ef5bab18f32328 upstream. The start_kthread() and stop_thread() code was not always called with the interface_lock held. This means that the kthread variable could be unexpectedly changed causing the kthread_stop() to be called on it when it should not have been, leading to: while true; do rtla timerlat top -u -q & PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; done Causing the following OOPS: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:hrtimer_active+0x58/0x300 Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 <0f> b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? poison_slab_object+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 get_signal+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_exit_to_user_mode+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_exit_to_user_mode+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c Code: Unable to access opcode bytes at 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008 </TASK> Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ end trace 0000000000000000 ]--- This is because it would mistakenly call kthread_stop() on a user space thread making it "exit" before it actually exits. Since kthreads are created based on global behavior, use a cpumask to know when kthreads are running and that they need to be shutdown before proceeding to do new work. Link: https://lore.kernel.org/all/20240820130001.124768-1-tglozar@redhat.com/ This was debugged by using the persistent ring buffer: Link: https://lore.kernel.org/all/20240823013902.135036960@goodmis.org/ Note, locking was originally used to fix this, but that proved to cause too many deadlocks to work around: https://lore.kernel.org/linux-trace-kernel/20240823102816.5e55753b@gandalf.… Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: "Luis Claudio R. Goncalves" <lgoncalv(a)redhat.com> Link: https://lore.kernel.org/20240904103428.08efdf4c@gandalf.local.home Fixes: e88ed227f639e ("tracing/timerlat: Add user-space interface") Reported-by: Tomas Glozar <tglozar(a)redhat.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace_osnoise.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c index a8e28f9b9271..49f10c7f7fd0 100644 --- a/kernel/trace/trace_osnoise.c +++ b/kernel/trace/trace_osnoise.c @@ -1612,6 +1612,7 @@ static int run_osnoise(void) static struct cpumask osnoise_cpumask; static struct cpumask save_cpumask; +static struct cpumask kthread_cpumask; /* * osnoise_sleep - sleep until the next period @@ -1675,6 +1676,7 @@ static inline int osnoise_migration_pending(void) */ mutex_lock(&interface_lock); this_cpu_osn_var()->kthread = NULL; + cpumask_clear_cpu(smp_processor_id(), &kthread_cpumask); mutex_unlock(&interface_lock); return 1; @@ -1947,9 +1949,10 @@ static void stop_kthread(unsigned int cpu) kthread = per_cpu(per_cpu_osnoise_var, cpu).kthread; if (kthread) { - if (test_bit(OSN_WORKLOAD, &osnoise_options)) { + if (cpumask_test_and_clear_cpu(cpu, &kthread_cpumask) && + !WARN_ON(!test_bit(OSN_WORKLOAD, &osnoise_options))) { kthread_stop(kthread); - } else { + } else if (!WARN_ON(test_bit(OSN_WORKLOAD, &osnoise_options))) { /* * This is a user thread waiting on the timerlat_fd. We need * to close all users, and the best way to guarantee this is @@ -2021,6 +2024,7 @@ static int start_kthread(unsigned int cpu) } per_cpu(per_cpu_osnoise_var, cpu).kthread = kthread; + cpumask_set_cpu(cpu, &kthread_cpumask); return 0; } @@ -2048,8 +2052,16 @@ static int start_per_cpu_kthreads(void) */ cpumask_and(current_mask, cpu_online_mask, &osnoise_cpumask); - for_each_possible_cpu(cpu) + for_each_possible_cpu(cpu) { + if (cpumask_test_and_clear_cpu(cpu, &kthread_cpumask)) { + struct task_struct *kthread; + + kthread = per_cpu(per_cpu_osnoise_var, cpu).kthread; + if (!WARN_ON(!kthread)) + kthread_stop(kthread); + } per_cpu(per_cpu_osnoise_var, cpu).kthread = NULL; + } for_each_cpu(cpu, current_mask) { retval = start_kthread(cpu); -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: rtw88: usb: schedule rx work after everything is set up
by Chen Zhongjin 27 Sep '24

