- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] LoongArch: fix AVEC related issue
by Hongchen Zhang 30 Nov '24

30 Nov '24

Juxin Gao (1): drivers/irqchip: Disable pci_irq_limit when using AVEC interrupt controller Tianyang Zhang (1): irqchip/avec: Support AVEC for 3C6000 multi-node machine arch/loongarch/include/asm/setup.h | 1 + drivers/irqchip/irq-loongarch-avec.c | 11 +++++++++-- drivers/pci/msi/msi.c | 18 ++++++++++++------ 3 files changed, 22 insertions(+), 8 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6] libbpf: Fix output .symtab byte-order during linking
by Tengda Wu 30 Nov '24

30 Nov '24

From: Tony Ambardar <tony.ambardar(a)gmail.com> mainline inclusion from mainline-v6.12-rc7 commit f896b4a5399e97af0b451fcf04754ed316935674 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB80HC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Object linking output data uses the default ELF_T_BYTE type for '.symtab' section data, which disables any libelf-based translation. Explicitly set the ELF_T_SYM type for output to restore libelf's byte-order conversion, noting that input '.symtab' data is already correctly translated. Fixes: faf6ed321cf6 ("libbpf: Add BPF static linker APIs") Signed-off-by: Tony Ambardar <tony.ambardar(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/87868bfeccf3f51aec61260073f8778e9077050a.172647… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- tools/lib/bpf/linker.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c index b311bb91f672..88cc7236f122 100644 --- a/tools/lib/bpf/linker.c +++ b/tools/lib/bpf/linker.c @@ -396,6 +396,8 @@ static int init_output_elf(struct bpf_linker *linker, const char *file) pr_warn_elf("failed to create SYMTAB data"); return -EINVAL; } + /* Ensure libelf translates byte-order of symbol records */ + sec->data->d_type = ELF_T_SYM; str_off = strset__add_str(linker->strtab_strs, sec->sec_name); if (str_off < 0) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Check validity of link->type in bpf_link_show_fdinfo()
by Pu Lehui 30 Nov '24

30 Nov '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.12-rc5 commit 8421d4c8762bd022cb491f2f0f7019ef51b4f0a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705A CVE: CVE-2024-53099 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing bpf_link_type_strs[link->type] may result in an out-of-bounds access. To spot such missed invocations early in the future, checking the validity of link->type in bpf_link_show_fdinfo() and emitting a warning when such invocations are missed. Signed-off-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20241024013558.1135167-3-houtao@huaweicloud.com Conflicts: kernel/bpf/syscall.c [The conflicts were due to some minor issue.] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/syscall.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index ad6d3306aec0..b9846d8a8bde 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2430,15 +2430,20 @@ static void bpf_link_show_fdinfo(struct seq_file *m, struct file *filp) { const struct bpf_link *link = filp->private_data; const struct bpf_prog *prog = link->prog; + enum bpf_link_type type = link->type; char prog_tag[sizeof(prog->tag) * 2 + 1] = { }; bin2hex(prog_tag, prog->tag, sizeof(prog->tag)); + if (type < ARRAY_SIZE(bpf_link_type_strs) && bpf_link_type_strs[type]) { + seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]); + } else { + WARN_ONCE(1, "missing BPF_LINK_TYPE(...) for link type %u\n", type); + seq_printf(m, "link_type:\t<%u>\n", type); + } seq_printf(m, - "link_type:\t%s\n" "link_id:\t%u\n" "prog_tag:\t%s\n" "prog_id:\t%u\n", - bpf_link_type_strs[link->type], link->id, prog_tag, prog->aux->id); -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Check validity of link->type in bpf_link_show_fdinfo()
by Pu Lehui 30 Nov '24

30 Nov '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.12-rc5 commit 8421d4c8762bd022cb491f2f0f7019ef51b4f0a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705A CVE: CVE-2024-53099 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing bpf_link_type_strs[link->type] may result in an out-of-bounds access. To spot such missed invocations early in the future, checking the validity of link->type in bpf_link_show_fdinfo() and emitting a warning when such invocations are missed. Signed-off-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20241024013558.1135167-3-houtao@huaweicloud.com Conflicts: kernel/bpf/syscall.c [The conflicts were due to some minor issue.] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/syscall.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index ad6d3306aec0..b9846d8a8bde 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2430,15 +2430,20 @@ static void bpf_link_show_fdinfo(struct seq_file *m, struct file *filp) { const struct bpf_link *link = filp->private_data; const struct bpf_prog *prog = link->prog; + enum bpf_link_type type = link->type; char prog_tag[sizeof(prog->tag) * 2 + 1] = { }; bin2hex(prog_tag, prog->tag, sizeof(prog->tag)); + if (type < ARRAY_SIZE(bpf_link_type_strs) && bpf_link_type_strs[type]) { + seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]); + } else { + WARN_ONCE(1, "missing BPF_LINK_TYPE(...) for link type %u\n", type); + seq_printf(m, "link_type:\t<%u>\n", type); + } seq_printf(m, - "link_type:\t%s\n" "link_id:\t%u\n" "prog_tag:\t%s\n" "prog_id:\t%u\n", - bpf_link_type_strs[link->type], link->id, prog_tag, prog->aux->id); -- 2.34.1

2 1

[openeuler:OLK-6.6 1562/1562] arch/loongarch/kernel/legacy_boot.c:106:48: error: implicit declaration of function 'nid_to_addrbase'
by kernel test robot 30 Nov '24

30 Nov '24

Hi liuyun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 429a19874eb589d27346ba7363fa091d7e4ff99a commit: db5bb24abc8dd120fd81b7ce21819e96578d011e [1562/1562] LoongArch: Old BPI compatibility config: loongarch-randconfig-r064-20241129 (https://download.01.org/0day-ci/archive/20241130/202411300409.9tXI7K0F-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241130/202411300409.9tXI7K0F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411300409.9tXI7K0F-lkp@intel.com/ All errors (new ones prefixed by >>): arch/loongarch/kernel/legacy_boot.c:94:6: warning: no previous prototype for 'register_default_pic' [-Wmissing-prototypes] 94 | void register_default_pic(int id, u32 address, u32 irq_base) | ^~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/legacy_boot.c: In function 'register_default_pic': >> arch/loongarch/kernel/legacy_boot.c:106:48: error: implicit declaration of function 'nid_to_addrbase' [-Wimplicit-function-declaration] 106 | pchpic_default[idx].address |= nid_to_addrbase(id) | HT1LO_OFFSET; | ^~~~~~~~~~~~~~~ arch/loongarch/kernel/legacy_boot.c: At top level: arch/loongarch/kernel/legacy_boot.c:242:13: warning: no previous prototype for 'fw_init_cmdline' [-Wmissing-prototypes] 242 | __init void fw_init_cmdline(unsigned long argc, unsigned long cmdp) | ^~~~~~~~~~~~~~~ arch/loongarch/kernel/legacy_boot.c:341:14: warning: no previous prototype for 'bpi_init' [-Wmissing-prototypes] 341 | unsigned int bpi_init(void) | ^~~~~~~~ vim +/nid_to_addrbase +106 arch/loongarch/kernel/legacy_boot.c 93 94 void register_default_pic(int id, u32 address, u32 irq_base) 95 { 96 int idx, entries; 97 unsigned long addr; 98 99 if (bad_pch_pic(address)) 100 return; 101 102 idx = nr_io_pics; 103 104 pchpic_default[idx].address = address; 105 if (idx) > 106 pchpic_default[idx].address |= nid_to_addrbase(id) | HT1LO_OFFSET; 107 pchpic_default[idx].id = id; 108 pchpic_default[idx].version = 0; 109 pchpic_default[idx].size = 0x1000; 110 pchpic_default[idx].gsi_base = irq_base; 111 112 msi_group[nr_io_pics].pci_segment = nr_io_pics; 113 pch_group[nr_io_pics].node = msi_group[nr_io_pics].node = id; 114 115 addr = pchpic_default[idx].address; 116 /* Read INT_ID.int_num */ 117 entries = (((unsigned long)ls7a_readq(addr) >> 48) & 0xff) + 1; 118 pchmsi_default[idx].msg_address = MSI_MSG_ADDRESS; 119 pchmsi_default[idx].start = entries; 120 pchmsi_default[idx].count = MSI_MSG_DEFAULT_COUNT; 121 122 eiointc_default[idx].cascade = 3; 123 eiointc_default[idx].node = id; 124 eiointc_default[idx].node_map = 1; 125 126 if (idx) { 127 eiointc_default[idx].cascade = 0x4; 128 eiointc_default[0].node_map = 0x1DF; 129 eiointc_default[idx].node_map = 0xFE20; 130 } 131 132 acpi_pchpic[idx] = &pchpic_default[idx]; 133 acpi_pchmsi[idx] = &pchmsi_default[idx]; 134 acpi_eiointc[idx] = &eiointc_default[idx]; 135 136 nr_io_pics++; 137 } 138 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1562/1562] arch/loongarch/kvm/exit.c:764:63: error: 'struct sched_info' has no member named 'run_delay'
by kernel test robot 30 Nov '24

30 Nov '24

Hi Bibo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 429a19874eb589d27346ba7363fa091d7e4ff99a commit: faa35b0fcdefb1e5f2d05b0eeac12be32e69e566 [1562/1562] LoongArch: KVM: Add steal time support in kvm side config: loongarch-randconfig-r061-20241129 (https://download.01.org/0day-ci/archive/20241130/202411300227.cX0BjKzQ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241130/202411300227.cX0BjKzQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411300227.cX0BjKzQ-lkp@intel.com/ All errors (new ones prefixed by >>): arch/loongarch/kvm/exit.c: In function 'kvm_save_notify': >> arch/loongarch/kvm/exit.c:764:63: error: 'struct sched_info' has no member named 'run_delay' 764 | vcpu->arch.st.last_steal = current->sched_info.run_delay; | ^ -- arch/loongarch/kvm/vcpu.c: In function 'kvm_update_stolen_time': >> arch/loongarch/kvm/vcpu.c:68:37: error: 'struct sched_info' has no member named 'run_delay' 68 | steal += current->sched_info.run_delay - | ^ arch/loongarch/kvm/vcpu.c:70:55: error: 'struct sched_info' has no member named 'run_delay' 70 | vcpu->arch.st.last_steal = current->sched_info.run_delay; | ^ vim +764 arch/loongarch/kvm/exit.c 754 755 static int kvm_save_notify(struct kvm_vcpu *vcpu) 756 { 757 unsigned long id, data; 758 759 id = vcpu->arch.gprs[LOONGARCH_GPR_A1]; 760 data = vcpu->arch.gprs[LOONGARCH_GPR_A2]; 761 switch (id) { 762 case KVM_FEATURE_STEAL_TIME: 763 vcpu->arch.st.guest_addr = data; > 764 vcpu->arch.st.last_steal = current->sched_info.run_delay; 765 kvm_make_request(KVM_REQ_RECORD_STEAL, vcpu); 766 break; 767 default: 768 break; 769 }; 770 771 return 0; 772 }; 773 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 00/20] blk-mq/scsi: tracking device queue depth via sbitmap
by Zheng Qixing 29 Nov '24

29 Nov '24

Linux mainline-5.13 uses sbitmap to track the queue depth of SCSI devices. This patch set backports the mainline patches to OLK-5.10 and fixes some KABI issues. Tests on scsi_debug show that this method can improve IO performance by more than 30%. Bart Van Assche (2): scsi: sbitmap: Silence a debug kernel warning triggered by sbitmap_put() scsi: core: Fix scsi_device_max_queue_depth() Kashyap Desai (1): scsi: megaraid_sas: Replace sdev_busy with local counter Ming Lei (12): scsi: sbitmap: Remove sbitmap_clear_bit_unlock scsi: sbitmap: Maintain allocation round_robin in sbitmap scsi: sbitmap: Add helpers for updating allocation hint scsi: sbitmap: Move allocation hint into sbitmap scsi: sbitmap: Export sbitmap_weight scsi: sbitmap: Add sbitmap_calculate_shift() helper scsi: blk-mq: Add callbacks for storing & retrieving budget token scsi: blk-mq: Return budget token from .get_budget callback scsi: core: Add scsi_device_busy() wrapper scsi: core: Make sure sdev->queue_depth is <= max(shost->can_queue, 1024) scsi: core: Replace sdev->device_busy with sbitmap scsi: blk-mq: Fix build warning when making htmldocs Pavel Begunkov (1): sbitmap: optimise sbitmap_deferred_clear() Sumit Saxena (1): scsi: core: Increase max device queue_depth to 4096 Zheng Qixing (3): sbitmap: fix kabi broken by adding struct sbitmap_extend sbitmap: fix kabi broken in struct blk_mq_ops and struct scsi_cmnd sbitmap: fix kabi broken in struct scsi_device block/blk-mq-sched.c | 17 +- block/blk-mq.c | 38 ++- block/blk-mq.h | 25 +- block/kyber-iosched.c | 3 +- drivers/message/fusion/mptsas.c | 2 +- drivers/scsi/megaraid/megaraid_sas.h | 2 + drivers/scsi/megaraid/megaraid_sas_fusion.c | 47 +++- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/scsi.c | 13 ++ drivers/scsi/scsi_lib.c | 71 ++++-- drivers/scsi/scsi_priv.h | 3 + drivers/scsi/scsi_scan.c | 45 +++- drivers/scsi/scsi_sysfs.c | 4 +- drivers/scsi/sg.c | 2 +- drivers/vhost/scsi.c | 4 +- include/linux/blk-mq.h | 17 +- include/linux/sbitmap.h | 91 ++++++-- include/scsi/scsi_cmnd.h | 2 +- include/scsi/scsi_device.h | 13 +- lib/sbitmap.c | 243 +++++++++++--------- 20 files changed, 448 insertions(+), 196 deletions(-) -- 2.39.2

