- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-36915
by Guo Mengqi 22 Aug '24

22 Aug '24

CVE-2024-36915 Eric Dumazet (3): mISDN: fix MISDN_TIME_STAMP handling net: add copy_safe_from_sockptr() helper nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies drivers/isdn/mISDN/socket.c | 10 +++++----- include/linux/sockptr.h | 25 +++++++++++++++++++++++++ net/nfc/llcp_sock.c | 12 ++++++------ 3 files changed, 36 insertions(+), 11 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-1.0-LTS] filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
by Long Li 22 Aug '24

22 Aug '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALNC4 CVE: NA Reference: https://lore.kernel.org/stable/20240816050627.2122228-1-leo.lilong@huawei.c… ---------------------------------------- The locks_remove_posix() function in fcntl_setlk/fcntl_setlk64 is designed to reliably remove locks when an fcntl/close race is detected. However, it was passing in the wrong filelock owner, it looks like a mistake and resulting in a failure to remove locks. More critically, if the lock removal fails, it could lead to a uaf issue while traversing the locks. This problem occurs only in the 4.19/5.4 stable version. Fixes: a561145f3ae9 ("filelock: Fix fcntl/close race recovery compat path") Fixes: d30ff3304083 ("filelock: Remove locks reliably when fcntl/close race is detected") Cc: stable(a)vger.kernel.org Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/locks.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index ae4b6d487985..ba9b7b7fd90a 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2314,7 +2314,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - locks_remove_posix(filp, &current->files); + locks_remove_posix(filp, current->files); error = -EBADF; } } @@ -2444,7 +2444,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - locks_remove_posix(filp, &current->files); + locks_remove_posix(filp, current->files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Fix a segment issue when downgrading gso_size
by Zhengchao Shao 22 Aug '24

22 Aug '24

From: Fred Li <dracodingfly(a)gmail.com> stable inclusion from stable-v5.10.224 commit dda518dea60d556a2d171c0122ca7d9fdb7d473a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPRL CVE: CVE-2024-42281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit fa5ef655615a01533035c6139248c5b33aa27028 ] Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as described in [1,2]. Fixes: 2be7e212d5419 ("bpf: add bpf_skb_adjust_room helper") Signed-off-by: Fred Li <dracodingfly(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/all/20240626065555.35460-2-dracodingfly@gmail.com [1] Link: https://lore.kernel.org/all/668d5cf1ec330_1c18c32947@willemb.c.googlers.com… [2] Link: https://lore.kernel.org/bpf/20240719024653.77006-1-dracodingfly@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/filter.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 012a5070a9e5..8a61914d35c5 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -3505,13 +3505,20 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff, if (skb_is_gso(skb)) { struct skb_shared_info *shinfo = skb_shinfo(skb); - /* Due to header grow, MSS needs to be downgraded. */ - if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) - skb_decrease_gso_size(shinfo, len_diff); - /* Header must be checked, and gso_segs recomputed. */ shinfo->gso_type |= gso_type; shinfo->gso_segs = 0; + + /* Due to header growth, MSS needs to be downgraded. + * There is a BUG_ON() when segmenting the frag_list with + * head_frag true, so linearize the skb after downgrading + * the MSS. + */ + if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) { + skb_decrease_gso_size(shinfo, len_diff); + if (shinfo->frag_list) + return skb_linearize(skb); + } } return 0; -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Fix a segment issue when downgrading gso_size
by Zhengchao Shao 22 Aug '24

22 Aug '24

From: Fred Li <dracodingfly(a)gmail.com> stable inclusion from stable-v5.10.224 commit dda518dea60d556a2d171c0122ca7d9fdb7d473a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPRL CVE: CVE-2024-42281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit fa5ef655615a01533035c6139248c5b33aa27028 ] Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as described in [1,2]. Fixes: 2be7e212d5419 ("bpf: add bpf_skb_adjust_room helper") Signed-off-by: Fred Li <dracodingfly(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/all/20240626065555.35460-2-dracodingfly@gmail.com [1] Link: https://lore.kernel.org/all/668d5cf1ec330_1c18c32947@willemb.c.googlers.com… [2] Link: https://lore.kernel.org/bpf/20240719024653.77006-1-dracodingfly@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/filter.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 73973bb60197..9ef84e86b5c5 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -3532,13 +3532,20 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff, if (skb_is_gso(skb)) { struct skb_shared_info *shinfo = skb_shinfo(skb); - /* Due to header grow, MSS needs to be downgraded. */ - if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) - skb_decrease_gso_size(shinfo, len_diff); - /* Header must be checked, and gso_segs recomputed. */ shinfo->gso_type |= gso_type; shinfo->gso_segs = 0; + + /* Due to header growth, MSS needs to be downgraded. + * There is a BUG_ON() when segmenting the frag_list with + * head_frag true, so linearize the skb after downgrading + * the MSS. + */ + if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) { + skb_decrease_gso_size(shinfo, len_diff); + if (shinfo->frag_list) + return skb_linearize(skb); + } } return 0; -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 2a231005abe3471e02ef8c447d8ea1310b181ebb
by kernel test robot 22 Aug '24

22 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2a231005abe3471e02ef8c447d8ea1310b181ebb !11012 hfsplus: fix uninit-value in copy_name elapsed time: 729m configs tested: 34 configs skipped: 127 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240822 gcc-14.1.0 arm64 randconfig-002-20240822 gcc-14.1.0 arm64 randconfig-003-20240822 gcc-14.1.0 arm64 randconfig-004-20240822 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240821 gcc-12 x86_64 buildonly-randconfig-002-20240821 clang-18 x86_64 buildonly-randconfig-003-20240821 gcc-12 x86_64 buildonly-randconfig-004-20240821 gcc-12 x86_64 buildonly-randconfig-005-20240821 gcc-12 x86_64 buildonly-randconfig-006-20240821 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240821 clang-18 x86_64 randconfig-002-20240821 gcc-12 x86_64 randconfig-003-20240821 clang-18 x86_64 randconfig-004-20240821 clang-18 x86_64 randconfig-005-20240821 clang-18 x86_64 randconfig-006-20240821 gcc-12 x86_64 randconfig-011-20240821 gcc-12 x86_64 randconfig-012-20240821 clang-18 x86_64 randconfig-013-20240821 clang-18 x86_64 randconfig-014-20240821 clang-18 x86_64 randconfig-015-20240821 gcc-12 x86_64 randconfig-016-20240821 clang-18 x86_64 randconfig-071-20240821 gcc-12 x86_64 randconfig-072-20240821 clang-18 x86_64 randconfig-073-20240821 gcc-12 x86_64 randconfig-074-20240821 clang-18 x86_64 randconfig-075-20240821 gcc-12 x86_64 randconfig-076-20240821 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION da3d113d5157468fcdfa7f7954c2d0704ba347fa
by kernel test robot 22 Aug '24

22 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: da3d113d5157468fcdfa7f7954c2d0704ba347fa !11018 net: usb: qmi_wwan: fix memory leak for not ip packets Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-001-20240821 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-002-20240821 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- ld.lld:error:duplicate-symbol:psp_register_cmd_notifier | `-- ld.lld:error:duplicate-symbol:psp_unregister_cmd_notifier |-- x86_64-buildonly-randconfig-004-20240821 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) `-- x86_64-randconfig-006-20240821 |-- crypto-asymmetric_keys-pgp_public_key.c:undefined-reference-to-public_key_subtype |-- ld:crypto-asymmetric_keys-pgp_public_key.c:undefined-reference-to-public_key_free `-- ld:crypto-asymmetric_keys-pgp_public_key.c:undefined-reference-to-public_key_subtype elapsed time: 725m configs tested: 38 configs skipped: 123 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240821 gcc-14.1.0 arm64 randconfig-002-20240821 gcc-14.1.0 arm64 randconfig-003-20240821 gcc-14.1.0 arm64 randconfig-004-20240821 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240821 gcc-14.1.0 loongarch randconfig-002-20240821 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240821 gcc-12 x86_64 buildonly-randconfig-002-20240821 clang-18 x86_64 buildonly-randconfig-003-20240821 gcc-12 x86_64 buildonly-randconfig-004-20240821 gcc-12 x86_64 buildonly-randconfig-005-20240821 gcc-12 x86_64 buildonly-randconfig-006-20240821 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240821 clang-18 x86_64 randconfig-002-20240821 gcc-12 x86_64 randconfig-003-20240821 clang-18 x86_64 randconfig-004-20240821 clang-18 x86_64 randconfig-005-20240821 clang-18 x86_64 randconfig-006-20240821 gcc-12 x86_64 randconfig-011-20240821 gcc-12 x86_64 randconfig-012-20240821 clang-18 x86_64 randconfig-013-20240821 clang-18 x86_64 randconfig-014-20240821 clang-18 x86_64 randconfig-015-20240821 gcc-12 x86_64 randconfig-016-20240821 clang-18 x86_64 randconfig-071-20240821 gcc-12 x86_64 randconfig-072-20240821 clang-18 x86_64 randconfig-073-20240821 gcc-12 x86_64 randconfig-074-20240821 clang-18 x86_64 randconfig-075-20240821 gcc-12 x86_64 randconfig-076-20240821 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS db863d19ea30eb8b3a72f0cf83381ef9eebd0c68
by kernel test robot 22 Aug '24

22 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: db863d19ea30eb8b3a72f0cf83381ef9eebd0c68 !10966 perf: Optimize perf_pmu_migrate_context() elapsed time: 793m configs tested: 34 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240821 gcc-14.1.0 arm64 randconfig-002-20240821 gcc-14.1.0 arm64 randconfig-003-20240821 gcc-14.1.0 arm64 randconfig-004-20240821 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240821 gcc-12 x86_64 buildonly-randconfig-002-20240821 clang-18 x86_64 buildonly-randconfig-003-20240821 gcc-12 x86_64 buildonly-randconfig-004-20240821 gcc-12 x86_64 buildonly-randconfig-005-20240821 gcc-12 x86_64 buildonly-randconfig-006-20240821 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240821 clang-18 x86_64 randconfig-002-20240821 gcc-12 x86_64 randconfig-003-20240821 clang-18 x86_64 randconfig-004-20240821 clang-18 x86_64 randconfig-005-20240821 clang-18 x86_64 randconfig-006-20240821 gcc-12 x86_64 randconfig-011-20240821 gcc-12 x86_64 randconfig-012-20240821 clang-18 x86_64 randconfig-013-20240821 clang-18 x86_64 randconfig-014-20240821 clang-18 x86_64 randconfig-015-20240821 gcc-12 x86_64 randconfig-016-20240821 clang-18 x86_64 randconfig-071-20240821 gcc-12 x86_64 randconfig-072-20240821 clang-18 x86_64 randconfig-073-20240821 gcc-12 x86_64 randconfig-074-20240821 clang-18 x86_64 randconfig-075-20240821 gcc-12 x86_64 randconfig-076-20240821 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/7] ext4: some bugfixs for large iomap&folio
by Zhihao Cheng 21 Aug '24

21 Aug '24

Darrick J. Wong (1): xfs: hoist multi-fsb allocation unit detection to a helper Zhang Yi (4): xfs: reserve blocks for truncating large realtime inode iomap: don't mark blocks uptodate after partial zeroing iomap: reduce unnecessary state_lock when setting ifs uptodate and dirty bits iomap: optimize setting uptodate bit Zhihao Cheng (2): ext4: ext4_iomap_map_blocks: Fix null pointer deference in nojournal mode iomap: improve iomap_folio_mkwrite_iter and ifs_clear_range_dirty fs/ext4/inode.c | 2 +- fs/iomap/buffered-io.c | 50 +++++++++++++++++++++++++++++++++++++----- fs/xfs/xfs_bmap_util.c | 4 ++-- fs/xfs/xfs_inode.h | 9 ++++++++ fs/xfs/xfs_iops.c | 15 ++++++++++++- 5 files changed, 70 insertions(+), 10 deletions(-) -- 2.31.1

2 8

[PATCH OLK-6.6 00/27] mm/shmem: mTHP support for anon shmem
by Liu Shixin 21 Aug '24

