- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 46d28312ab3cc0cfe7e8dea2f41d22fe4ac35e67
by kernel test robot 29 Aug '24

29 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 46d28312ab3cc0cfe7e8dea2f41d22fe4ac35e67 !11185 kobject_uevent: Fix OOB access within zap_modalias_env() elapsed time: 748m configs tested: 19 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240829 gcc-14.1.0 arm64 randconfig-002-20240829 gcc-14.1.0 arm64 randconfig-003-20240829 gcc-14.1.0 arm64 randconfig-004-20240829 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240829 clang-18 x86_64 buildonly-randconfig-002-20240829 gcc-12 x86_64 buildonly-randconfig-003-20240829 clang-18 x86_64 buildonly-randconfig-004-20240829 gcc-12 x86_64 buildonly-randconfig-005-20240829 gcc-12 x86_64 buildonly-randconfig-006-20240829 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240829 clang-18 x86_64 randconfig-002-20240829 clang-18 x86_64 randconfig-003-20240829 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20748/23581] drivers/block/.tmp_nbd.o: warning: objtool: nbd_alloc_and_init_config()+0x165: unreachable instruction
by kernel test robot 29 Aug '24

29 Aug '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 46d28312ab3cc0cfe7e8dea2f41d22fe4ac35e67 commit: 9d0422bf311dfb36617e4d8f7367a3e7dc9179ec [20748/23581] nbd: fold nbd config initialization into nbd_alloc_config() config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240829/202408290453.uMJshGum-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240829/202408290453.uMJshGum-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408290453.uMJshGum-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/block/nbd.c:17: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. >> drivers/block/.tmp_nbd.o: warning: objtool: nbd_alloc_and_init_config()+0x165: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19673/23581] net/bpf/.tmp_test_run.o: warning: objtool: bpf_prog_test_run_skb()+0x3b2: unreachable instruction
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 46d28312ab3cc0cfe7e8dea2f41d22fe4ac35e67 commit: 47e8d3acb59547baba8a14b65b4c11aef372e263 [19673/23581] bpf: Don't redirect packets with invalid pkt_len config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240828/202408282340.JcOrudl8-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408282340.JcOrudl8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408282340.JcOrudl8-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/bpf/.tmp_test_run.o: warning: objtool: bpf_prog_test_run_skb()+0x3b2: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

openEuler Kernel SIG双周例会
by openEuler conference 28 Aug '24

28 Aug '24

您好！ Kernel 邀请您参加 2024-08-30 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（可回复此邮件申请，也可直接填写至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/966225488 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-08-30 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（可回复此邮件申请，也可直接填写至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/966225488. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10] padata: Fix possible divide-by-0 panic in padata_mt_helper()
by He Yujie 28 Aug '24

28 Aug '24

From: Waiman Long <longman(a)redhat.com> stable inclusion from stable-v5.10.224 commit ab8b397d5997d8c37610252528edc54bebf9f6d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAN6XR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6d45e1c948a8b7ed6ceddb14319af69424db730c upstream. We are hit with a not easily reproducible divide-by-0 panic in padata.c at bootup time. [ 10.017908] Oops: divide error: 0000 1 PREEMPT SMP NOPTI [ 10.017908] CPU: 26 PID: 2627 Comm: kworker/u1666:1 Not tainted 6.10.0-15.el10.x86_64 #1 [ 10.017908] Hardware name: Lenovo ThinkSystem SR950 [7X12CTO1WW]/[7X12CTO1WW], BIOS [PSE140J-2.30] 07/20/2021 [ 10.017908] Workqueue: events_unbound padata_mt_helper [ 10.017908] RIP: 0010:padata_mt_helper+0x39/0xb0 : [ 10.017963] Call Trace: [ 10.017968] <TASK> [ 10.018004] ? padata_mt_helper+0x39/0xb0 [ 10.018084] process_one_work+0x174/0x330 [ 10.018093] worker_thread+0x266/0x3a0 [ 10.018111] kthread+0xcf/0x100 [ 10.018124] ret_from_fork+0x31/0x50 [ 10.018138] ret_from_fork_asm+0x1a/0x30 [ 10.018147] </TASK> Looking at the padata_mt_helper() function, the only way a divide-by-0 panic can happen is when ps->chunk_size is 0. The way that chunk_size is initialized in padata_do_multithreaded(), chunk_size can be 0 when the min_chunk in the passed-in padata_mt_job structure is 0. Fix this divide-by-0 panic by making sure that chunk_size will be at least 1 no matter what the input parameters are. Link: https://lkml.kernel.org/r/20240806174647.1050398-1-longman@redhat.com Fixes: 004ed42638f4 ("padata: add basic support for multithreaded jobs") Signed-off-by: Waiman Long <longman(a)redhat.com> Cc: Daniel Jordan <daniel.m.jordan(a)oracle.com> Cc: Steffen Klassert <steffen.klassert(a)secunet.com> Cc: Waiman Long <longman(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/padata.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/padata.c b/kernel/padata.c index fdcd78302cd7..7b8d92f44b16 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -521,6 +521,13 @@ void __init padata_do_multithreaded(struct padata_mt_job *job) ps.chunk_size = max(ps.chunk_size, job->min_chunk); ps.chunk_size = roundup(ps.chunk_size, job->align); + /* + * chunk_size can be 0 if the caller sets min_chunk to 0. So force it + * to at least 1 to prevent divide-by-0 panic in padata_mt_helper().` + */ + if (!ps.chunk_size) + ps.chunk_size = 1U; + list_for_each_entry(pw, &works, pw_list) queue_work(system_unbound_wq, &pw->pw_work); -- 2.34.1

2 1

[PATCH OLK-5.10] padata: Fix possible divide-by-0 panic in padata_mt_helper()
by He Yujie 28 Aug '24

28 Aug '24

From: Waiman Long <longman(a)redhat.com> stable inclusion form stable-v5.10.224 commit ab8b397d5997d8c37610252528edc54bebf9f6d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAN6XR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6d45e1c948a8b7ed6ceddb14319af69424db730c upstream. We are hit with a not easily reproducible divide-by-0 panic in padata.c at bootup time. [ 10.017908] Oops: divide error: 0000 1 PREEMPT SMP NOPTI [ 10.017908] CPU: 26 PID: 2627 Comm: kworker/u1666:1 Not tainted 6.10.0-15.el10.x86_64 #1 [ 10.017908] Hardware name: Lenovo ThinkSystem SR950 [7X12CTO1WW]/[7X12CTO1WW], BIOS [PSE140J-2.30] 07/20/2021 [ 10.017908] Workqueue: events_unbound padata_mt_helper [ 10.017908] RIP: 0010:padata_mt_helper+0x39/0xb0 : [ 10.017963] Call Trace: [ 10.017968] <TASK> [ 10.018004] ? padata_mt_helper+0x39/0xb0 [ 10.018084] process_one_work+0x174/0x330 [ 10.018093] worker_thread+0x266/0x3a0 [ 10.018111] kthread+0xcf/0x100 [ 10.018124] ret_from_fork+0x31/0x50 [ 10.018138] ret_from_fork_asm+0x1a/0x30 [ 10.018147] </TASK> Looking at the padata_mt_helper() function, the only way a divide-by-0 panic can happen is when ps->chunk_size is 0. The way that chunk_size is initialized in padata_do_multithreaded(), chunk_size can be 0 when the min_chunk in the passed-in padata_mt_job structure is 0. Fix this divide-by-0 panic by making sure that chunk_size will be at least 1 no matter what the input parameters are. Link: https://lkml.kernel.org/r/20240806174647.1050398-1-longman@redhat.com Fixes: 004ed42638f4 ("padata: add basic support for multithreaded jobs") Signed-off-by: Waiman Long <longman(a)redhat.com> Cc: Daniel Jordan <daniel.m.jordan(a)oracle.com> Cc: Steffen Klassert <steffen.klassert(a)secunet.com> Cc: Waiman Long <longman(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/padata.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/padata.c b/kernel/padata.c index fdcd78302cd7..7b8d92f44b16 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -521,6 +521,13 @@ void __init padata_do_multithreaded(struct padata_mt_job *job) ps.chunk_size = max(ps.chunk_size, job->min_chunk); ps.chunk_size = roundup(ps.chunk_size, job->align); + /* + * chunk_size can be 0 if the caller sets min_chunk to 0. So force it + * to at least 1 to prevent divide-by-0 panic in padata_mt_helper().` + */ + if (!ps.chunk_size) + ps.chunk_size = 1U; + list_for_each_entry(pw, &works, pw_list) queue_work(system_unbound_wq, &pw->pw_work); -- 2.34.1

2 1

[PATCH OLK-5.10] padata: Fix possible divide-by-0 panic in padata_mt_helper()
by He Yujie 28 Aug '24

28 Aug '24

From: Waiman Long <longman(a)redhat.com> stable inclusion form stable-v5.10.224~30 commit ab8b397d5997d8c37610252528edc54bebf9f6d3 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAN6XR Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6d45e1c948a8b7ed6ceddb14319af69424db730c upstream. We are hit with a not easily reproducible divide-by-0 panic in padata.c at bootup time. [ 10.017908] Oops: divide error: 0000 1 PREEMPT SMP NOPTI [ 10.017908] CPU: 26 PID: 2627 Comm: kworker/u1666:1 Not tainted 6.10.0-15.el10.x86_64 #1 [ 10.017908] Hardware name: Lenovo ThinkSystem SR950 [7X12CTO1WW]/[7X12CTO1WW], BIOS [PSE140J-2.30] 07/20/2021 [ 10.017908] Workqueue: events_unbound padata_mt_helper [ 10.017908] RIP: 0010:padata_mt_helper+0x39/0xb0 : [ 10.017963] Call Trace: [ 10.017968] <TASK> [ 10.018004] ? padata_mt_helper+0x39/0xb0 [ 10.018084] process_one_work+0x174/0x330 [ 10.018093] worker_thread+0x266/0x3a0 [ 10.018111] kthread+0xcf/0x100 [ 10.018124] ret_from_fork+0x31/0x50 [ 10.018138] ret_from_fork_asm+0x1a/0x30 [ 10.018147] </TASK> Looking at the padata_mt_helper() function, the only way a divide-by-0 panic can happen is when ps->chunk_size is 0. The way that chunk_size is initialized in padata_do_multithreaded(), chunk_size can be 0 when the min_chunk in the passed-in padata_mt_job structure is 0. Fix this divide-by-0 panic by making sure that chunk_size will be at least 1 no matter what the input parameters are. Link: https://lkml.kernel.org/r/20240806174647.1050398-1-longman@redhat.com Fixes: 004ed42638f4 ("padata: add basic support for multithreaded jobs") Signed-off-by: Waiman Long <longman(a)redhat.com> Cc: Daniel Jordan <daniel.m.jordan(a)oracle.com> Cc: Steffen Klassert <steffen.klassert(a)secunet.com> Cc: Waiman Long <longman(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/padata.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/padata.c b/kernel/padata.c index fdcd78302cd7..7b8d92f44b16 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -521,6 +521,13 @@ void __init padata_do_multithreaded(struct padata_mt_job *job) ps.chunk_size = max(ps.chunk_size, job->min_chunk); ps.chunk_size = roundup(ps.chunk_size, job->align); + /* + * chunk_size can be 0 if the caller sets min_chunk to 0. So force it + * to at least 1 to prevent divide-by-0 panic in padata_mt_helper().` + */ + if (!ps.chunk_size) + ps.chunk_size = 1U; + list_for_each_entry(pw, &works, pw_list) queue_work(system_unbound_wq, &pw->pw_work); -- 2.34.1

2 1

[PATCH OLK-5.10] padata: Fix possible divide-by-0 panic in padata_mt_helper()
by He Yujie 28 Aug '24

28 Aug '24

From: Waiman Long <longman(a)redhat.com> stable inclusion form stable-v5.10.224~30 commit ab8b397d5997d8c37610252528edc54bebf9f6d3 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAN6XR Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6d45e1c948a8b7ed6ceddb14319af69424db730c upstream. We are hit with a not easily reproducible divide-by-0 panic in padata.c at bootup time. [ 10.017908] Oops: divide error: 0000 1 PREEMPT SMP NOPTI [ 10.017908] CPU: 26 PID: 2627 Comm: kworker/u1666:1 Not tainted 6.10.0-15.el10.x86_64 #1 [ 10.017908] Hardware name: Lenovo ThinkSystem SR950 [7X12CTO1WW]/[7X12CTO1WW], BIOS [PSE140J-2.30] 07/20/2021 [ 10.017908] Workqueue: events_unbound padata_mt_helper [ 10.017908] RIP: 0010:padata_mt_helper+0x39/0xb0 : [ 10.017963] Call Trace: [ 10.017968] <TASK> [ 10.018004] ? padata_mt_helper+0x39/0xb0 [ 10.018084] process_one_work+0x174/0x330 [ 10.018093] worker_thread+0x266/0x3a0 [ 10.018111] kthread+0xcf/0x100 [ 10.018124] ret_from_fork+0x31/0x50 [ 10.018138] ret_from_fork_asm+0x1a/0x30 [ 10.018147] </TASK> Looking at the padata_mt_helper() function, the only way a divide-by-0 panic can happen is when ps->chunk_size is 0. The way that chunk_size is initialized in padata_do_multithreaded(), chunk_size can be 0 when the min_chunk in the passed-in padata_mt_job structure is 0. Fix this divide-by-0 panic by making sure that chunk_size will be at least 1 no matter what the input parameters are. Link: https://lkml.kernel.org/r/20240806174647.1050398-1-longman@redhat.com Fixes: 004ed42638f4 ("padata: add basic support for multithreaded jobs") Signed-off-by: Waiman Long <longman(a)redhat.com> Cc: Daniel Jordan <daniel.m.jordan(a)oracle.com> Cc: Steffen Klassert <steffen.klassert(a)secunet.com> Cc: Waiman Long <longman(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/padata.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/padata.c b/kernel/padata.c index fdcd78302cd7..7b8d92f44b16 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -521,6 +521,13 @@ void __init padata_do_multithreaded(struct padata_mt_job *job) ps.chunk_size = max(ps.chunk_size, job->min_chunk); ps.chunk_size = roundup(ps.chunk_size, job->align); + /* + * chunk_size can be 0 if the caller sets min_chunk to 0. So force it + * to at least 1 to prevent divide-by-0 panic in padata_mt_helper().` + */ + if (!ps.chunk_size) + ps.chunk_size = 1U; + list_for_each_entry(pw, &works, pw_list) queue_work(system_unbound_wq, &pw->pw_work); -- 2.34.1