27 Sep '24

From: Marcin Ślusarz <mslusarz(a)renau.com> mainline inclusion from mainline-v6.11-rc1 commit adc539784c98a7cc602cbf557debfc2e7b9be8b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYFO CVE: CVE-2024-46760 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Right now it's possible to hit NULL pointer dereference in rtw_rx_fill_rx_status on hw object and/or its fields because initialization routine can start getting USB replies before rtw_dev is fully setup. The stack trace looks like this: rtw_rx_fill_rx_status rtw8821c_query_rx_desc rtw_usb_rx_handler ... queue_work rtw_usb_read_port_complete ... usb_submit_urb rtw_usb_rx_resubmit rtw_usb_init_rx rtw_usb_probe So while we do the async stuff rtw_usb_probe continues and calls rtw_register_hw, which does all kinds of initialization (e.g. via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on. Fix this by moving the first usb_submit_urb after everything is set up. For me, this bug manifested as: [ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped [ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status because I'm using Larry's backport of rtw88 driver with the NULL checks in rtw_rx_fill_rx_status. Link: https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa… Signed-off-by: Marcin Ślusarz <mslusarz(a)renau.com> Cc: Tim K <tpkuester(a)gmail.com> Cc: Ping-Ke Shih <pkshih(a)realtek.com> Cc: Larry Finger <Larry.Finger(a)lwfinger.net> Cc: Kalle Valo <kvalo(a)kernel.org> Cc: linux-wireless(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20240528110246.477321-1-marcin.slusarz@gmail.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/net/wireless/realtek/rtw88/usb.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c index efd0c2915a05..04a64afcbf8a 100644 --- a/drivers/net/wireless/realtek/rtw88/usb.c +++ b/drivers/net/wireless/realtek/rtw88/usb.c @@ -742,7 +742,6 @@ static struct rtw_hci_ops rtw_usb_ops = { static int rtw_usb_init_rx(struct rtw_dev *rtwdev) { struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev); - int i; rtwusb->rxwq = create_singlethread_workqueue("rtw88_usb: rx wq"); if (!rtwusb->rxwq) { @@ -754,13 +753,19 @@ static int rtw_usb_init_rx(struct rtw_dev *rtwdev) INIT_WORK(&rtwusb->rx_work, rtw_usb_rx_handler); + return 0; +} + +static void rtw_usb_setup_rx(struct rtw_dev *rtwdev) +{ + struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev); + int i; + for (i = 0; i < RTW_USB_RXCB_NUM; i++) { struct rx_usb_ctrl_block *rxcb = &rtwusb->rx_cb[i]; rtw_usb_rx_resubmit(rtwusb, rxcb); } - - return 0; } static void rtw_usb_deinit_rx(struct rtw_dev *rtwdev) @@ -897,6 +902,8 @@ int rtw_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) goto err_destroy_rxwq; } + rtw_usb_setup_rx(rtwdev); + return 0; err_destroy_rxwq: -- 2.25.1

2 1

[PATCH OLK-5.10] hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
by Tong Tiangen 27 Sep '24

27 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v5.10.226 commit 56cfdeb2c77291f0b5e4592731adfb6ca8fc7c24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX5F CVE: CVE-2024-46756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c1de37969b7bc0abcb20b86e91e70caebbd4f89 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/hwmon/w83627ehf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c index 3964ceab2817..acf36862851a 100644 --- a/drivers/hwmon/w83627ehf.c +++ b/drivers/hwmon/w83627ehf.c @@ -897,7 +897,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 127000), 1000); mutex_lock(&data->update_lock); data->target_temp[nr] = val; @@ -922,7 +922,7 @@ store_tolerance(struct device *dev, struct device_attribute *attr, return err; /* Limit the temp to 0C - 15C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 15); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 15000), 1000); mutex_lock(&data->update_lock); reg = w83627ehf_read_value(data, W83627EHF_REG_TOLERANCE[nr]); -- 2.25.1