21 Aug '24

Bang Li (5): mm: add update_mmu_tlb_range() mm: implement update_mmu_tlb() using update_mmu_tlb_range() mm: use update_mmu_tlb_range() to simplify code mm/shmem: fix input and output inconsistencies mm: thp: support "THPeligible" semantics for mTHP with anonymous shmem Baolin Wang (8): mm: memory: extend finish_fault() to support large folio mm: shmem: add THP validation for PMD-mapped THP related statistics mm: shmem: add multi-size THP sysfs interface for anonymous shmem mm: shmem: add mTHP support for anonymous shmem mm: shmem: add mTHP size alignment in shmem_get_unmapped_area mm: shmem: add mTHP counters for anonymous shmem mm: shmem: avoid allocating huge pages larger than MAX_PAGECACHE_ORDER for shmem mm: shmem: fix incorrect aligned index when checking conflicts Christoph Hellwig (2): shmem: set a_ops earlier in shmem_symlink shmem: move the shmem_mapping assert into shmem_get_folio_gfp Hugh Dickins (8): shmem: shrink shmem_inode_info: dir_offsets in a union shmem: remove vma arg from shmem_get_folio_gfp() shmem: factor shmem_falloc_wait() out of shmem_fault() shmem: trivial tidyups, removing extra blank lines, etc shmem: shmem_acct_blocks() and shmem_inode_acct_blocks() shmem: move memcg charge out of shmem_add_to_page_cache() shmem: _add_to_page_cache() before shmem_inode_acct_blocks() shmem,percpu_counter: add _limited_add(fbc, limit, amount) Lance Yang (2): mm: add per-order mTHP split counters mm: add docs for per-order mTHP split counters Liu Shixin (1): mm: shmem: Merge shmem_alloc_hugefolio() with shmem_alloc_folio() Ryan Roberts (1): mm: shmem: rename mTHP shmem counters Documentation/admin-guide/mm/transhuge.rst | 74 +- arch/loongarch/include/asm/pgtable.h | 4 +- arch/mips/include/asm/pgtable.h | 4 +- arch/riscv/include/asm/pgtable.h | 4 +- arch/xtensa/include/asm/pgtable.h | 6 +- arch/xtensa/mm/tlb.c | 6 +- include/linux/huge_mm.h | 26 + include/linux/percpu_counter.h | 23 + include/linux/pgtable.h | 11 +- include/linux/shmem_fs.h | 25 +- lib/percpu_counter.c | 53 ++ mm/huge_memory.c | 43 +- mm/memory.c | 65 +- mm/shmem.c | 791 +++++++++++++-------- 14 files changed, 797 insertions(+), 338 deletions(-) -- 2.25.1

2 28

[PATCH OLK-6.6 00/12] mm: lazyfree THP support
by Liu Shixin 21 Aug '24

21 Aug '24

Andrew Morton (1): mm/huge_memory.c: fix used-uninitialized Barry Song (1): mm: arm64: fix the out-of-bounds issue in contpte_clear_young_dirty_ptes Lance Yang (7): mm/madvise: introduce clear_young_dirty_ptes() batch helper mm/arm64: override clear_young_dirty_ptes() batch helper mm/memory: add any_dirty optional pointer to folio_pte_batch() mm/madvise: optimize lazyfreeing with mTHP in madvise_free mm/rmap: remove duplicated exit code in pagewalk loop mm/rmap: integrate PMD-mapped folio splitting into pagewalk loop mm/vmscan: avoid split lazyfree THP during shrink_folio_list() Matthew Wilcox (Oracle) (1): mm: add pmd_folio() Peter Xu (2): mm/Kconfig: CONFIG_PGTABLE_HAS_HUGE_LEAVES mm: make HPAGE_PXD_* macros even if !THP arch/arm64/include/asm/pgtable.h | 55 +++++++++++++++ arch/arm64/mm/contpte.c | 29 ++++++++ include/linux/huge_mm.h | 44 ++++++++---- include/linux/mm_types.h | 9 +++ include/linux/pgtable.h | 76 ++++++++++++--------- include/linux/rmap.h | 24 +++++++ mm/Kconfig | 6 ++ mm/huge_memory.c | 111 +++++++++++++++++++++++++------ mm/internal.h | 12 +++- mm/madvise.c | 109 +++++++++++++++++------------- mm/memory.c | 4 +- mm/mempolicy.c | 2 +- mm/mlock.c | 2 +- mm/rmap.c | 67 ++++++++++--------- 14 files changed, 399 insertions(+), 151 deletions(-) -- 2.25.1

2 13

[PATCH openEuler-22.03-LTS-SP1] PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
by Yang Yingliang 21 Aug '24

21 Aug '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> mainline inclusion from mainline-v6.11-rc1 commit a231707a91f323af1e5d9f1722055ec2fc1c7775 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ54 CVE: CVE-2024-43823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- If IORESOURCE_MEM is not provided in Device Tree due to any error, resource_list_first_type() will return NULL and pci_parse_request_of_pci_ranges() will just emit a warning. This will cause a NULL pointer dereference. Fix this bug by adding NULL return check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 0f71c60ffd26 ("PCI: dwc: Remove storing of PCI resources") Link: https://lore.kernel.org/linux-pci/20240505061517.11527-1-amishin@t-argos.ru Suggested-by: Bjorn Helgaas <helgaas(a)kernel.org> Suggested-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/pci/controller/dwc/pci-keystone.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pci/controller/dwc/pci-keystone.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c index d3c3ca3ef4ba..db052628fb78 100644 --- a/drivers/pci/controller/dwc/pci-keystone.c +++ b/drivers/pci/controller/dwc/pci-keystone.c @@ -391,17 +391,22 @@ static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) } while (val & DBI_CS2); } -static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) +static int ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) { u32 val; struct dw_pcie *pci = ks_pcie->pci; struct pcie_port *pp = &pci->pp; u32 num_viewport = pci->num_viewport; - u64 start, end; + struct resource_entry *entry; struct resource *mem; + u64 start, end; int i; - mem = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM)->res; + entry = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM); + if (!entry) + return -ENODEV; + + mem = entry->res; start = mem->start; end = mem->end; @@ -412,7 +417,7 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) ks_pcie_clear_dbi_mode(ks_pcie); if (ks_pcie->is_am6) - return; + return 0; val = ilog2(OB_WIN_SIZE); ks_pcie_app_writel(ks_pcie, OB_SIZE, val); @@ -429,6 +434,8 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); val |= OB_XLAT_EN_VAL; ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); + + return 0; } static void __iomem *ks_pcie_other_map_bus(struct pci_bus *bus, @@ -825,7 +832,10 @@ static int __init ks_pcie_host_init(struct pcie_port *pp) dw_pcie_setup_rc(pp); ks_pcie_stop_link(pci); - ks_pcie_setup_rc_app_regs(ks_pcie); + ret = ks_pcie_setup_rc_app_regs(ks_pcie); + if (ret) + return ret; + writew(PCI_IO_RANGE_TYPE_32 | (PCI_IO_RANGE_TYPE_32 << 8), pci->dbi_base + PCI_IO_BASE); -- 2.25.1

2 1

[PATCH OLK-5.10] PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
by Yang Yingliang 21 Aug '24

21 Aug '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> mainline inclusion from mainline-v6.11-rc1 commit a231707a91f323af1e5d9f1722055ec2fc1c7775 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ54 CVE: CVE-2024-43823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- If IORESOURCE_MEM is not provided in Device Tree due to any error, resource_list_first_type() will return NULL and pci_parse_request_of_pci_ranges() will just emit a warning. This will cause a NULL pointer dereference. Fix this bug by adding NULL return check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 0f71c60ffd26 ("PCI: dwc: Remove storing of PCI resources") Link: https://lore.kernel.org/linux-pci/20240505061517.11527-1-amishin@t-argos.ru Suggested-by: Bjorn Helgaas <helgaas(a)kernel.org> Suggested-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/pci/controller/dwc/pci-keystone.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pci/controller/dwc/pci-keystone.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c index d3c3ca3ef4ba..db052628fb78 100644 --- a/drivers/pci/controller/dwc/pci-keystone.c +++ b/drivers/pci/controller/dwc/pci-keystone.c @@ -391,17 +391,22 @@ static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) } while (val & DBI_CS2); } -static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) +static int ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) { u32 val; struct dw_pcie *pci = ks_pcie->pci; struct pcie_port *pp = &pci->pp; u32 num_viewport = pci->num_viewport; - u64 start, end; + struct resource_entry *entry; struct resource *mem; + u64 start, end; int i; - mem = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM)->res; + entry = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM); + if (!entry) + return -ENODEV; + + mem = entry->res; start = mem->start; end = mem->end; @@ -412,7 +417,7 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) ks_pcie_clear_dbi_mode(ks_pcie); if (ks_pcie->is_am6) - return; + return 0; val = ilog2(OB_WIN_SIZE); ks_pcie_app_writel(ks_pcie, OB_SIZE, val); @@ -429,6 +434,8 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); val |= OB_XLAT_EN_VAL; ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); + + return 0; } static void __iomem *ks_pcie_other_map_bus(struct pci_bus *bus, @@ -825,7 +832,10 @@ static int __init ks_pcie_host_init(struct pcie_port *pp) dw_pcie_setup_rc(pp); ks_pcie_stop_link(pci); - ks_pcie_setup_rc_app_regs(ks_pcie); + ret = ks_pcie_setup_rc_app_regs(ks_pcie); + if (ret) + return ret; + writew(PCI_IO_RANGE_TYPE_32 | (PCI_IO_RANGE_TYPE_32 << 8), pci->dbi_base + PCI_IO_BASE); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] s390/sclp: Fix sclp_init() cleanup on failure
by dinglongwei 21 Aug '24

21 Aug '24

From: Heiko Carstens <hca(a)linux.ibm.com> stable inclusion from stable-v4.19.319 commit a778987afc36d5dc02a1f82d352a81edcaf7eb83 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEM8 CVE: CVE-2024-41068 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6434b33faaa063df500af355ee6c3942e0f8d982 ] If sclp_init() fails it only partially cleans up: if there are multiple failing calls to sclp_init() sclp_state_change_event will be added several times to sclp_reg_list, which results in the following warning: ------------[ cut here ]------------ list_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10. WARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3 Krnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 ... Call Trace: [<000003ffe0d6076a>] __list_add_valid_or_report+0xe2/0xf8 ([<000003ffe0d60766>] __list_add_valid_or_report+0xde/0xf8) [<000003ffe0a8d37e>] sclp_init+0x40e/0x450 [<000003ffe00009f2>] do_one_initcall+0x42/0x1e0 [<000003ffe15b77a6>] do_initcalls+0x126/0x150 [<000003ffe15b7a0a>] kernel_init_freeable+0x1ba/0x1f8 [<000003ffe0d6650e>] kernel_init+0x2e/0x180 [<000003ffe000301c>] __ret_from_fork+0x3c/0x60 [<000003ffe0d759ca>] ret_from_fork+0xa/0x30 Fix this by removing sclp_state_change_event from sclp_reg_list when sclp_init() fails. Reviewed-by: Peter Oberparleiter <oberpar(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/s390/char/sclp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c index e9aa71cdfc44..74df353d2244 100644 --- a/drivers/s390/char/sclp.c +++ b/drivers/s390/char/sclp.c @@ -1206,6 +1206,7 @@ sclp_init(void) fail_unregister_reboot_notifier: unregister_reboot_notifier(&sclp_reboot_notifier); fail_init_state_uninitialized: + list_del(&sclp_state_change_event.list); sclp_init_state = sclp_init_state_uninitialized; fail_unlock: spin_unlock_irqrestore(&sclp_lock, flags); -- 2.17.1

2 1

[PATCH v2 OLK-5.10 00/14] Some bugfix for HNS RoCE
by Chengchang Tang 21 Aug '24

21 Aug '24

Some bugfix patches for HNS RoCE: Chengchang Tang (4): RDMA/hns: Use one CQ bank per context RDMA/hns: Fix HW UAF when destroy context timeout RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled RDMA/hns: Fix integer overflow in calc_loading_percent() Feng Fang (1): RDMA/hns: Fix different dgids mapping to the same dip_idx Junxian Huang (6): RDMA/hns: Fix a potential Sleep-in-Atomic-Context RDMA/hns: Fix soft lockup under heavy CEQE load RDMA/hns: Fix mixed use of u32 and __le32 in sysfs RDMA/hns: Fix wrong output of sysfs scc pram when configuration failed RDMA/hns: Fix concurrency between sysfs store and FW configuration of scc params RDMA/hns: Fix creating sysfs before allocating resources wenglianfa (3): RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() RDMA/hns: Fix long waiting cmd event when reset RDMA/hns: Fix sleeping in spin_lock critical section drivers/infiniband/hw/hns/hns_roce_cq.c | 63 ++++++- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 10 +- drivers/infiniband/hw/hns/hns_roce_device.h | 19 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 12 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 189 ++++++++++++++----- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 + drivers/infiniband/hw/hns/hns_roce_main.c | 16 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 22 +-- drivers/infiniband/hw/hns/hns_roce_qp.c | 33 ++-- drivers/infiniband/hw/hns/hns_roce_srq.c | 6 +- drivers/infiniband/hw/hns/hns_roce_sysfs.c | 40 ++-- 11 files changed, 294 insertions(+), 117 deletions(-) -- 2.33.0

2 15

[PATCH OLK-6.6 v2 00/18] Backport bugfix of folio from v6.11
by Liu Shixin 21 Aug '24

21 Aug '24

Baolin Wang (1): mm: page_alloc: allowing mTHP compaction to capture the freed page directly Gao Xiang (1): mm/migrate: fix deadlock in migrate_pages_batch() on large folios Gavin Shan (2): mm/huge_memory: avoid PMD-size page cache if needed mm/readahead: limit page cache size in page_cache_ra_order() Hugh Dickins (2): mm: fix crashes from deferred split racing folio migration mm: simplify folio_migrate_mapping() Kefeng Wang (1): mm: refactor folio_undo_large_rmappable() Liu Shixin (1): mm/huge_memory: fix comment errors of thp_mapping_align Matthew Wilcox (Oracle) (1): filemap: Convert generic_perform_write() to support large folios Pankaj Raghav (1): readahead: use ilog2 instead of a while loop in page_cache_ra_order() Peter Xu (1): mm/migrate: putback split folios when numa hint migration fails Ran Xiaokai (1): mm/huge_memory: mark racy access onhuge_anon_orders_always Ryan Roberts (1): mm: fix khugepaged activation policy Yajun Deng (1): mm/mmap: simplify vma link and unlink Zi Yan (1): mm/migrate: make migrate_pages_batch() stats consistent linke li (3): mm/swapfile: mark racy access on si->highest_bit mm/slub: mark racy access on slab->freelist mm/slub: mark racy accesses on slab->slabs Documentation/admin-guide/mm/transhuge.rst | 15 ++++---- include/linux/huge_mm.h | 24 +++++------- mm/filemap.c | 40 ++++++++++++-------- mm/huge_memory.c | 32 +++++++++------- mm/internal.h | 17 ++++++++- mm/khugepaged.c | 33 ++++++++++++---- mm/memcontrol.c | 11 ------ mm/migrate.c | 42 +++++++++++++++------ mm/mmap.c | 44 ++++++++++------------ mm/page_alloc.c | 9 +++-- mm/readahead.c | 10 ++--- mm/slub.c | 8 ++-- mm/swap.c | 8 +--- mm/swapfile.c | 2 +- mm/vmscan.c | 8 +--- 15 files changed, 168 insertions(+), 135 deletions(-) -- 2.25.1

