- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1] mm: avoid overflows in dirty throttling logic
by Wupeng Ma 20 Aug '24

20 Aug '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.222 commit 7a49389771ae7666f4dc3426e2a4594bf23ae290 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGZUU CVE: CVE-2024-42131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 385d838df280eba6c8680f9777bfa0d0bfe7e8b2 upstream. The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications fit into 64-bits). If limits end up being larger, we will hit overflows, possible divisions by 0 etc. Fix these problems by never allowing so large dirty limits as they have dubious practical value anyway. For dirty_bytes / dirty_background_bytes interfaces we can just refuse to set so large limits. For dirty_ratio / dirty_background_ratio it isn't so simple as the dirty limit is computed from the amount of available memory which can change due to memory hotplug etc. So when converting dirty limits from ratios to numbers of pages, we just don't allow the result to exceed UINT_MAX. This is root-only triggerable problem which occurs when the operator sets dirty limits to >16 TB. Link: https://lkml.kernel.org/r/20240621144246.11148-2-jack@suse.cz Signed-off-by: Jan Kara <jack(a)suse.cz> Reported-by: Zach O'Keefe <zokeefe(a)google.com> Reviewed-By: Zach O'Keefe <zokeefe(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/page-writeback.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index e969667e8d62..0d7cc65c6367 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -427,13 +427,20 @@ static void domain_dirty_limits(struct dirty_throttle_control *dtc) else bg_thresh = (bg_ratio * available_memory) / PAGE_SIZE; - if (bg_thresh >= thresh) - bg_thresh = thresh / 2; tsk = current; if (rt_task(tsk)) { bg_thresh += bg_thresh / 4 + global_wb_domain.dirty_limit / 32; thresh += thresh / 4 + global_wb_domain.dirty_limit / 32; } + /* + * Dirty throttling logic assumes the limits in page units fit into + * 32-bits. This gives 16TB dirty limits max which is hopefully enough. + */ + if (thresh > UINT_MAX) + thresh = UINT_MAX; + /* This makes sure bg_thresh is within 32-bits as well */ + if (bg_thresh >= thresh) + bg_thresh = thresh / 2; dtc->thresh = thresh; dtc->bg_thresh = bg_thresh; @@ -483,7 +490,11 @@ static unsigned long node_dirty_limit(struct pglist_data *pgdat) if (rt_task(tsk)) dirty += dirty / 4; - return dirty; + /* + * Dirty throttling logic assumes the limits in page units fit into + * 32-bits. This gives 16TB dirty limits max which is hopefully enough. + */ + return min_t(unsigned long, dirty, UINT_MAX); } /** @@ -519,10 +530,17 @@ int dirty_background_bytes_handler(struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { int ret; + unsigned long old_bytes = dirty_background_bytes; ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos); - if (ret == 0 && write) + if (ret == 0 && write) { + if (DIV_ROUND_UP(dirty_background_bytes, PAGE_SIZE) > + UINT_MAX) { + dirty_background_bytes = old_bytes; + return -ERANGE; + } dirty_background_ratio = 0; + } return ret; } @@ -548,6 +566,10 @@ int dirty_bytes_handler(struct ctl_table *table, int write, ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos); if (ret == 0 && write && vm_dirty_bytes != old_bytes) { + if (DIV_ROUND_UP(vm_dirty_bytes, PAGE_SIZE) > UINT_MAX) { + vm_dirty_bytes = old_bytes; + return -ERANGE; + } writeback_set_ratelimit(); vm_dirty_ratio = 0; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/6] ext4: some bugfixs for large iomap&folio
by Zhihao Cheng 20 Aug '24

20 Aug '24

Darrick J. Wong (1): xfs: hoist multi-fsb allocation unit detection to a helper Zhang Yi (4): xfs: reserve blocks for truncating large realtime inode iomap: don't mark blocks uptodate after partial zeroing iomap: reduce unnecessary state_lock when setting ifs uptodate and dirty bits iomap: optimize setting uptodate bit Zhihao Cheng (1): ext4: ext4_iomap_map_blocks: Fix null pointer deference in nojournal mode fs/ext4/inode.c | 2 +- fs/iomap/buffered-io.c | 44 ++++++++++++++++++++++++++++++++++++++---- fs/xfs/xfs_bmap_util.c | 4 ++-- fs/xfs/xfs_inode.h | 9 +++++++++ fs/xfs/xfs_iops.c | 15 +++++++++++++- 5 files changed, 66 insertions(+), 8 deletions(-) -- 2.31.1