2 1

[openeuler:OLK-5.10 5206/30000] drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6be8d57e8dd89fb93f6a1801c246e70ae85fbfaf commit: ec4ae62c07d56281aacec51770e0453414a76ded [5206/30000] sw64: gpu/drm: solve driver load cause kernel crash config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240927/202409270508.u8KdTEFv-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240927/202409270508.u8KdTEFv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270508.u8KdTEFv-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got void *[addressable] cpu_addr @@ drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: expected void volatile [noderef] __iomem * drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: got void *[addressable] cpu_addr drivers/gpu/drm/radeon/radeon_vce.c:368:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:368:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:368:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:369:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:369:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:369:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:370:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:370:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:370:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:372:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:372:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:372:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:373:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:373:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:373:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:374:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:374:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:374:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:375:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:375:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:375:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:376:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:376:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:376:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:377:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:377:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:377:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:378:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:378:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:378:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:379:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:379:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:379:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:380:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:380:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:380:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:381:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:381:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:381:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:382:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:382:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:382:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:383:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:383:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:383:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:385:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:385:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:385:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:386:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:386:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:386:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:387:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:387:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:387:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:388:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:388:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:388:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:389:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:389:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:389:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:392:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:392:27: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:392:27: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:435:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:435:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:435:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:436:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:436:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:436:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:437:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:437:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:437:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:439:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:439:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:439:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:440:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:440:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:440:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:441:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:441:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:441:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:442:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:442:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:442:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:443:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:443:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:443:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:445:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:445:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:445:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:446:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:446:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:446:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:449:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:449:27: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:449:27: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:706:33: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned int [usertype] v @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:706:33: sparse: expected unsigned int [usertype] v vim +247 drivers/gpu/drm/radeon/radeon_vce.c 214 215 /** 216 * radeon_vce_resume - pin VCE fw memory 217 * 218 * @rdev: radeon_device pointer 219 * 220 */ 221 int radeon_vce_resume(struct radeon_device *rdev) 222 { 223 void *cpu_addr; 224 int r; 225 226 if (rdev->vce.vcpu_bo == NULL) 227 return -EINVAL; 228 229 r = radeon_bo_reserve(rdev->vce.vcpu_bo, false); 230 if (r) { 231 dev_err(rdev->dev, "(%d) failed to reserve VCE bo\n", r); 232 return r; 233 } 234 235 r = radeon_bo_kmap(rdev->vce.vcpu_bo, &cpu_addr); 236 if (r) { 237 radeon_bo_unreserve(rdev->vce.vcpu_bo); 238 dev_err(rdev->dev, "(%d) VCE map failed\n", r); 239 return r; 240 } 241 242 memset(cpu_addr, 0, radeon_bo_size(rdev->vce.vcpu_bo)); 243 if (rdev->family < CHIP_BONAIRE) 244 r = vce_v1_0_load_fw(rdev, cpu_addr); 245 else { 246 if (IS_ENABLED(CONFIG_SW64)) > 247 memcpy_toio(cpu_addr, rdev->vce_fw->data, rdev->vce_fw->size); 248 else 249 memcpy(cpu_addr, rdev->vce_fw->data, rdev->vce_fw->size); 250 } 251 252 radeon_bo_kunmap(rdev->vce.vcpu_bo); 253 254 radeon_bo_unreserve(rdev->vce.vcpu_bo); 255 256 return r; 257 } 258 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9419/14172] main.c:undefined reference to `perf_trace_run_bpf_submit'
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e95e7bae9486cc775ed2aa319bf323f6ba2677b commit: c03a541494af4fb1504917412d762247b90380da [9419/14172] LoongArch: Fix callchain parse error with kernel tracepoint events config: loongarch-randconfig-002-20240925 (https://download.01.org/0day-ci/archive/20240927/202409270442.VcOKC2UZ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409270442.VcOKC2UZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270442.VcOKC2UZ-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/oom_kill.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/oom_kill.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/swap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/vmscan.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/vmscan.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/percpu.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/percpu.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/slab_common.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/slab_common.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/compaction.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/compaction.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/mmap_lock.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/mmap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/rmap.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/rmap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/vmalloc.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/huge_memory.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/khugepaged.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/khugepaged.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/page_isolation.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/cma.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/damon/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/fs-writeback.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/fs-writeback.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/locks.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/iomap/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/ext4/super.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/ext4/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/ext2/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/jbd2/journal.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/xfs/xfs_trace.