2 19

[PATCH OLK-6.6 00/19] Backport bugfix of folio from v6.11
by Liu Shixin 21 Aug '24

21 Aug '24

Baolin Wang (1): mm: page_alloc: allowing mTHP compaction to capture the freed page directly Christoph Hellwig (1): shmem: set a_ops earlier in shmem_symlink Gao Xiang (1): mm/migrate: fix deadlock in migrate_pages_batch() on large folios Gavin Shan (2): mm/huge_memory: avoid PMD-size page cache if needed mm/readahead: limit page cache size in page_cache_ra_order() Hugh Dickins (2): mm: fix crashes from deferred split racing folio migration mm: simplify folio_migrate_mapping() Kefeng Wang (1): mm: refactor folio_undo_large_rmappable() Liu Shixin (1): mm/huge_memory: fix comment errors of thp_mapping_align Matthew Wilcox (Oracle) (1): filemap: Convert generic_perform_write() to support large folios Pankaj Raghav (1): readahead: use ilog2 instead of a while loop in page_cache_ra_order() Peter Xu (1): mm/migrate: putback split folios when numa hint migration fails Ran Xiaokai (1): mm/huge_memory: mark racy access onhuge_anon_orders_always Ryan Roberts (1): mm: fix khugepaged activation policy Yajun Deng (1): mm/mmap: simplify vma link and unlink Zi Yan (1): mm/migrate: make migrate_pages_batch() stats consistent linke li (3): mm/swapfile: mark racy access on si->highest_bit mm/slub: mark racy access on slab->freelist mm/slub: mark racy accesses on slab->slabs Documentation/admin-guide/mm/transhuge.rst | 15 ++++---- include/linux/huge_mm.h | 24 +++++------- mm/filemap.c | 40 ++++++++++++-------- mm/huge_memory.c | 32 +++++++++------- mm/internal.h | 17 ++++++++- mm/khugepaged.c | 33 ++++++++++++---- mm/memcontrol.c | 11 ------ mm/migrate.c | 42 +++++++++++++++------ mm/mmap.c | 44 ++++++++++------------ mm/page_alloc.c | 9 +++-- mm/readahead.c | 10 ++--- mm/shmem.c | 2 +- mm/slub.c | 8 ++-- mm/swap.c | 8 +--- mm/swapfile.c | 2 +- mm/vmscan.c | 8 +--- 16 files changed, 169 insertions(+), 136 deletions(-) -- 2.25.1

2 20

[PATCH v1 OLK-5.10] coresight: etm4x: Fix unbalanced
by dev01404 21 Aug '24

21 Aug '24

From f20bee130a0a3ac038ef8540e6f3018d02220db4Mon Sep 17 00:00:00 2001 From: Anshuman Khandual <anshuman.khandual(a)arm.com> community inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAKVLJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------------ coresight: etm4x: Fix unbalanced pm_runtime_enable() There is an unbalanced pm_runtime_enable() in etm4_probe_platform_dev() when etm4_probe() fails. This problem can be observed via the coresight etm4 module's (load -> unload -> load) sequence when etm4_probe() fails in etm4_probe_platform_dev(). [ 63.379943] coresight-etm4x 7040000.etm: Unbalanced pm_runtime_enable! [ 63.393630] coresight-etm4x 7140000.etm: Unbalanced pm_runtime_enable! [ 63.407455] coresight-etm4x 7240000.etm: Unbalanced pm_runtime_enable! [ 63.420983] coresight-etm4x 7340000.etm: Unbalanced pm_runtime_enable! [ 63.420999] coresight-etm4x 7440000.etm: Unbalanced pm_runtime_enable! [ 63.441209] coresight-etm4x 7540000.etm: Unbalanced pm_runtime_enable! [ 63.454689] coresight-etm4x 7640000.etm: Unbalanced pm_runtime_enable! [ 63.474982] coresight-etm4x 7740000.etm: Unbalanced pm_runtime_enable! This fixes the above problem - with an explicit pm_runtime_disable() call when etm4_probe() fails during etm4_probe_platform_dev(). Cc: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Cc: Hanjun Guo <guohanjun(a)huawei.com> Cc: Sudeep Holla <sudeep.holla(a)arm.com> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: Len Brown <lenb(a)kernel.org> Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> Cc: Mike Leach <mike.leach(a)linaro.org> Cc: James Clark <james.clark(a)arm.com> Cc: Leo Yan <leo.yan(a)linaro.org> Cc: linux-acpi(a)vger.kernel.org Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Cc: coresight(a)lists.linaro.org Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") Reviewed-by: James Clark <james.clark(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Wang Lian <dev01404(a)linx-info.com> Link: https://lore.kernel.org/r/20240314055843.2625883-2-anshuman.khandual@arm.com Subject: [PATCH OLK-5.10] coresight: etm4x: Fix unbalanced pm_runtime_enable --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 87cfd60ee..98db96a80 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2088,6 +2088,9 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) ret = etm4_probe(&pdev->dev); pm_runtime_put(&pdev->dev); + if (ret) + pm_runtime_disable(&pdev->dev); + return ret; } -- 2.20.1

2 1

[PATCH 0/4] Fix CVE-2024-40901
by Wang Wensheng 21 Aug '24

21 Aug '24

Breno Leitao (1): scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory Jia-Ju Bai (1): scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() Joe Perches (1): scsi: mpt3sas: Add ioc_<level> logging macros Suganath Prabu (1): scsi: mpt3sas: Gracefully handle online firmware update drivers/scsi/mpt3sas/mpt3sas_base.c | 120 +++++++++++++++++++++++++++- drivers/scsi/mpt3sas/mpt3sas_base.h | 11 +++ 2 files changed, 129 insertions(+), 2 deletions(-) -- 2.17.1

1 4

[PATCH OLK-5.10] coresight: etm4x: Fix unbalanced
by dev01404 21 Aug '24

21 Aug '24

From: Anshuman Khandual <anshuman.khandual(a)arm.com> mainline inclusion from mainline-v6.11-rc1 commit caa41c47dab7e1054f587e592ab21296e3a6781c category: bugfix bugzilla:https://gitee.com/openeuler/kernel/issues/IAKVLJ Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi… -------------------------------- coresight: etm4x: Fix unbalanced pm_runtime_enable() There is an unbalanced pm_runtime_enable() in etm4_probe_platform_dev() when etm4_probe() fails. This problem can be observed via the coresight etm4 module's (load -> unload -> load) sequence when etm4_probe() fails in etm4_probe_platform_dev(). [ 63.379943] coresight-etm4x 7040000.etm: Unbalanced pm_runtime_enable! [ 63.393630] coresight-etm4x 7140000.etm: Unbalanced pm_runtime_enable! [ 63.407455] coresight-etm4x 7240000.etm: Unbalanced pm_runtime_enable! [ 63.420983] coresight-etm4x 7340000.etm: Unbalanced pm_runtime_enable! [ 63.420999] coresight-etm4x 7440000.etm: Unbalanced pm_runtime_enable! [ 63.441209] coresight-etm4x 7540000.etm: Unbalanced pm_runtime_enable! [ 63.454689] coresight-etm4x 7640000.etm: Unbalanced pm_runtime_enable! [ 63.474982] coresight-etm4x 7740000.etm: Unbalanced pm_runtime_enable! This fixes the above problem - with an explicit pm_runtime_disable() call when etm4_probe() fails during etm4_probe_platform_dev(). Cc: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Cc: Hanjun Guo <guohanjun(a)huawei.com> Cc: Sudeep Holla <sudeep.holla(a)arm.com> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: Len Brown <lenb(a)kernel.org> Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> Cc: Mike Leach <mike.leach(a)linaro.org> Cc: James Clark <james.clark(a)arm.com> Cc: Leo Yan <leo.yan(a)linaro.org> Cc: linux-acpi(a)vger.kernel.org Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Cc: coresight(a)lists.linaro.org Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") Reviewed-by: James Clark <james.clark(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Wang Lian <dev01404(a)linx-info.com> Link: https://lore.kernel.org/r/20240314055843.2625883-2-anshuman.khandual@arm.com --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 87cfd60ee..98db96a80 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2088,6 +2088,9 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) ret = etm4_probe(&pdev->dev); pm_runtime_put(&pdev->dev); + if (ret) + pm_runtime_disable(&pdev->dev); + return ret; } -- 2.20.1

2 1

[PATCH v1 OLK-5.10] coresight: etm4x: Fix unbalanced
by dev01404 21 Aug '24

21 Aug '24

From 304474a878c6d11e260c4caef79c51d7a94a4429 Mon Sep 17 00:00:00 2001 From: Anshuman Khandual <anshuman.khandual(a)arm.com> mainline： inclusion from: mainline-6.10 commit: caa41c47dab7e1054f587e592ab21296e3a6781c category: bugfix bugzilla:https://gitee.com/openeuler/kernel/issues/IAKVLJ Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi… coresight: etm4x: Fix unbalanced pm_runtime_enable() There is an unbalanced pm_runtime_enable() in etm4_probe_platform_dev() when etm4_probe() fails. This problem can be observed via the coresight etm4 module's (load -> unload -> load) sequence when etm4_probe() fails in etm4_probe_platform_dev(). [ 63.379943] coresight-etm4x 7040000.etm: Unbalanced pm_runtime_enable! [ 63.393630] coresight-etm4x 7140000.etm: Unbalanced pm_runtime_enable! [ 63.407455] coresight-etm4x 7240000.etm: Unbalanced pm_runtime_enable! [ 63.420983] coresight-etm4x 7340000.etm: Unbalanced pm_runtime_enable! [ 63.420999] coresight-etm4x 7440000.etm: Unbalanced pm_runtime_enable! [ 63.441209] coresight-etm4x 7540000.etm: Unbalanced pm_runtime_enable! [ 63.454689] coresight-etm4x 7640000.etm: Unbalanced pm_runtime_enable! [ 63.474982] coresight-etm4x 7740000.etm: Unbalanced pm_runtime_enable! This fixes the above problem - with an explicit pm_runtime_disable() call when etm4_probe() fails during etm4_probe_platform_dev(). Cc: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Cc: Hanjun Guo <guohanjun(a)huawei.com> Cc: Sudeep Holla <sudeep.holla(a)arm.com> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: Len Brown <lenb(a)kernel.org> Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> Cc: Mike Leach <mike.leach(a)linaro.org> Cc: James Clark <james.clark(a)arm.com> Cc: Leo Yan <leo.yan(a)linaro.org> Cc: linux-acpi(a)vger.kernel.org Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Cc: coresight(a)lists.linaro.org Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") Reviewed-by: James Clark <james.clark(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Wang Lian <dev01404(a)linx-info.com> Link: https://lore.kernel.org/r/20240314055843.2625883-2-anshuman.khandual@arm.com Subject: [PATCH OLK-5.10] coresight: etm4x: Fix unbalanced pm_runtime_enable --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 87cfd60ee..98db96a80 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2088,6 +2088,9 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) ret = etm4_probe(&pdev->dev); pm_runtime_put(&pdev->dev); + if (ret) + pm_runtime_disable(&pdev->dev); + return ret; } -- 2.20.1

2 5

[PATCH v1 OLK-5.10] coresight: etm4x: Fix unbalanced
by dev01404 21 Aug '24

21 Aug '24

From 304474a878c6d11e260c4caef79c51d7a94a4429 Mon Sep 17 00:00:00 2001 From: Anshuman Khandual <anshuman.khandual(a)arm.com> community inclusion category: bugfix bugzilla:https://gitee.com/openeuler/kernel/issues/IAKVLJ Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi… coresight: etm4x: Fix unbalanced pm_runtime_enable() There is an unbalanced pm_runtime_enable() in etm4_probe_platform_dev() when etm4_probe() fails. This problem can be observed via the coresight etm4 module's (load -> unload -> load) sequence when etm4_probe() fails in etm4_probe_platform_dev(). [ 63.379943] coresight-etm4x 7040000.etm: Unbalanced pm_runtime_enable! [ 63.393630] coresight-etm4x 7140000.etm: Unbalanced pm_runtime_enable! [ 63.407455] coresight-etm4x 7240000.etm: Unbalanced pm_runtime_enable! [ 63.420983] coresight-etm4x 7340000.etm: Unbalanced pm_runtime_enable! [ 63.420999] coresight-etm4x 7440000.etm: Unbalanced pm_runtime_enable! [ 63.441209] coresight-etm4x 7540000.etm: Unbalanced pm_runtime_enable! [ 63.454689] coresight-etm4x 7640000.etm: Unbalanced pm_runtime_enable! [ 63.474982] coresight-etm4x 7740000.etm: Unbalanced pm_runtime_enable! This fixes the above problem - with an explicit pm_runtime_disable() call when etm4_probe() fails during etm4_probe_platform_dev(). Cc: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Cc: Hanjun Guo <guohanjun(a)huawei.com> Cc: Sudeep Holla <sudeep.holla(a)arm.com> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: Len Brown <lenb(a)kernel.org> Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> Cc: Mike Leach <mike.leach(a)linaro.org> Cc: James Clark <james.clark(a)arm.com> Cc: Leo Yan <leo.yan(a)linaro.org> Cc: linux-acpi(a)vger.kernel.org Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Cc: coresight(a)lists.linaro.org Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") Reviewed-by: James Clark <james.clark(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Wang Lian <dev01404(a)linx-info.com> Link: https://lore.kernel.org/r/20240314055843.2625883-2-anshuman.khandual@arm.com Subject: [PATCH OLK-5.10] coresight: etm4x: Fix unbalanced pm_runtime_enable --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 87cfd60ee..98db96a80 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2088,6 +2088,9 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) ret = etm4_probe(&pdev->dev); pm_runtime_put(&pdev->dev); + if (ret) + pm_runtime_disable(&pdev->dev); + return ret; } -- 2.20.1