2 21

[PATCH OLK-6.6] arm64: entry: Fix some warnings when enable nohz full CPU
by Jinjie Ruan 29 Nov '24

29 Nov '24

From: Yipeng Zou <zouyipeng(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/IB6JLE -------------------------------- Fix following warnings when enable nohz full CPU, by not skipping context tracking and irq tick idle inform. Also remove el1 xint, as less savings for both assembly and C. ct_state() == CONTEXT_USER WARNING: CPU: 66 PID: 10214 at kernel/sched/core.c:6012 __schedule+0x738/0xcf8 CPU: 66 PID: 10214 Comm: sh Kdump: loaded Not tainted 6.6.0xcall_xint_lcxint6.6_test+ #26 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 04/29/2022 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __schedule+0x738/0xcf8 lr : __schedule+0x738/0xcf8 sp : ffff8000d193bd90 pmr_save: 00000060 x29: ffff8000d193bd90 x28: ffff20203e95d100 x27: ffff20203e95d100 x26: 0000000000000000 x25: ffff800080e3fbb8 x24: ffff800081a2a008 x23: ffff800081e15370 x22: 0000000000000000 x21: ffff800081a40d80 x20: ffff20203e95d100 x19: ffff2027dfa1ad80 x18: 0000000000000000 x17: ffffa0275dfda000 x16: ffff800083008000 x15: 0000000000000000 x14: 0000000000000000 x13: 524553555f545845 x12: 544e4f43203d3d20 x11: 00000000ffff7fff x10: ffff80008210b368 x9 : ffff800080157fa8 x8 : 00000000000bffe8 x7 : c0000000ffff7fff x6 : 00000000002bffa8 x5 : ffff2027dfa07ac8 x4 : ffff8000d193bbf0 x3 : ffffa0275dfda000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff20203e95d100 Call trace: __schedule+0x738/0xcf8 schedule+0x58/0xf0 do_notify_resume+0x50/0x350 el0_xint.constprop.0+0xa0/0xe0 el0t_64_xint_handler+0x18/0x28 el0t_64_irq+0x170/0x3a0 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 66 PID: 0 at kernel/context_tracking.c:128 ct_kernel_exit.constprop.0+0xa0/0xa8 CPU: 66 PID: 0 Comm: swapper/66 Kdump: loaded Tainted: G W 6.6.0xcall_xint_lcxint6.6_test+ #26 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 04/29/2022 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ct_kernel_exit.constprop.0+0xa0/0xa8 lr : ct_idle_enter+0x14/0x20 sp : ffff8000839abdb0 pmr_save: 00000060 x29: ffff8000839abdb0 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000000 x22: ffff2020001f6540 x21: ffff2020001f6540 x20: 0000000000000005 x19: ffff2027dfa16760 x18: 0000000000000000 x17: ffffa0275dfda000 x16: ffff800083008000 x15: 0000000000000000 x14: 0000000000000000 x13: 524553555f545845 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000f90 x9 : ffff8000801bb9b8 x8 : ffff2020001f7530 x7 : 00000000ffff9d08 x6 : 0000000748890425 x5 : 0000000000000000 x4 : ffffa0275dfda000 x3 : ffff8000839abdb0 x2 : ffff800081a3c760 x1 : ffff800081a3c760 x0 : 4000000000000000 Call trace: ct_kernel_exit.constprop.0+0xa0/0xa8 ct_idle_enter+0x14/0x20 default_idle_call+0x38/0x120 cpuidle_idle_call+0x164/0x1a8 do_idle+0xac/0x118 cpu_startup_entry+0x3c/0x50 secondary_start_kernel+0x14c/0x1e8 __secondary_switched+0xb8/0xc0 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 10214 at arch/arm64/kernel/entry-common.c:105 el0_da+0x98/0x1a8 CPU: 0 PID: 10214 Comm: sh Kdump: loaded Tainted: G W 6.6.0xcall_xint_lcxint6.6_test+ #26 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 04/29/2022 pstate: 804003c9 (Nzcv DAIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : el0_da+0x98/0x1a8 lr : el0t_64_sync_handler+0xb8/0x130 sp : ffff8000d193be70 pmr_save: 000000f0 x29: ffff8000d193be70 x28: ffff20203e95d100 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000060000000 x22: 0000ffffbb7a9028 x21: 0000aaaafa8a1c18 x20: 000000009200004f x19: ffff8000d193beb0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : ffff8000d193beb0 x3 : 0000000000000000 x2 : ffff800080e36fac x1 : ffff80275df96000 x0 : 0000000000000000 Call trace: el0_da+0x98/0x1a8 el0t_64_sync_handler+0xb8/0x130 el0t_64_sync+0x3b8/0x3c0 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 15840 at arch/arm64/kernel/entry-common.c:105 el0_ia+0xc0/0x200 CPU: 0 PID: 15840 Comm: sh Kdump: loaded Tainted: G W 6.6.0xcall_xint_lcxint6.6_test+ #26 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 04/29/2022 pstate: 804003c9 (Nzcv DAIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : el0_ia+0xc0/0x200 lr : el0t_64_sync_handler+0xd0/0x130 sp : ffff8000dc90be70 pmr_save: 000000f0 x29: ffff8000dc90be70 x28: ffff20204f112880 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000020000000 x22: 0000ffffbb801080 x21: 0000ffffbb801080 x20: 0000000082000007 x19: ffff8000dc90beb0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : ffff8000dc90beb0 x3 : 0000000000000000 x2 : 0000000000000000 x1 : ffff80275df96000 x0 : 0000000000000000 Call trace: el0_ia+0xc0/0x200 el0t_64_sync_handler+0xd0/0x130 el0t_64_sync+0x3b8/0x3c0 ---[ end trace 0000000000000000 ]--- Fixes: cf5f2d9ff017 ("arm64: Faster SVC exception handler with xcall") Fixes: 3053668e6b21 ("arm64: Introduce Xint software solution") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/Kconfig | 1 + arch/arm64/kernel/entry-common.c | 161 ++++++++++++------------------- arch/arm64/kernel/entry.S | 18 ++-- kernel/softirq.c | 4 +- 4 files changed, 70 insertions(+), 114 deletions(-) diff --git a/arch/Kconfig b/arch/Kconfig index 98116fbfcff6..a9d7c5099b96 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -1573,6 +1573,7 @@ config FAST_IRQ config DEBUG_FEATURE_BYPASS bool "Bypass debug feature in fast syscall" depends on FAST_SYSCALL || FAST_IRQ + depends on !LOCKDEP default y help This to bypass debug feature in fast syscall. diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c index 60300e133d5f..4602c107c40a 100644 --- a/arch/arm64/kernel/entry-common.c +++ b/arch/arm64/kernel/entry-common.c @@ -151,6 +151,62 @@ asmlinkage void noinstr asm_exit_to_user_mode(struct pt_regs *regs) exit_to_user_mode(regs); } +#if defined(CONFIG_FAST_SYSCALL) || defined(CONFIG_FAST_IRQ) +/* + * Copy from exit_to_user_mode_prepare + */ +static __always_inline void fast_exit_to_user_mode_prepare(struct pt_regs *regs) +{ + unsigned long flags; + + local_daif_mask(); + + flags = read_thread_flags(); + if (unlikely(flags & _TIF_WORK_MASK)) + do_notify_resume(regs, flags); + +#ifndef CONFIG_DEBUG_FEATURE_BYPASS + lockdep_sys_exit(); +#endif +} + +/* Copy from __exit_to_user_mode */ +static __always_inline void __fast_exit_to_user_mode(void) +{ +#ifndef CONFIG_DEBUG_FEATURE_BYPASS + trace_hardirqs_on_prepare(); + lockdep_hardirqs_on_prepare(); +#endif + user_enter_irqoff(); +#ifndef CONFIG_DEBUG_FEATURE_BYPASS + lockdep_hardirqs_on(CALLER_ADDR0); +#endif +} + +static __always_inline void fast_exit_to_user_mode(struct pt_regs *regs) +{ + fast_exit_to_user_mode_prepare(regs); +#ifndef CONFIG_DEBUG_FEATURE_BYPASS + mte_check_tfsr_exit(); +#endif + __fast_exit_to_user_mode(); +} + +/* Copy from __enter_from_user_mode */ +static __always_inline void fast_enter_from_user_mode(struct pt_regs *regs) +{ +#ifndef CONFIG_DEBUG_FEATURE_BYPASS + lockdep_hardirqs_off(CALLER_ADDR0); +#endif + CT_WARN_ON(ct_state() != CONTEXT_USER); + user_exit_irqoff(); +#ifndef CONFIG_DEBUG_FEATURE_BYPASS + trace_hardirqs_off_finish(); + mte_disable_tco_entry(current); +#endif +} +#endif + /* * Handle IRQ/context state management when entering an NMI from user/kernel * mode. Before this function is called it is not safe to call regular kernel @@ -513,80 +569,12 @@ static __always_inline void __el1_pnmi(struct pt_regs *regs, } #ifdef CONFIG_FAST_IRQ -static __always_inline void __el1_xint(struct pt_regs *regs, - void (*handler)(struct pt_regs *)) -{ -#ifndef CONFIG_DEBUG_FEATURE_BYPASS - enter_from_kernel_mode(regs); -#endif - - xint_enter_rcu(); - do_interrupt_handler(regs, handler); - xint_exit_rcu(); - - arm64_preempt_schedule_irq(); - -#ifndef CONFIG_DEBUG_FEATURE_BYPASS - exit_to_kernel_mode(regs); -#endif -} - -static void noinstr el1_xint(struct pt_regs *regs, u64 nmi_flag, - void (*handler)(struct pt_regs *), - void (*nmi_handler)(struct pt_regs *)) -{ - /* Is there a NMI to handle? */ -#ifndef CONFIG_DEBUG_FEATURE_BYPASS - if (system_uses_nmi() && (read_sysreg(isr_el1) & nmi_flag)) { - __el1_nmi(regs, nmi_handler); - return; - } -#endif - - write_sysreg(DAIF_PROCCTX_NOIRQ, daif); - - if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && !interrupts_enabled(regs)) - __el1_pnmi(regs, handler); - else - __el1_xint(regs, handler); -} - -asmlinkage void noinstr el1h_64_xint_handler(struct pt_regs *regs) -{ - el1_xint(regs, ISR_EL1_IS, handle_arch_irq, handle_arch_nmi_irq); -} - -static __always_inline void xint_exit_to_user_mode_prepare(struct pt_regs *regs) -{ - unsigned long flags; - - local_daif_mask(); - - flags = read_thread_flags(); - if (unlikely(flags & _TIF_WORK_MASK)) - do_notify_resume(regs, flags); - -#ifndef CONFIG_DEBUG_FEATURE_BYPASS - lockdep_sys_exit(); -#endif -} - -static __always_inline void xint_exit_to_user_mode(struct pt_regs *regs) -{ - xint_exit_to_user_mode_prepare(regs); -#ifndef CONFIG_DEBUG_FEATURE_BYPASS - mte_check_tfsr_exit(); - __exit_to_user_mode(); -#endif -} - static void noinstr el0_xint(struct pt_regs *regs, u64 nmi_flag, void (*handler)(struct pt_regs *), void (*nmi_handler)(struct pt_regs *)) { + fast_enter_from_user_mode(regs); #ifndef CONFIG_DEBUG_FEATURE_BYPASS - enter_from_user_mode(regs); - /* Is there a NMI to handle? */ if (system_uses_nmi() && (read_sysreg(isr_el1) & nmi_flag)) { /* @@ -615,7 +603,7 @@ static void noinstr el0_xint(struct pt_regs *regs, u64 nmi_flag, do_interrupt_handler(regs, handler); xint_exit_rcu(); - xint_exit_to_user_mode(regs); + fast_exit_to_user_mode(regs); } @@ -828,46 +816,17 @@ static void noinstr el0_fpac(struct pt_regs *regs, unsigned long esr) } #ifdef CONFIG_FAST_SYSCALL -/* - * Copy from exit_to_user_mode_prepare - */ -static __always_inline void xcall_exit_to_user_mode_prepare(struct pt_regs *regs) -{ - unsigned long flags; - - local_daif_mask(); - - flags = read_thread_flags(); - if (unlikely(flags & _TIF_WORK_MASK)) - do_notify_resume(regs, flags); - -#ifndef CONFIG_DEBUG_FEATURE_BYPASS - lockdep_sys_exit(); -#endif -} - -static __always_inline void xcall_exit_to_user_mode(struct pt_regs *regs) -{ - xcall_exit_to_user_mode_prepare(regs); -#ifndef CONFIG_DEBUG_FEATURE_BYPASS - mte_check_tfsr_exit(); - __exit_to_user_mode(); -#endif -} - /* Copy from el0_sync */ static void noinstr el0_xcall(struct pt_regs *regs) { -#ifndef CONFIG_DEBUG_FEATURE_BYPASS - enter_from_user_mode(regs); -#endif + fast_enter_from_user_mode(regs); #ifndef CONFIG_SECURITY_FEATURE_BYPASS cortex_a76_erratum_1463225_svc_handler(); #endif fp_user_discard(); local_daif_restore(DAIF_PROCCTX); do_el0_svc(regs); - xcall_exit_to_user_mode(regs); + fast_exit_to_user_mode(regs); } asmlinkage void noinstr el0t_64_xcall_handler(struct pt_regs *regs) diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S index e9fd3094623f..da3809632f0f 100644 --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -660,7 +660,7 @@ SYM_CODE_END(__bad_stack) #endif #ifdef CONFIG_FAST_IRQ -.macro check_xint_pre_kernel_entry el:req, ht:req +.macro check_xint_pre_kernel_entry stp x0, x1, [sp, #0] stp x2, x3, [sp, #16] @@ -691,20 +691,16 @@ SYM_CODE_END(__bad_stack) ldp x0, x1, [sp, #0] ldp x2, x3, [sp, #16] #ifdef CONFIG_SECURITY_FEATURE_BYPASS - kernel_entry \el, 64, xint + kernel_entry 0, 64, xint #else - kernel_entry \el, 64 + kernel_entry 0, 64 #endif mov x0, sp - bl el\el\ht\()_64_xint_handler + bl el0t_64_xint_handler #ifdef CONFIG_SECURITY_FEATURE_BYPASS - kernel_exit \el, xint + kernel_exit 0, xint #else - .if \el == 0 b ret_to_user - .else - b ret_to_kernel - .endif #endif .Lskip_xint\@: @@ -726,11 +722,11 @@ SYM_CODE_START_LOCAL(el\el\ht\()_\regsize\()_\label) .endif #endif #ifdef CONFIG_FAST_IRQ - .if \regsize == 64 && \label == irq && (( \el == 0 && \ht == t) || (\el == 1 && \ht == h)) + .if \regsize == 64 && \label == irq && \el == 0 && \ht == t alternative_if_not ARM64_HAS_XINT b .Lskip_check_xint\@ alternative_else_nop_endif - check_xint_pre_kernel_entry \el, \ht + check_xint_pre_kernel_entry .Lskip_check_xint\@: .endif #endif diff --git a/kernel/softirq.c b/kernel/softirq.c index 6dc0ea5baf06..cd8770b2f76c 100644 --- a/kernel/softirq.c +++ b/kernel/softirq.c @@ -669,11 +669,13 @@ void xint_enter_rcu(void) preempt_count_add(HARDIRQ_OFFSET); #ifndef CONFIG_DEBUG_FEATURE_BYPASS lockdep_hardirq_enter(); +#endif if (tick_nohz_full_cpu(smp_processor_id()) || (is_idle_task(current) && (irq_count() == HARDIRQ_OFFSET))) tick_irq_enter(); +#ifndef CONFIG_DEBUG_FEATURE_BYPASS account_hardirq_enter(current); #endif } @@ -695,9 +697,7 @@ static inline void __xint_exit_rcu(void) if (!in_interrupt() && local_softirq_pending()) invoke_softirq(); -#ifndef CONFIG_DEBUG_FEATURE_BYPASS tick_irq_exit(); -#endif } void xint_exit_rcu(void) -- 2.34.1