2 1

[openeuler:OLK-5.10 26961/30000] drivers/ub/urma/ubcore/ubcore_device.c:1329:5: warning: no previous prototype for function 'ubcore_dispatch_event'
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: cf3b556dcd03b687660affb4acd63c75beab067b commit: f1753f8b17480bdb750cbd33fbaa358aef5dbb23 [26961/30000] urma: upload kernel patch for 20240219_Spring config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240828/202408281931.u9ypTWBv-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281931.u9ypTWBv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281931.u9ypTWBv-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_device.c:352:6: warning: no previous prototype for function 'ubcore_destroy_upi_list' [-Wmissing-prototypes] 352 | void ubcore_destroy_upi_list(struct ubcore_device *dev) | ^ drivers/ub/urma/ubcore/ubcore_device.c:352:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 352 | void ubcore_destroy_upi_list(struct ubcore_device *dev) | ^ | static drivers/ub/urma/ubcore/ubcore_device.c:440:23: warning: no previous prototype for function 'ubcore_find_tpf_device_legacy' [-Wmissing-prototypes] 440 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^ drivers/ub/urma/ubcore/ubcore_device.c:440:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 440 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^ | static >> drivers/ub/urma/ubcore/ubcore_device.c:1329:5: warning: no previous prototype for function 'ubcore_dispatch_event' [-Wmissing-prototypes] 1329 | int ubcore_dispatch_event(struct ubcore_event *event) | ^ drivers/ub/urma/ubcore/ubcore_device.c:1329:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1329 | int ubcore_dispatch_event(struct ubcore_event *event) | ^ | static drivers/ub/urma/ubcore/ubcore_device.c:1454:6: warning: no previous prototype for function 'ubcore_dev_accessible' [-Wmissing-prototypes] 1454 | bool ubcore_dev_accessible(struct ubcore_device *dev) | ^ drivers/ub/urma/ubcore/ubcore_device.c:1454:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1454 | bool ubcore_dev_accessible(struct ubcore_device *dev) | ^ | static >> drivers/ub/urma/ubcore/ubcore_device.c:2015:6: warning: no previous prototype for function 'ubcore_net_exit' [-Wmissing-prototypes] 2015 | void ubcore_net_exit(struct net *net) | ^ drivers/ub/urma/ubcore/ubcore_device.c:2015:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2015 | void ubcore_net_exit(struct net *net) | ^ | static 5 warnings generated. -- >> drivers/ub/urma/ubcore/ubcore_cdev_file.c:690:5: warning: no previous prototype for function 'ubcore_create_port_attr_files' [-Wmissing-prototypes] 690 | int ubcore_create_port_attr_files(struct ubcore_logic_device *ldev, | ^ drivers/ub/urma/ubcore/ubcore_cdev_file.c:690:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 690 | int ubcore_create_port_attr_files(struct ubcore_logic_device *ldev, | ^ | static drivers/ub/urma/ubcore/ubcore_cdev_file.c:785:5: warning: no previous prototype for function 'ubcore_create_eid_attr_files' [-Wmissing-prototypes] 785 | int ubcore_create_eid_attr_files(struct ubcore_logic_device *ldev, uint32_t eid_num) | ^ drivers/ub/urma/ubcore/ubcore_cdev_file.c:785:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 785 | int ubcore_create_eid_attr_files(struct ubcore_logic_device *ldev, uint32_t eid_num) | ^ | static >> drivers/ub/urma/ubcore/ubcore_cdev_file.c:797:5: warning: no previous prototype for function 'ubcore_create_dev_attr_files' [-Wmissing-prototypes] 797 | int ubcore_create_dev_attr_files(struct ubcore_logic_device *ldev) | ^ drivers/ub/urma/ubcore/ubcore_cdev_file.c:797:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 797 | int ubcore_create_dev_attr_files(struct ubcore_logic_device *ldev) | ^ | static >> drivers/ub/urma/ubcore/ubcore_cdev_file.c:810:6: warning: no previous prototype for function 'ubcore_remove_port_attr_files' [-Wmissing-prototypes] 810 | void ubcore_remove_port_attr_files(struct ubcore_logic_device *ldev, uint8_t port_id) | ^ drivers/ub/urma/ubcore/ubcore_cdev_file.c:810:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 810 | void ubcore_remove_port_attr_files(struct ubcore_logic_device *ldev, uint8_t port_id) | ^ | static drivers/ub/urma/ubcore/ubcore_cdev_file.c:815:6: warning: no previous prototype for function 'ubcore_remove_eid_attr_files' [-Wmissing-prototypes] 815 | void ubcore_remove_eid_attr_files(struct ubcore_logic_device *ldev, uint32_t eid_num) | ^ drivers/ub/urma/ubcore/ubcore_cdev_file.c:815:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 815 | void ubcore_remove_eid_attr_files(struct ubcore_logic_device *ldev, uint32_t eid_num) | ^ | static >> drivers/ub/urma/ubcore/ubcore_cdev_file.c:820:6: warning: no previous prototype for function 'ubcore_remove_dev_attr_files' [-Wmissing-prototypes] 820 | void ubcore_remove_dev_attr_files(struct ubcore_logic_device *ldev) | ^ drivers/ub/urma/ubcore/ubcore_cdev_file.c:820:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 820 | void ubcore_remove_dev_attr_files(struct ubcore_logic_device *ldev) | ^ | static 6 warnings generated. vim +/ubcore_dispatch_event +1329 drivers/ub/urma/ubcore/ubcore_device.c 1328 > 1329 int ubcore_dispatch_event(struct ubcore_event *event) 1330 { 1331 struct ubcore_event_work *l_ubcore_event; 1332 1333 l_ubcore_event = kzalloc(sizeof(*l_ubcore_event), GFP_ATOMIC); 1334 if (!l_ubcore_event) 1335 return -ENOMEM; 1336 1337 INIT_WORK(&l_ubcore_event->work, ubcore_dispatch_event_task); 1338 l_ubcore_event->event = *event; 1339 1340 if (ubcore_queue_work((int)UBCORE_DISPATCH_EVENT_WQ, &l_ubcore_event->work) != 0) { 1341 kfree(l_ubcore_event); 1342 ubcore_log_err("Queue work failed"); 1343 } 1344 1345 return 0; 1346 } 1347 1348 void ubcore_unregister_event_handler(struct ubcore_device *dev, 1349 struct ubcore_event_handler *handler) 1350 { 1351 if (dev == NULL || handler == NULL) { 1352 ubcore_log_err("Invalid argument.\n"); 1353 return; 1354 } 1355 1356 down_write(&dev->event_handler_rwsem); 1357 list_del(&handler->node); 1358 up_write(&dev->event_handler_rwsem); 1359 } 1360 EXPORT_SYMBOL(ubcore_unregister_event_handler); 1361 1362 static bool ubcore_preprocess_event(struct ubcore_event *event) 1363 { 1364 if (event->event_type == UBCORE_EVENT_TP_ERR && event->element.tp != NULL) { 1365 ubcore_log_info("ubcore detect tp error event"); 1366 if (event->ub_dev->transport_type == UBCORE_TRANSPORT_IB) { 1367 ubcore_restore_tp(event->ub_dev, event->element.tp); 1368 } else if (event->ub_dev->transport_type == UBCORE_TRANSPORT_UB) { 1369 if (event->element.tp->state == UBCORE_TP_STATE_ERR || 1370 event->element.tp->state == UBCORE_TP_STATE_RESET) { 1371 ubcore_log_warn("Tp already in state %d, ignore err event", 1372 (int32_t)event->element.tp->state); 1373 return true; 1374 } 1375 1376 if (ubcore_change_tp_to_err(event->ub_dev, event->element.tp) != 0) 1377 ubcore_log_info("ubcore change tp to error failed"); 1378 } 1379 return true; 1380 } else if (event->event_type == UBCORE_EVENT_TP_SUSPEND && event->element.tp != NULL) { 1381 ubcore_log_info("ubcore detect tp suspend event"); 1382 ubcore_report_tp_suspend(event->ub_dev, event->element.tp); 1383 return true; 1384 } else if (event->event_type == UBCORE_EVENT_MIGRATE_VTP_SWITCH && 1385 event->element.vtp != NULL) { 1386 ubcore_log_info("ubcore detect migrate vtp switch event"); 1387 ubcore_report_migrate_vtp(event->ub_dev, event->element.vtp, 1388 UBCORE_EVENT_MIGRATE_VTP_SWITCH); 1389 return true; 1390 } else if (event->event_type == UBCORE_EVENT_MIGRATE_VTP_ROLLBACK && 1391 event->element.vtp != NULL) { 1392 ubcore_log_info("ubcore detect migrate vtp rollback event"); 1393 ubcore_report_migrate_vtp(event->ub_dev, event->element.vtp, 1394 UBCORE_EVENT_MIGRATE_VTP_ROLLBACK); 1395 return true; 1396 } else if (event->event_type == UBCORE_EVENT_TP_FLUSH_DONE && 1397 event->element.tp != NULL) { 1398 ubcore_log_info("ubcore detect tp flush done event"); 1399 if (event->element.tp->state == UBCORE_TP_STATE_RESET) { 1400 ubcore_log_warn("Tp already in state %d, ignore flush done event", 1401 (int32_t)event->element.tp->state); 1402 return true; 1403 } 1404 /* flush done means tp already in error, 1405 * and all pkt have been send need uvs to restore 1406 */ 1407 if (event->ub_dev->transport_type == UBCORE_TRANSPORT_UB) 1408 ubcore_report_tp_error(event->ub_dev, event->element.tp); 1409 return true; 1410 } 1411 return false; 1412 } 1413 1414 void ubcore_dispatch_async_event(struct ubcore_event *event) 1415 { 1416 if (event == NULL || event->ub_dev == NULL) { 1417 ubcore_log_err("Invalid argument.\n"); 1418 return; 1419 } 1420 1421 if (ubcore_preprocess_event(event)) 1422 return; 1423 1424 if (ubcore_dispatch_event(event) != 0) 1425 ubcore_log_err("ubcore_dispatch_event failed"); 1426 } 1427 EXPORT_SYMBOL(ubcore_dispatch_async_event); 1428 1429 static bool ubcore_eid_accessible(struct ubcore_device *dev, uint32_t eid_index) 1430 { 1431 struct net *net; 1432 1433 if (eid_index >= dev->eid_table.eid_cnt) { 1434 ubcore_log_err("eid_indx: %u is over the up limit: %u", 1435 eid_index, dev->eid_table.eid_cnt); 1436 return false; 1437 } 1438 1439 spin_lock(&dev->eid_table.lock); 1440 if (IS_ERR_OR_NULL(dev->eid_table.eid_entries)) { 1441 spin_unlock(&dev->eid_table.lock); 1442 return false; 1443 } 1444 1445 if (!dev->eid_table.eid_entries[eid_index].valid) { 1446 spin_unlock(&dev->eid_table.lock); 1447 return false; 1448 } 1449 net = dev->eid_table.eid_entries[eid_index].net; 1450 spin_unlock(&dev->eid_table.lock); 1451 return net_eq(net, current->nsproxy->net_ns); 1452 } 1453 > 1454 bool ubcore_dev_accessible(struct ubcore_device *dev) 1455 { 1456 return (g_shared_ns || net_eq(current->nsproxy->net_ns, read_pnet(&dev->ldev.net))); 1457 } 1458 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19041/23581] fs/f2fs/.tmp_gc.o: warning: objtool: do_garbage_collect()+0xe35: unreachable instruction
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 46d28312ab3cc0cfe7e8dea2f41d22fe4ac35e67 commit: 584279e21249fcd4d9774a566420de500c90f472 [19041/23581] f2fs: fix to do sanity check on inode type during garbage collection config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240828/202408281910.ImD8ZAp3-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281910.ImD8ZAp3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281910.ImD8ZAp3-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/f2fs/gc.c:13: In file included from include/linux/backing-dev.h:15: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. >> fs/f2fs/.tmp_gc.o: warning: objtool: do_garbage_collect()+0xe35: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 27353/30000] arch/x86/kvm/x86.c:805:5: warning: no previous prototype for function 'kvm_read_guest_page_mmu'
by kernel test robot 28 Aug '24

28 Aug '24

Hi Sean, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 591c3cfd9334124e0c6df438eb2ffb040e6de29e commit: aeaeb4dcb428b870d4207cc0fae7c125b7522406 [27353/30000] KVM: x86: Subsume nested GPA read helper into load_pdptrs() config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20240828/202408281850.dOf6mZes-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281850.dOf6mZes-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281850.dOf6mZes-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kvm/x86.c:805:5: warning: no previous prototype for function 'kvm_read_guest_page_mmu' [-Wmissing-prototypes] 805 | int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, | ^ arch/x86/kvm/x86.c:805:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 805 | int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, | ^ | static arch/x86/kvm/x86.c:900:6: warning: no previous prototype for function 'kvm_post_set_cr0' [-Wmissing-prototypes] 900 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^ arch/x86/kvm/x86.c:900:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 900 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^ | static arch/x86/kvm/x86.c:1081:6: warning: no previous prototype for function 'kvm_post_set_cr4' [-Wmissing-prototypes] 1081 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^ arch/x86/kvm/x86.c:1081:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1081 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^ | static 3 warnings generated. vim +/kvm_read_guest_page_mmu +805 arch/x86/kvm/x86.c 16f8a6f9798ab9a Nadav Amit 2014-10-03 799 ec92fe44e7ff94d Joerg Roedel 2010-09-10 800 /* ec92fe44e7ff94d Joerg Roedel 2010-09-10 801 * This function will be used to read from the physical memory of the currently 54bf36aac520315 Paolo Bonzini 2015-04-08 802 * running guest. The difference to kvm_vcpu_read_guest_page is that this function ec92fe44e7ff94d Joerg Roedel 2010-09-10 803 * can read from guest physical or from the guest's guest physical memory. ec92fe44e7ff94d Joerg Roedel 2010-09-10 804 */ ec92fe44e7ff94d Joerg Roedel 2010-09-10 @805 int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, ec92fe44e7ff94d Joerg Roedel 2010-09-10 806 gfn_t ngfn, void *data, int offset, int len, ec92fe44e7ff94d Joerg Roedel 2010-09-10 807 u32 access) ec92fe44e7ff94d Joerg Roedel 2010-09-10 808 { 54987b7afa902e8 Paolo Bonzini 2014-09-02 809 struct x86_exception exception; ec92fe44e7ff94d Joerg Roedel 2010-09-10 810 gfn_t real_gfn; ec92fe44e7ff94d Joerg Roedel 2010-09-10 811 gpa_t ngpa; ec92fe44e7ff94d Joerg Roedel 2010-09-10 812 ec92fe44e7ff94d Joerg Roedel 2010-09-10 813 ngpa = gfn_to_gpa(ngfn); 54987b7afa902e8 Paolo Bonzini 2014-09-02 814 real_gfn = mmu->translate_gpa(vcpu, ngpa, access, &exception); ec92fe44e7ff94d Joerg Roedel 2010-09-10 815 if (real_gfn == UNMAPPED_GVA) ec92fe44e7ff94d Joerg Roedel 2010-09-10 816 return -EFAULT; ec92fe44e7ff94d Joerg Roedel 2010-09-10 817 ec92fe44e7ff94d Joerg Roedel 2010-09-10 818 real_gfn = gpa_to_gfn(real_gfn); ec92fe44e7ff94d Joerg Roedel 2010-09-10 819 54bf36aac520315 Paolo Bonzini 2015-04-08 820 return kvm_vcpu_read_guest_page(vcpu, real_gfn, data, offset, len); ec92fe44e7ff94d Joerg Roedel 2010-09-10 821 } ec92fe44e7ff94d Joerg Roedel 2010-09-10 822 EXPORT_SYMBOL_GPL(kvm_read_guest_page_mmu); ec92fe44e7ff94d Joerg Roedel 2010-09-10 823 :::::: The code at line 805 was first introduced by commit :::::: ec92fe44e7ff94d04d8305e49efcffd8773e1cf6 KVM: X86: Add kvm_read_guest_page_mmu function :::::: TO: Joerg Roedel <joerg.roedel(a)amd.com> :::::: CC: Avi Kivity <avi(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v2 0/6] Backport smart grid
by Yipeng Zou 28 Aug '24