2 1

[PATCH v1 OLK-5.10] coresight: etm4x: Fix unbalanced
by dev01404 21 Aug '24

21 Aug '24

From: Anshuman Khandual <anshuman.khandual(a)arm.com> mainline inclusion from mainline-5.10 commit caa41c47dab7e1054f587e592ab21296e3a6781c category: bugfix bugzilla:https://gitee.com/openeuler/kernel/issues/IAKVLJ Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi… coresight: etm4x: Fix unbalanced pm_runtime_enable() There is an unbalanced pm_runtime_enable() in etm4_probe_platform_dev() when etm4_probe() fails. This problem can be observed via the coresight etm4 module's (load -> unload -> load) sequence when etm4_probe() fails in etm4_probe_platform_dev(). [ 63.379943] coresight-etm4x 7040000.etm: Unbalanced pm_runtime_enable! [ 63.393630] coresight-etm4x 7140000.etm: Unbalanced pm_runtime_enable! [ 63.407455] coresight-etm4x 7240000.etm: Unbalanced pm_runtime_enable! [ 63.420983] coresight-etm4x 7340000.etm: Unbalanced pm_runtime_enable! [ 63.420999] coresight-etm4x 7440000.etm: Unbalanced pm_runtime_enable! [ 63.441209] coresight-etm4x 7540000.etm: Unbalanced pm_runtime_enable! [ 63.454689] coresight-etm4x 7640000.etm: Unbalanced pm_runtime_enable! [ 63.474982] coresight-etm4x 7740000.etm: Unbalanced pm_runtime_enable! This fixes the above problem - with an explicit pm_runtime_disable() call when etm4_probe() fails during etm4_probe_platform_dev(). Cc: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Cc: Hanjun Guo <guohanjun(a)huawei.com> Cc: Sudeep Holla <sudeep.holla(a)arm.com> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: Len Brown <lenb(a)kernel.org> Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> Cc: Mike Leach <mike.leach(a)linaro.org> Cc: James Clark <james.clark(a)arm.com> Cc: Leo Yan <leo.yan(a)linaro.org> Cc: linux-acpi(a)vger.kernel.org Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Cc: coresight(a)lists.linaro.org Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") Reviewed-by: James Clark <james.clark(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Wang Lian <dev01404(a)linx-info.com> Link: https://lore.kernel.org/r/20240314055843.2625883-2-anshuman.khandual@arm.com Subject: [PATCH v1 OLK-5.10] coresight: etm4x: Fix unbalanced --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 87cfd60ee..98db96a80 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2088,6 +2088,9 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) ret = etm4_probe(&pdev->dev); pm_runtime_put(&pdev->dev); + if (ret) + pm_runtime_disable(&pdev->dev); + return ret; } -- 2.20.1

2 1

[PATCH v1 OLK-5.10] coresight: etm4x: Fix unbalanced
by dev01404 21 Aug '24

21 Aug '24

From: Anshuman Khandual <anshuman.khandual(a)arm.com> mainline inclusion from mainline-5.10 commit caa41c47dab7e1054f587e592ab21296e3a6781c category: bugfix bugzilla:https://gitee.com/openeuler/kernel/issues/IAKVLJ Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi… coresight: etm4x: Fix unbalanced pm_runtime_enable() There is an unbalanced pm_runtime_enable() in etm4_probe_platform_dev() when etm4_probe() fails. This problem can be observed via the coresight etm4 module's (load -> unload -> load) sequence when etm4_probe() fails in etm4_probe_platform_dev(). [ 63.379943] coresight-etm4x 7040000.etm: Unbalanced pm_runtime_enable! [ 63.393630] coresight-etm4x 7140000.etm: Unbalanced pm_runtime_enable! [ 63.407455] coresight-etm4x 7240000.etm: Unbalanced pm_runtime_enable! [ 63.420983] coresight-etm4x 7340000.etm: Unbalanced pm_runtime_enable! [ 63.420999] coresight-etm4x 7440000.etm: Unbalanced pm_runtime_enable! [ 63.441209] coresight-etm4x 7540000.etm: Unbalanced pm_runtime_enable! [ 63.454689] coresight-etm4x 7640000.etm: Unbalanced pm_runtime_enable! [ 63.474982] coresight-etm4x 7740000.etm: Unbalanced pm_runtime_enable! This fixes the above problem - with an explicit pm_runtime_disable() call when etm4_probe() fails during etm4_probe_platform_dev(). Cc: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Cc: Hanjun Guo <guohanjun(a)huawei.com> Cc: Sudeep Holla <sudeep.holla(a)arm.com> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: Len Brown <lenb(a)kernel.org> Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> Cc: Mike Leach <mike.leach(a)linaro.org> Cc: James Clark <james.clark(a)arm.com> Cc: Leo Yan <leo.yan(a)linaro.org> Cc: linux-acpi(a)vger.kernel.org Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Cc: coresight(a)lists.linaro.org Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") Reviewed-by: James Clark <james.clark(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Wang Lian <dev01404(a)linx-info.com> Link: https://lore.kernel.org/r/20240314055843.2625883-2-anshuman.khandual@arm.com Subject: [PATCH] etm4x: Fix unbalanced pm_runtime_enable() --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 87cfd60ee..98db96a80 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2088,6 +2088,9 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) ret = etm4_probe(&pdev->dev); pm_runtime_put(&pdev->dev); + if (ret) + pm_runtime_disable(&pdev->dev); + return ret; } -- 2.20.1

2 1

[PATCH v1 OLK-5.10] coresight: etm4x: Fix unbalanced
by dev01404 21 Aug '24

21 Aug '24

From: Anshuman Khandual <anshuman.khandual(a)arm.com> mainline inclusion from mainline-6.10 commit caa41c47dab7e1054f587e592ab21296e3a6781c category: bugfix bugzilla:https://gitee.com/openeuler/kernel/issues/IAKVLJ Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi… coresight: etm4x: Fix unbalanced pm_runtime_enable() There is an unbalanced pm_runtime_enable() in etm4_probe_platform_dev() when etm4_probe() fails. This problem can be observed via the coresight etm4 module's (load -> unload -> load) sequence when etm4_probe() fails in etm4_probe_platform_dev(). [ 63.379943] coresight-etm4x 7040000.etm: Unbalanced pm_runtime_enable! [ 63.393630] coresight-etm4x 7140000.etm: Unbalanced pm_runtime_enable! [ 63.407455] coresight-etm4x 7240000.etm: Unbalanced pm_runtime_enable! [ 63.420983] coresight-etm4x 7340000.etm: Unbalanced pm_runtime_enable! [ 63.420999] coresight-etm4x 7440000.etm: Unbalanced pm_runtime_enable! [ 63.441209] coresight-etm4x 7540000.etm: Unbalanced pm_runtime_enable! [ 63.454689] coresight-etm4x 7640000.etm: Unbalanced pm_runtime_enable! [ 63.474982] coresight-etm4x 7740000.etm: Unbalanced pm_runtime_enable! This fixes the above problem - with an explicit pm_runtime_disable() call when etm4_probe() fails during etm4_probe_platform_dev(). Cc: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Cc: Hanjun Guo <guohanjun(a)huawei.com> Cc: Sudeep Holla <sudeep.holla(a)arm.com> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: Len Brown <lenb(a)kernel.org> Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> Cc: Mike Leach <mike.leach(a)linaro.org> Cc: James Clark <james.clark(a)arm.com> Cc: Leo Yan <leo.yan(a)linaro.org> Cc: linux-acpi(a)vger.kernel.org Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Cc: coresight(a)lists.linaro.org Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") Reviewed-by: James Clark <james.clark(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Wang Lian <dev01404(a)linx-info.com> Link: https://lore.kernel.org/r/20240314055843.2625883-2-anshuman.khandual@arm.com Subject: [PATCH] etm4x: Fix unbalanced pm_runtime_enable() --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 87cfd60ee..98db96a80 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2088,6 +2088,9 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) ret = etm4_probe(&pdev->dev); pm_runtime_put(&pdev->dev); + if (ret) + pm_runtime_disable(&pdev->dev); + return ret; } -- 2.20.1

2 1

[PATCH OLK-5.10 00/14] Some bugfix for HNS RoCE
by Chengchang Tang 21 Aug '24

21 Aug '24

Some bugfix patches for HNS RoCE: Chengchang Tang (4): RDMA/hns: Use one CQ bank per context RDMA/hns: Fix HW UAF when destroy context timeout RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled RDMA/hns: Fix integer overflow in calc_loading_percent() Feng Fang (1): RDMA/hns: Fix different dgids mapping to the same dip_idx Junxian Huang (6): RDMA/hns: Fix a potential Sleep-in-Atomic-Context RDMA/hns: Fix soft lockup under heavy CEQE load RDMA/hns: Fix mixed use of u32 and __le32 in sysfs RDMA/hns: Fix wrong output of sysfs scc pram when configuration failed RDMA/hns: Fix concurrency between sysfs store and FW configuration of scc params RDMA/hns: Fix creating sysfs before allocating resources wenglianfa (3): RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() RDMA/hns: Fix long waiting cmd event when reset RDMA/hns: Fix sleeping in spin_lock critical section drivers/infiniband/hw/hns/hns_roce_cq.c | 63 ++++++- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 10 +- drivers/infiniband/hw/hns/hns_roce_device.h | 19 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 12 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 189 ++++++++++++++----- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 + drivers/infiniband/hw/hns/hns_roce_main.c | 16 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 22 +-- drivers/infiniband/hw/hns/hns_roce_qp.c | 33 ++-- drivers/infiniband/hw/hns/hns_roce_srq.c | 6 +- drivers/infiniband/hw/hns/hns_roce_sysfs.c | 34 ++-- 11 files changed, 291 insertions(+), 114 deletions(-) -- 2.33.0

2 15

[PATCH OLK-5.10] PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
by liwei 21 Aug '24

21 Aug '24

From: Lukas Wunner <lukas(a)wunner.de> mainline inclusion from mainline-v6.11-rc1 commit 11a1f4bc47362700fcbde717292158873fb847ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ1W CVE: CVE-2024-42302 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_handler() awaits readiness of the secondary bus below the Downstream Port where the DPC event occurred. To do so, it polls the config space of the first child device on the secondary bus. If that child device is concurrently removed, accesses to its struct pci_dev cause the kernel to oops. That's because pci_bridge_wait_for_secondary_bus() neglects to hold a reference on the child device. Before v6.3, the function was only called on resume from system sleep or on runtime resume. Holding a reference wasn't necessary back then because the pciehp IRQ thread could never run concurrently. (On resume from system sleep, IRQs are not enabled until after the resume_noirq phase. And runtime resume is always awaited before a PCI device is removed.) However starting with v6.3, pci_bridge_wait_for_secondary_bus() is also called on a DPC event. Commit 53b54ad074de ("PCI/DPC: Await readiness of secondary bus after reset"), which introduced that, failed to appreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a reference on the child device because dpc_handler() and pciehp may indeed run concurrently. The commit was backported to v5.10+ stable kernels, so that's the oldest one affected. Add the missing reference acquisition. Abridged stack trace: BUG: unable to handle page fault for address: 00000000091400c0 CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0 RIP: pci_bus_read_config_dword+0x17/0x50 pci_dev_wait() pci_bridge_wait_for_secondary_bus() dpc_reset_link() pcie_do_recovery() dpc_handler() Fixes: 53b54ad074de ("PCI/DPC: Await readiness of secondary bus after reset") Closes: https://lore.kernel.org/r/20240612181625.3604512-3-kbusch@meta.com/ Link: https://lore.kernel.org/linux-pci/8e4bcd4116fd94f592f2bf2749f168099c480ddf.… Reported-by: Keith Busch <kbusch(a)kernel.org> Tested-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Lukas Wunner <lukas(a)wunner.de> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Cc: stable(a)vger.kernel.org # v5.10+ Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/pci/pci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 336daa667fb1..157d7e781227 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -4829,7 +4829,7 @@ static int pci_bus_max_d3cold_delay(const struct pci_bus *bus) int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type, int timeout) { - struct pci_dev *child; + struct pci_dev *child __free(pci_dev_put) = NULL; int delay; if (pci_dev_is_disconnected(dev)) @@ -4858,8 +4858,8 @@ int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type, return 0; } - child = list_first_entry(&dev->subordinate->devices, struct pci_dev, - bus_list); + child = pci_dev_get(list_first_entry(&dev->subordinate->devices, + struct pci_dev, bus_list)); up_read(&pci_bus_sem); /* -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] remoteproc: imx_rproc: Skip over memory region when node value is NULL
by liwei 21 Aug '24