2 1

[PATCH v3 OLK-5.10] arm64: mm: Stop use spinlock during pbha early init
by Wupeng Ma 29 Nov '24

29 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96IZH -------------------------------- During early_pbha_init() in __primary_switched(), debug spinlock related function is not fully initialized. This will lead to kernel unable to boot with CONFIG_LOCK_STAT=y or related configs. Since kernel is running with only one cpu during startup, there is no need to use lock. Fix it by removing the spinlock. Fixes: f43933b3f947 ("arm64: cpufeature: Enable PBHA for stage1 early via FDT") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- Changelog since v1: - goto found if exists in chosen node --- arch/arm64/kernel/cpufeature.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 36a426b0def2..dee049d27c74 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1796,16 +1796,14 @@ void __init early_pbha_init(void) const u8 *prop; int size; - spin_lock(&pbha_dt_lock); - fdt = get_early_fdt_ptr(); if (!fdt) - goto unlock; + return; /* arm,pbha-performance-only may exist in both chosen and cpus node */ node = fdt_path_offset(fdt, "/chosen"); if (node < 0) - goto unlock; + return; prop = fdt_getprop(fdt, node, "arm,pbha-performance-only", &size); if (prop) @@ -1813,15 +1811,15 @@ void __init early_pbha_init(void) node = fdt_path_offset(fdt, "/cpus"); if (node < 0) - goto unlock; + return; prop = fdt_getprop(fdt, node, "arm,pbha-performance-only", &size); if (prop) - goto unlock; + return; found: if (!cpu_has_pbha()) - goto unlock; + return; update_pbha_perf_only_bit(prop, size); enable_pbha_inner(); @@ -1829,9 +1827,6 @@ void __init early_pbha_init(void) pbha_enabled = true; early_pbha_bit0_init(); - -unlock: - spin_unlock(&pbha_dt_lock); } /* -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] LoongArch: backport patches from upstream
by Hongchen Zhang 29 Nov '24

29 Nov '24

Bibo Mao (1): LoongArch: Set initial pte entry with PAGE_GLOBAL for kernel space Huacai Chen (3): LoongArch: Use accessors to page table entries instead of direct dereference LoongArch: Remove superfluous flush_dcache_page() definition LoongArch: Improve hardware page table walker arch/loongarch/include/asm/atomic.h | 2 + arch/loongarch/include/asm/cacheflush.h | 3 - arch/loongarch/include/asm/hugetlb.h | 4 +- arch/loongarch/include/asm/kfence.h | 6 +- arch/loongarch/include/asm/mmu_context.h | 35 +++++++--- arch/loongarch/include/asm/pgalloc.h | 11 ++++ arch/loongarch/include/asm/pgtable.h | 83 ++++++++++-------------- arch/loongarch/kvm/mmu.c | 8 +-- arch/loongarch/mm/fault.c | 41 ++++++++++++ arch/loongarch/mm/hugetlbpage.c | 6 +- arch/loongarch/mm/init.c | 12 ++-- arch/loongarch/mm/kasan_init.c | 10 +-- arch/loongarch/mm/pgtable.c | 22 ++++++- include/linux/mm.h | 3 +- mm/kasan/init.c | 8 ++- mm/sparse-vmemmap.c | 5 ++ 16 files changed, 173 insertions(+), 86 deletions(-) -- 2.33.0

2 5

[PATCH v2 OLK-5.10] arm64: mm: Stop use spinlock during pbha early init
by Wupeng Ma 29 Nov '24

29 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96IZH -------------------------------- During early_pbha_init() in __primary_switched(), debug spinlock related function is not fully initialized. This will lead to kernel unable to boot with CONFIG_LOCK_STAT=y or related configs. Since kernel is running with only one cpu during startup, there is no need to use lock. Fix it by removing the spinlock. Fixes: f43933b3f947 ("arm64: cpufeature: Enable PBHA for stage1 early via FDT") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cpufeature.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 36a426b0def2..5ed44ff91e92 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1796,32 +1796,29 @@ void __init early_pbha_init(void) const u8 *prop; int size; - spin_lock(&pbha_dt_lock); - fdt = get_early_fdt_ptr(); if (!fdt) - goto unlock; + return; /* arm,pbha-performance-only may exist in both chosen and cpus node */ node = fdt_path_offset(fdt, "/chosen"); if (node < 0) - goto unlock; + return; prop = fdt_getprop(fdt, node, "arm,pbha-performance-only", &size); if (prop) - goto found; + return; node = fdt_path_offset(fdt, "/cpus"); if (node < 0) - goto unlock; + return; prop = fdt_getprop(fdt, node, "arm,pbha-performance-only", &size); if (prop) - goto unlock; + return; -found: if (!cpu_has_pbha()) - goto unlock; + return; update_pbha_perf_only_bit(prop, size); enable_pbha_inner(); @@ -1829,9 +1826,6 @@ void __init early_pbha_init(void) pbha_enabled = true; early_pbha_bit0_init(); - -unlock: - spin_unlock(&pbha_dt_lock); } /* -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] ext4: avoid remount errors with 'abort' mount option
by Yongjian Sun 29 Nov '24

29 Nov '24

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.12-rc3 commit 76486b104168ae59703190566e372badf433314b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWS CVE: CVE-2024-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we remount filesystem with 'abort' mount option while changing other mount options as well (as is LTP test doing), we can return error from the system call after commit d3476f3dad4a ("ext4: don't set SB_RDONLY after filesystem errors") because the application of mount option changes detects shutdown filesystem and refuses to do anything. The behavior of application of other mount options in presence of 'abort' mount option is currently rather arbitary as some mount option changes are handled before 'abort' and some after it. Move aborting of the filesystem to the end of remount handling so all requested changes are properly applied before the filesystem is shutdown to have a reasonably consistent behavior. Fixes: d3476f3dad4a ("ext4: don't set SB_RDONLY after filesystem errors") Reported-by: Jan Stancek <jstancek(a)redhat.com> Link: https://lore.kernel.org/all/Zvp6L+oFnfASaoHl@t14s Signed-off-by: Jan Kara <jack(a)suse.cz> Tested-by: Jan Stancek <jstancek(a)redhat.com> Link: https://patch.msgid.link/20241004221556.19222-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 367fa50be4d6..5c52881160e5 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -6662,9 +6662,6 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb) goto restore_opts; } - if (test_opt2(sb, ABORT)) - ext4_abort(sb, ESHUTDOWN, "Abort forced by user"); - sb->s_flags = (sb->s_flags & ~SB_POSIXACL) | (test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0); @@ -6833,6 +6830,14 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb) if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb)) ext4_stop_mmpd(sbi); + /* + * Handle aborting the filesystem as the last thing during remount to + * avoid obsure errors during remount when some option changes fail to + * apply due to shutdown filesystem. + */ + if (test_opt2(sb, ABORT)) + ext4_abort(sb, ESHUTDOWN, "Abort forced by user"); + return 0; restore_opts: -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] [Backport] fs: Fix uninitialized value issue in from_kuid and from_kgid
by Yongjian Sun 29 Nov '24

29 Nov '24

From: Alessandro Zanni <alessandro.zanni87(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit 15f34347481648a567db67fb473c23befb796af5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705C CVE: CVE-2024-53101 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. Reported-by: syzbot+6c55f725d1bdc8c52058(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 Signed-off-by: Alessandro Zanni <alessandro.zanni87(a)gmail.com> Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.c… Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ocfs2/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index 8c0e300f0463..da209f81c9ee 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1139,9 +1139,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) trace_ocfs2_setattr(inode, dentry, (unsigned long long)OCFS2_I(inode)->ip_blkno, dentry->d_name.len, dentry->d_name.name, - attr->ia_valid, attr->ia_mode, - from_kuid(&init_user_ns, attr->ia_uid), - from_kgid(&init_user_ns, attr->ia_gid)); + attr->ia_valid, + attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, + attr->ia_valid & ATTR_UID ? + from_kuid(&init_user_ns, attr->ia_uid) : 0, + attr->ia_valid & ATTR_GID ? + from_kgid(&init_user_ns, attr->ia_gid) : 0); /* ensuring we don't even attempt to truncate a symlink */ if (S_ISLNK(inode->i_mode)) -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] fs: Fix uninitialized value issue in from_kuid and from_kgid
by Yongjian Sun 29 Nov '24

29 Nov '24

From: Alessandro Zanni <alessandro.zanni87(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit 15f34347481648a567db67fb473c23befb796af5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705C CVE: CVE-2024-53101 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. Reported-by: syzbot+6c55f725d1bdc8c52058(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 Signed-off-by: Alessandro Zanni <alessandro.zanni87(a)gmail.com> Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.c… Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ocfs2/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index ffa258da6bac..a12f35d15032 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1133,9 +1133,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) trace_ocfs2_setattr(inode, dentry, (unsigned long long)OCFS2_I(inode)->ip_blkno, dentry->d_name.len, dentry->d_name.name, - attr->ia_valid, attr->ia_mode, - from_kuid(&init_user_ns, attr->ia_uid), - from_kgid(&init_user_ns, attr->ia_gid)); + attr->ia_valid, + attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, + attr->ia_valid & ATTR_UID ? + from_kuid(&init_user_ns, attr->ia_uid) : 0, + attr->ia_valid & ATTR_GID ? + from_kgid(&init_user_ns, attr->ia_gid) : 0); /* ensuring we don't even attempt to truncate a symlink */ if (S_ISLNK(inode->i_mode)) -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] fs: Fix uninitialized value issue in from_kuid and from_kgid
by Yongjian Sun 29 Nov '24