28 Aug '24

Backport smart grid form OLK-5.10 to openEuler-1.0-LTS Test on kunpeng920 and all DT test case pass. Yipeng Zou (6): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control smart_grid: introducing rebuild_affinity_domain sched: smart_grid: silence complier error drivers/cpufreq/cpufreq.c | 246 +++++++++++++++++++++++++++++++++ fs/proc/base.c | 82 +++++++++++ include/linux/cpufreq.h | 12 ++ include/linux/sched/grid_qos.h | 33 ++++- include/linux/sched/sysctl.h | 1 + kernel/sched/core.c | 28 ++++ kernel/sched/fair.c | 60 +++++++- kernel/sched/grid/qos.c | 127 +++++++++++++++++ kernel/sched/grid/stat.c | 16 +++ kernel/sched/sched.h | 3 + kernel/sysctl.c | 9 ++ 11 files changed, 611 insertions(+), 6 deletions(-) -- 2.34.1

2 7

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

*** BLURB HERE *** Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

CVE-2024-43892 Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

*** BLURB HERE *** Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

CVE-2024-43892 Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

CVE-2024-43892 Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

CVE-2024-43892 Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/6] Backport smart grid
by Yipeng Zou 28 Aug '24

28 Aug '24

Backport smart grid form OLK-5.10 to openEuler-1.0-LTS Yipeng Zou (6): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control smart_grid: introducing rebuild_affinity_domain sched: smart_grid: silence complier error drivers/cpufreq/cpufreq.c | 236 +++++++++++++++++++++++++++++++++ fs/proc/base.c | 78 +++++++++++ include/linux/cpufreq.h | 12 ++ include/linux/sched/grid_qos.h | 33 ++++- include/linux/sched/sysctl.h | 1 + kernel/sched/core.c | 26 ++++ kernel/sched/fair.c | 57 +++++++- kernel/sched/grid/qos.c | 123 +++++++++++++++++ kernel/sched/grid/stat.c | 15 +++ kernel/sched/sched.h | 2 + kernel/sysctl.c | 9 ++ 11 files changed, 586 insertions(+), 6 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 0/1] CVE-2024-43907
by Yongqiang Liu 28 Aug '24

28 Aug '24

Ma Jun (1): drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 7 +++++-- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 14 ++++++++------ .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 7 +++++-- 3 files changed, 18 insertions(+), 10 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-43907
by Yongqiang Liu 28 Aug '24

28 Aug '24

Ma Jun (1): drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 7 +++++-- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 14 ++++++++------ .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 7 +++++-- 3 files changed, 18 insertions(+), 10 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS 0/1] ARM: 9324/1: fix get_user() broken with veneer
by Yuntao Liu 28 Aug '24

28 Aug '24

ARM: 9324/1: fix get_user() broken with veneer Masahiro Yamada (1): ARM: 9324/1: fix get_user() broken with veneer arch/arm/include/asm/uaccess.h | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] efi: fix NULL-deref in init error path
by Gu Bowen 28 Aug '24

28 Aug '24

From: Johan Hovold <johan+linaro(a)kernel.org> stable inclusion from stable-v4.19.320 commit 585a0b2b3ae7903c6abee3087d09c69e955a7794 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIAT CVE: CVE-2022-48879 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 703c13fe3c9af557d312f5895ed6a5fda2711104 ] In cases where runtime services are not supported or have been disabled, the runtime services workqueue will never have been allocated. Do not try to destroy the workqueue unconditionally in the unlikely event that EFI initialisation fails to avoid dereferencing a NULL pointer. Fixes: 98086df8b70c ("efi: add missed destroy_workqueue when efisubsys_init fails") Cc: stable(a)vger.kernel.org Cc: Li Heng <liheng40(a)huawei.com> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/firmware/efi/efi.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 184ad34b9c58..e71037917dd5 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -361,8 +361,8 @@ static int __init efisubsys_init(void) efi_kobj = kobject_create_and_add("efi", firmware_kobj); if (!efi_kobj) { pr_err("efi: Firmware registration failed.\n"); - destroy_workqueue(efi_rts_wq); - return -ENOMEM; + error = -ENOMEM; + goto err_destroy_wq; } error = generic_ops_register(); @@ -398,7 +398,10 @@ static int __init efisubsys_init(void) generic_ops_unregister(); err_put: kobject_put(efi_kobj); - destroy_workqueue(efi_rts_wq); +err_destroy_wq: + if (efi_rts_wq) + destroy_workqueue(efi_rts_wq); + return error; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-43892
by Chen Ridong 28 Aug '24

28 Aug '24

*** BLURB HERE *** Shakeel Butt (1): memcg: protect concurrent access to mem_cgroup_idr mm/memcontrol.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: MGMT: Add error handling to pair_device()
by Zhengchao Shao 28 Aug '24

28 Aug '24

From: Griffin Kroah-Hartman <griffin(a)kroah.com> mainline inclusion from mainline-v6.11-rc5 commit 538fd3921afac97158d4177139a0ad39f056dbb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMK01 CVE: CVE-2024-43884 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function. Cc: Stable <stable(a)kernel.org> Fixes: 5157b8a503fa ("Bluetooth: Fix initializing conn_params in scan phase") Signed-off-by: Griffin Kroah-Hartman <griffin(a)kroah.com> Reported-by: Yiwei Zhang <zhan4630(a)purdue.edu> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/mgmt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 878bf7382244..2b1687485be0 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -2961,6 +2961,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, * will be kept and this function does nothing. */ p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); + if (!p) { + err = -EIO; + goto unlock; + } if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) p->auto_connect = HCI_AUTO_CONN_DISABLED; -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: MGMT: Add error handling to pair_device()
by Zhengchao Shao 28 Aug '24

28 Aug '24

From: Griffin Kroah-Hartman <griffin(a)kroah.com> mainline inclusion from mainline-v6.11-rc5 commit 538fd3921afac97158d4177139a0ad39f056dbb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMK01 CVE: CVE-2024-43884 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function. Cc: Stable <stable(a)kernel.org> Fixes: 5157b8a503fa ("Bluetooth: Fix initializing conn_params in scan phase") Signed-off-by: Griffin Kroah-Hartman <griffin(a)kroah.com> Reported-by: Yiwei Zhang <zhan4630(a)purdue.edu> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/mgmt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index bd8cfcfca7ae..0078e33e12ba 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -2962,6 +2962,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, * will be kept and this function does nothing. */ p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); + if (!p) { + err = -EIO; + goto unlock; + } if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) p->auto_connect = HCI_AUTO_CONN_DISABLED; -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Have format file honor EVENT_FILE_FL_FREED
by Zheng Yejian 28 Aug '24

28 Aug '24

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.11-rc3 commit b1560408692cd0ab0370cfbe9deb03ce97ab3f6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMNBO CVE: CVE-2024-43891 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit b1560408692cd0ab0370cfbe9deb03ce97ab3f6d upstream. When eventfs was introduced, special care had to be done to coordinate the freeing of the file meta data with the files that are exposed to user space. The file meta data would have a ref count that is set when the file is created and would be decremented and freed after the last user that opened the file closed it. When the file meta data was to be freed, it would set a flag (EVENT_FILE_FL_FREED) to denote that the file is freed, and any new references made (like new opens or reads) would fail as it is marked freed. This allowed other meta data to be freed after this flag was set (under the event_mutex). All the files that were dynamically created in the events directory had a pointer to the file meta data and would call event_release() when the last reference to the user space file was closed. This would be the time that it is safe to free the file meta data. A shortcut was made for the "format" file. It's i_private would point to the "call" entry directly and not point to the file's meta data. This is because all format files are the same for the same "call", so it was thought there was no reason to differentiate them. The other files maintain state (like the "enable", "trigger", etc). But this meant if the file were to disappear, the "format" file would be unaware of it. This caused a race that could be trigger via the user_events test (that would create dynamic events and free them), and running a loop that would read the user_events format files: In one console run: # cd tools/testing/selftests/user_events # while true; do ./ftrace_test; done And in another console run: # cd /sys/kernel/tracing/ # while true; do cat events/user_events/__test_event/format; done 2>/dev/null With KASAN memory checking, it would trigger a use-after-free bug report (which was a real bug). This was because the format file was not checking the file's meta data flag "EVENT_FILE_FL_FREED", so it would access the event that the file meta data pointed to after the event was freed. After inspection, there are other locations that were found to not check the EVENT_FILE_FL_FREED flag when accessing the trace_event_file. Add a new helper function: event_file_file() that will make sure that the event_mutex is held, and will return NULL if the trace_event_file has the EVENT_FILE_FL_FREED flag set. Have the first reference of the struct file pointer use event_file_file() and check for NULL. Later uses can still use the event_file_data() helper function if the event_mutex is still held and was not released since the event_file_file() call. Link: https://lore.kernel.org/all/20240719204701.1605950-1-minipli@grsecurity.net/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Ajay Kaher <ajay.kaher(a)broadcom.com> Cc: Ilkka Naulapää <digirigawa(a)gmail.com> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: Beau Belgrave <beaub(a)linux.microsoft.com> Cc: Florian Fainelli <florian.fainelli(a)broadcom.com> Cc: Alexey Makhalov <alexey.makhalov(a)broadcom.com> Cc: Vasavi Sirnapalli <vasavi.sirnapalli(a)broadcom.com> Link: https://lore.kernel.org/20240730110657.3b69d3c1@gandalf.local.home Fixes: b63db58e2fa5d ("eventfs/tracing: Add callback for release of an eventfs_inode") Reported-by: Mathias Krause <minipli(a)grsecurity.net> Tested-by: Mathias Krause <minipli(a)grsecurity.net> Conflicts: kernel/trace/trace_events.c [Resolve conflict due to lack of commit a1f157c7a3bb ("tracing: Expand all ring buffers individually") which add tracing_update_buffers() in event_enable_write(), that commit is more of a feature than a bugfix and is not related to the problem fixed by this patch] Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace.h | 23 ++++++++++++++++++++ kernel/trace/trace_events.c | 33 +++++++++++++++++------------ kernel/trace/trace_events_hist.c | 4 ++-- kernel/trace/trace_events_inject.c | 2 +- kernel/trace/trace_events_trigger.c | 6 +++--- 5 files changed, 49 insertions(+), 19 deletions(-) diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 5d81b6efaa1e..3ff785aa9444 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -1563,6 +1563,29 @@ static inline void *event_file_data(struct file *filp) extern struct mutex event_mutex; extern struct list_head ftrace_events; +/* + * When the trace_event_file is the filp->i_private pointer, + * it must be taken under the event_mutex lock, and then checked + * if the EVENT_FILE_FL_FREED flag is set. If it is, then the + * data pointed to by the trace_event_file can not be trusted. + * + * Use the event_file_file() to access the trace_event_file from + * the filp the first time under the event_mutex and check for + * NULL. If it is needed to be retrieved again and the event_mutex + * is still held, then the event_file_data() can be used and it + * is guaranteed to be valid. + */ +static inline struct trace_event_file *event_file_file(struct file *filp) +{ + struct trace_event_file *file; + + lockdep_assert_held(&event_mutex); + file = READ_ONCE(file_inode(filp)->i_private); + if (!file || file->flags & EVENT_FILE_FL_FREED) + return NULL; + return file; +} + extern const struct file_operations event_trigger_fops; extern const struct file_operations event_hist_fops; extern const struct file_operations event_hist_debug_fops; diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 2ae0f2807438..c68dc50c8bec 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -1386,12 +1386,12 @@ event_enable_read(struct file *filp, char __user *ubuf, size_t cnt, char buf[4] = "0"; mutex_lock(&event_mutex); - file = event_file_data(filp); + file = event_file_file(filp); if (likely(file)) flags = file->flags; mutex_unlock(&event_mutex); - if (!file || flags & EVENT_FILE_FL_FREED) + if (!file) return -ENODEV; if (flags & EVENT_FILE_FL_ENABLED && @@ -1428,8 +1428,8 @@ event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt, case 1: ret = -ENODEV; mutex_lock(&event_mutex); - file = event_file_data(filp); - if (likely(file && !(file->flags & EVENT_FILE_FL_FREED))) + file = event_file_file(filp); + if (likely(file)) ret = ftrace_event_enable_disable(file, val); mutex_unlock(&event_mutex); break; @@ -1538,7 +1538,8 @@ enum { static void *f_next(struct seq_file *m, void *v, loff_t *pos) { - struct trace_event_call *call = event_file_data(m->private); + struct trace_event_file *file = event_file_data(m->private); + struct trace_event_call *call = file->event_call; struct list_head *common_head = &ftrace_common_fields; struct list_head *head = trace_get_fields(call); struct list_head *node = v; @@ -1570,7 +1571,8 @@ static void *f_next(struct seq_file *m, void *v, loff_t *pos) static int f_show(struct seq_file *m, void *v) { - struct trace_event_call *call = event_file_data(m->private); + struct trace_event_file *file = event_file_data(m->private); + struct trace_event_call *call = file->event_call; struct ftrace_event_field *field; const char *array_descriptor; @@ -1625,12 +1627,14 @@ static int f_show(struct seq_file *m, void *v) static void *f_start(struct seq_file *m, loff_t *pos) { + struct trace_event_file *file; void *p = (void *)FORMAT_HEADER; loff_t l = 0; /* ->stop() is called even if ->start() fails */ mutex_lock(&event_mutex); - if (!event_file_data(m->private)) + file = event_file_file(m->private); + if (!file) return ERR_PTR(-ENODEV); while (l < *pos && p) @@ -1704,8 +1708,8 @@ event_filter_read(struct file *filp, char __user *ubuf, size_t cnt, trace_seq_init(s); mutex_lock(&event_mutex); - file = event_file_data(filp); - if (file && !(file->flags & EVENT_FILE_FL_FREED)) + file = event_file_file(filp); + if (file) print_event_filter(file, s); mutex_unlock(&event_mutex); @@ -1734,9 +1738,13 @@ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt, return PTR_ERR(buf); mutex_lock(&event_mutex); - file = event_file_data(filp); - if (file) - err = apply_event_filter(file, buf); + file = event_file_file(filp); + if (file) { + if (file->flags & EVENT_FILE_FL_FREED) + err = -ENODEV; + else + err = apply_event_filter(file, buf); + } mutex_unlock(&event_mutex); kfree(buf); @@ -2451,7 +2459,6 @@ static int event_callback(const char *name, umode_t *mode, void **data, if (strcmp(name, "format") == 0) { *mode = TRACE_MODE_READ; *fops = &ftrace_event_format_fops; - *data = call; return 1; } diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 68aaf0bd7a78..dd16faf0d150 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -5609,7 +5609,7 @@ static int hist_show(struct seq_file *m, void *v) mutex_lock(&event_mutex); - event_file = event_file_data(m->private); + event_file = event_file_file(m->private); if (unlikely(!event_file)) { ret = -ENODEV; goto out_unlock; @@ -5888,7 +5888,7 @@ static int hist_debug_show(struct seq_file *m, void *v) mutex_lock(&event_mutex); - event_file = event_file_data(m->private); + event_file = event_file_file(m->private); if (unlikely(!event_file)) { ret = -ENODEV; goto out_unlock; diff --git a/kernel/trace/trace_events_inject.c b/kernel/trace/trace_events_inject.c index 8650562bdaa9..a8f076809db4 100644 --- a/kernel/trace/trace_events_inject.c +++ b/kernel/trace/trace_events_inject.c @@ -299,7 +299,7 @@ event_inject_write(struct file *filp, const char __user *ubuf, size_t cnt, strim(buf); mutex_lock(&event_mutex); - file = event_file_data(filp); + file = event_file_file(filp); if (file) { call = file->event_call; size = parse_entry(buf, call, &entry); diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c index b33c3861fbbb..76abc9a45f97 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -159,7 +159,7 @@ static void *trigger_start(struct seq_file *m, loff_t *pos) /* ->stop() is called even if ->start() fails */ mutex_lock(&event_mutex); - event_file = event_file_data(m->private); + event_file = event_file_file(m->private); if (unlikely(!event_file)) return ERR_PTR(-ENODEV); @@ -213,7 +213,7 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file) mutex_lock(&event_mutex); - if (unlikely(!event_file_data(file))) { + if (unlikely(!event_file_file(file))) { mutex_unlock(&event_mutex); return -ENODEV; } @@ -293,7 +293,7 @@ static ssize_t event_trigger_regex_write(struct file *file, strim(buf); mutex_lock(&event_mutex); - event_file = event_file_data(file); + event_file = event_file_file(file); if (unlikely(!event_file)) { mutex_unlock(&event_mutex); kfree(buf); -- 2.25.1