21 Aug '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> mainline inclusion from mainline-v6.11-rc1 commit 2fa26ca8b786888673689ccc9da6094150939982 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5U CVE: CVE-2024-43860 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In imx_rproc_addr_init() "nph = of_count_phandle_with_args()" just counts number of phandles. But phandles may be empty. So of_parse_phandle() in the parsing loop (0 < a < nph) may return NULL which is later dereferenced. Adjust this issue by adding NULL-return check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: a0ff4aa6f010 ("remoteproc: imx_rproc: add a NXP/Freescale imx_rproc driver") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Reviewed-by: Peng Fan <peng.fan(a)nxp.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240606075204.12354-1-amishin@t-argos.ru [Fixed title to fit within the prescribed 70-75 charcters] Signed-off-by: Mathieu Poirier <mathieu.poirier(a)linaro.org> Conflicts: drivers/remoteproc/imx_rproc.c [context conflict] Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/remoteproc/imx_rproc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c index 8957ed271d20..0576cefb93df 100644 --- a/drivers/remoteproc/imx_rproc.c +++ b/drivers/remoteproc/imx_rproc.c @@ -287,6 +287,8 @@ static int imx_rproc_addr_init(struct imx_rproc *priv, struct resource res; node = of_parse_phandle(np, "memory-region", a); + if (!node) + continue; err = of_address_to_resource(node, 0, &res); if (err) { dev_err(dev, "unable to resolve memory region\n"); -- 2.25.1

2 1

[PATCH OLK-5.10] remoteproc: imx_rproc: Skip over memory region when node value is NULL
by liwei 21 Aug '24

21 Aug '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> mainline inclusion from mainline-v6.11-rc1 commit 2fa26ca8b786888673689ccc9da6094150939982 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5U CVE: CVE-2024-43860 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In imx_rproc_addr_init() "nph = of_count_phandle_with_args()" just counts number of phandles. But phandles may be empty. So of_parse_phandle() in the parsing loop (0 < a < nph) may return NULL which is later dereferenced. Adjust this issue by adding NULL-return check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: a0ff4aa6f010 ("remoteproc: imx_rproc: add a NXP/Freescale imx_rproc driver") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Reviewed-by: Peng Fan <peng.fan(a)nxp.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240606075204.12354-1-amishin@t-argos.ru [Fixed title to fit within the prescribed 70-75 charcters] Signed-off-by: Mathieu Poirier <mathieu.poirier(a)linaro.org> Conflicts: drivers/remoteproc/imx_rproc.c [context conflict] Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/remoteproc/imx_rproc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c index 8957ed271d20..0576cefb93df 100644 --- a/drivers/remoteproc/imx_rproc.c +++ b/drivers/remoteproc/imx_rproc.c @@ -287,6 +287,8 @@ static int imx_rproc_addr_init(struct imx_rproc *priv, struct resource res; node = of_parse_phandle(np, "memory-region", a); + if (!node) + continue; err = of_address_to_resource(node, 0, &res); if (err) { dev_err(dev, "unable to resolve memory region\n"); -- 2.25.1

2 1

[PATCH v1 OLK-5.10] coresight: etm4x: Fix unbalanced
by dev01404 21 Aug '24

21 Aug '24

From 304474a878c6d11e260c4caef79c51d7a94a4429 Mon Sep 17 00:00:00 2001 From: Wang Lian <dev01404(a)linx-info.com> Date: Tue, 20 Aug 2024 15:30:23 +0800 Subject: [PATCH v2 OLK-5.10] coresight: etm4x: Fix unbalanced pm_runtime_enable() This fixes the above problem - with an explicit pm_runtime_disable() call when etm4_probe() fails during etm4_probe_platform_dev(). From: Anshuman Khandual <anshuman.khandual(a)arm.com> mainline inclusion from mainline-6.10 commit caa41c47dab7e1054f587e592ab21296e3a6781c category: bugfix bugzilla:https://gitee.com/openeuler/kernel/issues/IAKVLJ Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi… coresight: etm4x: Fix unbalanced pm_runtime_enable() There is an unbalanced pm_runtime_enable() in etm4_probe_platform_dev() when etm4_probe() fails. This problem can be observed via the coresight etm4 module's (load -> unload -> load) sequence when etm4_probe() fails in etm4_probe_platform_dev(). [ 63.379943] coresight-etm4x 7040000.etm: Unbalanced pm_runtime_enable! [ 63.393630] coresight-etm4x 7140000.etm: Unbalanced pm_runtime_enable! [ 63.407455] coresight-etm4x 7240000.etm: Unbalanced pm_runtime_enable! [ 63.420983] coresight-etm4x 7340000.etm: Unbalanced pm_runtime_enable! [ 63.420999] coresight-etm4x 7440000.etm: Unbalanced pm_runtime_enable! [ 63.441209] coresight-etm4x 7540000.etm: Unbalanced pm_runtime_enable! [ 63.454689] coresight-etm4x 7640000.etm: Unbalanced pm_runtime_enable! [ 63.474982] coresight-etm4x 7740000.etm: Unbalanced pm_runtime_enable! This fixes the above problem - with an explicit pm_runtime_disable() call when etm4_probe() fails during etm4_probe_platform_dev(). Cc: Lorenzo Pieralisi <lpieralisi(a)kernel.org> Cc: Hanjun Guo <guohanjun(a)huawei.com> Cc: Sudeep Holla <sudeep.holla(a)arm.com> Cc: "Rafael J. Wysocki" <rafael(a)kernel.org> Cc: Len Brown <lenb(a)kernel.org> Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> Cc: Mike Leach <mike.leach(a)linaro.org> Cc: James Clark <james.clark(a)arm.com> Cc: Leo Yan <leo.yan(a)linaro.org> Cc: linux-acpi(a)vger.kernel.org Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Cc: coresight(a)lists.linaro.org Fixes: 5214b563588e ("coresight: etm4x: Add support for sysreg only devices") Reviewed-by: James Clark <james.clark(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Wang Lian <dev01404(a)linx-info.com> Link: https://lore.kernel.org/r/20240314055843.2625883-2-anshuman.khandual@arm.com -------------------------------------------------------------- drivers/hwtracing/coresight/coresight-etm4x-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 87cfd60ee36c..f280032a9318 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2088,6 +2088,9 @@ static int etm4_probe_platform_dev(struct platform_device *pdev) ret = etm4_probe(&pdev->dev); pm_runtime_put(&pdev->dev); + if(ret) + pm_runtime_disable(&pdev->dev); + return ret; } -- 2.34.1

2 1

[PATCH OLK-5.10] landlock: Don't lose track of restrictions on cred_transfer
by GONG, Ruiqi 21 Aug '24

21 Aug '24

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.11-rc1 commit 39705a6c29f8a2b93cf5b99528a55366c50014d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPQE CVE: CVE-2024-42318 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a process' cred struct is replaced, this _almost_ always invokes the cred_prepare LSM hook; but in one special case (when KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the cred_transfer LSM hook is used instead. Landlock only implements the cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes all information on Landlock restrictions to be lost. This basically means that a process with the ability to use the fork() and keyctl() syscalls can get rid of all Landlock restrictions on itself. Fix it by adding a cred_transfer hook that does the same thing as the existing cred_prepare hook. (Implemented by having hook_cred_prepare() call hook_cred_transfer() so that the two functions are less likely to accidentally diverge in the future.) Cc: stable(a)kernel.org Fixes: 385975dca53e ("landlock: Set up the security framework and manage credentials") Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240724-landlock-houdini-fix-v1-1-df89a4560ca3@g… Signed-off-by: Mickaël Salaün <mic(a)digikod.net> Conflicts: security/landlock/cred.c [Just context conflicts.] Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- security/landlock/cred.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/security/landlock/cred.c b/security/landlock/cred.c index 6725af24c684..dfe432488638 100644 --- a/security/landlock/cred.c +++ b/security/landlock/cred.c @@ -14,8 +14,8 @@ #include "ruleset.h" #include "setup.h" -static int hook_cred_prepare(struct cred *const new, - const struct cred *const old, const gfp_t gfp) +static void hook_cred_transfer(struct cred *const new, + const struct cred *const old) { struct landlock_ruleset *const old_dom = landlock_cred(old)->domain; @@ -23,6 +23,12 @@ static int hook_cred_prepare(struct cred *const new, landlock_get_ruleset(old_dom); landlock_cred(new)->domain = old_dom; } +} + +static int hook_cred_prepare(struct cred *const new, + const struct cred *const old, const gfp_t gfp) +{ + hook_cred_transfer(new, old); return 0; } @@ -36,6 +42,7 @@ static void hook_cred_free(struct cred *const cred) static struct security_hook_list landlock_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(cred_prepare, hook_cred_prepare), + LSM_HOOK_INIT(cred_transfer, hook_cred_transfer), LSM_HOOK_INIT(cred_free, hook_cred_free), }; -- 2.25.1

2 1

[PATCH OLK-5.10] ipv6: sr: fix missing sk_buff release in seg6_input_core
by Guo Mengqi 21 Aug '24

21 Aug '24

From: Andrea Mayer <andrea.mayer(a)uniroma2.it> mainline inclusion from mainline-v6.10-rc1 commit 5447f9708d9e4c17a647b16a9cb29e9e02820bd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAC3N2 CVE: CVE-2024-39490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak. This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") and persists even after commit 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), where the entire seg6_input() code was refactored to deal with netfilter hooks. The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails. Fixes: af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") Signed-off-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv6/seg6_iptunnel.c [commit 7a3f5b0de364 add seg6_input_core() to seg6_input() for netfilter hooks of SRv6, which lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/seg6_iptunnel.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 40ac23242c37..ab2a606fdb65 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -318,10 +318,8 @@ static int seg6_input(struct sk_buff *skb) int err; err = seg6_do_srh(skb); - if (unlikely(err)) { - kfree_skb(skb); - return err; - } + if (unlikely(err)) + goto drop; slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); @@ -346,9 +344,12 @@ static int seg6_input(struct sk_buff *skb) err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); if (unlikely(err)) - return err; + goto drop; return dst_input(skb); +drop: + kfree_skb(skb); + return err; } static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ipv6: sr: fix missing sk_buff release in seg6_input_core
by Guo Mengqi 21 Aug '24

21 Aug '24

From: Andrea Mayer <andrea.mayer(a)uniroma2.it> mainline inclusion from mainline-v6.10-rc1 commit 5447f9708d9e4c17a647b16a9cb29e9e02820bd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAC3N2 CVE: CVE-2024-39490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak. This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") and persists even after commit 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), where the entire seg6_input() code was refactored to deal with netfilter hooks. The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails. Fixes: af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") Signed-off-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv6/seg6_iptunnel.c [commit 7a3f5b0de364 add seg6_input_core() to seg6_input() for netfilter hooks of SRv6, which lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/seg6_iptunnel.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 40ac23242c37..ab2a606fdb65 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -318,10 +318,8 @@ static int seg6_input(struct sk_buff *skb) int err; err = seg6_do_srh(skb); - if (unlikely(err)) { - kfree_skb(skb); - return err; - } + if (unlikely(err)) + goto drop; slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate); @@ -346,9 +344,12 @@ static int seg6_input(struct sk_buff *skb) err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); if (unlikely(err)) - return err; + goto drop; return dst_input(skb); +drop: + kfree_skb(skb); + return err; } static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
by Guo Mengqi 21 Aug '24

21 Aug '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.197 commit 5475b8bea1489403a4e6c2d102fcb5dde310acb3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917IV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e63972a2de14482d0eae1a03a73e379f1c3f44c ] The variable crtc->state->event is often protected by the lock crtc->dev->event_lock when is accessed. However, it is accessed as a condition of an if statement in exynos_drm_crtc_atomic_disable() without holding the lock: if (crtc->state->event && !crtc->state->active) However, if crtc->state->event is changed to NULL by another thread right after the conditions of the if statement is checked to be true, a null-pointer dereference can occur in drm_crtc_send_vblank_event(): e->pipe = pipe; To fix this possible null-pointer dereference caused by data race, the spin lock coverage is extended to protect the if statement as well as the function call to drm_crtc_send_vblank_event(). Reported-by: BassCheck <bass(a)buaa.edu.cn> Link: https://sites.google.com/view/basscheck/home Signed-off-by: Tuo Li <islituo(a)gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Added relevant link. Signed-off-by: Inki Dae <inki.dae(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/gpu/drm/exynos/exynos_drm_crtc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c index 1c03485676ef..de9fadccf22e 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c +++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c @@ -39,13 +39,12 @@ static void exynos_drm_crtc_atomic_disable(struct drm_crtc *crtc, if (exynos_crtc->ops->atomic_disable) exynos_crtc->ops->atomic_disable(exynos_crtc); + spin_lock_irq(&crtc->dev->event_lock); if (crtc->state->event && !crtc->state->active) { - spin_lock_irq(&crtc->dev->event_lock); drm_crtc_send_vblank_event(crtc, crtc->state->event); - spin_unlock_irq(&crtc->dev->event_lock); - crtc->state->event = NULL; } + spin_unlock_irq(&crtc->dev->event_lock); } static int exynos_crtc_atomic_check(struct drm_crtc *crtc, -- 2.17.1