2 7

[PATCH OLK-5.10] mm: avoid overflows in dirty throttling logic
by Wupeng Ma 20 Aug '24

20 Aug '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.222 commit 7a49389771ae7666f4dc3426e2a4594bf23ae290 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGZUU CVE: CVE-2024-42131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 385d838df280eba6c8680f9777bfa0d0bfe7e8b2 upstream. The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications fit into 64-bits). If limits end up being larger, we will hit overflows, possible divisions by 0 etc. Fix these problems by never allowing so large dirty limits as they have dubious practical value anyway. For dirty_bytes / dirty_background_bytes interfaces we can just refuse to set so large limits. For dirty_ratio / dirty_background_ratio it isn't so simple as the dirty limit is computed from the amount of available memory which can change due to memory hotplug etc. So when converting dirty limits from ratios to numbers of pages, we just don't allow the result to exceed UINT_MAX. This is root-only triggerable problem which occurs when the operator sets dirty limits to >16 TB. Link: https://lkml.kernel.org/r/20240621144246.11148-2-jack@suse.cz Signed-off-by: Jan Kara <jack(a)suse.cz> Reported-by: Zach O'Keefe <zokeefe(a)google.com> Reviewed-By: Zach O'Keefe <zokeefe(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/page-writeback.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index e969667e8d62..0d7cc65c6367 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -427,13 +427,20 @@ static void domain_dirty_limits(struct dirty_throttle_control *dtc) else bg_thresh = (bg_ratio * available_memory) / PAGE_SIZE; - if (bg_thresh >= thresh) - bg_thresh = thresh / 2; tsk = current; if (rt_task(tsk)) { bg_thresh += bg_thresh / 4 + global_wb_domain.dirty_limit / 32; thresh += thresh / 4 + global_wb_domain.dirty_limit / 32; } + /* + * Dirty throttling logic assumes the limits in page units fit into + * 32-bits. This gives 16TB dirty limits max which is hopefully enough. + */ + if (thresh > UINT_MAX) + thresh = UINT_MAX; + /* This makes sure bg_thresh is within 32-bits as well */ + if (bg_thresh >= thresh) + bg_thresh = thresh / 2; dtc->thresh = thresh; dtc->bg_thresh = bg_thresh; @@ -483,7 +490,11 @@ static unsigned long node_dirty_limit(struct pglist_data *pgdat) if (rt_task(tsk)) dirty += dirty / 4; - return dirty; + /* + * Dirty throttling logic assumes the limits in page units fit into + * 32-bits. This gives 16TB dirty limits max which is hopefully enough. + */ + return min_t(unsigned long, dirty, UINT_MAX); } /** @@ -519,10 +530,17 @@ int dirty_background_bytes_handler(struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { int ret; + unsigned long old_bytes = dirty_background_bytes; ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos); - if (ret == 0 && write) + if (ret == 0 && write) { + if (DIV_ROUND_UP(dirty_background_bytes, PAGE_SIZE) > + UINT_MAX) { + dirty_background_bytes = old_bytes; + return -ERANGE; + } dirty_background_ratio = 0; + } return ret; } @@ -548,6 +566,10 @@ int dirty_bytes_handler(struct ctl_table *table, int write, ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos); if (ret == 0 && write && vm_dirty_bytes != old_bytes) { + if (DIV_ROUND_UP(vm_dirty_bytes, PAGE_SIZE) > UINT_MAX) { + vm_dirty_bytes = old_bytes; + return -ERANGE; + } writeback_set_ratelimit(); vm_dirty_ratio = 0; } -- 2.25.1

2 1

[PATCH OLK-5.10] kvm: s390: Reject memory region operations for ucontrol VMs
by Li Lingfeng 20 Aug '24