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/xfs/xfs_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/xfs/scrub/trace.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/xfs/scrub/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/btrfs/super.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/btrfs/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/gfs2/glock.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/f2fs/super.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/f2fs/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/zonefs/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `block/blk-core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `block/blk-iocost.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `block/blk-wbt.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `io_uring/io_uring.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpio/gpiolib.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/clk/clk.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/dma/tegra20-apb-dma.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/soc/qcom/rpmh-rsc.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/regulator/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/iommu/iommu-traces.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/host1x/dev.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/drm_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/scheduler/sched_main.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/radeon/radeon_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/amd/amdgpu/amdgpu_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/v3d/v3d_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/msm/disp/dpu1/dpu_kms.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/msm/msm_atomic_tracepoints.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/msm/msm_gpu_tracepoints.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/tegra/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/lima/lima_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/base/regmap/regmap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/dma-buf/dma-fence.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/dma-buf/sw_sync.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/scsi/scsi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/scsi/sd_zbc.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/nvme/host/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/target/target_core_transport.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/spi/spi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/spmi/spmi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/usb/host/xhci-trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/usb/musb/musb_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/input/keyboard/applespi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/i2c/i2c-core-base.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/i2c/i2c-core-smbus.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `drivers/i2c/i2c-core-slave.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/i2c/i2c-core-slave.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/hwmon/hwmon.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `drivers/thermal/thermal_core.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/thermal/thermal_core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/mmc/core/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `drivers/ufs/core/ufshcd.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/ufs/core/ufshcd.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/platform/chrome/cros_ec_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/devfreq/devfreq.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/android/binder.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-master-aspeed.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-master-gpio.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-master-ast-cf.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/interconnect/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `sound/core/pcm_native.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `sound/core/pcm_lib.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `lib/maple_tree.o' being placed in section `_ftrace_events' loongarch64-linux-ld: init/main.o: in function `.L199': main.c:(.text+0x200): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: main.c:(.text+0x250): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_start': main.c:(.text+0x36c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: init/main.o: in function `.L213': >> main.c:(.text+0x3a0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_finish': main.c:(.text+0x47c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: init/main.o: in function `.L225': main.c:(.text+0x4b4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_start': main.c:(.text+0x590): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x5a0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L236': main.c:(.text+0x5e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_finish': main.c:(.text+0x660): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x674): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L247': main.c:(.text+0x6c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: main.c:(.text+0x6fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_level': main.c:(.text+0x754): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x774): undefined reference to `trace_handle_return' loongarch64-linux-ld: init/main.o: in function `.L263': main.c:(.text+0x79c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_start': main.c:(.text+0x7f0): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x810): undefined reference to `trace_handle_return' loongarch64-linux-ld: main.c:(.text+0x83c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_finish': main.c:(.text+0x894): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x8b4): undefined reference to `trace_handle_return' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_level': main.c:(.text+0x938): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x954): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L312': main.c:(.text+0x9bc): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: init/main.o: in function `.L299': main.c:(.text+0xa08): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_newtask': fork.c:(.text+0x178): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L34': fork.c:(.text+0x1dc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L21': fork.c:(.text+0x258): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_newtask': fork.c:(.text+0x2d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `.L39': fork.c:(.text+0x30c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L35': fork.c:(.text+0x34c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o: in function `.L36': fork.c:(.text+0x384): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_newtask': fork.c:(.text+0x3dc): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x3fc): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L52': fork.c:(.text+0x424): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_rename': fork.c:(.text+0x47c): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x49c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L58': fork.c:(.text+0x510): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_rename': fork.c:(.text+0x580): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L72': fork.c:(.text+0x5f8): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L71': fork.c:(.text+0x678): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_rename': fork.c:(.text+0x6bc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L77': fork.c:(.text+0x708): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_enter': cpu.c:(.text+0x2dc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L35': cpu.c:(.text+0x31c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_multi_enter': cpu.c:(.text+0x40c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L47': cpu.c:(.text+0x44c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_exit': cpu.c:(.text+0x54c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L59': cpu.c:(.text+0x58c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_enter': cpu.c:(.text+0x688): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x6a4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L70': cpu.c:(.text+0x708): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_multi_enter': cpu.c:(.text+0x790): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x7ac): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L81': cpu.c:(.text+0x808): undefined reference to `__trace_trigger_soft_disabled' -- loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_queue_cpu': smp.c:(.text+0x224): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L30': smp.c:(.text+0x264): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_function': smp.c:(.text+0x33c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L42': smp.c:(.text+0x374): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_queue_cpu': smp.c:(.text+0x468): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: smp.c:(.text+0x484): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L53': smp.c:(.text+0x4e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_function': smp.c:(.text+0x560): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: smp.c:(.text+0x574): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L64': smp.c:(.text+0x5c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `.L65': smp.c:(.text+0x5fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_queue_cpu': smp.c:(.text+0x65c): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x67c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o: in function `.L80': smp.c:(.text+0x6a4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_function': smp.c:(.text+0x6f4): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x714): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L255': kexec_core.c:(.text+0x1b10): undefined reference to `machine_kexec_cleanup' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L296': kexec_core.c:(.text+0x1d70): undefined reference to `machine_crash_shutdown' loongarch64-linux-ld: kexec_core.c:(.text+0x1d78): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L383': kexec_core.c:(.text+0x2350): undefined reference to `machine_shutdown' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L380': kexec_core.c:(.text+0x2360): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L128': cgroup.c:(.text+0x868): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L129': cgroup.c:(.text+0x8d4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_event': cgroup.c:(.text+0xa40): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L147': cgroup.c:(.text+0xab4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L169': cgroup.c:(.text+0xd70): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L21': cgroup.c:(.text+0xdb4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L193': cgroup.c:(.text+0xe68): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L192': cgroup.c:(.text+0xe9c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L189': cgroup.c:(.text+0xefc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L200': cgroup.c:(.text+0xf1c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xf44): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L201': cgroup.c:(.text+0xfa0): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_root': cgroup.c:(.text+0xfc0): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xfec): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L207': cgroup.c:(.text+0x106c): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup': cgroup.c:(.text+0x108c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0x10b4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L213': cgroup.c:(.text+0x1124): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_migrate': cgroup.c:(.text+0x1144): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L730': cgroup.c:(.text+0x3e5c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L15': cgroup.c:(.text+0x3ef4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L756': cgroup.c:(.text+0x4050): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `css_create': cgroup.c:(.text+0x40c0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L769': cgroup.c:(.text+0x4234): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cgroup.c:(.text+0x4278): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L772': cgroup.c:(.text+0x42d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L775': cgroup.c:(.text+0x4328): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_migrate': cgroup.c:(.text+0x43c4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L782': cgroup.c:(.text+0x43f4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L784': cgroup.c:(.text+0x444c): undefined reference to `trace_event_buffer_reserve' >> loongarch64-linux-ld: cgroup.c:(.text+0x44a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L788': cgroup.c:(.text+0x4580): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup': cgroup.c:(.text+0x45e8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L802': cgroup.c:(.text+0x46c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L12': error_report-traces.c:(.text+0xec): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: error_report-traces.c:(.text+0x124): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `trace_event_raw_event_error_report_template': error_report-traces.c:(.text+0x1f8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L27': error_report-traces.c:(.text+0x20c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L23': error_report-traces.c:(.text+0x248): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L24': error_report-traces.c:(.text+0x27c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `trace_raw_output_error_report_template': error_report-traces.c:(.text+0x2d0): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: error_report-traces.c:(.text+0x2e8): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L39': error_report-traces.c:(.text+0x308): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/error_report-traces.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/error_report-traces.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu': power-traces.c:(.text+0xdb4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L209': power-traces.c:(.text+0xdec): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu_idle_miss': power-traces.c:(.text+0xec4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L221': power-traces.c:(.text+0xf00): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_pstate_sample': power-traces.c:(.text+0x1010): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L233': power-traces.c:(.text+0x106c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu_frequency_limits': power-traces.c:(.text+0x1154): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: power-traces.c:(.text+0x119c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_suspend_resume': power-traces.c:(.text+0x1284): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: power-traces.c:(.text+0x12c0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L267': power-traces.c:(.text+0x1394): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu_latency_qos_request': power-traces.c:(.text+0x13c8): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L268': power-traces.c:(.text+0x14a4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_pm_qos_update': power-traces.c:(.text+0x14e0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L280': power-traces.c:(.text+0x15c4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_guest_halt_poll_ns': power-traces.c:(.text+0x1600): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L292': power-traces.c:(.text+0x16d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x16ec): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_cpu': power-traces.c:(.text+0x1728): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L304': power-traces.c:(.text+0x17a8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x17c0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_cpu_idle_miss': power-traces.c:(.text+0x1808): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L315': power-traces.c:(.text+0x18b0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x18e0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_pstate_sample': power-traces.c:(.text+0x194c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L330': power-traces.c:(.text+0x19b8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L326': power-traces.c:(.text+0x19e0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: power-traces.c:(.text+0x1a2c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L341': power-traces.c:(.text+0x1ab0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1ac8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L338': power-traces.c:(.text+0x1b28): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_suspend_resume': power-traces.c:(.text+0x1b98): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1ba8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L348': power-traces.c:(.text+0x1be8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_cpu_latency_qos_request': power-traces.c:(.text+0x1c68): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1c80): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L359': power-traces.c:(.text+0x1cc8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_pm_qos_update': power-traces.c:(.text+0x1d48): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1d60): undefined reference to `trace_event_buffer_commit' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20217/23779] mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static?
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b1d54e6f06c518a52f83edade0da2b959e1c9a4e commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [20217/23779] dhugetlb: backport dynamic hugetlb feature config: x86_64-randconfig-123-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270316.mecxJZQM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409270316.mecxJZQM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270316.mecxJZQM-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static? mm/hugetlb.c:4438:58: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void [noderef] <asn:1> * @@ got void *buffer @@ mm/hugetlb.c:4438:58: sparse: expected void [noderef] <asn:1> * mm/hugetlb.c:4438:58: sparse: got void *buffer mm/hugetlb.c:4452:60: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void *buffer @@ got void [noderef] <asn:1> *buffer @@ mm/hugetlb.c:4452:60: sparse: expected void *buffer mm/hugetlb.c:4452:60: sparse: got void [noderef] <asn:1> *buffer mm/hugetlb.c:4510:60: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void *buffer @@ got void [noderef] <asn:1> *buffer @@ mm/hugetlb.c:4510:60: sparse: expected void *buffer mm/hugetlb.c:4510:60: sparse: got void [noderef] <asn:1> *buffer mm/hugetlb.c:2018:20: sparse: sparse: context imbalance in 'gather_surplus_pages' - unexpected unlock mm/hugetlb.c:5168:17: sparse: sparse: context imbalance in 'hugetlb_cow' - unexpected unlock mm/hugetlb.c:5881:25: sparse: sparse: context imbalance in 'follow_hugetlb_page' - different lock contexts for basic block mm/hugetlb.c:1370:6: warning: no previous prototype for 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 5053/23779] drivers/platform/x86/intel_atomisp2_pm.