2 1

[PATCH OLK-6.6] Bluetooth: MGMT: Add error handling to pair_device()
by Zhengchao Shao 28 Aug '24

28 Aug '24

From: Griffin Kroah-Hartman <griffin(a)kroah.com> mainline inclusion from mainline-v6.11-rc5 commit 538fd3921afac97158d4177139a0ad39f056dbb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMK01 CVE: CVE-2024-43884 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function. Cc: Stable <stable(a)kernel.org> Fixes: 5157b8a503fa ("Bluetooth: Fix initializing conn_params in scan phase") Signed-off-by: Griffin Kroah-Hartman <griffin(a)kroah.com> Reported-by: Yiwei Zhang <zhan4630(a)purdue.edu> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/mgmt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 0ca6593a029c..3533ac679e42 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -3449,6 +3449,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, * will be kept and this function does nothing. */ p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); + if (!p) { + err = -EIO; + goto unlock; + } if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) p->auto_connect = HCI_AUTO_CONN_DISABLED; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ext4: sanity check for NULL pointer after ext4_force_shutdown
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> stable inclusion from stable-6.6.47 commit 3f6bbe6e07e5239294ecc3d2efa70d1f98aed52e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-43898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 83f4414b8f84249d538905825b088ff3ae555652 ] Test case: 2 threads write short inline data to a file. In ext4_page_mkwrite the resulting inline data is converted. Handling ext4_grp_locked_error with description "block bitmap and bg descriptor inconsistent: X vs Y free clusters" calls ext4_force_shutdown. The conversion clears EXT4_STATE_MAY_INLINE_DATA but fails for ext4_destroy_inline_data_nolock and ext4_mark_iloc_dirty due to ext4_forced_shutdown. The restoration of inline data fails for the same reason not setting EXT4_STATE_MAY_INLINE_DATA. Without the flag set a regular process path in ext4_da_write_end follows trying to dereference page folio private pointer that has not been set. The fix calls early return with -EIO error shall the pointer to private be NULL. Sample crash report: Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 20274 Comm: syz-executor185 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 lr : __block_commit_write+0x3c/0x2b0 fs/buffer.c:2160 sp : ffff8000a1957600 x29: ffff8000a1957610 x28: dfff800000000000 x27: ffff0000e30e34b0 x26: 0000000000000000 x25: dfff800000000000 x24: dfff800000000000 x23: fffffdffc397c9e0 x22: 0000000000000020 x21: 0000000000000020 x20: 0000000000000040 x19: fffffdffc397c9c0 x18: 1fffe000367bd196 x17: ffff80008eead000 x16: ffff80008ae89e3c x15: 00000000200000c0 x14: 1fffe0001cbe4e04 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000004 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffdffc397c9c0 x4 : 0000000000000020 x3 : 0000000000000020 x2 : 0000000000000040 x1 : 0000000000000020 x0 : fffffdffc397c9c0 Call trace: __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 block_write_end+0xb4/0x104 fs/buffer.c:2253 ext4_da_do_write_end fs/ext4/inode.c:2955 [inline] ext4_da_write_end+0x2c4/0xa40 fs/ext4/inode.c:3028 generic_perform_write+0x394/0x588 mm/filemap.c:3985 ext4_buffered_write_iter+0x2c0/0x4ec fs/ext4/file.c:299 ext4_file_write_iter+0x188/0x1780 call_write_iter include/linux/fs.h:2110 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x968/0xc3c fs/read_write.c:590 ksys_write+0x15c/0x26c fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:652 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Code: 97f85911 f94002da 91008356 d343fec8 (38796908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97f85911 bl 0xffffffffffe16444 4: f94002da ldr x26, [x22] 8: 91008356 add x22, x26, #0x20 c: d343fec8 lsr x8, x22, #3 * 10: 38796908 ldrb w8, [x8, x25] <-- trapping instruction Reported-by: syzbot+18df508cf00a0598d9a6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18df508cf00a0598d9a6 Link: https://lore.kernel.org/all/000000000000f19a1406109eb5c5@google.com/T/ Signed-off-by: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> Link: https://patch.msgid.link/20240703070112.10235-1-wojciech.gladysz@infogain.c… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/buffer.c fs/ext4/inode.c [Since folio is not defined in the earlier version, page_private is judged ahead of time.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/buffer.c | 3 +++ fs/ext4/inode.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index af88734d1d38..0a813fad9002 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2037,6 +2037,9 @@ static int __block_commit_write(struct inode *inode, struct page *page, unsigned blocksize; struct buffer_head *bh, *head; + if (!page_private(page)) + return 0; + bh = head = page_buffers(page); blocksize = bh->b_size; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 35033bb43149..6c3e5aedc2ca 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3155,6 +3155,9 @@ static int ext4_da_write_end(struct file *file, if (unlikely(copied < len) && !PageUptodate(page)) copied = 0; + if (unlikely(!page_private(page))) + return -EIO; + start = pos & (PAGE_SIZE - 1); end = start + copied - 1; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ext4: sanity check for NULL pointer after ext4_force_shutdown
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> stable inclusion from stable-6.6.47 commit 3f6bbe6e07e5239294ecc3d2efa70d1f98aed52e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-43898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 83f4414b8f84249d538905825b088ff3ae555652 ] Test case: 2 threads write short inline data to a file. In ext4_page_mkwrite the resulting inline data is converted. Handling ext4_grp_locked_error with description "block bitmap and bg descriptor inconsistent: X vs Y free clusters" calls ext4_force_shutdown. The conversion clears EXT4_STATE_MAY_INLINE_DATA but fails for ext4_destroy_inline_data_nolock and ext4_mark_iloc_dirty due to ext4_forced_shutdown. The restoration of inline data fails for the same reason not setting EXT4_STATE_MAY_INLINE_DATA. Without the flag set a regular process path in ext4_da_write_end follows trying to dereference page folio private pointer that has not been set. The fix calls early return with -EIO error shall the pointer to private be NULL. Sample crash report: Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 20274 Comm: syz-executor185 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 lr : __block_commit_write+0x3c/0x2b0 fs/buffer.c:2160 sp : ffff8000a1957600 x29: ffff8000a1957610 x28: dfff800000000000 x27: ffff0000e30e34b0 x26: 0000000000000000 x25: dfff800000000000 x24: dfff800000000000 x23: fffffdffc397c9e0 x22: 0000000000000020 x21: 0000000000000020 x20: 0000000000000040 x19: fffffdffc397c9c0 x18: 1fffe000367bd196 x17: ffff80008eead000 x16: ffff80008ae89e3c x15: 00000000200000c0 x14: 1fffe0001cbe4e04 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000004 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffdffc397c9c0 x4 : 0000000000000020 x3 : 0000000000000020 x2 : 0000000000000040 x1 : 0000000000000020 x0 : fffffdffc397c9c0 Call trace: __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 block_write_end+0xb4/0x104 fs/buffer.c:2253 ext4_da_do_write_end fs/ext4/inode.c:2955 [inline] ext4_da_write_end+0x2c4/0xa40 fs/ext4/inode.c:3028 generic_perform_write+0x394/0x588 mm/filemap.c:3985 ext4_buffered_write_iter+0x2c0/0x4ec fs/ext4/file.c:299 ext4_file_write_iter+0x188/0x1780 call_write_iter include/linux/fs.h:2110 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x968/0xc3c fs/read_write.c:590 ksys_write+0x15c/0x26c fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:652 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Code: 97f85911 f94002da 91008356 d343fec8 (38796908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97f85911 bl 0xffffffffffe16444 4: f94002da ldr x26, [x22] 8: 91008356 add x22, x26, #0x20 c: d343fec8 lsr x8, x22, #3 * 10: 38796908 ldrb w8, [x8, x25] <-- trapping instruction Reported-by: syzbot+18df508cf00a0598d9a6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18df508cf00a0598d9a6 Link: https://lore.kernel.org/all/000000000000f19a1406109eb5c5@google.com/T/ Signed-off-by: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> Link: https://patch.msgid.link/20240703070112.10235-1-wojciech.gladysz@infogain.c… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/buffer.c fs/ext4/inode.c [Since folio is not defined in the earlier version, page_private is judged ahead of time.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/buffer.c | 3 +++ fs/ext4/inode.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index af88734d1d38..0a813fad9002 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2037,6 +2037,9 @@ static int __block_commit_write(struct inode *inode, struct page *page, unsigned blocksize; struct buffer_head *bh, *head; + if (!page_private(page)) + return 0; + bh = head = page_buffers(page); blocksize = bh->b_size; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 35033bb43149..743141449809 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3155,6 +3155,9 @@ static int ext4_da_write_end(struct file *file, if (unlikely(copied < len) && !PageUptodate(page)) copied = 0; + if (!page_private(page)) + return -EIO; + start = pos & (PAGE_SIZE - 1); end = start + copied - 1; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] apparmor: Fix null pointer deref when receiving skb during sock creation
by Gu Bowen 28 Aug '24

28 Aug '24

From: Xiao Liang <shaw.leon(a)gmail.com> stable inclusion from stable-v5.10.224 commit 347dcb84a4874b5fb375092c08d8cc4069b94f81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPW7 CVE: CVE-2023-52889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fce09ea314505a52f2436397608fa0a5d0934fb1 ] The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK_CTX(sk)->label is updated in apparmor_socket_post_create(), but the packet is delivered to the socket before that, causing the null pointer dereference. Drop the packet if label context is not set. BUG: kernel NULL pointer dereference, address: 000000000000004c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020 RIP: 0010:aa_label_next_confined+0xb/0x40 Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2 RSP: 0018:ffffa92940003b08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002 R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 FS: 00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0 PKRU: 55555554 Call Trace: <IRQ> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? aa_label_next_confined+0xb/0x40 apparmor_secmark_check+0xec/0x330 security_sock_rcv_skb+0x35/0x50 sk_filter_trim_cap+0x47/0x250 sock_queue_rcv_skb_reason+0x20/0x60 raw_rcv+0x13c/0x210 raw_local_deliver+0x1f3/0x250 ip_protocol_deliver_rcu+0x4f/0x2f0 ip_local_deliver_finish+0x76/0xa0 __netif_receive_skb_one_core+0x89/0xa0 netif_receive_skb+0x119/0x170 ? __netdev_alloc_skb+0x3d/0x140 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] __napi_poll+0x28/0x1b0 net_rx_action+0x2a4/0x380 __do_softirq+0xd1/0x2c8 __irq_exit_rcu+0xbb/0xf0 common_interrupt+0x86/0xa0 </IRQ> <TASK> asm_common_interrupt+0x26/0x40 RIP: 0010:apparmor_socket_post_create+0xb/0x200 Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48 RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286 RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003 R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748 ? __pfx_apparmor_socket_post_create+0x10/0x10 security_socket_post_create+0x4b/0x80 __sock_create+0x176/0x1f0 __sys_socket+0x89/0x100 __x64_sys_socket+0x17/0x20 do_syscall_64+0x5d/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixes: ab9f2115081a ("apparmor: Allow filtering based on secmark policy") Signed-off-by: Xiao Liang <shaw.leon(a)gmail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/apparmor/lsm.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index ffeaee5ed968..44eaaa8b7754 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1048,6 +1048,13 @@ static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) if (!skb->secmark) return 0; + /* + * If reach here before socket_post_create hook is called, in which + * case label is null, drop the packet. + */ + if (!ctx->label) + return -EACCES; + return apparmor_secmark_check(ctx->label, OP_RECVMSG, AA_MAY_RECEIVE, skb->secmark, sk); } -- 2.25.1