2 1

[PATCH OLK-5.10] ocfs2: add bounds checking to ocfs2_check_dir_entry()
by Zhang Zekun 21 Aug '24

21 Aug '24

From: lei lu <llfamsec(a)gmail.com> mainline inclusion from mainline-v6.11-rc1 commit 255547c6bb8940a97eea94ef9d464ea5967763fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG8VL CVE: CVE-2024-41015 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------------------------------------- This adds sanity checks for ocfs2_dir_entry to make sure all members of ocfs2_dir_entry don't stray beyond valid memory region. Link: https://lkml.kernel.org/r/20240626104433.163270-1-llfamsec@gmail.com Signed-off-by: lei lu <llfamsec(a)gmail.com> Reviewed-by: Heming Zhao <heming.zhao(a)suse.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/ocfs2/dir.c [There are some changes in the context, modify the patch to fit the kernel] Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- fs/ocfs2/dir.c | 46 +++++++++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 17 deletions(-) diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c index bdfba9db558a..4cc29b808d18 100644 --- a/fs/ocfs2/dir.c +++ b/fs/ocfs2/dir.c @@ -296,13 +296,16 @@ static void ocfs2_dx_dir_name_hash(struct inode *dir, const char *name, int len, * bh passed here can be an inode block or a dir data block, depending * on the inode inline data flag. */ -static int ocfs2_check_dir_entry(struct inode * dir, - struct ocfs2_dir_entry * de, - struct buffer_head * bh, +static int ocfs2_check_dir_entry(struct inode *dir, + struct ocfs2_dir_entry *de, + struct buffer_head *bh, + char *buf, + unsigned int size, unsigned long offset) { const char *error_msg = NULL; const int rlen = le16_to_cpu(de->rec_len); + const unsigned long next_offset = ((char *) de - buf) + rlen; if (unlikely(rlen < OCFS2_DIR_REC_LEN(1))) error_msg = "rec_len is smaller than minimal"; @@ -310,9 +313,11 @@ static int ocfs2_check_dir_entry(struct inode * dir, error_msg = "rec_len % 4 != 0"; else if (unlikely(rlen < OCFS2_DIR_REC_LEN(de->name_len))) error_msg = "rec_len is too small for name_len"; - else if (unlikely( - ((char *) de - bh->b_data) + rlen > dir->i_sb->s_blocksize)) - error_msg = "directory entry across blocks"; + else if (unlikely(next_offset > size)) + error_msg = "directory entry overrun"; + else if (unlikely(next_offset > size - OCFS2_DIR_REC_LEN(1)) && + next_offset != size) + error_msg = "directory entry too close to end"; if (unlikely(error_msg != NULL)) mlog(ML_ERROR, "bad entry in directory #%llu: %s - " @@ -354,16 +359,17 @@ static inline int ocfs2_search_dirblock(struct buffer_head *bh, de_buf = first_de; dlimit = de_buf + bytes; - while (de_buf < dlimit) { + while (de_buf < dlimit - OCFS2_DIR_MEMBER_LEN) { /* this code is executed quadratically often */ /* do minimal checking `by hand' */ de = (struct ocfs2_dir_entry *) de_buf; - if (de_buf + namelen <= dlimit && + if (de->name + namelen <= dlimit && ocfs2_match(namelen, name, de)) { /* found a match - just to be sure, do a full check */ - if (!ocfs2_check_dir_entry(dir, de, bh, offset)) { + if (!ocfs2_check_dir_entry(dir, de, bh, first_de, + bytes, offset)) { ret = -1; goto bail; } @@ -1140,7 +1146,7 @@ static int __ocfs2_delete_entry(handle_t *handle, struct inode *dir, pde = NULL; de = (struct ocfs2_dir_entry *) first_de; while (i < bytes) { - if (!ocfs2_check_dir_entry(dir, de, bh, i)) { + if (!ocfs2_check_dir_entry(dir, de, bh, first_de, bytes, i)) { status = -EIO; mlog_errno(status); goto bail; @@ -1640,7 +1646,8 @@ int __ocfs2_add_entry(handle_t *handle, /* These checks should've already been passed by the * prepare function, but I guess we can leave them * here anyway. */ - if (!ocfs2_check_dir_entry(dir, de, insert_bh, offset)) { + if (!ocfs2_check_dir_entry(dir, de, insert_bh, data_start, + size, offset)) { retval = -ENOENT; goto bail; } @@ -1778,7 +1785,8 @@ static int ocfs2_dir_foreach_blk_id(struct inode *inode, } de = (struct ocfs2_dir_entry *) (data->id_data + ctx->pos); - if (!ocfs2_check_dir_entry(inode, de, di_bh, ctx->pos)) { + if (!ocfs2_check_dir_entry(inode, de, di_bh, (char *)data->id_data, + i_size_read(inode), ctx->pos)) { /* On error, skip the f_pos to the end. */ ctx->pos = i_size_read(inode); break; @@ -1871,7 +1879,8 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode, while (ctx->pos < i_size_read(inode) && offset < sb->s_blocksize) { de = (struct ocfs2_dir_entry *) (bh->b_data + offset); - if (!ocfs2_check_dir_entry(inode, de, bh, offset)) { + if (!ocfs2_check_dir_entry(inode, de, bh, bh->b_data, + sb->s_blocksize, offset)) { /* On error, skip the f_pos to the next block. */ ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1; @@ -3343,7 +3352,7 @@ static int ocfs2_find_dir_space_id(struct inode *dir, struct buffer_head *di_bh, struct super_block *sb = dir->i_sb; struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data; struct ocfs2_dir_entry *de, *last_de = NULL; - char *de_buf, *limit; + char *first_de, *de_buf, *limit; unsigned long offset = 0; unsigned int rec_len, new_rec_len, free_space = dir->i_sb->s_blocksize; @@ -3356,14 +3365,16 @@ static int ocfs2_find_dir_space_id(struct inode *dir, struct buffer_head *di_bh, else free_space = dir->i_sb->s_blocksize - i_size_read(dir); - de_buf = di->id2.i_data.id_data; + first_de = di->id2.i_data.id_data; + de_buf = first_de; limit = de_buf + i_size_read(dir); rec_len = OCFS2_DIR_REC_LEN(namelen); while (de_buf < limit) { de = (struct ocfs2_dir_entry *)de_buf; - if (!ocfs2_check_dir_entry(dir, de, di_bh, offset)) { + if (!ocfs2_check_dir_entry(dir, de, di_bh, first_de, + i_size_read(dir), offset)) { ret = -ENOENT; goto out; } @@ -3445,7 +3456,8 @@ static int ocfs2_find_dir_space_el(struct inode *dir, const char *name, /* move to next block */ de = (struct ocfs2_dir_entry *) bh->b_data; } - if (!ocfs2_check_dir_entry(dir, de, bh, offset)) { + if (!ocfs2_check_dir_entry(dir, de, bh, bh->b_data, blocksize, + offset)) { status = -ENOENT; goto bail; } -- 2.17.1

2 1

[PATCH OLK-5.10] udf: Avoid using corrupted block bitmap buffer
by Ye Bin 21 Aug '24

21 Aug '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.224 commit 2199e157a465aaf98294d3932797ecd7fce942d5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPZN CVE: CVE-2024-42306 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a90d4471146de21745980cba51ce88e7926bcc4f upstream. When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap will notice the bitmap buffer is already loaded and tries to allocate from the bitmap with mixed results (depending on the exact nature of the bitmap corruption). Fix the problem by using BH_verified bit to indicate whether the bitmap is valid or not. Reported-by: syzbot+5f682cd029581f9edfd1(a)syzkaller.appspotmail.com CC: stable(a)vger.kernel.org Link: https://patch.msgid.link/20240617154201.29512-2-jack@suse.cz Fixes: 1e0d4adf17e7 ("udf: Check consistency of Space Bitmap Descriptor") Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- fs/udf/balloc.c | 15 +++++++++++++-- fs/udf/super.c | 3 ++- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c index f416b7fe092f..c4c18eeacb60 100644 --- a/fs/udf/balloc.c +++ b/fs/udf/balloc.c @@ -68,8 +68,12 @@ static int read_block_bitmap(struct super_block *sb, } for (i = 0; i < count; i++) - if (udf_test_bit(i + off, bh->b_data)) + if (udf_test_bit(i + off, bh->b_data)) { + bitmap->s_block_bitmap[bitmap_nr] = + ERR_PTR(-EFSCORRUPTED); + brelse(bh); return -EFSCORRUPTED; + } return 0; } @@ -85,8 +89,15 @@ static int __load_block_bitmap(struct super_block *sb, block_group, nr_groups); } - if (bitmap->s_block_bitmap[block_group]) + if (bitmap->s_block_bitmap[block_group]) { + /* + * The bitmap failed verification in the past. No point in + * trying again. + */ + if (IS_ERR(bitmap->s_block_bitmap[block_group])) + return PTR_ERR(bitmap->s_block_bitmap[block_group]); return block_group; + } retval = read_block_bitmap(sb, bitmap, block_group, block_group); if (retval < 0) diff --git a/fs/udf/super.c b/fs/udf/super.c index 4af9ce34ee80..1939678f0b62 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c @@ -266,7 +266,8 @@ static void udf_sb_free_bitmap(struct udf_bitmap *bitmap) int nr_groups = bitmap->s_nr_groups; for (i = 0; i < nr_groups; i++) - brelse(bitmap->s_block_bitmap[i]); + if (!IS_ERR_OR_NULL(bitmap->s_block_bitmap[i])) + brelse(bitmap->s_block_bitmap[i]); kvfree(bitmap); } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] net: usb: qmi_wwan: fix memory leak for not ip packets
by Pu Lehui 21 Aug '24

21 Aug '24

From: Daniele Palmas <dnlplm(a)gmail.com> stable inclusion from stable-v4.19.320 commit 3c90a69533b5bba73401ef884d033ea49ee99662 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALDR9 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7ab107544b777c3bd7feb9fe447367d8edd5b202 ] Free the unused skb when not ip packets arrive. Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support") Signed-off-by: Daniele Palmas <dnlplm(a)gmail.com> Acked-by: Bjørn Mork <bjorn(a)mork.no> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c index b55fd76348f9..ad5feb20dd0f 100644 --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -194,6 +194,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb) break; default: /* not ip - do not know what to do */ + kfree_skb(skbn); goto skip; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: usb: qmi_wwan: fix memory leak for not ip packets
by Pu Lehui 21 Aug '24

21 Aug '24

From: Daniele Palmas <dnlplm(a)gmail.com> stable inclusion from stable-v5.10.224 commit e87f52225e04a7001bf55bbd7a330fa4252327b5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALDR9 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7ab107544b777c3bd7feb9fe447367d8edd5b202 ] Free the unused skb when not ip packets arrive. Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support") Signed-off-by: Daniele Palmas <dnlplm(a)gmail.com> Acked-by: Bjørn Mork <bjorn(a)mork.no> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c index a1c9233e264d..d412331c1f6a 100644 --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -216,6 +216,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb) break; default: /* not ip - do not know what to do */ + kfree_skb(skbn); goto skip; } -- 2.34.1

2 1

[PATCH OLK-5.10] net: usb: qmi_wwan: fix memory leak for not ip packets
by Pu Lehui 21 Aug '24

21 Aug '24

From: Daniele Palmas <dnlplm(a)gmail.com> stable inclusion from stable-v5.10.224 commit e87f52225e04a7001bf55bbd7a330fa4252327b5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALDR9 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7ab107544b777c3bd7feb9fe447367d8edd5b202 ] Free the unused skb when not ip packets arrive. Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support") Signed-off-by: Daniele Palmas <dnlplm(a)gmail.com> Acked-by: Bjørn Mork <bjorn(a)mork.no> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c index a1c9233e264d..d412331c1f6a 100644 --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -216,6 +216,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb) break; default: /* not ip - do not know what to do */ + kfree_skb(skbn); goto skip; } -- 2.34.1

2 1

[PATCH OLK-6.6] net: usb: qmi_wwan: fix memory leak for not ip packets
by Pu Lehui 21 Aug '24

21 Aug '24

From: Daniele Palmas <dnlplm(a)gmail.com> stable inclusion from stable-v6.6.46 commit f2c353227de14b0289298ffc3ba92058c4768384 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALDR9 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7ab107544b777c3bd7feb9fe447367d8edd5b202 ] Free the unused skb when not ip packets arrive. Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support") Signed-off-by: Daniele Palmas <dnlplm(a)gmail.com> Acked-by: Bjørn Mork <bjorn(a)mork.no> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c index befbca01bfe3..b1380cf1b13a 100644 --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -201,6 +201,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb) break; default: /* not ip - do not know what to do */ + kfree_skb(skbn); goto skip; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: usb: qmi_wwan: fix memory leak for not ip packets
by Pu Lehui 21 Aug '24