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b1d54e6f06c518a52f83edade0da2b959e1c9a4e commit: 1073f9d006321689fb82bdac7b7af58e8617f128 [5053/23779] platform/x86: Add Intel AtomISP2 dummy / power-management driver config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270224.SJPfAkVu-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409270224.SJPfAkVu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270224.SJPfAkVu-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/platform/x86/intel_atomisp2_pm.c:15: include/linux/module.h:140:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'isp_pci_driver_exit': 'cold' [-Wmissing-attributes] 140 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1637:1: note: in expansion of macro 'module_exit' 1637 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/pci.h:1335:9: note: in expansion of macro 'module_driver' 1335 | module_driver(__pci_driver, pci_register_driver, pci_unregister_driver) | ^~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/pci.h:32, from drivers/platform/x86/intel_atomisp2_pm.c:17: drivers/platform/x86/intel_atomisp2_pm.c:115:19: note: 'cleanup_module' target declared here 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1633:20: note: in definition of macro 'module_driver' 1633 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ include/linux/module.h:134:13: warning: 'init_module' specifies less restrictive attribute than its target 'isp_pci_driver_init': 'cold' [-Wmissing-attributes] 134 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1632:1: note: in expansion of macro 'module_init' 1632 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/pci.h:1335:9: note: in expansion of macro 'module_driver' 1335 | module_driver(__pci_driver, pci_register_driver, pci_unregister_driver) | ^~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:19: note: 'init_module' target declared here 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1628:19: note: in definition of macro 'module_driver' 1628 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/platform/x86/intel_atomisp2_pm.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 14067/14172] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:403:15: error: no member named 'start' in 'struct iommu_iotlb_gather'
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e95e7bae9486cc775ed2aa319bf323f6ba2677b commit: e4a624e3e991f56f3783c5fafe8fd075a2be861b [14067/14172] net: hns3: add sync command to sync io-pgtable config: arm64-randconfig-r123-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270232.uDTz2n2f-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce: (https://download.01.org/0day-ci/archive/20240927/202409270232.uDTz2n2f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270232.uDTz2n2f-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:403:15: error: no member named 'start' in 'struct iommu_iotlb_gather' iotlb_gather.start = iova; ~~~~~~~~~~~~ ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:404:15: error: no member named 'end' in 'struct iommu_iotlb_gather' iotlb_gather.end = iova + granule - 1; ~~~~~~~~~~~~ ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:405:15: error: no member named 'pgsize' in 'struct iommu_iotlb_gather' iotlb_gather.pgsize = granule; ~~~~~~~~~~~~ ^ 3 errors generated. vim +403 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 388 389 #define HNS3_INVALID_PTYPE \ 390 ARRAY_SIZE(hns3_rx_ptype_tbl) 391 392 static void hns3_dma_map_sync(struct device *dev, unsigned long iova) 393 { 394 struct iommu_domain *domain = iommu_get_domain_for_dev(dev); 395 struct iommu_iotlb_gather iotlb_gather; 396 size_t granule; 397 398 if (!domain || domain->type != IOMMU_DOMAIN_DMA) 399 return; 400 401 granule = 1 << __ffs(domain->pgsize_bitmap); 402 iova = ALIGN_DOWN(iova, granule); > 403 iotlb_gather.start = iova; > 404 iotlb_gather.end = iova + granule - 1; > 405 iotlb_gather.pgsize = granule; 406 407 iommu_iotlb_sync(domain, &iotlb_gather); 408 } 409 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1336/14122] include/linux/uaccess.h:213:16: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 81a41d2ac1de43215c014bc71d907a026042e55b commit: 975e216e36aa3f7aba9d8e1e1d6cbba7cf692ad7 [1336/14122] arm64: add support for machine check error safe config: arm64-randconfig-r123-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270023.ToC1weNo-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce: (https://download.01.org/0day-ci/archive/20240927/202409270023.ToC1weNo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270023.ToC1weNo-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) lib/iov_iter.c: note: in included file (through include/linux/sched/task.h, include/linux/sched/signal.h, include/linux/rcuwait.h, ...): >> include/linux/uaccess.h:213:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __user *ptr @@ got void *dst @@ include/linux/uaccess.h:213:16: sparse: expected void const [noderef] __user *ptr include/linux/uaccess.h:213:16: sparse: got void *dst lib/iov_iter.c: note: in included file: include/net/checksum.h:33:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:33:39: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:33:39: sparse: got unsigned int include/net/checksum.h:33:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:33:39: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:33:39: sparse: got unsigned int include/net/checksum.h:41:45: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:41:45: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:41:45: sparse: got unsigned int include/net/checksum.h:41:45: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:41:45: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:41:45: sparse: got unsigned int vim +213 include/linux/uaccess.h ec6347bb43395c Dan Williams 2020-10-05 207 59feaaa04e929c Tong Tiangen 2023-12-07 208 #ifndef copy_mc_to_user 59feaaa04e929c Tong Tiangen 2023-12-07 209 static inline unsigned long __must_check 59feaaa04e929c Tong Tiangen 2023-12-07 210 copy_mc_to_user(void *dst, const void *src, size_t cnt) 59feaaa04e929c Tong Tiangen 2023-12-07 211 { 59feaaa04e929c Tong Tiangen 2023-12-07 212 check_object_size(src, cnt, true); 59feaaa04e929c Tong Tiangen 2023-12-07 @213 return raw_copy_to_user(dst, src, cnt); 59feaaa04e929c Tong Tiangen 2023-12-07 214 } 59feaaa04e929c Tong Tiangen 2023-12-07 215 #endif 59feaaa04e929c Tong Tiangen 2023-12-07 216 :::::: The code at line 213 was first introduced by commit :::::: 59feaaa04e929cf051c9b29e28fb9e1299785280 uaccess: add generic fallback version of copy_mc_to_user() :::::: TO: Tong Tiangen <tongtiangen(a)huawei.com> :::::: CC: Tong Tiangen <tongtiangen(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v4.19.322 commit 4eb4085c1346d19d4a05c55246eb93e74e671048 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 3276a5e4c430..486fad430958 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -35,7 +35,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -54,7 +53,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH OLK-5.10] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v5.10.226 commit bc1faed19db95abf0933b104910a3fb01b138f59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 04565162a449..cf9c0e75f0be 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -38,7 +38,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -57,7 +56,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v5.10.226 commit bc1faed19db95abf0933b104910a3fb01b138f59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 04565162a449..cf9c0e75f0be 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -38,7 +38,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -57,7 +56,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH OLK-6.6] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v6.6.51 commit b82d4d5c736f4fd2ed224c35f554f50d1953d21e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 881d420637bf..092c9ac0d26d 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -39,7 +39,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -58,7 +57,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH OLK-6.6] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 21ae34013c35..1e60458e72ff 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5737,10 +5737,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5752,8 +5754,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5761,15 +5765,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5777,8 +5781,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5810,9 +5816,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5838,14 +5845,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5856,7 +5862,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH OLK-6.6] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index 211360eee95a..a9cb04043f08 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index e733be840545..a150855b4b05 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 336daa667fb1..269fb2419325 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5268,10 +5268,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5283,8 +5285,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5292,15 +5296,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5308,8 +5312,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5341,9 +5347,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5369,14 +5376,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5387,7 +5393,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 8ace56c8141b..5ca3201d4f3e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5265,10 +5265,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5280,8 +5282,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5289,15 +5293,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5305,8 +5309,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5338,9 +5344,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5366,14 +5373,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5384,7 +5390,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index e733be840545..a150855b4b05 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index e58fe13c99e1..b93605616d4e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5035,10 +5035,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5050,8 +5052,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5059,15 +5063,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5075,8 +5079,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5108,9 +5114,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5136,14 +5143,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5154,7 +5160,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index 16081383c401..6127505770ce 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -296,8 +293,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH OLK-6.6] btrfs: handle errors from btrfs_dec_ref() properly
by Long Li 26 Sep '24