20 Aug '24

From: Christoph Schlameuss <schlameuss(a)linux.ibm.com> mainline inclusion from mainline-v6.11-rc1 commit 7816e58967d0e6cadce05c8540b47ed027dc2499 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5E CVE: CVE-2024-43819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ----------------------------------------------------------- This change rejects the KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM. This is necessary since ucontrol VMs have kvm->arch.gmap set to 0 and would thus result in a null pointer dereference further in. Memory management needs to be performed in userspace and using the ioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP. Also improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2. Signed-off-by: Christoph Schlameuss <schlameuss(a)linux.ibm.com> Fixes: 27e0393f15fc ("KVM: s390: ucontrol: per vcpu address spaces") Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240624095902.29375-1-schlameuss@linux.ibm.com Signed-off-by: Janosch Frank <frankja(a)linux.ibm.com> [frankja(a)linux.ibm.com: commit message spelling fix, subject prefix fix] Message-ID: <20240624095902.29375-1-schlameuss(a)linux.ibm.com> Conflicts: arch/s390/kvm/kvm-s390.c Documentation/virt/kvm/api.rst [Commit cf5b486922dc ("KVM: s390: Use "new" memslot instead of userspace memory region") add definition of "size"; Commit b8f8d190fa8f ("KVM: arm64: Document the behaviour of S1PTW faults on RO memslots") add some descriptions before KVM_SET_TSS_ADDR; Commit bb58b90b1a8f ("KVM: Introduce KVM_SET_USER_MEMORY_REGION2") introduce the description of KVM_SET_USER_MEMORY_REGION2.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- Documentation/virt/kvm/api.rst | 5 +++++ arch/s390/kvm/kvm-s390.c | 3 +++ 2 files changed, 8 insertions(+) diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst index 4980cab552f3..5d55487e2eb2 100644 --- a/Documentation/virt/kvm/api.rst +++ b/Documentation/virt/kvm/api.rst @@ -1331,6 +1331,11 @@ It is recommended to use this API instead of the KVM_SET_MEMORY_REGION ioctl. The KVM_SET_MEMORY_REGION does not allow fine grained control over memory allocation and is deprecated. +S390: +^^^^^ + +Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set. +Returns -EINVAL if called on a protected VM. 4.36 KVM_SET_TSS_ADDR --------------------- diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index d7c216ada386..b9b883ef47be 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -4992,6 +4992,9 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, const struct kvm_userspace_memory_region *mem, enum kvm_mr_change change) { + if (kvm_is_ucontrol(kvm)) + return -EINVAL; + /* A few sanity checks. We can have memory slots which have to be located/ended at a segment boundary (1MB). The memory in userland is ok to be fragmented into various different vmas. It is okay to mmap() -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 00/30] support block hierarchy stats
by Yu Kuai 20 Aug '24