21 Aug '24

From: Daniele Palmas <dnlplm(a)gmail.com> stable inclusion from stable-v4.19.320 commit 3c90a69533b5bba73401ef884d033ea49ee99662 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALDR9 CVE: HWPSIRT-2024-84570 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7ab107544b777c3bd7feb9fe447367d8edd5b202 ] Free the unused skb when not ip packets arrive. Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support") Signed-off-by: Daniele Palmas <dnlplm(a)gmail.com> Acked-by: Bjørn Mork <bjorn(a)mork.no> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c index b55fd76348f9..ad5feb20dd0f 100644 --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -194,6 +194,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb) break; default: /* not ip - do not know what to do */ + kfree_skb(skbn); goto skip; } -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS c791a3698880e8d64f4089b69d9c09789c606439
by kernel test robot 21 Aug '24

21 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c791a3698880e8d64f4089b69d9c09789c606439 !9573 [OLK-5.10] Intel: backport RAPL bugfixes up to v6.9 elapsed time: 747m configs tested: 35 configs skipped: 137 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240821 gcc-14.1.0 arm64 randconfig-002-20240821 gcc-14.1.0 arm64 randconfig-003-20240821 gcc-14.1.0 arm64 randconfig-004-20240821 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240821 gcc-12 x86_64 buildonly-randconfig-002-20240821 clang-18 x86_64 buildonly-randconfig-003-20240821 gcc-12 x86_64 buildonly-randconfig-004-20240821 gcc-12 x86_64 buildonly-randconfig-005-20240821 gcc-12 x86_64 buildonly-randconfig-006-20240821 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240821 clang-18 x86_64 randconfig-002-20240821 gcc-12 x86_64 randconfig-003-20240821 clang-18 x86_64 randconfig-004-20240821 clang-18 x86_64 randconfig-005-20240821 clang-18 x86_64 randconfig-006-20240821 gcc-12 x86_64 randconfig-011-20240821 gcc-12 x86_64 randconfig-012-20240821 clang-18 x86_64 randconfig-013-20240821 clang-18 x86_64 randconfig-014-20240821 clang-18 x86_64 randconfig-015-20240821 gcc-12 x86_64 randconfig-016-20240821 clang-18 x86_64 randconfig-071-20240821 gcc-12 x86_64 randconfig-072-20240821 clang-18 x86_64 randconfig-073-20240821 gcc-12 x86_64 randconfig-074-20240821 clang-18 x86_64 randconfig-075-20240821 gcc-12 x86_64 randconfig-076-20240821 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION a768b922343d9cab29e2e0aaef1d4bdee47cfbb5
by kernel test robot 21 Aug '24

21 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: a768b922343d9cab29e2e0aaef1d4bdee47cfbb5 !10969 bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202408210406.xQBoe5bW-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202408210612.lVpJWy3E-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) crypto/asymmetric_keys/pgp_public_key.c:359: undefined reference to `public_key_subtype' ld.lld: error: duplicate symbol: psp_register_cmd_notifier ld.lld: error: duplicate symbol: psp_unregister_cmd_notifier ld: crypto/asymmetric_keys/pgp_public_key.c:359: undefined reference to `public_key_subtype' ld: crypto/asymmetric_keys/pgp_public_key.c:369: undefined reference to `public_key_free' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-001-20240821 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-002-20240821 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- ld.lld:error:duplicate-symbol:psp_register_cmd_notifier | `-- ld.lld:error:duplicate-symbol:psp_unregister_cmd_notifier |-- x86_64-buildonly-randconfig-004-20240821 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) `-- x86_64-randconfig-006-20240821 |-- crypto-asymmetric_keys-pgp_public_key.c:undefined-reference-to-public_key_subtype |-- ld:crypto-asymmetric_keys-pgp_public_key.c:undefined-reference-to-public_key_free `-- ld:crypto-asymmetric_keys-pgp_public_key.c:undefined-reference-to-public_key_subtype elapsed time: 734m configs tested: 38 configs skipped: 134 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240821 gcc-14.1.0 arm64 randconfig-002-20240821 gcc-14.1.0 arm64 randconfig-003-20240821 gcc-14.1.0 arm64 randconfig-004-20240821 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240821 gcc-14.1.0 loongarch randconfig-002-20240821 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240821 gcc-12 x86_64 buildonly-randconfig-002-20240821 clang-18 x86_64 buildonly-randconfig-003-20240821 gcc-12 x86_64 buildonly-randconfig-004-20240821 gcc-12 x86_64 buildonly-randconfig-005-20240821 gcc-12 x86_64 buildonly-randconfig-006-20240821 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240821 clang-18 x86_64 randconfig-002-20240821 gcc-12 x86_64 randconfig-003-20240821 clang-18 x86_64 randconfig-004-20240821 clang-18 x86_64 randconfig-005-20240821 clang-18 x86_64 randconfig-006-20240821 gcc-12 x86_64 randconfig-011-20240821 gcc-12 x86_64 randconfig-012-20240821 clang-18 x86_64 randconfig-013-20240821 clang-18 x86_64 randconfig-014-20240821 clang-18 x86_64 randconfig-015-20240821 gcc-12 x86_64 randconfig-016-20240821 clang-18 x86_64 randconfig-071-20240821 gcc-12 x86_64 randconfig-072-20240821 clang-18 x86_64 randconfig-073-20240821 gcc-12 x86_64 randconfig-074-20240821 clang-18 x86_64 randconfig-075-20240821 gcc-12 x86_64 randconfig-076-20240821 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 5f1e8ffb9191bc7cb8ee31f9f6996e05be5cc228
by kernel test robot 21 Aug '24

21 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5f1e8ffb9191bc7cb8ee31f9f6996e05be5cc228 !10978 CVE-2024-42304 elapsed time: 727m configs tested: 34 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240821 gcc-14.1.0 arm64 randconfig-002-20240821 gcc-14.1.0 arm64 randconfig-003-20240821 gcc-14.1.0 arm64 randconfig-004-20240821 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240820 clang-18 x86_64 buildonly-randconfig-002-20240820 gcc-11 x86_64 buildonly-randconfig-003-20240820 clang-18 x86_64 buildonly-randconfig-004-20240820 clang-18 x86_64 buildonly-randconfig-005-20240820 clang-18 x86_64 buildonly-randconfig-006-20240820 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240820 gcc-12 x86_64 randconfig-002-20240820 gcc-12 x86_64 randconfig-003-20240820 clang-18 x86_64 randconfig-004-20240820 gcc-12 x86_64 randconfig-005-20240820 clang-18 x86_64 randconfig-006-20240820 gcc-12 x86_64 randconfig-011-20240820 clang-18 x86_64 randconfig-012-20240820 gcc-12 x86_64 randconfig-013-20240820 clang-18 x86_64 randconfig-014-20240820 clang-18 x86_64 randconfig-015-20240820 gcc-12 x86_64 randconfig-016-20240820 clang-18 x86_64 randconfig-071-20240820 gcc-12 x86_64 randconfig-072-20240820 gcc-12 x86_64 randconfig-073-20240820 gcc-12 x86_64 randconfig-074-20240820 clang-18 x86_64 randconfig-075-20240820 clang-18 x86_64 randconfig-076-20240820 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3342/13457] crypto/asymmetric_keys/pgp_public_key.c:359: undefined reference to `public_key_subtype'
by kernel test robot 21 Aug '24

21 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a768b922343d9cab29e2e0aaef1d4bdee47cfbb5 commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [3342/13457] KEYS: Provide a function to load keys from a PGP keyring blob config: x86_64-randconfig-006-20240821 (https://download.01.org/0day-ci/archive/20240821/202408210612.lVpJWy3E-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240821/202408210612.lVpJWy3E-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408210612.lVpJWy3E-lkp@intel.com/ All errors (new ones prefixed by >>): ld: vmlinux.o: in function `pgp_key_parse': >> crypto/asymmetric_keys/pgp_public_key.c:359: undefined reference to `public_key_subtype' >> ld: crypto/asymmetric_keys/pgp_public_key.c:359: undefined reference to `public_key_subtype' ld: crypto/asymmetric_keys/pgp_public_key.c:360: undefined reference to `public_key_subtype' >> ld: crypto/asymmetric_keys/pgp_public_key.c:369: undefined reference to `public_key_free' >> ld: crypto/asymmetric_keys/pgp_public_key.c:359: undefined reference to `public_key_subtype' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +359 crypto/asymmetric_keys/pgp_public_key.c 4e59d757dc3f7f Roberto Sassu 2023-09-12 300 4e59d757dc3f7f Roberto Sassu 2023-09-12 301 /* 4e59d757dc3f7f Roberto Sassu 2023-09-12 302 * Attempt to parse the instantiation data blob for a key as a PGP packet 4e59d757dc3f7f Roberto Sassu 2023-09-12 303 * message holding a key. 4e59d757dc3f7f Roberto Sassu 2023-09-12 304 */ 4e59d757dc3f7f Roberto Sassu 2023-09-12 305 static int pgp_key_parse(struct key_preparsed_payload *prep) 4e59d757dc3f7f Roberto Sassu 2023-09-12 306 { 4e59d757dc3f7f Roberto Sassu 2023-09-12 307 struct pgp_key_data_parse_context ctx; 4e59d757dc3f7f Roberto Sassu 2023-09-12 308 int ret; 4e59d757dc3f7f Roberto Sassu 2023-09-12 309 4e59d757dc3f7f Roberto Sassu 2023-09-12 310 kenter(""); 4e59d757dc3f7f Roberto Sassu 2023-09-12 311 4e59d757dc3f7f Roberto Sassu 2023-09-12 312 memset(&ctx, 0, sizeof(ctx)); e8c01f299ab793 David Howells 2023-09-12 313 ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY) | e8c01f299ab793 David Howells 2023-09-12 314 (1 << PGP_PKT_USER_ID); 4e59d757dc3f7f Roberto Sassu 2023-09-12 315 ctx.pgp.process_packet = pgp_process_public_key; 4e59d757dc3f7f Roberto Sassu 2023-09-12 316 4e59d757dc3f7f Roberto Sassu 2023-09-12 317 ret = pgp_parse_packets(prep->data, prep->datalen, &ctx.pgp); 4e59d757dc3f7f Roberto Sassu 2023-09-12 318 if (ret < 0) 4e59d757dc3f7f Roberto Sassu 2023-09-12 319 goto error; 4e59d757dc3f7f Roberto Sassu 2023-09-12 320 e8c01f299ab793 David Howells 2023-09-12 321 if (!ctx.fingerprint) { e8c01f299ab793 David Howells 2023-09-12 322 ret = -EINVAL; e8c01f299ab793 David Howells 2023-09-12 323 goto error; e8c01f299ab793 David Howells 2023-09-12 324 } e8c01f299ab793 David Howells 2023-09-12 325 e8c01f299ab793 David Howells 2023-09-12 326 if (ctx.user_id && ctx.user_id_len > 0) { e8c01f299ab793 David Howells 2023-09-12 327 /* Propose a description for the key e8c01f299ab793 David Howells 2023-09-12 328 * (user ID without the comment) e8c01f299ab793 David Howells 2023-09-12 329 */ e8c01f299ab793 David Howells 2023-09-12 330 size_t ulen = ctx.user_id_len, flen = ctx.fingerprint_len; e8c01f299ab793 David Howells 2023-09-12 331 const char *p; e8c01f299ab793 David Howells 2023-09-12 332 e8c01f299ab793 David Howells 2023-09-12 333 p = memchr(ctx.user_id, '(', ulen); e8c01f299ab793 David Howells 2023-09-12 334 if (p) { e8c01f299ab793 David Howells 2023-09-12 335 /* Remove the comment */ e8c01f299ab793 David Howells 2023-09-12 336 do { e8c01f299ab793 David Howells 2023-09-12 337 p--; e8c01f299ab793 David Howells 2023-09-12 338 } while (*p == ' ' && p > ctx.user_id); e8c01f299ab793 David Howells 2023-09-12 339 if (*p != ' ') e8c01f299ab793 David Howells 2023-09-12 340 p++; e8c01f299ab793 David Howells 2023-09-12 341 ulen = p - ctx.user_id; e8c01f299ab793 David Howells 2023-09-12 342 } e8c01f299ab793 David Howells 2023-09-12 343 e8c01f299ab793 David Howells 2023-09-12 344 if (ulen > 255 - 9) e8c01f299ab793 David Howells 2023-09-12 345 ulen = 255 - 9; e8c01f299ab793 David Howells 2023-09-12 346 prep->description = kmalloc(ulen + 1 + 8 + 1, GFP_KERNEL); e8c01f299ab793 David Howells 2023-09-12 347 ret = -ENOMEM; e8c01f299ab793 David Howells 2023-09-12 348 if (!prep->description) e8c01f299ab793 David Howells 2023-09-12 349 goto error; e8c01f299ab793 David Howells 2023-09-12 350 memcpy(prep->description, ctx.user_id, ulen); e8c01f299ab793 David Howells 2023-09-12 351 prep->description[ulen] = ' '; e8c01f299ab793 David Howells 2023-09-12 352 memcpy(prep->description + ulen + 1, e8c01f299ab793 David Howells 2023-09-12 353 ctx.fingerprint + flen - 8, 8); e8c01f299ab793 David Howells 2023-09-12 354 prep->description[ulen + 9] = 0; e8c01f299ab793 David Howells 2023-09-12 355 pr_debug("desc '%s'\n", prep->description); e8c01f299ab793 David Howells 2023-09-12 356 } e8c01f299ab793 David Howells 2023-09-12 357 4e59d757dc3f7f Roberto Sassu 2023-09-12 358 /* We're pinning the module by being linked against it */ 4e59d757dc3f7f Roberto Sassu 2023-09-12 @359 __module_get(public_key_subtype.owner); 4e59d757dc3f7f Roberto Sassu 2023-09-12 360 prep->payload.data[asym_subtype] = &public_key_subtype; 4e59d757dc3f7f Roberto Sassu 2023-09-12 361 prep->payload.data[asym_key_ids] = pgp_key_generate_id(&ctx); 4e59d757dc3f7f Roberto Sassu 2023-09-12 362 prep->payload.data[asym_crypto] = ctx.pub; 4e59d757dc3f7f Roberto Sassu 2023-09-12 363 prep->quotalen = 100; 4e59d757dc3f7f Roberto Sassu 2023-09-12 364 kfree(ctx.fingerprint); 4e59d757dc3f7f Roberto Sassu 2023-09-12 365 kfree(ctx.raw_fingerprint); 4e59d757dc3f7f Roberto Sassu 2023-09-12 366 return 0; 4e59d757dc3f7f Roberto Sassu 2023-09-12 367 4e59d757dc3f7f Roberto Sassu 2023-09-12 368 error: 4e59d757dc3f7f Roberto Sassu 2023-09-12 @369 public_key_free(ctx.pub); 4e59d757dc3f7f Roberto Sassu 2023-09-12 370 kfree(ctx.fingerprint); 4e59d757dc3f7f Roberto Sassu 2023-09-12 371 kfree(ctx.raw_fingerprint); 4e59d757dc3f7f Roberto Sassu 2023-09-12 372 return ret; 4e59d757dc3f7f Roberto Sassu 2023-09-12 373 } 4e59d757dc3f7f Roberto Sassu 2023-09-12 374 :::::: The code at line 359 was first introduced by commit :::::: 4e59d757dc3f7f2e2a646a2e3f0f271ae4599eeb KEYS: PGP data parser :::::: TO: Roberto Sassu <roberto.sassu(a)huawei.com> :::::: CC: zgzxx <zhangguangzhi3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13309/13457] ld.lld: error: duplicate symbol: psp_register_cmd_notifier
by kernel test robot 21 Aug '24