2 1

[PATCH OLK-5.10] ext4: sanity check for NULL pointer after ext4_force_shutdown
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> stable inclusion from stable-6.6.47 commit 3f6bbe6e07e5239294ecc3d2efa70d1f98aed52e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-43898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 83f4414b8f84249d538905825b088ff3ae555652 ] Test case: 2 threads write short inline data to a file. In ext4_page_mkwrite the resulting inline data is converted. Handling ext4_grp_locked_error with description "block bitmap and bg descriptor inconsistent: X vs Y free clusters" calls ext4_force_shutdown. The conversion clears EXT4_STATE_MAY_INLINE_DATA but fails for ext4_destroy_inline_data_nolock and ext4_mark_iloc_dirty due to ext4_forced_shutdown. The restoration of inline data fails for the same reason not setting EXT4_STATE_MAY_INLINE_DATA. Without the flag set a regular process path in ext4_da_write_end follows trying to dereference page folio private pointer that has not been set. The fix calls early return with -EIO error shall the pointer to private be NULL. Sample crash report: Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 20274 Comm: syz-executor185 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 lr : __block_commit_write+0x3c/0x2b0 fs/buffer.c:2160 sp : ffff8000a1957600 x29: ffff8000a1957610 x28: dfff800000000000 x27: ffff0000e30e34b0 x26: 0000000000000000 x25: dfff800000000000 x24: dfff800000000000 x23: fffffdffc397c9e0 x22: 0000000000000020 x21: 0000000000000020 x20: 0000000000000040 x19: fffffdffc397c9c0 x18: 1fffe000367bd196 x17: ffff80008eead000 x16: ffff80008ae89e3c x15: 00000000200000c0 x14: 1fffe0001cbe4e04 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000004 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffdffc397c9c0 x4 : 0000000000000020 x3 : 0000000000000020 x2 : 0000000000000040 x1 : 0000000000000020 x0 : fffffdffc397c9c0 Call trace: __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 block_write_end+0xb4/0x104 fs/buffer.c:2253 ext4_da_do_write_end fs/ext4/inode.c:2955 [inline] ext4_da_write_end+0x2c4/0xa40 fs/ext4/inode.c:3028 generic_perform_write+0x394/0x588 mm/filemap.c:3985 ext4_buffered_write_iter+0x2c0/0x4ec fs/ext4/file.c:299 ext4_file_write_iter+0x188/0x1780 call_write_iter include/linux/fs.h:2110 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x968/0xc3c fs/read_write.c:590 ksys_write+0x15c/0x26c fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:652 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Code: 97f85911 f94002da 91008356 d343fec8 (38796908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97f85911 bl 0xffffffffffe16444 4: f94002da ldr x26, [x22] 8: 91008356 add x22, x26, #0x20 c: d343fec8 lsr x8, x22, #3 * 10: 38796908 ldrb w8, [x8, x25] <-- trapping instruction Reported-by: syzbot+18df508cf00a0598d9a6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18df508cf00a0598d9a6 Link: https://lore.kernel.org/all/000000000000f19a1406109eb5c5@google.com/T/ Signed-off-by: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> Link: https://patch.msgid.link/20240703070112.10235-1-wojciech.gladysz@infogain.c… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/buffer.c fs/ext4/inode.c [Since folio is not defined in the earlier version, page_private is judged ahead of time.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/buffer.c | 3 +++ fs/ext4/inode.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index a74312b1bb42..0419cbff9419 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2070,6 +2070,9 @@ static int __block_commit_write(struct inode *inode, struct page *page, unsigned blocksize; struct buffer_head *bh, *head; + if (!page_private(page)) + return 0; + bh = head = page_buffers(page); blocksize = bh->b_size; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 8e4407120cbc..c9326e059e3b 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3078,6 +3078,9 @@ static int ext4_da_do_write_end(struct address_space *mapping, bool disksize_changed = false; loff_t new_i_size; + if (unlikely(!page_private(page))) + return -EIO; + /* * block_write_end() will mark the inode as dirty with I_DIRTY_PAGES * flag, which all that's needed to trigger page writeback. -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] ext4: sanity check for NULL pointer after ext4_force_shutdown
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> stable inclusion from stable-6.6.47 commit 3f6bbe6e07e5239294ecc3d2efa70d1f98aed52e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM9L CVE: CVE-2024-43898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 83f4414b8f84249d538905825b088ff3ae555652 ] Test case: 2 threads write short inline data to a file. In ext4_page_mkwrite the resulting inline data is converted. Handling ext4_grp_locked_error with description "block bitmap and bg descriptor inconsistent: X vs Y free clusters" calls ext4_force_shutdown. The conversion clears EXT4_STATE_MAY_INLINE_DATA but fails for ext4_destroy_inline_data_nolock and ext4_mark_iloc_dirty due to ext4_forced_shutdown. The restoration of inline data fails for the same reason not setting EXT4_STATE_MAY_INLINE_DATA. Without the flag set a regular process path in ext4_da_write_end follows trying to dereference page folio private pointer that has not been set. The fix calls early return with -EIO error shall the pointer to private be NULL. Sample crash report: Unable to handle kernel paging request at virtual address dfff800000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000004] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 20274 Comm: syz-executor185 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 lr : __block_commit_write+0x3c/0x2b0 fs/buffer.c:2160 sp : ffff8000a1957600 x29: ffff8000a1957610 x28: dfff800000000000 x27: ffff0000e30e34b0 x26: 0000000000000000 x25: dfff800000000000 x24: dfff800000000000 x23: fffffdffc397c9e0 x22: 0000000000000020 x21: 0000000000000020 x20: 0000000000000040 x19: fffffdffc397c9c0 x18: 1fffe000367bd196 x17: ffff80008eead000 x16: ffff80008ae89e3c x15: 00000000200000c0 x14: 1fffe0001cbe4e04 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000004 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffdffc397c9c0 x4 : 0000000000000020 x3 : 0000000000000020 x2 : 0000000000000040 x1 : 0000000000000020 x0 : fffffdffc397c9c0 Call trace: __block_commit_write+0x64/0x2b0 fs/buffer.c:2167 block_write_end+0xb4/0x104 fs/buffer.c:2253 ext4_da_do_write_end fs/ext4/inode.c:2955 [inline] ext4_da_write_end+0x2c4/0xa40 fs/ext4/inode.c:3028 generic_perform_write+0x394/0x588 mm/filemap.c:3985 ext4_buffered_write_iter+0x2c0/0x4ec fs/ext4/file.c:299 ext4_file_write_iter+0x188/0x1780 call_write_iter include/linux/fs.h:2110 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0x968/0xc3c fs/read_write.c:590 ksys_write+0x15c/0x26c fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:652 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Code: 97f85911 f94002da 91008356 d343fec8 (38796908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 97f85911 bl 0xffffffffffe16444 4: f94002da ldr x26, [x22] 8: 91008356 add x22, x26, #0x20 c: d343fec8 lsr x8, x22, #3 * 10: 38796908 ldrb w8, [x8, x25] <-- trapping instruction Reported-by: syzbot+18df508cf00a0598d9a6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18df508cf00a0598d9a6 Link: https://lore.kernel.org/all/000000000000f19a1406109eb5c5@google.com/T/ Signed-off-by: Wojciech Gładysz <wojciech.gladysz(a)infogain.com> Link: https://patch.msgid.link/20240703070112.10235-1-wojciech.gladysz@infogain.c… Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/buffer.c fs/ext4/inode.c [Since folio is not defined in the earlier version, page_private is judged ahead of time.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/buffer.c | 3 +++ fs/ext4/inode.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index 93324b06ecb4..a22d35004874 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2070,6 +2070,9 @@ static int __block_commit_write(struct inode *inode, struct page *page, unsigned blocksize; struct buffer_head *bh, *head; + if (!page_private(page)) + return 0; + bh = head = page_buffers(page); blocksize = bh->b_size; diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 690f7866dc0c..f8459b6b9a27 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3089,6 +3089,9 @@ static int ext4_da_do_write_end(struct address_space *mapping, bool disksize_changed = false; loff_t new_i_size; + if (unlikely(!page_private(page))) + return -EIO; + /* * block_write_end() will mark the inode as dirty with I_DIRTY_PAGES * flag, which all that's needed to trigger page writeback. -- 2.39.2

2 1

[openeuler:OLK-5.10 27211/30000] arch/x86/kvm/x86.c:1076:6: warning: no previous prototype for function 'kvm_post_set_cr4'
by kernel test robot 28 Aug '24

28 Aug '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d96e94294726506c2893c3a71305c65168c22526 commit: 8a7e6f51a756aa6e88ebd5da8a5f3b6744cd07b5 [27211/30000] KVM: x86: Introduce kvm_post_set_cr4 to post handle the CR4 emulation config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20240828/202408281404.nd7rLidC-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281404.nd7rLidC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281404.nd7rLidC-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kvm/x86.c:893:6: warning: no previous prototype for function 'kvm_post_set_cr0' [-Wmissing-prototypes] 893 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^ arch/x86/kvm/x86.c:893:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 893 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^ | static >> arch/x86/kvm/x86.c:1076:6: warning: no previous prototype for function 'kvm_post_set_cr4' [-Wmissing-prototypes] 1076 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^ arch/x86/kvm/x86.c:1076:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1076 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^ | static 2 warnings generated. vim +/kvm_post_set_cr4 +1076 arch/x86/kvm/x86.c 1075 > 1076 void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) 1077 { 1078 unsigned long mmu_role_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE | 1079 X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE; 1080 1081 if (((cr4 ^ old_cr4) & mmu_role_bits) || 1082 (!(cr4 & X86_CR4_PCIDE) && (old_cr4 & X86_CR4_PCIDE))) 1083 kvm_mmu_reset_context(vcpu); 1084 } 1085 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] nfs: pass explicit offset/count to trace events
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Christoph Hellwig <hch(a)lst.de> stable inclusion from stable-v6.10.3 commit 387e6e9d110250946df4d4ebef9c2def5c7a4722 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2A CVE: CVE-2024-43826 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit fada32ed6dbc748f447c8d050a961b75d946055a ] nfs_folio_length is unsafe to use without having the folio locked and a check for a NULL ->f_mapping that protects against truncations and can lead to kernel crashes. E.g. when running xfstests generic/065 with all nfs trace points enabled. Follow the model of the XFS trace points and pass in an explіcit offset and length. This has the additional benefit that these values can be more accurate as some of the users touch partial folio ranges. Fixes: eb5654b3b89d ("NFS: Enable tracing of nfs_invalidate_folio() and nfs_launder_folio()") Reported-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nfs/file.c [Trace context conflict, no adaptation required.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/file.c | 5 +++-- fs/nfs/nfstrace.h | 36 ++++++++++++++++++++---------------- fs/nfs/read.c | 8 +++++--- fs/nfs/write.c | 10 +++++----- 4 files changed, 33 insertions(+), 26 deletions(-) diff --git a/fs/nfs/file.c b/fs/nfs/file.c index 3f9768810427..9342f8074801 100644 --- a/fs/nfs/file.c +++ b/fs/nfs/file.c @@ -434,7 +434,7 @@ static void nfs_invalidate_folio(struct folio *folio, size_t offset, /* Cancel any unstarted writes on this page */ nfs_wb_folio_cancel(inode, folio); folio_wait_fscache(folio); - trace_nfs_invalidate_folio(inode, folio); + trace_nfs_invalidate_folio(inode, folio_pos(folio) + offset, length); } /* @@ -502,7 +502,8 @@ static int nfs_launder_folio(struct folio *folio) folio_wait_fscache(folio); ret = nfs_wb_folio(inode, folio); - trace_nfs_launder_folio_done(inode, folio, ret); + trace_nfs_launder_folio_done(inode, folio_pos(folio), + folio_size(folio), ret); return ret; } diff --git a/fs/nfs/nfstrace.h b/fs/nfs/nfstrace.h index 4e90ca531176..004c25f0782b 100644 --- a/fs/nfs/nfstrace.h +++ b/fs/nfs/nfstrace.h @@ -933,10 +933,11 @@ TRACE_EVENT(nfs_sillyrename_unlink, DECLARE_EVENT_CLASS(nfs_folio_event, TP_PROTO( const struct inode *inode, - struct folio *folio + loff_t offset, + size_t count ), - TP_ARGS(inode, folio), + TP_ARGS(inode, offset, count), TP_STRUCT__entry( __field(dev_t, dev) @@ -944,7 +945,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event, __field(u64, fileid) __field(u64, version) __field(loff_t, offset) - __field(u32, count) + __field(size_t, count) ), TP_fast_assign( @@ -954,13 +955,13 @@ DECLARE_EVENT_CLASS(nfs_folio_event, __entry->fileid = nfsi->fileid; __entry->fhandle = nfs_fhandle_hash(&nfsi->fh); __entry->version = inode_peek_iversion_raw(inode); - __entry->offset = folio_file_pos(folio); - __entry->count = nfs_folio_length(folio); + __entry->offset = offset, + __entry->count = count; ), TP_printk( "fileid=%02x:%02x:%llu fhandle=0x%08x version=%llu " - "offset=%lld count=%u", + "offset=%lld count=%zu", MAJOR(__entry->dev), MINOR(__entry->dev), (unsigned long long)__entry->fileid, __entry->fhandle, __entry->version, @@ -972,18 +973,20 @@ DECLARE_EVENT_CLASS(nfs_folio_event, DEFINE_EVENT(nfs_folio_event, name, \ TP_PROTO( \ const struct inode *inode, \ - struct folio *folio \ + loff_t offset, \ + size_t count \ ), \ - TP_ARGS(inode, folio)) + TP_ARGS(inode, offset, count)) DECLARE_EVENT_CLASS(nfs_folio_event_done, TP_PROTO( const struct inode *inode, - struct folio *folio, + loff_t offset, + size_t count, int ret ), - TP_ARGS(inode, folio, ret), + TP_ARGS(inode, offset, count, ret), TP_STRUCT__entry( __field(dev_t, dev) @@ -992,7 +995,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done, __field(u64, fileid) __field(u64, version) __field(loff_t, offset) - __field(u32, count) + __field(size_t, count) ), TP_fast_assign( @@ -1002,14 +1005,14 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done, __entry->fileid = nfsi->fileid; __entry->fhandle = nfs_fhandle_hash(&nfsi->fh); __entry->version = inode_peek_iversion_raw(inode); - __entry->offset = folio_file_pos(folio); - __entry->count = nfs_folio_length(folio); + __entry->offset = offset, + __entry->count = count, __entry->ret = ret; ), TP_printk( "fileid=%02x:%02x:%llu fhandle=0x%08x version=%llu " - "offset=%lld count=%u ret=%d", + "offset=%lld count=%zu ret=%d", MAJOR(__entry->dev), MINOR(__entry->dev), (unsigned long long)__entry->fileid, __entry->fhandle, __entry->version, @@ -1021,10 +1024,11 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done, DEFINE_EVENT(nfs_folio_event_done, name, \ TP_PROTO( \ const struct inode *inode, \ - struct folio *folio, \ + loff_t offset, \ + size_t count, \ int ret \ ), \ - TP_ARGS(inode, folio, ret)) + TP_ARGS(inode, offset, count, ret)) DEFINE_NFS_FOLIO_EVENT(nfs_aop_readpage); DEFINE_NFS_FOLIO_EVENT_DONE(nfs_aop_readpage_done); diff --git a/fs/nfs/read.c b/fs/nfs/read.c index a142287d86f6..88e6a78d37fb 100644 --- a/fs/nfs/read.c +++ b/fs/nfs/read.c @@ -332,13 +332,15 @@ int nfs_read_add_folio(struct nfs_pageio_descriptor *pgio, int nfs_read_folio(struct file *file, struct folio *folio) { struct inode *inode = file_inode(file); + loff_t pos = folio_pos(folio); + size_t len = folio_size(folio); struct nfs_pageio_descriptor pgio; struct nfs_open_context *ctx; int ret; - trace_nfs_aop_readpage(inode, folio); + trace_nfs_aop_readpage(inode, pos, len); nfs_inc_stats(inode, NFSIOS_VFSREADPAGE); - task_io_account_read(folio_size(folio)); + task_io_account_read(len); /* * Try to flush any pending writes to the file.. @@ -381,7 +383,7 @@ int nfs_read_folio(struct file *file, struct folio *folio) out_put: put_nfs_open_context(ctx); out: - trace_nfs_aop_readpage_done(inode, folio, ret); + trace_nfs_aop_readpage_done(inode, pos, len, ret); return ret; out_unlock: folio_unlock(folio); diff --git a/fs/nfs/write.c b/fs/nfs/write.c index 7d03811f44a4..6bc36cef14cd 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -2088,17 +2088,17 @@ int nfs_wb_folio_cancel(struct inode *inode, struct folio *folio) */ int nfs_wb_folio(struct inode *inode, struct folio *folio) { - loff_t range_start = folio_file_pos(folio); - loff_t range_end = range_start + (loff_t)folio_size(folio) - 1; + loff_t range_start = folio_pos(folio); + size_t len = folio_size(folio); struct writeback_control wbc = { .sync_mode = WB_SYNC_ALL, .nr_to_write = 0, .range_start = range_start, - .range_end = range_end, + .range_end = range_start + len - 1, }; int ret; - trace_nfs_writeback_folio(inode, folio); + trace_nfs_writeback_folio(inode, range_start, len); for (;;) { folio_wait_writeback(folio); @@ -2116,7 +2116,7 @@ int nfs_wb_folio(struct inode *inode, struct folio *folio) goto out_error; } out_error: - trace_nfs_writeback_folio_done(inode, folio, ret); + trace_nfs_writeback_folio_done(inode, range_start, len, ret); return ret; } -- 2.39.2