20 Aug '24

Bart Van Assche (1): blk-mq: remove blk_mq_put_ctx() Jens Axboe (4): block: add blk_time_get_ns() and blk_time_get() helpers block: cache current nsec time in struct blk_plug block: update cached timestamp post schedule/preemption block: limit block time caching to in_task() context Yu Kuai (25): blk-mq: export blk-mq-debugfs apis block: fix that blk_time_get_ns() doesn't update time after schedule block: fix kabi broken in struct blk_plug block: support to recored bio allocation time block: support to recored bio allocation task block: support to recored bio allocation time in request block: fix kabi broken for struct request block: support to recored bio allocation task in request block: block: fix kabi broken for struct blk_mq_alloc_data blk-mq-debugfs: factor out a new helper to show allocated request block: support to record when request is completed block-io-hierarchy: core hierarchy stats implementation block-io-hierarchy: core hierarchy iodump implementation blk-io-hierarchy: support to recored the number of slow IO blk-io-hierarchy: support new bio based stage blk-throtl blk-io-hierarchy: support new bio based stage blk-wbt blk-io-hierarchy: support new bio based stage gettag blk-io-hierarchy: support new rq based stage plug blk-io-hierarchy: support new rq based stage mq-deadline blk-io-hierarchy: support new rq based stage bfq blk-io-hierarchy: support new rq based stage kyber blk-io-hierarchy: support new rq based stage hctx blk-io-hierarchy: support new rq based stage requeue blk-io-hierarchy: support new rq based stage rq_driver blk-io-hierarchy: support new stage for bio lifetime arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 8 + block/Makefile | 1 + block/bfq-cgroup.c | 15 +- block/bfq-iosched.c | 28 +- block/bio.c | 17 + block/blk-core.c | 37 +- block/blk-flush.c | 19 +- block/blk-io-hierarchy/Kconfig | 145 +++++ block/blk-io-hierarchy/Makefile | 8 + block/blk-io-hierarchy/debugfs.c | 230 ++++++++ block/blk-io-hierarchy/iodump.c | 754 +++++++++++++++++++++++++ block/blk-io-hierarchy/iodump.h | 103 ++++ block/blk-io-hierarchy/stats.c | 445 +++++++++++++++ block/blk-io-hierarchy/stats.h | 372 ++++++++++++ block/blk-merge.c | 1 + block/blk-mq-debugfs.c | 21 +- block/blk-mq-debugfs.h | 10 + block/blk-mq-sched.c | 7 +- block/blk-mq-tag.c | 13 +- block/blk-mq.c | 76 ++- block/blk-mq.h | 56 +- block/blk-sysfs.c | 16 + block/blk-throttle.c | 29 +- block/blk-wbt.c | 12 +- block/blk.h | 84 ++- block/kyber-iosched.c | 10 +- block/mq-deadline.c | 15 +- include/linux/blk_types.h | 55 +- include/linux/blkdev.h | 16 + include/linux/sched.h | 2 + kernel/sched/core.c | 6 +- 33 files changed, 2532 insertions(+), 81 deletions(-) create mode 100644 block/blk-io-hierarchy/Kconfig create mode 100644 block/blk-io-hierarchy/Makefile create mode 100644 block/blk-io-hierarchy/debugfs.c create mode 100644 block/blk-io-hierarchy/iodump.c create mode 100644 block/blk-io-hierarchy/iodump.h create mode 100644 block/blk-io-hierarchy/stats.c create mode 100644 block/blk-io-hierarchy/stats.h -- 2.39.2

2 31

[PATCH OLK-6.6] kvm: s390: Reject memory region operations for ucontrol VMs
by Li Lingfeng 20 Aug '24

20 Aug '24

From: Christoph Schlameuss <schlameuss(a)linux.ibm.com> mainline inclusion from mainline-v6.11-rc1 commit 7816e58967d0e6cadce05c8540b47ed027dc2499 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5E CVE: CVE-2024-43819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ----------------------------------------------------------- This change rejects the KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM. This is necessary since ucontrol VMs have kvm->arch.gmap set to 0 and would thus result in a null pointer dereference further in. Memory management needs to be performed in userspace and using the ioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP. Also improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION and KVM_SET_USER_MEMORY_REGION2. Signed-off-by: Christoph Schlameuss <schlameuss(a)linux.ibm.com> Fixes: 27e0393f15fc ("KVM: s390: ucontrol: per vcpu address spaces") Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240624095902.29375-1-schlameuss@linux.ibm.com Signed-off-by: Janosch Frank <frankja(a)linux.ibm.com> [frankja(a)linux.ibm.com: commit message spelling fix, subject prefix fix] Message-ID: <20240624095902.29375-1-schlameuss(a)linux.ibm.com> Conflicts: Documentation/virt/kvm/api.rst [Commit bb58b90b1a8f ("KVM: Introduce KVM_SET_USER_MEMORY_REGION2") introduce the description of KVM_SET_USER_MEMORY_REGION2.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- Documentation/virt/kvm/api.rst | 6 ++++++ arch/s390/kvm/kvm-s390.c | 3 +++ 2 files changed, 9 insertions(+) diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst index edc682a94ca4..17811002a8f7 100644 --- a/Documentation/virt/kvm/api.rst +++ b/Documentation/virt/kvm/api.rst @@ -1396,6 +1396,12 @@ Instead, an abort (data abort if the cause of the page-table update was a load or a store, instruction abort if it was an instruction fetch) is injected in the guest. +S390: +^^^^^ + +Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set. +Returns -EINVAL if called on a protected VM. + 4.36 KVM_SET_TSS_ADDR --------------------- diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index 348d030d2660..c019ff0d8ce6 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -5764,6 +5764,9 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, { gpa_t size; + if (kvm_is_ucontrol(kvm)) + return -EINVAL; + /* When we are protected, we should not change the memory slots */ if (kvm_s390_pv_get_handle(kvm)) return -EINVAL; -- 2.31.1