21 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a768b922343d9cab29e2e0aaef1d4bdee47cfbb5 commit: d0b3a770d8e20d953fe2a74ea8c4b5f4767c4add [13309/13457] crypto: command co-processor: Add another mailbox interrupt support for PSP sending command to X86 config: x86_64-buildonly-randconfig-002-20240821 (https://download.01.org/0day-ci/archive/20240821/202408210406.xQBoe5bW-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240821/202408210406.xQBoe5bW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408210406.xQBoe5bW-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: duplicate symbol: psp_register_cmd_notifier >>> defined at psp-dev.c >>> drivers/crypto/ccp/psp-dev.o:(psp_register_cmd_notifier) in archive vmlinux.a >>> defined at csv-dev.c >>> drivers/crypto/ccp/hygon/csv-dev.o:(.text+0x0) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: psp_unregister_cmd_notifier >>> defined at psp-dev.c >>> drivers/crypto/ccp/psp-dev.o:(psp_unregister_cmd_notifier) in archive vmlinux.a >>> defined at csv-dev.c >>> drivers/crypto/ccp/hygon/csv-dev.o:(.text+0x20) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: psp_register_cmd_notifier >>> defined at psp-dev.c >>> drivers/crypto/ccp/psp-dev.o:(psp_register_cmd_notifier) in archive vmlinux.a >>> defined at ring-buffer.c >>> drivers/crypto/ccp/hygon/ring-buffer.o:(.text+0x0) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: psp_register_cmd_notifier >>> defined at psp-dev.c >>> drivers/crypto/ccp/psp-dev.o:(psp_register_cmd_notifier) in archive vmlinux.a >>> defined at psp-dev.c >>> drivers/crypto/ccp/hygon/psp-dev.o:(.text+0x0) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: psp_unregister_cmd_notifier >>> defined at psp-dev.c >>> drivers/crypto/ccp/psp-dev.o:(psp_unregister_cmd_notifier) in archive vmlinux.a >>> defined at ring-buffer.c >>> drivers/crypto/ccp/hygon/ring-buffer.o:(.text+0x20) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: psp_unregister_cmd_notifier >>> defined at psp-dev.c >>> drivers/crypto/ccp/psp-dev.o:(psp_unregister_cmd_notifier) in archive vmlinux.a >>> defined at psp-dev.c >>> drivers/crypto/ccp/hygon/psp-dev.o:(.text+0x20) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: psp_register_cmd_notifier >>> defined at psp-dev.c >>> drivers/crypto/ccp/psp-dev.o:(psp_register_cmd_notifier) in archive vmlinux.a >>> defined at sev-dev.c >>> drivers/crypto/ccp/sev-dev.o:(.text+0x0) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: psp_unregister_cmd_notifier >>> defined at psp-dev.c >>> drivers/crypto/ccp/psp-dev.o:(psp_unregister_cmd_notifier) in archive vmlinux.a >>> defined at sev-dev.c >>> drivers/crypto/ccp/sev-dev.o:(.text+0x20) in archive vmlinux.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] nvme-pci: add missing condition check for existence of mapped data
by Li Lingfeng 20 Aug '24

20 Aug '24

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v6.11-rc1 commit c31fad1470389666ac7169fe43aa65bf5b7e2cfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPOL CVE: CVE-2024-42276 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference. Fixes: 4aedb705437f ("nvme-pci: split metadata handling from nvme_map_data / nvme_unmap_data") Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Nitesh Shetty <nj.shetty(a)samsung.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/pci.c [Commit 62451a2b2e7e ("nvme: separate command prep and issue") separate nvme_map_data/nvme_unmap_data from nvme_queue_rq to nvme_prep_rq.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index c378649b583b..c4a0c1611629 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -947,7 +947,8 @@ static blk_status_t nvme_queue_rq(struct blk_mq_hw_ctx *hctx, nvme_submit_cmd(nvmeq, cmnd, bd->last); return BLK_STS_OK; out_unmap_data: - nvme_unmap_data(dev, req); + if (blk_rq_nr_phys_segments(req)) + nvme_unmap_data(dev, req); out_free_cmd: nvme_cleanup_cmd(req); return ret; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] media: mediatek: vcodec: Handle invalid decoder vsi
by Cai Xinchen 20 Aug '24

20 Aug '24

From: Irui Wang <irui.wang(a)mediatek.com> mainline inclusion from mainline-v6.11-rc1 commit 59d438f8e02ca641c58d77e1feffa000ff809e9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2F CVE: CVE-2024-43831 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi is valid for future use. Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver") Signed-off-by: Irui Wang <irui.wang(a)mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Signed-off-by: Sebastian Fricke <sebastian.fricke(a)collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Conflicts: drivers/media/platform/mtk-vcodec/vdec_vpu_if.c [vpu_dec_init is moved from drivers/media/platform/mtk-vcodec/vdec_vpu_if.c to drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c. Using mtk_vcodec_err instead of mtk_vdec_err becuase 0db2fc4eec23e4c92abee357e98d9f97998098b4 is not merged] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/media/platform/mtk-vcodec/vdec_vpu_if.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c b/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c index 58b0e6fa8fd2..93d40f0e0f79 100644 --- a/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c +++ b/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c @@ -127,6 +127,12 @@ int vpu_dec_init(struct vdec_vpu_inst *vpu) mtk_vcodec_debug(vpu, "vdec_inst=%p", vpu); err = vcodec_vpu_send_msg(vpu, (void *)&msg, sizeof(msg)); + + if (IS_ERR_OR_NULL(vpu->vsi)) { + mtk_vcodec_err(vpu, "invalid vdec vsi, status=%d", err); + return -EINVAL; + } + mtk_vcodec_debug(vpu, "- ret=%d", err); return err; } -- 2.34.1

2 1

[PATCH OLK-5.10] media: mediatek: vcodec: Handle invalid decoder vsi
by Cai Xinchen 20 Aug '24

20 Aug '24

From: Irui Wang <irui.wang(a)mediatek.com> mainline inclusion from mainline-v6.11-rc1 commit 59d438f8e02ca641c58d77e1feffa000ff809e9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2F CVE: CVE-2024-43831 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi is valid for future use. Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver") Signed-off-by: Irui Wang <irui.wang(a)mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Signed-off-by: Sebastian Fricke <sebastian.fricke(a)collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Conflicts: drivers/media/platform/mtk-vcodec/vdec_vpu_if.c [vpu_dec_init is moved from drivers/media/platform/mtk-vcodec/vdec_vpu_if.c to drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c. Using mtk_vcodec_err instead of mtk_vdec_err becuase 0db2fc4eec23e4c92abee357e98d9f97998098b4 is not merged] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/media/platform/mtk-vcodec/vdec_vpu_if.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c b/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c index 58b0e6fa8fd2..93d40f0e0f79 100644 --- a/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c +++ b/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c @@ -127,6 +127,12 @@ int vpu_dec_init(struct vdec_vpu_inst *vpu) mtk_vcodec_debug(vpu, "vdec_inst=%p", vpu); err = vcodec_vpu_send_msg(vpu, (void *)&msg, sizeof(msg)); + + if (IS_ERR_OR_NULL(vpu->vsi)) { + mtk_vcodec_err(vpu, "invalid vdec vsi, status=%d", err); + return -EINVAL; + } + mtk_vcodec_debug(vpu, "- ret=%d", err); return err; } -- 2.34.1

2 1

[PATCH OLK-5.10] hfsplus: fix uninit-value in copy_name
by Wenyu Huang 20 Aug '24

20 Aug '24

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v5.10.223 commit 34f8efd2743f2d961e92e8e994de4c7a2f9e74a0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELD CVE: CVE-2024-41059 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0570730c16307a72f8241df12363f76600baf57d ] [syzbot reported] BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 sized_strscpy+0xc4/0x160 copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411 hfsplus_listxattr+0x11e9/0x1a50 fs/hfsplus/xattr.c:750 vfs_listxattr fs/xattr.c:493 [inline] listxattr+0x1f3/0x6b0 fs/xattr.c:840 path_listxattr fs/xattr.c:864 [inline] __do_sys_listxattr fs/xattr.c:876 [inline] __se_sys_listxattr fs/xattr.c:873 [inline] __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873 x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3877 [inline] slab_alloc_node mm/slub.c:3918 [inline] kmalloc_trace+0x57b/0xbe0 mm/slub.c:4065 kmalloc include/linux/slab.h:628 [inline] hfsplus_listxattr+0x4cc/0x1a50 fs/hfsplus/xattr.c:699 vfs_listxattr fs/xattr.c:493 [inline] listxattr+0x1f3/0x6b0 fs/xattr.c:840 path_listxattr fs/xattr.c:864 [inline] __do_sys_listxattr fs/xattr.c:876 [inline] __se_sys_listxattr fs/xattr.c:873 [inline] __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873 x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [Fix] When allocating memory to strbuf, initialize memory to 0. Reported-and-tested-by: syzbot+efde959319469ff8d4d7(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Link: https://lore.kernel.org/r/tencent_8BBB6433BC9E1C1B7B4BDF1BF52574BA8808@qq.c… Reported-and-tested-by: syzbot+01ade747b16e9c8030e0(a)syzkaller.appspotmail.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- fs/hfsplus/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c index bb0b27d88e502..d91f76ef18d9b 100644 --- a/fs/hfsplus/xattr.c +++ b/fs/hfsplus/xattr.c @@ -700,7 +700,7 @@ ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size) return err; } - strbuf = kmalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN + + strbuf = kzalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN + XATTR_MAC_OSX_PREFIX_LEN + 1, GFP_KERNEL); if (!strbuf) { res = -ENOMEM; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] media: mediatek: vcodec: Handle invalid decoder vsi
by Cai Xinchen 20 Aug '24

20 Aug '24

From: Irui Wang <irui.wang(a)mediatek.com> mainline inclusion from mainline-v6.11-rc1 commit 59d438f8e02ca641c58d77e1feffa000ff809e9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ2F CVE: CVE-2024-43831 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi is valid for future use. Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver") Signed-off-by: Irui Wang <irui.wang(a)mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Signed-off-by: Sebastian Fricke <sebastian.fricke(a)collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Conflicts: drivers/media/platform/mtk-vcodec/vdec_vpu_if.c [vpu_dec_init is moved from drivers/media/platform/mtk-vcodec/vdec_vpu_if.c to drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c. Using mtk_vcodec_err instead of mtk_vdec_err becuase 0db2fc4eec23e4c92abee357e98d9f97998098b4 is not merged] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/media/platform/mtk-vcodec/vdec_vpu_if.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c b/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c index 1abd14e79565..59542139b271 100644 --- a/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c +++ b/drivers/media/platform/mtk-vcodec/vdec_vpu_if.c @@ -124,6 +124,12 @@ int vpu_dec_init(struct vdec_vpu_inst *vpu) mtk_vcodec_debug(vpu, "vdec_inst=%p", vpu); err = vcodec_vpu_send_msg(vpu, (void *)&msg, sizeof(msg)); + + if (IS_ERR_OR_NULL(vpu->vsi)) { + mtk_vcodec_err(vpu, "invalid vdec vsi, status=%d", err); + return -EINVAL; + } + mtk_vcodec_debug(vpu, "- ret=%d", err); return err; } -- 2.34.1

2 1