2 1

[PATCH OLK-5.10] apparmor: Fix null pointer deref when receiving skb during sock creation
by Gu Bowen 28 Aug '24

28 Aug '24

From: Xiao Liang <shaw.leon(a)gmail.com> stable inclusion from stable-v5.10.224 commit 347dcb84a4874b5fb375092c08d8cc4069b94f81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPW7 CVE: CVE-2023-52889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fce09ea314505a52f2436397608fa0a5d0934fb1 ] The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK_CTX(sk)->label is updated in apparmor_socket_post_create(), but the packet is delivered to the socket before that, causing the null pointer dereference. Drop the packet if label context is not set. BUG: kernel NULL pointer dereference, address: 000000000000004c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020 RIP: 0010:aa_label_next_confined+0xb/0x40 Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2 RSP: 0018:ffffa92940003b08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002 R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 FS: 00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0 PKRU: 55555554 Call Trace: <IRQ> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? aa_label_next_confined+0xb/0x40 apparmor_secmark_check+0xec/0x330 security_sock_rcv_skb+0x35/0x50 sk_filter_trim_cap+0x47/0x250 sock_queue_rcv_skb_reason+0x20/0x60 raw_rcv+0x13c/0x210 raw_local_deliver+0x1f3/0x250 ip_protocol_deliver_rcu+0x4f/0x2f0 ip_local_deliver_finish+0x76/0xa0 __netif_receive_skb_one_core+0x89/0xa0 netif_receive_skb+0x119/0x170 ? __netdev_alloc_skb+0x3d/0x140 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] __napi_poll+0x28/0x1b0 net_rx_action+0x2a4/0x380 __do_softirq+0xd1/0x2c8 __irq_exit_rcu+0xbb/0xf0 common_interrupt+0x86/0xa0 </IRQ> <TASK> asm_common_interrupt+0x26/0x40 RIP: 0010:apparmor_socket_post_create+0xb/0x200 Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48 RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286 RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003 R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748 ? __pfx_apparmor_socket_post_create+0x10/0x10 security_socket_post_create+0x4b/0x80 __sock_create+0x176/0x1f0 __sys_socket+0x89/0x100 __x64_sys_socket+0x17/0x20 do_syscall_64+0x5d/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixes: ab9f2115081a ("apparmor: Allow filtering based on secmark policy") Signed-off-by: Xiao Liang <shaw.leon(a)gmail.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/apparmor/lsm.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 052f1b920e43..37aa1650c74e 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1048,6 +1048,13 @@ static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) if (!skb->secmark) return 0; + /* + * If reach here before socket_post_create hook is called, in which + * case label is null, drop the packet. + */ + if (!ctx->label) + return -EACCES; + return apparmor_secmark_check(ctx->label, OP_RECVMSG, AA_MAY_RECEIVE, skb->secmark, sk); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] io_uring: add a schedule point in io_add_buffers()
by Zizhi Wo 28 Aug '24

28 Aug '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-5.10.103 commit 4a93c6594613c3429b6f30136fff115c7f803af4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALQ20 CVE: CVE-2022-48937 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit f240762f88b4b1b58561939ffd44837759756477 upstream. Looping ~65535 times doing kmalloc() calls can trigger soft lockups, especially with DEBUG features (like KASAN). [ 253.536212] watchdog: BUG: soft lockup - CPU#64 stuck for 26s! [b219417889:12575] [ 253.544433] Modules linked in: vfat fat i2c_mux_pca954x i2c_mux spidev cdc_acm xhci_pci xhci_hcd sha3_generic gq(O) [ 253.544451] CPU: 64 PID: 12575 Comm: b219417889 Tainted: G S O 5.17.0-smp-DEV #801 [ 253.544457] RIP: 0010:kernel_text_address (./include/asm-generic/sections.h:192 ./include/linux/kallsyms.h:29 kernel/extable.c:67 kernel/extable.c:98) [ 253.544464] Code: 0f 93 c0 48 c7 c1 e0 63 d7 a4 48 39 cb 0f 92 c1 20 c1 0f b6 c1 5b 5d c3 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 fb <48> c7 c0 00 00 80 a0 41 be 01 00 00 00 48 39 c7 72 0c 48 c7 c0 40 [ 253.544468] RSP: 0018:ffff8882d8baf4c0 EFLAGS: 00000246 [ 253.544471] RAX: 1ffff1105b175e00 RBX: ffffffffa13ef09a RCX: 00000000a13ef001 [ 253.544474] RDX: ffffffffa13ef09a RSI: ffff8882d8baf558 RDI: ffffffffa13ef09a [ 253.544476] RBP: ffff8882d8baf4d8 R08: ffff8882d8baf5e0 R09: 0000000000000004 [ 253.544479] R10: ffff8882d8baf5e8 R11: ffffffffa0d59a50 R12: ffff8882eab20380 [ 253.544481] R13: ffffffffa0d59a50 R14: dffffc0000000000 R15: 1ffff1105b175eb0 [ 253.544483] FS: 00000000016d3380(0000) GS:ffff88af48c00000(0000) knlGS:0000000000000000 [ 253.544486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 253.544488] CR2: 00000000004af0f0 CR3: 00000002eabfa004 CR4: 00000000003706e0 [ 253.544491] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 253.544492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 253.544494] Call Trace: [ 253.544496] <TASK> [ 253.544498] ? io_queue_sqe (fs/io_uring.c:7143) [ 253.544505] __kernel_text_address (kernel/extable.c:78) [ 253.544508] unwind_get_return_address (arch/x86/kernel/unwind_frame.c:19) [ 253.544514] arch_stack_walk (arch/x86/kernel/stacktrace.c:27) [ 253.544517] ? io_queue_sqe (fs/io_uring.c:7143) [ 253.544521] stack_trace_save (kernel/stacktrace.c:123) [ 253.544527] ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544531] ? ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544533] ? __kasan_kmalloc (mm/kasan/common.c:524) [ 253.544535] ? kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567) [ 253.544541] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) [ 253.544544] ? __io_queue_sqe (fs/io_uring.c:?) [ 253.544551] __kasan_kmalloc (mm/kasan/common.c:524) [ 253.544553] kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567) [ 253.544556] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) [ 253.544560] io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828) [ 253.544564] ? __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) [ 253.544567] ? __kasan_slab_alloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) [ 253.544569] ? kmem_cache_alloc_bulk (mm/slab.h:732 mm/slab.c:3546) [ 253.544573] ? __io_alloc_req_refill (fs/io_uring.c:2078) [ 253.544578] ? io_submit_sqes (fs/io_uring.c:7441) [ 253.544581] ? __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096) [ 253.544584] ? __x64_sys_io_uring_enter (fs/io_uring.c:10096) [ 253.544587] ? do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 253.544590] ? entry_SYSCALL_64_after_hwframe (??:?) [ 253.544596] __io_queue_sqe (fs/io_uring.c:?) [ 253.544600] io_queue_sqe (fs/io_uring.c:7143) [ 253.544603] io_submit_sqe (fs/io_uring.c:?) [ 253.544608] io_submit_sqes (fs/io_uring.c:?) [ 253.544612] __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096) [ 253.544616] __x64_sys_io_uring_enter (fs/io_uring.c:10096) [ 253.544619] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 253.544623] entry_SYSCALL_64_after_hwframe (??:?) Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Pavel Begunkov <asml.silence(a)gmail.com> Cc: io-uring <io-uring(a)vger.kernel.org> Reported-by: syzbot <syzkaller(a)googlegroups.com> Link: https://lore.kernel.org/r/20220215041003.2394784-1-eric.dumazet@gmail.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index dde9205fc287..411b7491f3f5 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3647,6 +3647,7 @@ static int io_add_buffers(struct io_provide_buf *pbuf, struct io_buffer **head) } else { list_add_tail(&buf->list, &(*head)->list); } + cond_resched(); } return i ? i : -ENOMEM; -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 17746/23570] drivers/dax/.tmp_bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7ad52b4435297d752bdb8c2fce6524544448d4af commit: 9bb67bd58e6a7e3ef00793b4966be7bb0a346830 [17746/23570] Intel: device-dax: Add support for a dax override driver config: x86_64-buildonly-randconfig-004-20240825 (https://download.01.org/0day-ci/archive/20240828/202408281448.DeW129VU-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281448.DeW129VU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281448.DeW129VU-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dax/.tmp_bus.o: warning: objtool: __dax_driver_register()+0xd5: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7193/13757] mm/page_alloc.c:4110:9: error: implicit declaration of function 'dynamic_pool_should_alloc' is invalid in C99
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e59105d1ac962dacde2b6480857e834f97ca108e commit: fd855715f24e3eeadaa56de5fde21c55a14aeea0 [7193/13757] mm/mem_reliable: Fallback to dpool if reliable memory is not enough config: arm64-randconfig-003-20240827 (https://download.01.org/0day-ci/archive/20240828/202408281316.tzOrTedV-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281316.tzOrTedV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281316.tzOrTedV-lkp@intel.com/ All errors (new ones prefixed by >>): >> mm/page_alloc.c:4110:9: error: implicit declaration of function 'dynamic_pool_should_alloc' is invalid in C99 [-Werror,-Wimplicit-function-declaration] return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); ^ 1 error generated. vim +/dynamic_pool_should_alloc +4110 mm/page_alloc.c 4101 4102 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4103 { 4104 if (!reliable_allow_fb_enabled()) 4105 return false; 4106 4107 if (!(gfp_mask & GFP_RELIABLE)) 4108 return false; 4109 > 4110 return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); 4111 } 4112 #else 4113 static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, 4114 struct alloc_context *ac) 4115 { 4116 return NULL; 4117 } 4118 static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, 4119 struct alloc_context *ac) {} 4120 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4121 { 4122 return false; 4123 } 4124 #endif 4125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 27370/30000] arch/x86/kvm/x86.c:805:5: warning: no previous prototype for 'kvm_read_guest_page_mmu'
by kernel test robot 28 Aug '24