29 Nov '24

From: Alessandro Zanni <alessandro.zanni87(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit 15f34347481648a567db67fb473c23befb796af5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705C CVE: CVE-2024-53101 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. Reported-by: syzbot+6c55f725d1bdc8c52058(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 Signed-off-by: Alessandro Zanni <alessandro.zanni87(a)gmail.com> Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.c… Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ocfs2/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index ffa258da6bac..a12f35d15032 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1133,9 +1133,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) trace_ocfs2_setattr(inode, dentry, (unsigned long long)OCFS2_I(inode)->ip_blkno, dentry->d_name.len, dentry->d_name.name, - attr->ia_valid, attr->ia_mode, - from_kuid(&init_user_ns, attr->ia_uid), - from_kgid(&init_user_ns, attr->ia_gid)); + attr->ia_valid, + attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, + attr->ia_valid & ATTR_UID ? + from_kuid(&init_user_ns, attr->ia_uid) : 0, + attr->ia_valid & ATTR_GID ? + from_kgid(&init_user_ns, attr->ia_gid) : 0); /* ensuring we don't even attempt to truncate a symlink */ if (S_ISLNK(inode->i_mode)) -- 2.39.2

2 1

[PATCH OLK-5.10] [Backport] fs: Fix uninitialized value issue in from_kuid and from_kgid
by Yongjian Sun 29 Nov '24

29 Nov '24

From: Alessandro Zanni <alessandro.zanni87(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit 15f34347481648a567db67fb473c23befb796af5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705C CVE: CVE-2024-53101 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. Reported-by: syzbot+6c55f725d1bdc8c52058(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 Signed-off-by: Alessandro Zanni <alessandro.zanni87(a)gmail.com> Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.c… Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ocfs2/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index ec0e67e9a3ec..43ce41404e72 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1133,9 +1133,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) trace_ocfs2_setattr(inode, dentry, (unsigned long long)OCFS2_I(inode)->ip_blkno, dentry->d_name.len, dentry->d_name.name, - attr->ia_valid, attr->ia_mode, - from_kuid(&init_user_ns, attr->ia_uid), - from_kgid(&init_user_ns, attr->ia_gid)); + attr->ia_valid, + attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, + attr->ia_valid & ATTR_UID ? + from_kuid(&init_user_ns, attr->ia_uid) : 0, + attr->ia_valid & ATTR_GID ? + from_kgid(&init_user_ns, attr->ia_gid) : 0); /* ensuring we don't even attempt to truncate a symlink */ if (S_ISLNK(inode->i_mode)) -- 2.39.2

2 1

[PATCH OLK-6.6] drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range
by Zhang Zekun 29 Nov '24

29 Nov '24

From: Hersen Wu <hersenxs.wu(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit 5524fa301ba649f8cf00848f91468e0ba7e4f24c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OL CVE: CVE-2024-46808 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------------------------------------- [Why & How] ASSERT if return NULL from kcalloc. Reviewed-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c index fc50931c2aec..9d67b9a9c2d9 100644 --- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c +++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c @@ -165,6 +165,7 @@ static void dpcd_extend_address_range( *out_address = new_addr_range.start; *out_size = ADDRESS_RANGE_SIZE(new_addr_range.start, new_addr_range.end); *out_data = kzalloc(*out_size * sizeof(**out_data), GFP_KERNEL); + ASSERT(*out_data); } } -- 2.17.1

2 1

[PATCH OLK-6.6 0/2] ext4: fix potential memory exposure issues during truncate in iomap
by Yongjian Sun 29 Nov '24

29 Nov '24

*** BLURB HERE *** Yongjian Sun (2): ext4: do not always order data when partial zeroing out a block ext4: fix potential memory exposure issues during truncate in iomap mode. fs/ext4/inode.c | 75 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 59 insertions(+), 16 deletions(-) -- 2.39.2

2 3

[openeuler:openEuler-1.0-LTS 1297/1297] drivers/pci/controller/hisi-pcie-customer/.tmp_hisi_pcie_cae.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 29 Nov '24

29 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b5504db0db8375a77340b5bb54c17cfb75d3c754 commit: 2208b0283616863f166ef470fb9286223ba8f9ba [1297/1297] pcie: hisi pcie dfx driver config: x86_64-buildonly-randconfig-002-20241117 (https://download.01.org/0day-ci/archive/20241129/202411291412.QcA88pv3-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241129/202411291412.QcA88pv3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411291412.QcA88pv3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/pci/controller/hisi-pcie-customer/.tmp_hisi_pcie_cae.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1484/1484] arch/x86/kvm/svm/sev.c:2200:18: error: no member named 'false' in 'struct hygon_kvm_hooks_table'
by kernel test robot 29 Nov '24

29 Nov '24

Hi fangbaoshun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 95bc69473a373c2e578d4fc39734e5811a03ead3 commit: 1c3b1095a26ed8bc1aa7ac3d4e8dd3e65964a74b [1484/1484] KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode config: x86_64-randconfig-073-20241119 (https://download.01.org/0day-ci/archive/20241129/202411291233.9CXb1cKX-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241129/202411291233.9CXb1cKX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411291233.9CXb1cKX-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/x86/kvm/svm/sev.c:12: In file included from include/linux/kvm_host.h:16: In file included from include/linux/mm.h:2235: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> arch/x86/kvm/svm/sev.c:2200:18: error: no member named 'false' in 'struct hygon_kvm_hooks_table' 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ~~~~~~~~~~~~~~~ ^ arch/x86/kvm/svm/sev.c:66:21: note: expanded from macro 'sev_enabled' 66 | #define sev_enabled false | ^ >> arch/x86/kvm/svm/sev.c:2200:32: error: cannot take the address of an rvalue of type 'int' 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ^~~~~~~~~~~~ arch/x86/kvm/svm/sev.c:2198:6: warning: no previous prototype for function 'sev_install_hooks' [-Wmissing-prototypes] 2198 | void sev_install_hooks(void) | ^ arch/x86/kvm/svm/sev.c:2198:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2198 | void sev_install_hooks(void) | ^ | static 2 warnings and 2 errors generated. vim +2200 arch/x86/kvm/svm/sev.c 2195 2196 #ifdef CONFIG_HYGON_CSV 2197 /* Code to set all of the function and vaiable pointers */ 2198 void sev_install_hooks(void) 2199 { > 2200 hygon_kvm_hooks.sev_enabled = &sev_enabled; 2201 hygon_kvm_hooks.sev_issue_cmd = sev_issue_cmd; 2202 hygon_kvm_hooks.get_num_contig_pages = get_num_contig_pages; 2203 hygon_kvm_hooks.sev_pin_memory = sev_pin_memory; 2204 hygon_kvm_hooks.sev_unpin_memory = sev_unpin_memory; 2205 2206 hygon_kvm_hooks.sev_hooks_installed = true; 2207 } 2208 #endif 2209 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1484/1484] include/linux/pgplib.h:36:30: error: field 'version' has incomplete type
by kernel test robot 29 Nov '24

29 Nov '24

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 95bc69473a373c2e578d4fc39734e5811a03ead3 commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [1484/1484] KEYS: Provide a function to load keys from a PGP keyring blob config: x86_64-randconfig-074-20241119 (https://download.01.org/0day-ci/archive/20241129/202411291248.k6zanntO-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241129/202411291248.k6zanntO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411291248.k6zanntO-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from crypto/asymmetric_keys/pgp_public_key.c:20: >> include/linux/pgplib.h:26:36: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 26 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ >> include/linux/pgplib.h:36:30: warning: 'version' is narrower than values of its type 36 | enum pgp_key_version version : 8; | ^~~~~~~ >> include/linux/pgplib.h:36:30: error: field 'version' has incomplete type >> include/linux/pgplib.h:37:30: warning: 'pubkey_algo' is narrower than values of its type 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^~~~~~~~~~~ >> include/linux/pgplib.h:37:30: error: field 'pubkey_algo' has incomplete type crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_calc_pkey_keyid': >> crypto/asymmetric_keys/pgp_public_key.c:63:9: error: implicit declaration of function 'kenter' [-Werror=implicit-function-declaration] 63 | kenter(""); | ^~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:65:29: error: 'PGP_KEY_VERSION_4' undeclared (first use in this function) 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:65:29: note: each undeclared identifier is reported only once for each function it appears in >> crypto/asymmetric_keys/pgp_public_key.c:67:23: error: implicit declaration of function 'mpi_key_length' [-Werror=implicit-function-declaration] 67 | ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); | ^~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:115:9: error: implicit declaration of function 'kleave' [-Werror=implicit-function-declaration] 115 | kleave(" = %d", ret); | ^~~~~~ crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_generate_fingerprint': crypto/asymmetric_keys/pgp_public_key.c:134:49: error: 'PGP_KEY_VERSION_4' undeclared (first use in this function) 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c: At top level: >> crypto/asymmetric_keys/pgp_public_key.c:199:40: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 199 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:199:55: error: parameter 2 ('type') has incomplete type 199 | enum pgp_packet_tag type, | ~~~~~~~~~~~~~~~~~~~~^~~~ >> crypto/asymmetric_keys/pgp_public_key.c:198:12: error: function declaration isn't a prototype [-Werror=strict-prototypes] 198 | static int pgp_process_public_key(struct pgp_parse_context *context, | ^~~~~~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_process_public_key': >> crypto/asymmetric_keys/pgp_public_key.c:213:21: error: 'PGP_PKT_USER_ID' undeclared (first use in this function) 213 | if (type == PGP_PKT_USER_ID) { | ^~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:234:32: error: 'PGP_PUBKEY__LAST' undeclared (first use in this function) 234 | if (pgp.pubkey_algo >= PGP_PUBKEY__LAST) | ^~~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:236:16: error: 'pgp_to_public_key_algo' undeclared (first use in this function); did you mean 'pgp_pubkey_algo'? 236 | algo = pgp_to_public_key_algo[pgp.pubkey_algo]; | ^~~~~~~~~~~~~~~~~~~~~~ | pgp_pubkey_algo crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_key_parse': >> crypto/asymmetric_keys/pgp_public_key.c:313:43: error: 'PGP_PKT_PUBLIC_KEY' undeclared (first use in this function) 313 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY) | | ^~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:314:43: error: 'PGP_PKT_USER_ID' undeclared (first use in this function) 314 | (1 << PGP_PKT_USER_ID); | ^~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:315:32: error: assignment to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' {aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, long unsigned int)'} from incompatible pointer type 'int (*)()' [-Werror=incompatible-pointer-types] 315 | ctx.pgp.process_packet = pgp_process_public_key; | ^ cc1: some warnings being treated as errors -- In file included from crypto/asymmetric_keys/pgp_preload.c:19: >> include/linux/pgplib.h:26:36: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 26 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ >> include/linux/pgplib.h:36:30: warning: 'version' is narrower than values of its type 36 | enum pgp_key_version version : 8; | ^~~~~~~ >> include/linux/pgplib.h:36:30: error: field 'version' has incomplete type >> include/linux/pgplib.h:37:30: warning: 'pubkey_algo' is narrower than values of its type 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^~~~~~~~~~~ >> include/linux/pgplib.h:37:30: error: field 'pubkey_algo' has incomplete type >> crypto/asymmetric_keys/pgp_preload.c:63:38: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 63 | enum pgp_packet_tag type, u8 headerlen, | ^~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_preload.c:63:53: error: parameter 2 ('type') has incomplete type 63 | enum pgp_packet_tag type, u8 headerlen, | ~~~~~~~~~~~~~~~~~~~~^~~~ >> crypto/asymmetric_keys/pgp_preload.c:62:19: error: function declaration isn't a prototype [-Werror=strict-prototypes] 62 | static int __init found_pgp_key(struct pgp_parse_context *context, | ^~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_preload.c:101:12: warning: no previous prototype for 'preload_pgp_keys' [-Wmissing-prototypes] 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c: In function 'preload_pgp_keys': >> crypto/asymmetric_keys/pgp_preload.c:107:43: error: 'PGP_PKT_PUBLIC_KEY' undeclared (first use in this function) 107 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); | ^~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c:107:43: note: each undeclared identifier is reported only once for each function it appears in >> crypto/asymmetric_keys/pgp_preload.c:108:32: error: assignment to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' {aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, long unsigned int)'} from incompatible pointer type 'int (*)()' [-Werror=incompatible-pointer-types] 108 | ctx.pgp.process_packet = found_pgp_key; | ^ cc1: some warnings being treated as errors Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [m]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=m] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/version +36 include/linux/pgplib.h b78af6579e15dc David Howells 2023-09-12 19 b78af6579e15dc David Howells 2023-09-12 20 /* b78af6579e15dc David Howells 2023-09-12 21 * PGP library packet parser b78af6579e15dc David Howells 2023-09-12 22 */ b78af6579e15dc David Howells 2023-09-12 23 struct pgp_parse_context { b78af6579e15dc David Howells 2023-09-12 24 u64 types_of_interest; b78af6579e15dc David Howells 2023-09-12 25 int (*process_packet)(struct pgp_parse_context *context, b78af6579e15dc David Howells 2023-09-12 @26 enum pgp_packet_tag type, b78af6579e15dc David Howells 2023-09-12 27 u8 headerlen, b78af6579e15dc David Howells 2023-09-12 28 const u8 *data, b78af6579e15dc David Howells 2023-09-12 29 size_t datalen); b78af6579e15dc David Howells 2023-09-12 30 }; b78af6579e15dc David Howells 2023-09-12 31 b78af6579e15dc David Howells 2023-09-12 32 extern int pgp_parse_packets(const u8 *data, size_t datalen, b78af6579e15dc David Howells 2023-09-12 33 struct pgp_parse_context *ctx); b78af6579e15dc David Howells 2023-09-12 34 b78af6579e15dc David Howells 2023-09-12 35 struct pgp_parse_pubkey { b78af6579e15dc David Howells 2023-09-12 @36 enum pgp_key_version version : 8; b78af6579e15dc David Howells 2023-09-12 @37 enum pgp_pubkey_algo pubkey_algo : 8; b78af6579e15dc David Howells 2023-09-12 38 __kernel_old_time_t creation_time; b78af6579e15dc David Howells 2023-09-12 39 __kernel_old_time_t expires_at; b78af6579e15dc David Howells 2023-09-12 40 }; b78af6579e15dc David Howells 2023-09-12 41 :::::: The code at line 36 was first introduced by commit :::::: b78af6579e15dcdff86504da90af77f3e890270e PGPLIB: Basic packet parser :::::: TO: David Howells <dhowells(a)redhat.com> :::::: CC: zgzxx <zhangguangzhi3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] Fix UAF in __update_blocked_fair
by liukai 29 Nov '24