26 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.10-rc2 commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYDJ CVE: CVE-2024-46753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Conflict due to not merge mainline commit e094f48040cd] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/extent-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index c6ecfd05e1db..b6be2e2f1994 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5505,7 +5505,10 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, ret = btrfs_dec_ref(trans, root, eb, 1); else ret = btrfs_dec_ref(trans, root, eb, 0); - BUG_ON(ret); /* -ENOMEM */ + if (ret) { + btrfs_abort_transaction(trans, ret); + return ret; + } if (is_fstree(root->root_key.objectid)) { ret = btrfs_qgroup_trace_leaf_items(trans, eb); if (ret) { -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: handle errors from btrfs_dec_ref() properly
by Long Li 26 Sep '24

26 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.10-rc2 commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYDJ CVE: CVE-2024-46753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Conflict due to not merge mainline commit e094f48040cd] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/extent-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 1cf787209798..42617407feb1 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5227,7 +5227,10 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, ret = btrfs_dec_ref(trans, root, eb, 1); else ret = btrfs_dec_ref(trans, root, eb, 0); - BUG_ON(ret); /* -ENOMEM */ + if (ret) { + btrfs_abort_transaction(trans, ret); + return ret; + } if (is_fstree(root->root_key.objectid)) { ret = btrfs_qgroup_trace_leaf_items(trans, eb); if (ret) { -- 2.39.2