2 1

[PATCH OLK-5.10] tipc: Return non-zero value from tipc_udp_addr2str() on error
by Liu Jian 20 Aug '24

20 Aug '24

From: Shigeru Yoshida <syoshida(a)redhat.com> stable inclusion from stable-v5.10.224 commit aa38bf74899de07cf70b50cd17f8ad45fb6654c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ1T CVE: CVE-2024-42284 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit fa96c6baef1b5385e2f0c0677b32b3839e716076 ] tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP media address. Fixes: d0f91938bede ("tipc: add ip/udp media type") Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Reviewed-by: Tung Nguyen <tung.q.nguyen(a)endava.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/tipc/udp_media.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index 3e47501f024f..ec6d7730b852 100644 --- a/net/tipc/udp_media.c +++ b/net/tipc/udp_media.c @@ -129,8 +129,11 @@ static int tipc_udp_addr2str(struct tipc_media_addr *a, char *buf, int size) snprintf(buf, size, "%pI4:%u", &ua->ipv4, ntohs(ua->port)); else if (ntohs(ua->proto) == ETH_P_IPV6) snprintf(buf, size, "%pI6:%u", &ua->ipv6, ntohs(ua->port)); - else + else { pr_err("Invalid UDP media address\n"); + return 1; + } + return 0; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] tipc: Return non-zero value from tipc_udp_addr2str() on error
by Liu Jian 20 Aug '24

20 Aug '24

From: Shigeru Yoshida <syoshida(a)redhat.com> stable inclusion from stable-v5.10.224 commit aa38bf74899de07cf70b50cd17f8ad45fb6654c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ1T CVE: CVE-2024-42284 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit fa96c6baef1b5385e2f0c0677b32b3839e716076 ] tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP media address. Fixes: d0f91938bede ("tipc: add ip/udp media type") Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Reviewed-by: Tung Nguyen <tung.q.nguyen(a)endava.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/tipc/udp_media.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index a23628108272..3c1591f64bd5 100644 --- a/net/tipc/udp_media.c +++ b/net/tipc/udp_media.c @@ -129,8 +129,11 @@ static int tipc_udp_addr2str(struct tipc_media_addr *a, char *buf, int size) snprintf(buf, size, "%pI4:%u", &ua->ipv4, ntohs(ua->port)); else if (ntohs(ua->proto) == ETH_P_IPV6) snprintf(buf, size, "%pI6:%u", &ua->ipv6, ntohs(ua->port)); - else + else { pr_err("Invalid UDP media address\n"); + return 1; + } + return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tipc: Return non-zero value from tipc_udp_addr2str() on error
by Liu Jian 20 Aug '24

20 Aug '24

From: Shigeru Yoshida <syoshida(a)redhat.com> stable inclusion from stable-v4.19.320 commit 7ec3335dd89c8d169e9650e4bac64fde71fdf15b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ1T CVE: CVE-2024-42284 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit fa96c6baef1b5385e2f0c0677b32b3839e716076 ] tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP media address. Fixes: d0f91938bede ("tipc: add ip/udp media type") Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Reviewed-by: Tung Nguyen <tung.q.nguyen(a)endava.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/tipc/udp_media.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index efe822d3bb28..c01dcf9746be 100644 --- a/net/tipc/udp_media.c +++ b/net/tipc/udp_media.c @@ -127,8 +127,11 @@ static int tipc_udp_addr2str(struct tipc_media_addr *a, char *buf, int size) snprintf(buf, size, "%pI4:%u", &ua->ipv4, ntohs(ua->port)); else if (ntohs(ua->proto) == ETH_P_IPV6) snprintf(buf, size, "%pI6:%u", &ua->ipv6, ntohs(ua->port)); - else + else { pr_err("Invalid UDP media address\n"); + return 1; + } + return 0; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] media: venus: fix use after free in vdec_close
by Xia Fukun 20 Aug '24