29 Nov '24

From: Wenyu Huang <huangwenyu5(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB7B5F -------------------------------- After running the long-term stability test for a period of time, the UAF problem is triggered: [ 9533.667062] dump_stack_lvl+0x47/0x80 [ 9533.667158] print_address_description.constprop.0+0x66/0x300 [ 9533.667346] print_report+0x3e/0x70 [ 9533.667436] kasan_report+0xb4/0xf0 [ 9533.667619] __update_blocked_fair+0x421/0x15c0 [ 9533.667804] update_blocked_averages+0x14d/0x360 [ 9533.668176] run_rebalance_domains+0x66/0xa0 [ 9533.668271] handle_softirqs+0x10e/0x4c0 [ 9533.668370] irq_exit_rcu+0xea/0x120 [ 9533.668458] sysvec_apic_timer_interrupt+0x72/0x90 The unthrottle_qos_sched_group adds the leaf_cfs_rq back to the leaf_cfs_rq and sets on_list to 1. When unthrottle_qos_sched_group is executed in free_fair_sched_group, the node is inserted into the linked list again and then freed. So it causes UAF. Fixes: 926b9b0cd97e ("sched: Throttle qos cfs_rq when current cpu is running online task") Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- kernel/sched/fair.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index f1cd57e70f1f..13be1bd6cc53 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -14704,10 +14704,6 @@ void free_fair_sched_group(struct task_group *tg) int i; for_each_possible_cpu(i) { -#ifdef CONFIG_QOS_SCHED - if (tg->cfs_rq && tg->cfs_rq[i]) - unthrottle_qos_sched_group(tg->cfs_rq[i]); -#endif if (tg->cfs_rq) kfree(tg->cfs_rq[i]); if (tg->se) @@ -14794,6 +14790,11 @@ void unregister_fair_sched_group(struct task_group *tg) if (tg->se[cpu]) remove_entity_load_avg(tg->se[cpu]); + #ifdef CONFIG_QOS_SCHED + if (tg->cfs_rq && tg->cfs_rq[cpu]) + unthrottle_qos_sched_group(tg->cfs_rq[cpu]); + #endif + /* * Only empty task groups can be destroyed; so we can speculatively * check on_list without danger of it being re-added. -- 2.34.1

2 1

[PATCH OLK-6.6] Fix SCHED_WARN_ON(cfs_rq->throttled_clock) in throttle_cfs_rq
by liukai 29 Nov '24

29 Nov '24

From: Wenyu Huang <huangwenyu5(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB7FU1 -------------------------------- In enqueue_entity, it assigns rq_clock(rq) to a cfs_rq when this cfs_rq is throttled by QOS, which causes SCHED_WARN_ON(cfs_rq->throttled_clock) in throttle_cfs_rq. So we add a "cfs_rq->throttled != QOS_THROTTLED" check to avoid assign rq_clock to the cfs_rq throttled by QOS. Fixes: 926b9b0cd97e ("sched: Throttle qos cfs_rq when current cpu is running online task") Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- kernel/sched/fair.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 2bf8b64182c5..7835353a583b 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5453,13 +5453,19 @@ enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags) if (!throttled_hierarchy(cfs_rq)) { list_add_leaf_cfs_rq(cfs_rq); } else { +#ifdef CONFIG_QOS_SCHED + if (cfs_rq->throttled != QOS_THROTTLED) { +#endif #ifdef CONFIG_CFS_BANDWIDTH - struct rq *rq = rq_of(cfs_rq); + struct rq *rq = rq_of(cfs_rq); - if (cfs_rq_throttled(cfs_rq) && !cfs_rq->throttled_clock) - cfs_rq->throttled_clock = rq_clock(rq); - if (!cfs_rq->throttled_clock_self) - cfs_rq->throttled_clock_self = rq_clock(rq); + if (cfs_rq_throttled(cfs_rq) && !cfs_rq->throttled_clock) + cfs_rq->throttled_clock = rq_clock(rq); + if (!cfs_rq->throttled_clock_self) + cfs_rq->throttled_clock_self = rq_clock(rq); +#endif +#ifdef CONFIG_QOS_SCHED + } #endif } } -- 2.34.1

2 1

[PATCH OLK-6.6] sched/fair: Fix qos_timer deadlock when cpuhp offline
by liukai 29 Nov '24

29 Nov '24

From: Wenyu Huang <huangwenyu5(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB7GK5 -------------------------------- When cpu hotplug offline, if qos_overload_timer_handler() concurrently running, It could trigger an ABBA deadlock. As qos_overload_timer_handler() requires rq lock, while the cpu hotplug attached firstly and waiting for the qos_timer handling, This can cause Hard LOCKUP like: [359230.788754] Call trace: [359230.788755] hrtimer_active+0x7c/0xec [359230.788757] hrtimer_cancel+0x3c/0x60 [359230.788758] unthrottle_qos_cfs_rqs+0xbc/0x110 [359230.788760] unthrottle_offline_cfs_rqs+0x40/0x150 [359230.788762] rq_offline_fair+0x60/0x70 [359230.788764] set_rq_offline.part.0+0x54/0xf4 [359230.788765] set_rq_offline+0x34/0x44 [359230.788767] rq_attach_root+0x1e8/0x260 [359230.788768] cpu_attach_domain+0x244/0x430 [359230.788770] detach_destroy_domains+0xbc/0x140 [359230.788772] partition_sched_domains_locked+0x23c/0x314 [359230.788774] rebuild_sched_domains_locked+0x1f0/0x270 [359230.788776] cpuset_hotplug_workfn+0x514/0x74c [359230.788777] process_one_work+0x34c/0x800 [359230.788779] worker_thread+0xa8/0x500 [359230.788780] kthread+0x1e0/0x220 [359230.788782] ret_from_fork+0x10/0x18 [359230.788783] Kernel panic - not syncing: Hard LOCKUP Fix it by switch to use __unthrottle_qos_cfs_rqs(), instead of unthrottle_qos_cfs_rqs() in unthrottle_offline_cfs_rqs, so that it will not trigger cancel_qos_timer() when cpu hotplug offline. Fixes: 926b9b0cd97e ("sched: Throttle qos cfs_rq when current cpu is running online task") Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- kernel/sched/fair.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index f1cd57e70f1f..2bf8b64182c5 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -152,6 +152,7 @@ unsigned int sysctl_overload_detect_period = 5000; /* in ms */ unsigned int sysctl_offline_wait_interval = 100; /* in ms */ static int one_thousand = 1000; static int hundred_thousand = 100000; +static int __unthrottle_qos_cfs_rqs(int cpu); static int unthrottle_qos_cfs_rqs(int cpu); static bool qos_smt_expelled(int this_cpu); #endif @@ -6672,7 +6673,7 @@ static void __maybe_unused unthrottle_offline_cfs_rqs(struct rq *rq) */ rq_clock_start_loop_update(rq); #ifdef CONFIG_QOS_SCHED - unthrottle_qos_cfs_rqs(cpu_of(rq)); + __unthrottle_qos_cfs_rqs(cpu_of(rq)); #endif rcu_read_lock(); @@ -6699,9 +6700,6 @@ static void __maybe_unused unthrottle_offline_cfs_rqs(struct rq *rq) rcu_read_unlock(); rq_clock_stop_loop_update(rq); -#ifdef CONFIG_QOS_SCHED - unthrottle_qos_cfs_rqs(cpu_of(rq)); -#endif } bool cfs_task_bw_constrained(struct task_struct *p) -- 2.34.1

2 1

[openeuler:OLK-5.10 2461/2461] kernel/sched/topology.c:1618:9: error: implicit declaration of function 'register_sysctl_init'; did you mean 'register_sysctl'?
by kernel test robot 29 Nov '24

29 Nov '24

Hi Tim, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 1a47bbfaad6fcbfb4fe3935cb7408d843caf3760 commit: 8ce3e706b31409147f035c037055caa68e450ce5 [2461/2461] scheduler: Add runtime knob sysctl_sched_cluster config: arm64-randconfig-001-20241120 (https://download.01.org/0day-ci/archive/20241129/202411291255.OrGZGrUb-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241129/202411291255.OrGZGrUb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411291255.OrGZGrUb-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/topology.c:5: kernel/sched/sched.h:2967:22: error: array type has incomplete element type 'struct cftype' 2967 | extern struct cftype cgroup_v1_psi_files[]; | ^~~~~~~~~~~~~~~~~~~ kernel/sched/topology.c: In function 'sched_cluster_sysctl_init': >> kernel/sched/topology.c:1618:9: error: implicit declaration of function 'register_sysctl_init'; did you mean 'register_sysctl'? [-Werror=implicit-function-declaration] 1618 | register_sysctl_init("kernel", sched_cluster_sysctls); | ^~~~~~~~~~~~~~~~~~~~ | register_sysctl cc1: some warnings being treated as errors vim +1618 kernel/sched/topology.c 1615 1616 static int __init sched_cluster_sysctl_init(void) 1617 { > 1618 register_sysctl_init("kernel", sched_cluster_sysctls); 1619 return 0; 1620 } 1621 late_initcall(sched_cluster_sysctl_init); 1622 #endif 1623 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1 0/2] fix CVE-2024-49906
by Cheng Yu 29 Nov '24

29 Nov '24

fix CVE-2024-49906 Rodrigo Siqueira (1): drm/amd/display: Check null pointer before try to access it Wayne Lin (1): drm/amd/display: Check null pointer before try to access it drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
by Wang Liang 29 Nov '24

29 Nov '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.12-rc1 commit 04ccecfa959d3b9ae7348780d8e379c6486176ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPK7 CVE: CVE-2024-47707 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Blamed commit accidentally removed a check for rt->rt6i_idev being NULL, as spotted by syzbot: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856 addrconf_notify+0x3cb/0x1020 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352 unregister_netdevice_many net/core/dev.c:11414 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289 unregister_netdevice include/linux/netdevice.h:3129 [inline] __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685 tun_detach drivers/net/tun.c:701 [inline] tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1acc77def9 Code: Unable to access opcode bytes at 0x7f1acc77decf. RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: e332bc67cf5e ("ipv6: Don't call with rt6_uncached_list_flush_dev") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Acked-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/20240913083147.3095442-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 45be9e9c595f..05e2b7acf4d7 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -170,7 +170,7 @@ static void rt6_uncached_list_flush_dev(struct net_device *dev) struct inet6_dev *rt_idev = rt->rt6i_idev; struct net_device *rt_dev = rt->dst.dev; - if (rt_idev->dev == dev) { + if (rt_idev && rt_idev->dev == dev) { rt->rt6i_idev = in6_dev_get(blackhole_netdev); in6_dev_put(rt_idev); } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: rtw88: always wait for both firmware loading attempts
by Wang Liang 29 Nov '24

29 Nov '24

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v5.10.227 commit a0c1e2da652cf70825739bc12d49ea15805690bf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPKI CVE: CVE-2024-47718 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d ] In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN. Fixes: c8e5695eae99 ("rtw88: load wowlan firmware if wowlan is supported") Reported-by: syzbot+6c6c08700f9480c41fe3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c6c08700f9480c41fe3 Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20240726114657.25396-1-dmantipov@yandex.ru Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/realtek/rtw88/main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c index 2ef1416899f0..91eea38f62cd 100644 --- a/drivers/net/wireless/realtek/rtw88/main.c +++ b/drivers/net/wireless/realtek/rtw88/main.c @@ -1007,20 +1007,21 @@ static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev) { struct rtw_chip_info *chip = rtwdev->chip; struct rtw_fw_state *fw; + int ret = 0; fw = &rtwdev->fw; wait_for_completion(&fw->completion); if (!fw->firmware) - return -EINVAL; + ret = -EINVAL; if (chip->wow_fw_name) { fw = &rtwdev->wow_fw; wait_for_completion(&fw->completion); if (!fw->firmware) - return -EINVAL; + ret = -EINVAL; } - return 0; + return ret; } static int rtw_power_on(struct rtw_dev *rtwdev) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
by Wang Liang 29 Nov '24