28 Aug '24

Hi Sean, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d96e94294726506c2893c3a71305c65168c22526 commit: aeaeb4dcb428b870d4207cc0fae7c125b7522406 [27370/30000] KVM: x86: Subsume nested GPA read helper into load_pdptrs() config: x86_64-buildonly-randconfig-005-20240828 (https://download.01.org/0day-ci/archive/20240828/202408281227.MN7ngvtP-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281227.MN7ngvtP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281227.MN7ngvtP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kvm/x86.c:805:5: warning: no previous prototype for 'kvm_read_guest_page_mmu' [-Wmissing-prototypes] 805 | int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, | ^~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kvm/x86.c:900:6: warning: no previous prototype for 'kvm_post_set_cr0' [-Wmissing-prototypes] 900 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^~~~~~~~~~~~~~~~ arch/x86/kvm/x86.c:1081:6: warning: no previous prototype for 'kvm_post_set_cr4' [-Wmissing-prototypes] 1081 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^~~~~~~~~~~~~~~~ vim +/kvm_read_guest_page_mmu +805 arch/x86/kvm/x86.c 16f8a6f9798ab9 Nadav Amit 2014-10-03 799 ec92fe44e7ff94 Joerg Roedel 2010-09-10 800 /* ec92fe44e7ff94 Joerg Roedel 2010-09-10 801 * This function will be used to read from the physical memory of the currently 54bf36aac52031 Paolo Bonzini 2015-04-08 802 * running guest. The difference to kvm_vcpu_read_guest_page is that this function ec92fe44e7ff94 Joerg Roedel 2010-09-10 803 * can read from guest physical or from the guest's guest physical memory. ec92fe44e7ff94 Joerg Roedel 2010-09-10 804 */ ec92fe44e7ff94 Joerg Roedel 2010-09-10 @805 int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, ec92fe44e7ff94 Joerg Roedel 2010-09-10 806 gfn_t ngfn, void *data, int offset, int len, ec92fe44e7ff94 Joerg Roedel 2010-09-10 807 u32 access) ec92fe44e7ff94 Joerg Roedel 2010-09-10 808 { 54987b7afa902e Paolo Bonzini 2014-09-02 809 struct x86_exception exception; ec92fe44e7ff94 Joerg Roedel 2010-09-10 810 gfn_t real_gfn; ec92fe44e7ff94 Joerg Roedel 2010-09-10 811 gpa_t ngpa; ec92fe44e7ff94 Joerg Roedel 2010-09-10 812 ec92fe44e7ff94 Joerg Roedel 2010-09-10 813 ngpa = gfn_to_gpa(ngfn); 54987b7afa902e Paolo Bonzini 2014-09-02 814 real_gfn = mmu->translate_gpa(vcpu, ngpa, access, &exception); ec92fe44e7ff94 Joerg Roedel 2010-09-10 815 if (real_gfn == UNMAPPED_GVA) ec92fe44e7ff94 Joerg Roedel 2010-09-10 816 return -EFAULT; ec92fe44e7ff94 Joerg Roedel 2010-09-10 817 ec92fe44e7ff94 Joerg Roedel 2010-09-10 818 real_gfn = gpa_to_gfn(real_gfn); ec92fe44e7ff94 Joerg Roedel 2010-09-10 819 54bf36aac52031 Paolo Bonzini 2015-04-08 820 return kvm_vcpu_read_guest_page(vcpu, real_gfn, data, offset, len); ec92fe44e7ff94 Joerg Roedel 2010-09-10 821 } ec92fe44e7ff94 Joerg Roedel 2010-09-10 822 EXPORT_SYMBOL_GPL(kvm_read_guest_page_mmu); ec92fe44e7ff94 Joerg Roedel 2010-09-10 823 :::::: The code at line 805 was first introduced by commit :::::: ec92fe44e7ff94d04d8305e49efcffd8773e1cf6 KVM: X86: Add kvm_read_guest_page_mmu function :::::: TO: Joerg Roedel <joerg.roedel(a)amd.com> :::::: CC: Avi Kivity <avi(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] wifi: cfg80211: Avoid Wdiscarded-qualifiers warning
by Yue Haibing 28 Aug '24

28 Aug '24

Commit 591481cccbad trigger a warning: In file included from ./include/net/genetlink.h:6, from net/wireless/nl80211.c:25: net/wireless/nl80211.c:692:69: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] 692 | [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), | ^ ./include/net/netlink.h:407:18: note: in definition of macro 'NLA_POLICY_FULL_RANGE' 407 | .range = _range, \ | ^~~~~~ Remove const qualifier to fix this. Fixes: 591481cccbad ("wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values") Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 89b94d482fcf..674a0d54aff8 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -403,7 +403,7 @@ nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + .len = IEEE80211_MAX_DATA_LEN } }; -static const struct netlink_range_validation q_range = { +static struct netlink_range_validation q_range = { .max = INT_MAX, }; -- 2.34.1

2 1

[openeuler:OLK-6.6 7193/13757] mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e59105d1ac962dacde2b6480857e834f97ca108e commit: fd855715f24e3eeadaa56de5fde21c55a14aeea0 [7193/13757] mm/mem_reliable: Fallback to dpool if reliable memory is not enough config: arm64-randconfig-r064-20240828 (https://download.01.org/0day-ci/archive/20240828/202408281109.dl4CIWeu-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281109.dl4CIWeu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281109.dl4CIWeu-lkp@intel.com/ All errors (new ones prefixed by >>): >> mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); ^ 1 error generated. vim +/dynamic_pool_should_alloc +4110 mm/page_alloc.c 4101 4102 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4103 { 4104 if (!reliable_allow_fb_enabled()) 4105 return false; 4106 4107 if (!(gfp_mask & GFP_RELIABLE)) 4108 return false; 4109 > 4110 return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); 4111 } 4112 #else 4113 static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, 4114 struct alloc_context *ac) 4115 { 4116 return NULL; 4117 } 4118 static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, 4119 struct alloc_context *ac) {} 4120 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4121 { 4122 return false; 4123 } 4124 #endif 4125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] scsi: qla2xxx: validate nvme_local_port correctly
by He Yujie 28 Aug '24

28 Aug '24

From: Nilesh Javali <njavali(a)marvell.com> mainline inclusion from mainline-v6.11-rc1 commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ0D CVE: CVE-2024-42286 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port. Cc: stable(a)vger.kernel.org Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240710171057.35066-3-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/scsi/qla2xxx/qla_nvme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c index d63ccdf6e988..f898a9cc8d06 100644 --- a/drivers/scsi/qla2xxx/qla_nvme.c +++ b/drivers/scsi/qla2xxx/qla_nvme.c @@ -27,7 +27,10 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) return 0; } - if (!vha->nvme_local_port && qla_nvme_register_hba(vha)) + if (qla_nvme_register_hba(vha)) + return 0; + + if (!vha->nvme_local_port) return 0; if (!(fcport->nvme_prli_service_param & -- 2.34.1

2 1

[PATCH OLK-5.10] scsi: qla2xxx: validate nvme_local_port correctly
by He Yujie 28 Aug '24

28 Aug '24

From: Nilesh Javali <njavali(a)marvell.com> mainline inclusion from mainline-v6.11-rc1 commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ0D CVE: CVE-2024-42286 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port. Cc: stable(a)vger.kernel.org Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240710171057.35066-3-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/scsi/qla2xxx/qla_nvme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c index 6dad7787f20d..28a5b40e0f32 100644 --- a/drivers/scsi/qla2xxx/qla_nvme.c +++ b/drivers/scsi/qla2xxx/qla_nvme.c @@ -27,7 +27,10 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) return 0; } - if (!vha->nvme_local_port && qla_nvme_register_hba(vha)) + if (qla_nvme_register_hba(vha)) + return 0; + + if (!vha->nvme_local_port) return 0; if (!(fcport->nvme_prli_service_param & -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] scsi: qla2xxx: validate nvme_local_port correctly
by He Yujie 28 Aug '24

28 Aug '24

From: Nilesh Javali <njavali(a)marvell.com> mainline inclusion from mainline-v6.11-rc1 commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ0D CVE: CVE-2024-42286 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port. Cc: stable(a)vger.kernel.org Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240710171057.35066-3-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/scsi/qla2xxx/qla_nvme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c index db367e428095..daa412667d6e 100644 --- a/drivers/scsi/qla2xxx/qla_nvme.c +++ b/drivers/scsi/qla2xxx/qla_nvme.c @@ -30,7 +30,10 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) return 0; } - if (!vha->nvme_local_port && qla_nvme_register_hba(vha)) + if (qla_nvme_register_hba(vha)) + return 0; + + if (!vha->nvme_local_port) return 0; if (!(fcport->nvme_prli_service_param & -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/4] Fix CVE-2024-40901
by Wang Wensheng 28 Aug '24

28 Aug '24

Breno Leitao (1): scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory Jia-Ju Bai (1): scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() Joe Perches (1): scsi: mpt3sas: Add ioc_<level> logging macros Suganath Prabu (1): scsi: mpt3sas: Gracefully handle online firmware update drivers/scsi/mpt3sas/mpt3sas_base.c | 120 +++++++++++++++++++++++++++- drivers/scsi/mpt3sas/mpt3sas_base.h | 11 +++ 2 files changed, 129 insertions(+), 2 deletions(-) -- 2.17.1

2 5

[openeuler:OLK-5.10 29634/30000] net/wireless/nl80211.c:692:62: error: initializing 'struct netlink_range_validation *' with an expression of type 'const struct netlink_range_validation *' discards qualifiers
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 3e3bb79c307826ef516265644ccc984250795495 commit: 591481cccbad338e0c98905d08ffd0e454886a70 [29634/30000] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values config: x86_64-buildonly-randconfig-001-20240828 (https://download.01.org/0day-ci/archive/20240828/202408281103.NN6DJ2d4-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281103.NN6DJ2d4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281103.NN6DJ2d4-lkp@intel.com/ All errors (new ones prefixed by >>): >> net/wireless/nl80211.c:692:62: error: initializing 'struct netlink_range_validation *' with an expression of type 'const struct netlink_range_validation *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers] 692 | [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), | ^~~~~~~~ include/net/netlink.h:407:11: note: expanded from macro 'NLA_POLICY_FULL_RANGE' 407 | .range = _range, \ | ^~~~~~ 1 error generated. vim +692 net/wireless/nl80211.c 409 410 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 411 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, 412 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 413 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 414 .len = 20-1 }, 415 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 416 417 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 418 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 419 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8, 420 NL80211_EDMG_CHANNELS_MIN, 421 NL80211_EDMG_CHANNELS_MAX), 422 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8, 423 NL80211_EDMG_BW_CONFIG_MIN, 424 NL80211_EDMG_BW_CONFIG_MAX), 425 426 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 427 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 428 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 429 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 430 431 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 432 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 433 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 434 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 435 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 436 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 437 438 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 439 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 440 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 441 442 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 443 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 444 445 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 446 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 447 .len = WLAN_MAX_KEY_LEN }, 448 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7), 449 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 450 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 451 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 452 [NL80211_ATTR_KEY_TYPE] = 453 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 454 455 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 456 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 457 [NL80211_ATTR_BEACON_HEAD] = 458 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head, 459 IEEE80211_MAX_DATA_LEN), 460 [NL80211_ATTR_BEACON_TAIL] = 461 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 462 IEEE80211_MAX_DATA_LEN), 463 [NL80211_ATTR_STA_AID] = 464 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 465 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 466 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 467 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 468 .len = NL80211_MAX_SUPP_RATES }, 469 [NL80211_ATTR_STA_PLINK_ACTION] = 470 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 471 [NL80211_ATTR_STA_TX_POWER_SETTING] = 472 NLA_POLICY_RANGE(NLA_U8, 473 NL80211_TX_POWER_AUTOMATIC, 474 NL80211_TX_POWER_FIXED), 475 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 }, 476 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 477 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 478 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 479 .len = IEEE80211_MAX_MESH_ID_LEN }, 480 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, 481 482 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */ 483 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3), 484 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 485 486 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 487 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 488 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 489 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 490 .len = NL80211_MAX_SUPP_RATES }, 491 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 492 493 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 494 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 495 496 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN), 497 498 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 499 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 500 validate_ie_attr, 501 IEEE80211_MAX_DATA_LEN), 502 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 503 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 504 505 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 506 .len = IEEE80211_MAX_SSID_LEN }, 507 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 508 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 509 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 510 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 511 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 512 NL80211_MFP_NO, 513 NL80211_MFP_OPTIONAL), 514 [NL80211_ATTR_STA_FLAGS2] = { 515 .len = sizeof(struct nl80211_sta_flag_update), 516 }, 517 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 518 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 519 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 520 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 521 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 522 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, 523 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 524 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 525 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 526 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 527 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN), 528 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 529 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 530 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 531 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 532 .len = IEEE80211_MAX_DATA_LEN }, 533 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 534 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 535 NL80211_PS_DISABLED, 536 NL80211_PS_ENABLED), 537 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 538 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 539 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 540 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 541 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 542 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 543 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 544 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 545 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 546 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 547 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 548 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 549 [NL80211_ATTR_STA_PLINK_STATE] = 550 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 551 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, 552 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, 553 [NL80211_ATTR_MESH_PEER_AID] = 554 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 555 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 556 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 557 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 558 [NL80211_ATTR_HIDDEN_SSID] = 559 NLA_POLICY_RANGE(NLA_U32, 560 NL80211_HIDDEN_SSID_NOT_IN_USE, 561 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 562 [NL80211_ATTR_IE_PROBE_RESP] = 563 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 564 IEEE80211_MAX_DATA_LEN), 565 [NL80211_ATTR_IE_ASSOC_RESP] = 566 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 567 IEEE80211_MAX_DATA_LEN), 568 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 569 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 570 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 571 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 572 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 573 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 574 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 575 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 576 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 577 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 578 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 579 .len = IEEE80211_MAX_DATA_LEN }, 580 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 581 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 582 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 583 .len = NL80211_HT_CAPABILITY_LEN 584 }, 585 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 586 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 587 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 588 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 589 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 590 591 /* need to include at least Auth Transaction and Status Code */ 592 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4), 593 594 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN), 595 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 596 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 597 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 598 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 599 NLA_POLICY_RANGE(NLA_U32, 600 NL80211_MESH_POWER_UNKNOWN + 1, 601 NL80211_MESH_POWER_MAX), 602 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 603 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 604 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 605 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 606 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 607 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 608 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 609 .len = NL80211_VHT_CAPABILITY_LEN, 610 }, 611 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 612 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 613 .len = IEEE80211_MAX_DATA_LEN }, 614 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, 615 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = 616 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION), 617 [NL80211_ATTR_PEER_AID] = 618 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 619 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 620 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 621 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 622 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY }, 623 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY }, 624 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2), 625 /* 626 * The value of the Length field of the Supported Operating 627 * Classes element is between 2 and 253. 628 */ 629 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = 630 NLA_POLICY_RANGE(NLA_BINARY, 2, 253), 631 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 632 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 633 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 634 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 635 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 636 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY, 637 IEEE80211_QOS_MAP_LEN_MIN, 638 IEEE80211_QOS_MAP_LEN_MAX), 639 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 640 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 641 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 642 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 643 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 644 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 645 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 646 [NL80211_ATTR_USER_PRIO] = 647 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 648 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 649 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 650 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, 651 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 652 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 653 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 654 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 655 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 656 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 657 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 658 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 659 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 660 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 661 .len = VHT_MUMIMO_GROUPS_DATA_LEN 662 }, 663 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 664 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 665 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 666 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 667 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 668 .len = FILS_MAX_KEK_LEN }, 669 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN), 670 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 671 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN), 672 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 673 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 674 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 675 }, 676 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 677 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 678 .len = FILS_ERP_MAX_USERNAME_LEN }, 679 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 680 .len = FILS_ERP_MAX_REALM_LEN }, 681 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 682 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 683 .len = FILS_ERP_MAX_RRK_LEN }, 684 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2), 685 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 686 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN), 687 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 688 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 689 690 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 691 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, > 692 [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), 693 [NL80211_ATTR_HE_CAPABILITY] = 694 NLA_POLICY_RANGE(NLA_BINARY, 695 NL80211_HE_MIN_CAPABILITY_LEN, 696 NL80211_HE_MAX_CAPABILITY_LEN), 697 [NL80211_ATTR_FTM_RESPONDER] = 698 NLA_POLICY_NESTED(nl80211_ftm_responder_policy), 699 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), 700 [NL80211_ATTR_PEER_MEASUREMENTS] = 701 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), 702 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1), 703 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY, 704 .len = SAE_PASSWORD_MAX_LEN }, 705 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG }, 706 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy), 707 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2), 708 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy), 709 [NL80211_ATTR_TID_CONFIG] = 710 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy), 711 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG }, 712 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1), 713 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100), 714 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG }, 715 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999), 716 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED }, 717 [NL80211_ATTR_HE_6GHZ_CAPABILITY] = 718 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)), 719 [NL80211_ATTR_FILS_DISCOVERY] = 720 NLA_POLICY_NESTED(nl80211_fils_discovery_policy), 721 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] = 722 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy), 723 [NL80211_ATTR_S1G_CAPABILITY] = 724 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 725 [NL80211_ATTR_S1G_CAPABILITY_MASK] = 726 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN), 727 }; 728 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] drm/amdgpu: Fix the null pointer dereference to ras_manager
by Ye Bin 28 Aug '24