20 Aug '24

From: Dikshita Agarwal <quic_dikshita(a)quicinc.com> stable inclusion from stable-v5.10.224 commit 4c9d235630d35db762b85a4149bbb0be9d504c36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ1L CVE: CVE-2024-42313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit a0157b5aa34eb43ec4c5510f9c260bbb03be937e upstream. There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close. Cc: stable(a)vger.kernel.org Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") Signed-off-by: Dikshita Agarwal <quic_dikshita(a)quicinc.com> Acked-by: Vikash Garodia <quic_vgarodia(a)quicinc.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/media/platform/qcom/venus/vdec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c index c437a929a5451..c27a135f5429f 100644 --- a/drivers/media/platform/qcom/venus/vdec.c +++ b/drivers/media/platform/qcom/venus/vdec.c @@ -1587,6 +1587,7 @@ static int vdec_close(struct file *file) vdec_pm_get(inst); + cancel_work_sync(&inst->delayed_process_work); v4l2_m2m_ctx_release(inst->m2m_ctx); v4l2_m2m_release(inst->m2m_dev); vdec_ctrl_deinit(inst); -- 2.34.1

2 1

[PATCH OLK-5.10] media: venus: fix use after free in vdec_close
by Xia Fukun 20 Aug '24

20 Aug '24

From: Dikshita Agarwal <quic_dikshita(a)quicinc.com> stable inclusion from stable-v5.10.224 commit 4c9d235630d35db762b85a4149bbb0be9d504c36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ1L CVE: CVE-2024-42313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit a0157b5aa34eb43ec4c5510f9c260bbb03be937e upstream. There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close. Cc: stable(a)vger.kernel.org Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") Signed-off-by: Dikshita Agarwal <quic_dikshita(a)quicinc.com> Acked-by: Vikash Garodia <quic_vgarodia(a)quicinc.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/media/platform/qcom/venus/vdec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c index c437a929a5451..c27a135f5429f 100644 --- a/drivers/media/platform/qcom/venus/vdec.c +++ b/drivers/media/platform/qcom/venus/vdec.c @@ -1587,6 +1587,7 @@ static int vdec_close(struct file *file) vdec_pm_get(inst); + cancel_work_sync(&inst->delayed_process_work); v4l2_m2m_ctx_release(inst->m2m_ctx); v4l2_m2m_release(inst->m2m_dev); vdec_ctrl_deinit(inst); -- 2.34.1

2 1

[PATCH OLK-6.6] PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
by liwei 20 Aug '24