29 Nov '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.227 commit ef44274dae9b0a90d1a97ce8b242a3b8243a7745 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRE8 CVE: CVE-2024-50044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 08d1914293dae38350b8088980e59fbc699a72fe ] rfcomm_sk_state_change attempts to use sock_lock so it must never be called with it locked but rfcomm_sock_ioctl always attempt to lock it causing the following trace: ====================================================== WARNING: possible circular locking dependency detected 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted ------------------------------------------------------ syz-executor386/5093 is trying to acquire lock: ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline] ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73 but task is already holding lock: ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491 Reported-by: syzbot+d7ce59b06b3eb14fd218(a)syzkaller.appspotmail.com Tested-by: syzbot+d7ce59b06b3eb14fd218(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218 Fixes: 3241ad820dbb ("[Bluetooth] Add timestamp support to L2CAP, RFCOMM and SCO") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/rfcomm/sock.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index 82f404d3eba2..82fb8db7f92e 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -867,9 +867,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lon if (err == -ENOIOCTLCMD) { #ifdef CONFIG_BT_RFCOMM_TTY - lock_sock(sk); err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); - release_sock(sk); #else err = -EOPNOTSUPP; #endif -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net/sched: accept TCA_STAB only for root qdisc
by Wang Liang 29 Nov '24

29 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.227 commit adbc3eef43fc94c7c8436da832691ae02333a972 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJQ CVE: CVE-2024-50039 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3cb7cf1540ddff5473d6baeb530228d19bc97b8a ] Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers. Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1] We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage. [1] [ 88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 88.798611] #PF: supervisor read access in kernel mode [ 88.799014] #PF: error_code(0x0000) - not-present page [ 88.799506] PGD 0 P4D 0 [ 88.799829] Oops: Oops: 0000 [#1] SMP NOPTI [ 88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117 [ 88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00 All code ======== 0: 0f b7 50 12 movzwl 0x12(%rax),%edx 4: 48 8d 04 d5 00 00 00 lea 0x0(,%rdx,8),%rax b: 00 c: 48 89 d6 mov %rdx,%rsi f: 48 29 d0 sub %rdx,%rax 12: 48 8b 91 c0 01 00 00 mov 0x1c0(%rcx),%rdx 19: 48 c1 e0 03 shl $0x3,%rax 1d: 48 01 c2 add %rax,%rdx 20: 66 83 7a 1a 00 cmpw $0x0,0x1a(%rdx) 25: 7e c0 jle 0xffffffffffffffe7 27: 48 8b 3a mov (%rdx),%rdi 2a:* 4c 8b 07 mov (%rdi),%r8 <-- trapping instruction 2d: 4c 89 02 mov %r8,(%rdx) 30: 49 89 50 08 mov %rdx,0x8(%r8) 34: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 3b: 00 3c: 48 rex.W 3d: c7 .byte 0xc7 3e: 07 (bad) ... Code starting with the faulting instruction =========================================== 0: 4c 8b 07 mov (%rdi),%r8 3: 4c 89 02 mov %r8,(%rdx) 6: 49 89 50 08 mov %rdx,0x8(%r8) a: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 11: 00 12: 48 rex.W 13: c7 .byte 0xc7 14: 07 (bad) ... [ 88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206 [ 88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800 [ 88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000 [ 88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f [ 88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140 [ 88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac [ 88.806734] FS: 00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000 [ 88.807225] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0 [ 88.808165] Call Trace: [ 88.808459] <TASK> [ 88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715) [ 88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [ 88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [ 88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq [ 88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036) [ 88.810950] tbf_reset (./include/linux/timekeeping.h:169 net/sched/sch_tbf.c:334) sch_tbf [ 88.811208] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036) [ 88.811484] netif_set_real_num_tx_queues (./include/linux/spinlock.h:396 ./include/net/sch_generic.h:768 net/core/dev.c:2958) [ 88.811870] __tun_detach (drivers/net/tun.c:590 drivers/net/tun.c:673) [ 88.812271] tun_chr_close (drivers/net/tun.c:702 drivers/net/tun.c:3517) [ 88.812505] __fput (fs/file_table.c:432 (discriminator 1)) [ 88.812735] task_work_run (kernel/task_work.c:230) [ 88.813016] do_exit (kernel/exit.c:940) [ 88.813372] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:58 (discriminator 4)) [ 88.813639] ? handle_mm_fault (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/memcontrol.h:1022 ./include/linux/memcontrol.h:1045 ./include/linux/memcontrol.h:1052 mm/memory.c:5928 mm/memory.c:6088) [ 88.813867] do_group_exit (kernel/exit.c:1070) [ 88.814138] __x64_sys_exit_group (kernel/exit.c:1099) [ 88.814490] x64_sys_call (??:?) [ 88.814791] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 88.815012] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 88.815495] RIP: 0033:0x7f44560f1975 Fixes: 175f9c1bba9b ("net_sched: Add size table for qdiscs") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://patch.msgid.link/20241007184130.3960565-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/net/sch_generic.h | 1 - net/sched/sch_api.c | 7 ++++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index f78a2ea07771..4bed10e321aa 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -838,7 +838,6 @@ static inline void qdisc_calculate_pkt_len(struct sk_buff *skb, static inline int qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) { - qdisc_calculate_pkt_len(skb, sch); return sch->enqueue(skb, sch, to_free); } diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index b8eecd6704cb..eff018a2c3ed 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -590,7 +590,6 @@ void __qdisc_calculate_pkt_len(struct sk_buff *skb, pkt_len = 1; qdisc_skb_cb(skb)->pkt_len = pkt_len; } -EXPORT_SYMBOL(__qdisc_calculate_pkt_len); void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc) { @@ -1120,6 +1119,12 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent, return -EINVAL; } + if (new && + !(parent->flags & TCQ_F_MQROOT) && + rcu_access_pointer(new->stab)) { + NL_SET_ERR_MSG(extack, "STAB not supported on a non root"); + return -EINVAL; + } err = cops->graft(parent, cl, new, &old, extack); if (err) return err; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: ethernet: lantiq_etop: fix memory disclosure
by Wang Liang 29 Nov '24

29 Nov '24

From: Aleksander Jan Bajkowski <olek2(a)wp.pl> stable inclusion from stable-v5.10.227 commit 185df159843d30fb71f821e7ea4368c2a3bfcd36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCJ CVE: CVE-2024-49997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 45c0de18ff2dc9af01236380404bbd6a46502c69 ] When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer. In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions. Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied. Fixes: 504d4721ee8e ("MIPS: Lantiq: Add ethernet driver") Signed-off-by: Aleksander Jan Bajkowski <olek2(a)wp.pl> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Link: https://patch.msgid.link/20240923214949.231511-2-olek2@wp.pl Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/lantiq_etop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c index 9ea6c9a7d93f..5f9cc6ebf5d4 100644 --- a/drivers/net/ethernet/lantiq_etop.c +++ b/drivers/net/ethernet/lantiq_etop.c @@ -464,7 +464,9 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev) unsigned long flags; u32 byte_offset; - len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len; + if (skb_put_padto(skb, ETH_ZLEN)) + return NETDEV_TX_OK; + len = skb->len; if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) { dev_kfree_skb_any(skb); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: Fix an unsafe loop on the list
by Wang Liang 29 Nov '24

29 Nov '24

From: Anastasia Kovaleva <a.kovaleva(a)yadro.com> stable inclusion from stable-v5.10.227 commit 68ad5da6ca630a276f0a5c924179e57724d00013 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDW CVE: CVE-2024-50024 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1dae9f1187189bc09ff6d25ca97ead711f7e26f9 upstream. The kernel may crash when deleting a genetlink family if there are still listeners for that family: Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0 LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0 Call Trace: __netlink_clear_multicast_users+0x74/0xc0 genl_unregister_family+0xd4/0x2d0 Change the unsafe loop on the list to a safe one, because inside the loop there is an element removal from this list. Fixes: b8273570f802 ("genetlink: fix netns vs. netlink table locking (2)") Cc: stable(a)vger.kernel.org Signed-off-by: Anastasia Kovaleva <a.kovaleva(a)yadro.com> Reviewed-by: Dmitry Bogdanov <d.bogdanov(a)yadro.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20241003104431.12391-1-a.kovaleva@yadro.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/net/sock.h | 2 ++ net/netlink/af_netlink.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/include/net/sock.h b/include/net/sock.h index 2a78dd349577..13f62fd4dbc7 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -853,6 +853,8 @@ static inline void sk_add_bind_node(struct sock *sk, hlist_for_each_entry_safe(__sk, tmp, list, sk_node) #define sk_for_each_bound(__sk, list) \ hlist_for_each_entry(__sk, list, sk_bind_node) +#define sk_for_each_bound_safe(__sk, tmp, list) \ + hlist_for_each_entry_safe(__sk, tmp, list, sk_bind_node) /** * sk_for_each_entry_offset_rcu - iterate over a list at a given struct offset diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index b9d1b3a68cba..1bb8a0268c1a 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -2172,8 +2172,9 @@ void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group) { struct sock *sk; struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; + struct hlist_node *tmp; - sk_for_each_bound(sk, &tbl->mc_list) + sk_for_each_bound_safe(sk, tmp, &tbl->mc_list) netlink_update_socket_mc(nlk_sk(sk), group, 0); } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: stmmac: Fix zero-division error when disabling tc cbs
by Wang Liang 29 Nov '24

29 Nov '24

From: KhaiWenTan <khai.wen.tan(a)linux.intel.com> stable inclusion from stable-v5.10.227 commit e33fe25b1efe4f2e6a5858786dbc82ae4c44ed4c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8Y CVE: CVE-2024-49977 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 675faf5a14c14a2be0b870db30a70764df81e2df upstream. The commit b8c43360f6e4 ("net: stmmac: No need to calculate speed divider when offload is disabled") allows the "port_transmit_rate_kbps" to be set to a value of 0, which is then passed to the "div_s64" function when tc-cbs is disabled. This leads to a zero-division error. When tc-cbs is disabled, the idleslope, sendslope, and credit values the credit values are not required to be configured. Therefore, adding a return statement after setting the txQ mode to DCB when tc-cbs is disabled would prevent a zero-division error. Fixes: b8c43360f6e4 ("net: stmmac: No need to calculate speed divider when offload is disabled") Cc: <stable(a)vger.kernel.org> Co-developed-by: Choong Yong Liang <yong.liang.choong(a)linux.intel.com> Signed-off-by: Choong Yong Liang <yong.liang.choong(a)linux.intel.com> Signed-off-by: KhaiWenTan <khai.wen.tan(a)linux.intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20240918061422.1589662-1-khai.wen.tan@linux.intel.… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c index 2429c57fa452..5afa592a8cdf 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c @@ -362,6 +362,7 @@ static int tc_setup_cbs(struct stmmac_priv *priv, return ret; priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB; + return 0; } /* Final adjustments for HW */ -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
by Wang Liang 29 Nov '24

29 Nov '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v5.10.227 commit dd70c8a89ef99c3d53127fe19e51ef47c3f860fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCU CVE: CVE-2024-49944 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8beee4d8dee76b67c75dc91fd8185d91e845c160 ] In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason. Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline] Fixes: 5e8f3f703ae4 ("sctp: simplify sctp listening code") Reported-by: syzbot+f4e0f821e3a3b7cee51d(a)syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Link: https://patch.msgid.link/a93e655b3c153dc8945d7a812e6d8ab0d52b7aa0.172772939… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 5af0230e818c..67a824b9977e 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -8273,8 +8273,10 @@ static int sctp_listen_start(struct sock *sk, int backlog) */ inet_sk_set_state(sk, SCTP_SS_LISTENING); if (!ep->base.bind_addr.port) { - if (sctp_autobind(sk)) + if (sctp_autobind(sk)) { + inet_sk_set_state(sk, SCTP_SS_CLOSED); return -EAGAIN; + } } else { if (sctp_get_port(sk, inet_sk(sk)->inet_num)) { inet_sk_set_state(sk, SCTP_SS_CLOSED); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
by Wang Liang 29 Nov '24

29 Nov '24

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v5.10.227 commit b02eb7c86ff2ef1411c3095ec8a52b13f68db04f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA2 CVE: CVE-2024-49938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94745807f3ebd379f23865e6dab196f220664179 ] Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call. The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it. Reported-by: syzbot+98afa303be379af6cdb2(a)syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240812142447.12328-1-toke@toke.dk Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index f06eec99de68..51b7efe2d610 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -688,8 +688,7 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb) } resubmit: - skb_reset_tail_pointer(skb); - skb_trim(skb, 0); + __skb_set_length(skb, 0); usb_anchor_urb(urb, &hif_dev->rx_submitted); ret = usb_submit_urb(urb, GFP_ATOMIC); @@ -727,8 +726,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb) case -ESHUTDOWN: goto free; default: - skb_reset_tail_pointer(skb); - skb_trim(skb, 0); + __skb_set_length(skb, 0); goto resubmit; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: ath11k: fix array out-of-bound access in SoC stats
by Wang Liang 29 Nov '24

29 Nov '24

From: Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> stable inclusion from stable-v5.10.227 commit 0f26f26944035ec67546a944f182cbad6577a9c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8M CVE: CVE-2024-49930 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 69f253e46af98af17e3efa3e5dfa72fcb7d1983d ] Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by: Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240704070811.4186543-3-quic_periyasa@quicinc.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index 24c38cfad629..c3625514485d 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -2597,7 +2597,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id, if (push_reason != HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION) { dev_kfree_skb_any(msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++; continue; } -- 2.34.1

2 1

[PATCH OLK-5.10] ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
by Wang Liang 29 Nov '24