28 Aug '24

From: Ma Jun <Jun.Ma2(a)amd.com> stable inclusion from stable-v5.10.224 commit d81c1eeb333d84b3012a91c0500189dc1d71e46c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM8O CVE: CVE-2024-43908 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c11d30c95576937c6c35e6f29884761f2dddb43 ] Check ras_manager before using it Signed-off-by: Ma Jun <Jun.Ma2(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c index 454473c9db6c..88fc38df4b0b 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c @@ -1345,12 +1345,15 @@ static void amdgpu_ras_interrupt_process_handler(struct work_struct *work) int amdgpu_ras_interrupt_dispatch(struct amdgpu_device *adev, struct ras_dispatch_if *info) { - struct ras_manager *obj = amdgpu_ras_find_obj(adev, &info->head); - struct ras_ih_data *data = &obj->ih_data; + struct ras_manager *obj; + struct ras_ih_data *data; + obj = amdgpu_ras_find_obj(adev, &info->head); if (!obj) return -EINVAL; + data = &obj->ih_data; + if (data->inuse == 0) return 0; -- 2.34.1

2 1

[openeuler:OLK-5.10 27226/30000] arch/x86/kvm/x86.c:1076:6: warning: no previous prototype for 'kvm_post_set_cr4'
by kernel test robot 28 Aug '24

28 Aug '24

Hi Yu, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a3e2493c22a624aefb09b92b040c97ecd2e8e2dd commit: 8a7e6f51a756aa6e88ebd5da8a5f3b6744cd07b5 [27226/30000] KVM: x86: Introduce kvm_post_set_cr4 to post handle the CR4 emulation config: x86_64-buildonly-randconfig-005-20240828 (https://download.01.org/0day-ci/archive/20240828/202408281038.faDmsrP1-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281038.faDmsrP1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281038.faDmsrP1-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kvm/x86.c:893:6: warning: no previous prototype for 'kvm_post_set_cr0' [-Wmissing-prototypes] 893 | void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) | ^~~~~~~~~~~~~~~~ >> arch/x86/kvm/x86.c:1076:6: warning: no previous prototype for 'kvm_post_set_cr4' [-Wmissing-prototypes] 1076 | void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) | ^~~~~~~~~~~~~~~~ vim +/kvm_post_set_cr4 +1076 arch/x86/kvm/x86.c 892 > 893 void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0) 894 { 895 unsigned long update_bits = X86_CR0_PG | X86_CR0_WP; 896 897 if ((cr0 ^ old_cr0) & X86_CR0_PG) { 898 kvm_clear_async_pf_completion_queue(vcpu); 899 kvm_async_pf_hash_reset(vcpu); 900 } 901 902 if ((cr0 ^ old_cr0) & update_bits) 903 kvm_mmu_reset_context(vcpu); 904 905 if (((cr0 ^ old_cr0) & X86_CR0_CD) && 906 kvm_arch_has_noncoherent_dma(vcpu->kvm) && 907 !kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED)) 908 kvm_zap_gfn_range(vcpu->kvm, 0, ~0ULL); 909 } 910 911 int kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) 912 { 913 unsigned long old_cr0 = kvm_read_cr0(vcpu); 914 unsigned long pdptr_bits = X86_CR0_CD | X86_CR0_NW | X86_CR0_PG; 915 916 cr0 |= X86_CR0_ET; 917 918 #ifdef CONFIG_X86_64 919 if (cr0 & 0xffffffff00000000UL) 920 return 1; 921 #endif 922 923 cr0 &= ~CR0_RESERVED_BITS; 924 925 if ((cr0 & X86_CR0_NW) && !(cr0 & X86_CR0_CD)) 926 return 1; 927 928 if ((cr0 & X86_CR0_PG) && !(cr0 & X86_CR0_PE)) 929 return 1; 930 931 #ifdef CONFIG_X86_64 932 if ((vcpu->arch.efer & EFER_LME) && !is_paging(vcpu) && 933 (cr0 & X86_CR0_PG)) { 934 int cs_db, cs_l; 935 936 if (!is_pae(vcpu)) 937 return 1; 938 kvm_x86_ops.get_cs_db_l_bits(vcpu, &cs_db, &cs_l); 939 if (cs_l) 940 return 1; 941 } 942 #endif 943 if (!(vcpu->arch.efer & EFER_LME) && (cr0 & X86_CR0_PG) && 944 is_pae(vcpu) && ((cr0 ^ old_cr0) & pdptr_bits) && 945 !load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu))) 946 return 1; 947 948 if (!(cr0 & X86_CR0_PG) && kvm_read_cr4_bits(vcpu, X86_CR4_PCIDE)) 949 return 1; 950 951 kvm_x86_ops.set_cr0(vcpu, cr0); 952 953 kvm_post_set_cr0(vcpu, old_cr0, cr0); 954 955 return 0; 956 } 957 EXPORT_SYMBOL_GPL(kvm_set_cr0); 958 959 void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw) 960 { 961 (void)kvm_set_cr0(vcpu, kvm_read_cr0_bits(vcpu, ~0x0eul) | (msw & 0x0f)); 962 } 963 EXPORT_SYMBOL_GPL(kvm_lmsw); 964 965 void kvm_load_guest_xsave_state(struct kvm_vcpu *vcpu) 966 { 967 if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE)) { 968 969 if (vcpu->arch.xcr0 != host_xcr0) 970 xsetbv(XCR_XFEATURE_ENABLED_MASK, vcpu->arch.xcr0); 971 972 if (vcpu->arch.xsaves_enabled && 973 vcpu->arch.ia32_xss != host_xss) 974 wrmsrl(MSR_IA32_XSS, vcpu->arch.ia32_xss); 975 } 976 977 if (static_cpu_has(X86_FEATURE_PKU) && 978 (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) || 979 (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU)) && 980 vcpu->arch.pkru != vcpu->arch.host_pkru) 981 write_pkru(vcpu->arch.pkru); 982 } 983 EXPORT_SYMBOL_GPL(kvm_load_guest_xsave_state); 984 985 void kvm_load_host_xsave_state(struct kvm_vcpu *vcpu) 986 { 987 if (static_cpu_has(X86_FEATURE_PKU) && 988 (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) || 989 (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU))) { 990 vcpu->arch.pkru = rdpkru(); 991 if (vcpu->arch.pkru != vcpu->arch.host_pkru) 992 write_pkru(vcpu->arch.host_pkru); 993 } 994 995 if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE)) { 996 997 if (vcpu->arch.xcr0 != host_xcr0) 998 xsetbv(XCR_XFEATURE_ENABLED_MASK, host_xcr0); 999 1000 if (vcpu->arch.xsaves_enabled && 1001 vcpu->arch.ia32_xss != host_xss) 1002 wrmsrl(MSR_IA32_XSS, host_xss); 1003 } 1004 1005 } 1006 EXPORT_SYMBOL_GPL(kvm_load_host_xsave_state); 1007 1008 static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr) 1009 { 1010 u64 xcr0 = xcr; 1011 u64 old_xcr0 = vcpu->arch.xcr0; 1012 u64 valid_bits; 1013 1014 /* Only support XCR_XFEATURE_ENABLED_MASK(xcr0) now */ 1015 if (index != XCR_XFEATURE_ENABLED_MASK) 1016 return 1; 1017 if (!(xcr0 & XFEATURE_MASK_FP)) 1018 return 1; 1019 if ((xcr0 & XFEATURE_MASK_YMM) && !(xcr0 & XFEATURE_MASK_SSE)) 1020 return 1; 1021 1022 /* 1023 * Do not allow the guest to set bits that we do not support 1024 * saving. However, xcr0 bit 0 is always set, even if the 1025 * emulated CPU does not support XSAVE (see fx_init). 1026 */ 1027 valid_bits = vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FP; 1028 if (xcr0 & ~valid_bits) 1029 return 1; 1030 1031 if ((!(xcr0 & XFEATURE_MASK_BNDREGS)) != 1032 (!(xcr0 & XFEATURE_MASK_BNDCSR))) 1033 return 1; 1034 1035 if (xcr0 & XFEATURE_MASK_AVX512) { 1036 if (!(xcr0 & XFEATURE_MASK_YMM)) 1037 return 1; 1038 if ((xcr0 & XFEATURE_MASK_AVX512) != XFEATURE_MASK_AVX512) 1039 return 1; 1040 } 1041 1042 if ((xcr0 & XFEATURE_MASK_XTILE) && 1043 ((xcr0 & XFEATURE_MASK_XTILE) != XFEATURE_MASK_XTILE)) 1044 return 1; 1045 1046 vcpu->arch.xcr0 = xcr0; 1047 1048 if ((xcr0 ^ old_xcr0) & XFEATURE_MASK_EXTEND) 1049 kvm_update_cpuid_runtime(vcpu); 1050 return 0; 1051 } 1052 1053 int kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr) 1054 { 1055 if (kvm_x86_ops.get_cpl(vcpu) != 0 || 1056 __kvm_set_xcr(vcpu, index, xcr)) { 1057 kvm_inject_gp(vcpu, 0); 1058 return 1; 1059 } 1060 return 0; 1061 } 1062 EXPORT_SYMBOL_GPL(kvm_set_xcr); 1063 1064 bool kvm_is_valid_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) 1065 { 1066 if (cr4 & cr4_reserved_bits) 1067 return false; 1068 1069 if (cr4 & vcpu->arch.cr4_guest_rsvd_bits) 1070 return false; 1071 1072 return kvm_x86_ops.is_valid_cr4(vcpu, cr4); 1073 } 1074 EXPORT_SYMBOL_GPL(kvm_is_valid_cr4); 1075 > 1076 void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4) 1077 { 1078 unsigned long mmu_role_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE | 1079 X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE; 1080 1081 if (((cr4 ^ old_cr4) & mmu_role_bits) || 1082 (!(cr4 & X86_CR4_PCIDE) && (old_cr4 & X86_CR4_PCIDE))) 1083 kvm_mmu_reset_context(vcpu); 1084 } 1085 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7228/13744] drivers/scsi/sssraid/sssraid_os.c:1553: undefined reference to `msi_domain_first_desc'
by kernel test robot 28 Aug '24

28 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e65c0786c5c765daf978c13bfe587f5426745bc7 commit: 165b3cc224374728856b5584455d7ae7f054fbe5 [7228/13744] SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers config: x86_64-randconfig-074-20240827 (https://download.01.org/0day-ci/archive/20240828/202408281025.qPre06ub-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240828/202408281025.qPre06ub-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408281025.qPre06ub-lkp@intel.com/ All errors (new ones prefixed by >>): ld: vmlinux.o: in function `ls2k500sfb_events_fn': drivers/video/fbdev/ls2k500sfb.c:249: undefined reference to `fg_console' ld: drivers/video/fbdev/ls2k500sfb.c:249: undefined reference to `fg_console' ld: drivers/video/fbdev/ls2k500sfb.c:249: undefined reference to `fg_console' ld: vmlinux.o: in function `sssraid_map_queues': >> drivers/scsi/sssraid/sssraid_os.c:1553: undefined reference to `msi_domain_first_desc' >> ld: drivers/scsi/sssraid/sssraid_os.c:1553: undefined reference to `msi_next_desc' vim +1553 drivers/scsi/sssraid/sssraid_os.c 1535 1536 static void sssraid_map_queues(struct Scsi_Host *shost) 1537 { 1538 struct sssraid_ioc *sdioc = shost_priv(shost); 1539 struct pci_dev *pdev = sdioc->pdev; 1540 struct msi_desc *entry = NULL; 1541 struct irq_affinity_desc *affinity = NULL; 1542 struct blk_mq_tag_set *tag_set = &shost->tag_set; 1543 struct blk_mq_queue_map *queue_map = &tag_set->map[HCTX_TYPE_DEFAULT]; 1544 const struct cpumask *node_mask = NULL; 1545 unsigned int queue_offset = queue_map->queue_offset; 1546 unsigned int *map = queue_map->mq_map; 1547 unsigned int nr_queues = queue_map->nr_queues; 1548 unsigned int node_id, node_id_last = 0xFFFFFFFF; 1549 int cpu, first_sibling, cpu_index = 0; 1550 u8 node_count = 0, i; 1551 unsigned int node_id_array[100]; 1552 > 1553 msi_for_each_desc(entry, &pdev->dev, MSI_DESC_ALL) { 1554 if (entry->irq) { 1555 affinity = entry->affinity; 1556 node_mask = &affinity->mask; 1557 1558 cpu = cpumask_first(node_mask); 1559 node_id = cpu_to_node(cpu); 1560 if (node_id_last == node_id) 1561 continue; 1562 1563 for (i = 0; i < node_count; i++) { 1564 if (node_id == node_id_array[i]) 1565 goto get_next_numa_node; 1566 } 1567 node_id_array[node_count++] = node_id; 1568 node_id_last = node_id; 1569 } 1570 get_next_numa_node: 1571 continue; 1572 } 1573 1574 for (i = 0; i < node_count; i++) { 1575 node_mask = cpumask_of_node(node_id_array[i]); 1576 dbgprint(sdioc, "NUMA_node = %d\n", node_id_array[i]); 1577 for_each_cpu(cpu, node_mask) { 1578 if (cpu_index < nr_queues) { 1579 map[cpu_index++] = queue_offset + (cpu % nr_queues); 1580 } else { 1581 first_sibling = sssraid_get_first_sibling(cpu); 1582 if (first_sibling == cpu) 1583 map[cpu_index++] = queue_offset + (cpu % nr_queues); 1584 else 1585 map[cpu_index++] = map[first_sibling]; 1586 } 1587 dbgprint(sdioc, "map[%d] = %d\n", cpu_index - 1, map[cpu_index - 1]); 1588 } 1589 } 1590 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

2024

2023

2022

2021

2020

2019