2 1

[PATCH OLK-6.6 0/8] fix CVE-2024-46701
by Yu Kuai 26 Sep '24

26 Sep '24

Chuck Lever (5): libfs: Re-arrange locking in offset_iterate_dir() libfs: Define a minimum directory offset libfs: Add simple_offset_empty() maple_tree: Add mtree_alloc_cyclic() libfs: Convert simple directory offsets to use a Maple Tree Liam R. Howlett (1): test_maple_tree: testing the cyclic allocation Yu Kuai (1): fs: fix kabi kroken in struct offset_ctx yangerkun (1): libfs: fix infinite directory reads for offset dir fs/libfs.c | 129 +++++++++++++++++++++++++------------ include/linux/fs.h | 15 ++++- include/linux/maple_tree.h | 7 ++ lib/maple_tree.c | 93 ++++++++++++++++++++++++++ lib/test_maple_tree.c | 44 +++++++++++++ mm/shmem.c | 4 +- 6 files changed, 247 insertions(+), 45 deletions(-) -- 2.39.2

2 9

[PATCH OLK-5.10] NFSD: Reset cb_seq_status after NFS4ERR_DELAY
by Li Lingfeng 26 Sep '24

26 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.9-rc1 commit 961b4b5e86bf56a2e4b567f81682defa5cba957e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATOAX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- I noticed that once an NFSv4.1 callback operation gets a NFS4ERR_DELAY status on CB_SEQUENCE and then the connection is lost, the callback client loops, resending it indefinitely. The switch arm in nfsd4_cb_sequence_done() that handles NFS4ERR_DELAY uses rpc_restart_call() to rearm the RPC state machine for the retransmit, but that path does not call the rpc_prepare_call callback again. Thus cb_seq_status is set to -10008 by the first NFS4ERR_DELAY result, but is never set back to 1 for the retransmits. nfsd4_cb_sequence_done() thinks it's getting nothing but a long series of CB_SEQUENCE NFS4ERR_DELAY replies. Fixes: 7ba6cad6c88f ("nfsd: New helper nfsd4_cb_sequence_done() for processing more cb errors") Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4callback.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index f5b7ad0847f2..bd79fc4934f0 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -1126,6 +1126,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback ret = false; break; case -NFS4ERR_DELAY: + cb->cb_seq_status = 1; if (!rpc_restart_call(task)) goto out; -- 2.31.1

2 1

[PATCH OLK-6.6] NFSD: Reset cb_seq_status after NFS4ERR_DELAY
by Li Lingfeng 26 Sep '24

26 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.9-rc1 commit 961b4b5e86bf56a2e4b567f81682defa5cba957e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATOAX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- I noticed that once an NFSv4.1 callback operation gets a NFS4ERR_DELAY status on CB_SEQUENCE and then the connection is lost, the callback client loops, resending it indefinitely. The switch arm in nfsd4_cb_sequence_done() that handles NFS4ERR_DELAY uses rpc_restart_call() to rearm the RPC state machine for the retransmit, but that path does not call the rpc_prepare_call callback again. Thus cb_seq_status is set to -10008 by the first NFS4ERR_DELAY result, but is never set back to 1 for the retransmits. nfsd4_cb_sequence_done() thinks it's getting nothing but a long series of CB_SEQUENCE NFS4ERR_DELAY replies. Fixes: 7ba6cad6c88f ("nfsd: New helper nfsd4_cb_sequence_done() for processing more cb errors") Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4callback.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index 4039ffcf90ba..49a88dde9631 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -1202,6 +1202,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback ret = false; break; case -NFS4ERR_DELAY: + cb->cb_seq_status = 1; if (!rpc_restart_call(task)) goto out; -- 2.31.1

2 1