29 Nov '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.12-rc1 commit 04ccecfa959d3b9ae7348780d8e379c6486176ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPK7 CVE: CVE-2024-47707 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Blamed commit accidentally removed a check for rt->rt6i_idev being NULL, as spotted by syzbot: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856 addrconf_notify+0x3cb/0x1020 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352 unregister_netdevice_many net/core/dev.c:11414 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289 unregister_netdevice include/linux/netdevice.h:3129 [inline] __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685 tun_detach drivers/net/tun.c:701 [inline] tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1acc77def9 Code: Unable to access opcode bytes at 0x7f1acc77decf. RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: e332bc67cf5e ("ipv6: Don't call with rt6_uncached_list_flush_dev") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Acked-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/20240913083147.3095442-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 7809905953e7..6821ef52eb98 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -170,7 +170,7 @@ static void rt6_uncached_list_flush_dev(struct net_device *dev) struct inet6_dev *rt_idev = rt->rt6i_idev; struct net_device *rt_dev = rt->dst.dev; - if (rt_idev->dev == dev) { + if (rt_idev && rt_idev->dev == dev) { rt->rt6i_idev = in6_dev_get(blackhole_netdev); in6_dev_put(rt_idev); } -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: rtw88: always wait for both firmware loading attempts
by Wang Liang 29 Nov '24

29 Nov '24

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v5.10.227 commit a0c1e2da652cf70825739bc12d49ea15805690bf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPKI CVE: CVE-2024-47718 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d ] In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN. Fixes: c8e5695eae99 ("rtw88: load wowlan firmware if wowlan is supported") Reported-by: syzbot+6c6c08700f9480c41fe3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c6c08700f9480c41fe3 Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20240726114657.25396-1-dmantipov@yandex.ru Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/realtek/rtw88/main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c index 2ef1416899f0..91eea38f62cd 100644 --- a/drivers/net/wireless/realtek/rtw88/main.c +++ b/drivers/net/wireless/realtek/rtw88/main.c @@ -1007,20 +1007,21 @@ static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev) { struct rtw_chip_info *chip = rtwdev->chip; struct rtw_fw_state *fw; + int ret = 0; fw = &rtwdev->fw; wait_for_completion(&fw->completion); if (!fw->firmware) - return -EINVAL; + ret = -EINVAL; if (chip->wow_fw_name) { fw = &rtwdev->wow_fw; wait_for_completion(&fw->completion); if (!fw->firmware) - return -EINVAL; + ret = -EINVAL; } - return 0; + return ret; } static int rtw_power_on(struct rtw_dev *rtwdev) -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
by Wang Liang 29 Nov '24

29 Nov '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.227 commit ef44274dae9b0a90d1a97ce8b242a3b8243a7745 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRE8 CVE: CVE-2024-50044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 08d1914293dae38350b8088980e59fbc699a72fe ] rfcomm_sk_state_change attempts to use sock_lock so it must never be called with it locked but rfcomm_sock_ioctl always attempt to lock it causing the following trace: ====================================================== WARNING: possible circular locking dependency detected 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted ------------------------------------------------------ syz-executor386/5093 is trying to acquire lock: ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline] ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73 but task is already holding lock: ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491 Reported-by: syzbot+d7ce59b06b3eb14fd218(a)syzkaller.appspotmail.com Tested-by: syzbot+d7ce59b06b3eb14fd218(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218 Fixes: 3241ad820dbb ("[Bluetooth] Add timestamp support to L2CAP, RFCOMM and SCO") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/rfcomm/sock.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index 82f404d3eba2..82fb8db7f92e 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -867,9 +867,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lon if (err == -ENOIOCTLCMD) { #ifdef CONFIG_BT_RFCOMM_TTY - lock_sock(sk); err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); - release_sock(sk); #else err = -EOPNOTSUPP; #endif -- 2.34.1

2 1

[PATCH OLK-5.10] net/sched: accept TCA_STAB only for root qdisc
by Wang Liang 29 Nov '24

29 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.227 commit adbc3eef43fc94c7c8436da832691ae02333a972 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJQ CVE: CVE-2024-50039 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3cb7cf1540ddff5473d6baeb530228d19bc97b8a ] Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers. Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1] We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage. [1] [ 88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 88.798611] #PF: supervisor read access in kernel mode [ 88.799014] #PF: error_code(0x0000) - not-present page [ 88.799506] PGD 0 P4D 0 [ 88.799829] Oops: Oops: 0000 [#1] SMP NOPTI [ 88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117 [ 88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00 All code ======== 0: 0f b7 50 12 movzwl 0x12(%rax),%edx 4: 48 8d 04 d5 00 00 00 lea 0x0(,%rdx,8),%rax b: 00 c: 48 89 d6 mov %rdx,%rsi f: 48 29 d0 sub %rdx,%rax 12: 48 8b 91 c0 01 00 00 mov 0x1c0(%rcx),%rdx 19: 48 c1 e0 03 shl $0x3,%rax 1d: 48 01 c2 add %rax,%rdx 20: 66 83 7a 1a 00 cmpw $0x0,0x1a(%rdx) 25: 7e c0 jle 0xffffffffffffffe7 27: 48 8b 3a mov (%rdx),%rdi 2a:* 4c 8b 07 mov (%rdi),%r8 <-- trapping instruction 2d: 4c 89 02 mov %r8,(%rdx) 30: 49 89 50 08 mov %rdx,0x8(%r8) 34: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 3b: 00 3c: 48 rex.W 3d: c7 .byte 0xc7 3e: 07 (bad) ... Code starting with the faulting instruction =========================================== 0: 4c 8b 07 mov (%rdi),%r8 3: 4c 89 02 mov %r8,(%rdx) 6: 49 89 50 08 mov %rdx,0x8(%r8) a: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 11: 00 12: 48 rex.W 13: c7 .byte 0xc7 14: 07 (bad) ... [ 88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206 [ 88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800 [ 88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000 [ 88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f [ 88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140 [ 88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac [ 88.806734] FS: 00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000 [ 88.807225] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0 [ 88.808165] Call Trace: [ 88.808459] <TASK> [ 88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715) [ 88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [ 88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [ 88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq [ 88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036) [ 88.810950] tbf_reset (./include/linux/timekeeping.h:169 net/sched/sch_tbf.c:334) sch_tbf [ 88.811208] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036) [ 88.811484] netif_set_real_num_tx_queues (./include/linux/spinlock.h:396 ./include/net/sch_generic.h:768 net/core/dev.c:2958) [ 88.811870] __tun_detach (drivers/net/tun.c:590 drivers/net/tun.c:673) [ 88.812271] tun_chr_close (drivers/net/tun.c:702 drivers/net/tun.c:3517) [ 88.812505] __fput (fs/file_table.c:432 (discriminator 1)) [ 88.812735] task_work_run (kernel/task_work.c:230) [ 88.813016] do_exit (kernel/exit.c:940) [ 88.813372] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:58 (discriminator 4)) [ 88.813639] ? handle_mm_fault (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/memcontrol.h:1022 ./include/linux/memcontrol.h:1045 ./include/linux/memcontrol.h:1052 mm/memory.c:5928 mm/memory.c:6088) [ 88.813867] do_group_exit (kernel/exit.c:1070) [ 88.814138] __x64_sys_exit_group (kernel/exit.c:1099) [ 88.814490] x64_sys_call (??:?) [ 88.814791] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 88.815012] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 88.815495] RIP: 0033:0x7f44560f1975 Fixes: 175f9c1bba9b ("net_sched: Add size table for qdiscs") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://patch.msgid.link/20241007184130.3960565-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/net/sch_generic.h | 1 - net/sched/sch_api.c | 7 ++++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index efacdfee3702..6b6e6e1a2a48 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -838,7 +838,6 @@ static inline void qdisc_calculate_pkt_len(struct sk_buff *skb, static inline int qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) { - qdisc_calculate_pkt_len(skb, sch); return sch->enqueue(skb, sch, to_free); } diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index cfb4904ee540..efd109652f22 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -590,7 +590,6 @@ void __qdisc_calculate_pkt_len(struct sk_buff *skb, pkt_len = 1; qdisc_skb_cb(skb)->pkt_len = pkt_len; } -EXPORT_SYMBOL(__qdisc_calculate_pkt_len); void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc) { @@ -1120,6 +1119,12 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent, return -EINVAL; } + if (new && + !(parent->flags & TCQ_F_MQROOT) && + rcu_access_pointer(new->stab)) { + NL_SET_ERR_MSG(extack, "STAB not supported on a non root"); + return -EINVAL; + } err = cops->graft(parent, cl, new, &old, extack); if (err) return err; -- 2.34.1

2 1

[PATCH OLK-5.10] net: ethernet: lantiq_etop: fix memory disclosure
by Wang Liang 29 Nov '24

29 Nov '24

From: Aleksander Jan Bajkowski <olek2(a)wp.pl> stable inclusion from stable-v5.10.227 commit 185df159843d30fb71f821e7ea4368c2a3bfcd36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCJ CVE: CVE-2024-49997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 45c0de18ff2dc9af01236380404bbd6a46502c69 ] When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer. In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions. Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied. Fixes: 504d4721ee8e ("MIPS: Lantiq: Add ethernet driver") Signed-off-by: Aleksander Jan Bajkowski <olek2(a)wp.pl> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Link: https://patch.msgid.link/20240923214949.231511-2-olek2@wp.pl Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/lantiq_etop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c index 1d7c0b872c59..45155023a298 100644 --- a/drivers/net/ethernet/lantiq_etop.c +++ b/drivers/net/ethernet/lantiq_etop.c @@ -464,7 +464,9 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev) unsigned long flags; u32 byte_offset; - len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len; + if (skb_put_padto(skb, ETH_ZLEN)) + return NETDEV_TX_OK; + len = skb->len; if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) { netdev_err(dev, "tx ring full\n"); -- 2.34.1

2 1

[PATCH OLK-5.10] net: Fix an unsafe loop on the list
by Wang Liang 29 Nov '24

29 Nov '24

From: Anastasia Kovaleva <a.kovaleva(a)yadro.com> stable inclusion from stable-v5.10.227 commit 68ad5da6ca630a276f0a5c924179e57724d00013 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDW CVE: CVE-2024-50024 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1dae9f1187189bc09ff6d25ca97ead711f7e26f9 upstream. The kernel may crash when deleting a genetlink family if there are still listeners for that family: Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0 LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0 Call Trace: __netlink_clear_multicast_users+0x74/0xc0 genl_unregister_family+0xd4/0x2d0 Change the unsafe loop on the list to a safe one, because inside the loop there is an element removal from this list. Fixes: b8273570f802 ("genetlink: fix netns vs. netlink table locking (2)") Cc: stable(a)vger.kernel.org Signed-off-by: Anastasia Kovaleva <a.kovaleva(a)yadro.com> Reviewed-by: Dmitry Bogdanov <d.bogdanov(a)yadro.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20241003104431.12391-1-a.kovaleva@yadro.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/net/sock.h | 2 ++ net/netlink/af_netlink.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/include/net/sock.h b/include/net/sock.h index 1438f332edf6..30e128286a86 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -857,6 +857,8 @@ static inline void sk_add_bind_node(struct sock *sk, hlist_for_each_entry_safe(__sk, tmp, list, sk_node) #define sk_for_each_bound(__sk, list) \ hlist_for_each_entry(__sk, list, sk_bind_node) +#define sk_for_each_bound_safe(__sk, tmp, list) \ + hlist_for_each_entry_safe(__sk, tmp, list, sk_bind_node) /** * sk_for_each_entry_offset_rcu - iterate over a list at a given struct offset diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index f1406502c3d3..836fa113d785 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -2155,8 +2155,9 @@ void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group) { struct sock *sk; struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; + struct hlist_node *tmp; - sk_for_each_bound(sk, &tbl->mc_list) + sk_for_each_bound_safe(sk, tmp, &tbl->mc_list) netlink_update_socket_mc(nlk_sk(sk), group, 0); } -- 2.34.1

2 1

[PATCH OLK-5.10] net: stmmac: Fix zero-division error when disabling tc cbs
by Wang Liang 29 Nov '24

29 Nov '24

From: KhaiWenTan <khai.wen.tan(a)linux.intel.com> stable inclusion from stable-v5.10.227 commit e33fe25b1efe4f2e6a5858786dbc82ae4c44ed4c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8Y CVE: CVE-2024-49977 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 675faf5a14c14a2be0b870db30a70764df81e2df upstream. The commit b8c43360f6e4 ("net: stmmac: No need to calculate speed divider when offload is disabled") allows the "port_transmit_rate_kbps" to be set to a value of 0, which is then passed to the "div_s64" function when tc-cbs is disabled. This leads to a zero-division error. When tc-cbs is disabled, the idleslope, sendslope, and credit values the credit values are not required to be configured. Therefore, adding a return statement after setting the txQ mode to DCB when tc-cbs is disabled would prevent a zero-division error. Fixes: b8c43360f6e4 ("net: stmmac: No need to calculate speed divider when offload is disabled") Cc: <stable(a)vger.kernel.org> Co-developed-by: Choong Yong Liang <yong.liang.choong(a)linux.intel.com> Signed-off-by: Choong Yong Liang <yong.liang.choong(a)linux.intel.com> Signed-off-by: KhaiWenTan <khai.wen.tan(a)linux.intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20240918061422.1589662-1-khai.wen.tan@linux.intel.… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c index 2429c57fa452..5afa592a8cdf 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c @@ -362,6 +362,7 @@ static int tc_setup_cbs(struct stmmac_priv *priv, return ret; priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB; + return 0; } /* Final adjustments for HW */ -- 2.34.1

2 1

[PATCH OLK-5.10] sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
by Wang Liang 29 Nov '24

29 Nov '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v5.10.227 commit dd70c8a89ef99c3d53127fe19e51ef47c3f860fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCU CVE: CVE-2024-49944 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8beee4d8dee76b67c75dc91fd8185d91e845c160 ] In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason. Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline] Fixes: 5e8f3f703ae4 ("sctp: simplify sctp listening code") Reported-by: syzbot+f4e0f821e3a3b7cee51d(a)syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Link: https://patch.msgid.link/a93e655b3c153dc8945d7a812e6d8ab0d52b7aa0.172772939… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 46fb5840ce82..5ffa7515903b 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -8282,8 +8282,10 @@ static int sctp_listen_start(struct sock *sk, int backlog) */ inet_sk_set_state(sk, SCTP_SS_LISTENING); if (!ep->base.bind_addr.port) { - if (sctp_autobind(sk)) + if (sctp_autobind(sk)) { + inet_sk_set_state(sk, SCTP_SS_CLOSED); return -EAGAIN; + } } else { if (sctp_get_port(sk, inet_sk(sk)->inet_num)) { inet_sk_set_state(sk, SCTP_SS_CLOSED); -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
by Wang Liang 29 Nov '24

29 Nov '24

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v5.10.227 commit b02eb7c86ff2ef1411c3095ec8a52b13f68db04f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA2 CVE: CVE-2024-49938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94745807f3ebd379f23865e6dab196f220664179 ] Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call. The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it. Reported-by: syzbot+98afa303be379af6cdb2(a)syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240812142447.12328-1-toke@toke.dk Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index e0130beb304d..6c73c0c0b82a 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -718,8 +718,7 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb) } resubmit: - skb_reset_tail_pointer(skb); - skb_trim(skb, 0); + __skb_set_length(skb, 0); usb_anchor_urb(urb, &hif_dev->rx_submitted); ret = usb_submit_urb(urb, GFP_ATOMIC); @@ -756,8 +755,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb) case -ESHUTDOWN: goto free_skb; default: - skb_reset_tail_pointer(skb); - skb_trim(skb, 0); + __skb_set_length(skb, 0); goto resubmit; } -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: ath11k: fix array out-of-bound access in SoC stats
by Wang Liang 29 Nov '24

29 Nov '24

From: Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> stable inclusion from stable-v5.10.227 commit 0f26f26944035ec67546a944f182cbad6577a9c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8M CVE: CVE-2024-49930 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 69f253e46af98af17e3efa3e5dfa72fcb7d1983d ] Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by: Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240704070811.4186543-3-quic_periyasa@quicinc.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index a50325f4634b..89d90be0ba9c 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -2600,7 +2600,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id, if (push_reason != HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION) { dev_kfree_skb_any(msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++; continue; } -- 2.34.1

2 1

[openeuler:OLK-6.6 1484/1484] drivers/md/dm-cache-metadata.c:1729:9: warning: 'strncpy' specified bound 16 equals destination size
by kernel test robot 29 Nov '24

29 Nov '24

Hi Feiyang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 95bc69473a373c2e578d4fc39734e5811a03ead3 commit: 2363088eba2ecccfb643725e4864af73c4226a04 [1484/1484] LoongArch: Allow building with kcov coverage config: loongarch-randconfig-001-20241119 (https://download.01.org/0day-ci/archive/20241129/202411291031.9VhI0eVO-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241129/202411291031.9VhI0eVO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411291031.9VhI0eVO-lkp@intel.com/ All warnings (new ones prefixed by >>): In function 'write_hints', inlined from 'dm_cache_write_hints' at drivers/md/dm-cache-metadata.c:1753:6: >> drivers/md/dm-cache-metadata.c:1729:9: warning: 'strncpy' specified bound 16 equals destination size [-Wstringop-truncation] 1729 | strncpy(cmd->policy_name, policy_name, sizeof(cmd->policy_name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/strncpy +1729 drivers/md/dm-cache-metadata.c 4e781b498ee500 Joe Thornber 2016-09-15 1713 4e781b498ee500 Joe Thornber 2016-09-15 1714 /* 4e781b498ee500 Joe Thornber 2016-09-15 1715 * It's quicker to always delete the hint array, and recreate with 4e781b498ee500 Joe Thornber 2016-09-15 1716 * dm_array_new(). 4e781b498ee500 Joe Thornber 2016-09-15 1717 */ 4e781b498ee500 Joe Thornber 2016-09-15 1718 static int write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy *policy) c6b4fcbad044e6 Joe Thornber 2013-03-01 1719 { c6b4fcbad044e6 Joe Thornber 2013-03-01 1720 int r; c6b4fcbad044e6 Joe Thornber 2013-03-01 1721 size_t hint_size; c6b4fcbad044e6 Joe Thornber 2013-03-01 1722 const char *policy_name = dm_cache_policy_get_name(policy); 86a3238c7b9b75 Heinz Mauelshagen 2023-01-25 1723 const unsigned int *policy_version = dm_cache_policy_get_version(policy); c6b4fcbad044e6 Joe Thornber 2013-03-01 1724 c6b4fcbad044e6 Joe Thornber 2013-03-01 1725 if (!policy_name[0] || c6b4fcbad044e6 Joe Thornber 2013-03-01 1726 (strlen(policy_name) > sizeof(cmd->policy_name) - 1)) c6b4fcbad044e6 Joe Thornber 2013-03-01 1727 return -EINVAL; c6b4fcbad044e6 Joe Thornber 2013-03-01 1728 c6b4fcbad044e6 Joe Thornber 2013-03-01 @1729 strncpy(cmd->policy_name, policy_name, sizeof(cmd->policy_name)); 4e7f506f642963 Mike Snitzer 2013-03-20 1730 memcpy(cmd->policy_version, policy_version, sizeof(cmd->policy_version)); c6b4fcbad044e6 Joe Thornber 2013-03-01 1731 c6b4fcbad044e6 Joe Thornber 2013-03-01 1732 hint_size = dm_cache_policy_get_hint_size(policy); c6b4fcbad044e6 Joe Thornber 2013-03-01 1733 if (!hint_size) c6b4fcbad044e6 Joe Thornber 2013-03-01 1734 return 0; /* short-circuit hints initialization */ c6b4fcbad044e6 Joe Thornber 2013-03-01 1735 cmd->policy_hint_size = hint_size; c6b4fcbad044e6 Joe Thornber 2013-03-01 1736 c6b4fcbad044e6 Joe Thornber 2013-03-01 1737 if (cmd->hint_root) { c6b4fcbad044e6 Joe Thornber 2013-03-01 1738 r = dm_array_del(&cmd->hint_info, cmd->hint_root); c6b4fcbad044e6 Joe Thornber 2013-03-01 1739 if (r) c6b4fcbad044e6 Joe Thornber 2013-03-01 1740 return r; c6b4fcbad044e6 Joe Thornber 2013-03-01 1741 } c6b4fcbad044e6 Joe Thornber 2013-03-01 1742 4e781b498ee500 Joe Thornber 2016-09-15 1743 return dm_array_new(&cmd->hint_info, &cmd->hint_root, c6b4fcbad044e6 Joe Thornber 2013-03-01 1744 from_cblock(cmd->cache_blocks), 4e781b498ee500 Joe Thornber 2016-09-15 1745 get_hint, policy); 0596661f0a16d9 Joe Thornber 2014-04-03 1746 } 0596661f0a16d9 Joe Thornber 2014-04-03 1747 :::::: The code at line 1729 was first introduced by commit :::::: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 dm: add cache target :::::: TO: Joe Thornber <ejt(a)redhat.com> :::::: CC: Alasdair G Kergon <agk(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] genirq/proc: Fix warning of no previous prototype for register_irqchip_proc()
by Jinjie Ruan 29 Nov '24

29 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/IB6JLE -------------------------------- Fix the following warnings by add the proper header. kernel/irq/proc.c:334:13: warning: no previous prototype for function 'register_irqchip_proc' [-Wmissing-prototypes] 334 | void __weak register_irqchip_proc(struct irq_desc *desc, void *irqp) { } | ^ kernel/irq/proc.c:334:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 334 | void __weak register_irqchip_proc(struct irq_desc *desc, void *irqp) { } | ^ | static kernel/irq/proc.c:335:13: warning: no previous prototype for function 'unregister_irqchip_proc' [-Wmissing-prototypes] 335 | void __weak unregister_irqchip_proc(struct irq_desc *desc) { } | ^ kernel/irq/proc.c:335:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 335 | void __weak unregister_irqchip_proc(struct irq_desc *desc) { } | ^ | static 2 warnings generated. Fixes: 3053668e6b21 ("arm64: Introduce Xint software solution") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- kernel/irq/proc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c index 0fdfde11ab81..2bb1769cf432 100644 --- a/kernel/irq/proc.c +++ b/kernel/irq/proc.c @@ -13,6 +13,10 @@ #include <linux/kernel_stat.h> #include <linux/mutex.h> +#ifdef CONFIG_FAST_IRQ +#include <linux/irqchip/arm-gic-v3.h> +#endif + #include "internals.h" /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-50236
by Wang Liang 29 Nov '24

29 Nov '24

Manikanta Pubbisetty (1): wifi: ath10k: Fix memory leak in management tx Rakesh Pillai (1): ath10k: Remove msdu from idr when management pkt send fails drivers/net/wireless/ath/ath10k/mac.c | 3 +++ drivers/net/wireless/ath/ath10k/wmi-ops.h | 10 ++++++++++ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 20 ++++++++++++++++++++ drivers/net/wireless/ath/ath10k/wmi.c | 2 ++ 4 files changed, 35 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] wifi: ath10k: Fix memory leak in management tx
by Wang Liang 29 Nov '24

29 Nov '24

From: Manikanta Pubbisetty <quic_mpubbise(a)quicinc.com> stable inclusion from stable-v5.10.229 commit 4112450da7d67b59ccedc2208bae622db17dbcb8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AQ CVE: CVE-2024-50236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e15d84b3bba187aa372dff7c58ce1fd5cb48a076 upstream. In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during management TX completion. Similar leaks are seen in the management TX cleanup logic. Kmemleak reports this problem as below, unreferenced object 0xffffff80b64ed250 (size 16): comm "kworker/u16:7", pid 148, jiffies 4294687130 (age 714.199s) hex dump (first 16 bytes): 00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00 .+.......t...... backtrace: [<ffffffe6e7b245dc>] __kmem_cache_alloc_node+0x1e4/0x2d8 [<ffffffe6e7adde88>] kmalloc_trace+0x48/0x110 [<ffffffe6bbd765fc>] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core] [<ffffffe6bbd3eed4>] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core] [<ffffffe6e78d5974>] process_scheduled_works+0x1ac/0x400 [<ffffffe6e78d60b8>] worker_thread+0x208/0x328 [<ffffffe6e78dc890>] kthread+0x100/0x1c0 [<ffffffe6e78166c0>] ret_from_fork+0x10/0x20 Free the memory during completion and cleanup to fix the leak. Protect the mgmt_pending_tx idr_remove() operation in ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar->data_lock similar to other instances. Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 Fixes: dc405152bb64 ("ath10k: handle mgmt tx completion event") Fixes: c730c477176a ("ath10k: Remove msdu from idr when management pkt send fails") Cc: stable(a)vger.kernel.org Signed-off-by: Manikanta Pubbisetty <quic_mpubbise(a)quicinc.com> Link: https://patch.msgid.link/20241015064103.6060-1-quic_mpubbise@quicinc.com Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 7 ++++++- drivers/net/wireless/ath/ath10k/wmi.c | 2 ++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c index 0eeb74245372..7e65788238bb 100644 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c @@ -3035,9 +3035,14 @@ ath10k_wmi_tlv_op_cleanup_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu) { struct ath10k_skb_cb *cb = ATH10K_SKB_CB(msdu); + struct ath10k_mgmt_tx_pkt_addr *pkt_addr; struct ath10k_wmi *wmi = &ar->wmi; - idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); + spin_lock_bh(&ar->data_lock); + pkt_addr = idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); + spin_unlock_bh(&ar->data_lock); + + kfree(pkt_addr); return 0; } diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c index 85fe855ece09..77bd00d933c0 100644 --- a/drivers/net/wireless/ath/ath10k/wmi.c +++ b/drivers/net/wireless/ath/ath10k/wmi.c @@ -2420,6 +2420,7 @@ wmi_process_mgmt_tx_comp(struct ath10k *ar, struct mgmt_tx_compl_params *param) dma_unmap_single(ar->dev, pkt_addr->paddr, msdu->len, DMA_TO_DEVICE); info = IEEE80211_SKB_CB(msdu); + kfree(pkt_addr); if (param->status) { info->flags &= ~IEEE80211_TX_STAT_ACK; @@ -9561,6 +9562,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pending(int msdu_id, void *ptr, dma_unmap_single(ar->dev, pkt_addr->paddr, msdu->len, DMA_TO_DEVICE); ieee80211_free_txskb(ar->hw, msdu); + kfree(pkt_addr); return 0; } -- 2.34.1

2 1