20 Aug '24

From: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> mainline inclusion from mainline-v6.11-rc1 commit 5a5095a8bd1bd349cce1c879e5e44407a34dda8a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5P CVE: CVE-2024-43824 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Instead of getting the epc_features from pci_epc_get_features() API, use the cached pci_epf_test::epc_features value to avoid the NULL check. Since the NULL check is already performed in pci_epf_test_bind(), having one more check in pci_epf_test_core_init() is redundant and it is not possible to hit the NULL pointer dereference. Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier" flag"), 'epc_features' got dereferenced without the NULL check, leading to the following false positive Smatch warning: drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747) Thus, remove the redundant NULL check and also use the epc_features:: {msix_capable/msi_capable} flags directly to avoid local variables. [kwilczynski: commit log] Fixes: 5e50ee27d4a5 ("PCI: pci-epf-test: Add support to defer core initialization") Closes: https://lore.kernel.org/linux-pci/024b5826-7180-4076-ae08-57d2584cca3f@moro… Link: https://lore.kernel.org/linux-pci/20240418-pci-epf-test-fix-v2-1-eacd548314… Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Frank Li <Frank.Li(a)nxp.com> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-test.c [context conflicts] Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/endpoint/functions/pci-epf-test.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c index 1f0d2b84296a..0411b5d605f4 100644 --- a/drivers/pci/endpoint/functions/pci-epf-test.c +++ b/drivers/pci/endpoint/functions/pci-epf-test.c @@ -750,19 +750,11 @@ static int pci_epf_test_core_init(struct pci_epf *epf) { struct pci_epf_test *epf_test = epf_get_drvdata(epf); struct pci_epf_header *header = epf->header; - const struct pci_epc_features *epc_features; + const struct pci_epc_features *epc_features = epf_test->epc_features; struct pci_epc *epc = epf->epc; struct device *dev = &epf->dev; - bool msix_capable = false; - bool msi_capable = true; int ret; - epc_features = pci_epc_get_features(epc, epf->func_no, epf->vfunc_no); - if (epc_features) { - msix_capable = epc_features->msix_capable; - msi_capable = epc_features->msi_capable; - } - if (epf->vfunc_no <= 1) { ret = pci_epc_write_header(epc, epf->func_no, epf->vfunc_no, header); if (ret) { @@ -775,7 +767,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) if (ret) return ret; - if (msi_capable) { + if (epc_features->msi_capable) { ret = pci_epc_set_msi(epc, epf->func_no, epf->vfunc_no, epf->msi_interrupts); if (ret) { @@ -784,7 +776,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) } } - if (msix_capable) { + if (epc_features->msix_capable) { ret = pci_epc_set_msix(epc, epf->func_no, epf->vfunc_no, epf->msix_interrupts, epf_test->test_reg_bar, -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
by liwei 20 Aug '24

20 Aug '24

From: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> mainline inclusion from mainline-v6.11-rc1 commit 5a5095a8bd1bd349cce1c879e5e44407a34dda8a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5P CVE: CVE-2024-43824 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Instead of getting the epc_features from pci_epc_get_features() API, use the cached pci_epf_test::epc_features value to avoid the NULL check. Since the NULL check is already performed in pci_epf_test_bind(), having one more check in pci_epf_test_core_init() is redundant and it is not possible to hit the NULL pointer dereference. Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier" flag"), 'epc_features' got dereferenced without the NULL check, leading to the following false positive Smatch warning: drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747) Thus, remove the redundant NULL check and also use the epc_features:: {msix_capable/msi_capable} flags directly to avoid local variables. [kwilczynski: commit log] Fixes: 5e50ee27d4a5 ("PCI: pci-epf-test: Add support to defer core initialization") Closes: https://lore.kernel.org/linux-pci/024b5826-7180-4076-ae08-57d2584cca3f@moro… Link: https://lore.kernel.org/linux-pci/20240418-pci-epf-test-fix-v2-1-eacd548314… Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Frank Li <Frank.Li(a)nxp.com> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-test.c [context conflicts] Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/endpoint/functions/pci-epf-test.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c index ddfeca9016a0..ff3e26cc407d 100644 --- a/drivers/pci/endpoint/functions/pci-epf-test.c +++ b/drivers/pci/endpoint/functions/pci-epf-test.c @@ -674,19 +674,11 @@ static int pci_epf_test_core_init(struct pci_epf *epf) { struct pci_epf_test *epf_test = epf_get_drvdata(epf); struct pci_epf_header *header = epf->header; - const struct pci_epc_features *epc_features; + const struct pci_epc_features *epc_features = epf_test->epc_features; struct pci_epc *epc = epf->epc; struct device *dev = &epf->dev; - bool msix_capable = false; - bool msi_capable = true; int ret; - epc_features = pci_epc_get_features(epc, epf->func_no); - if (epc_features) { - msix_capable = epc_features->msix_capable; - msi_capable = epc_features->msi_capable; - } - ret = pci_epc_write_header(epc, epf->func_no, header); if (ret) { dev_err(dev, "Configuration header write failed\n"); @@ -697,7 +689,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) if (ret) return ret; - if (msi_capable) { + if (epc_features->msi_capable) { ret = pci_epc_set_msi(epc, epf->func_no, epf->msi_interrupts); if (ret) { dev_err(dev, "MSI configuration failed\n"); @@ -705,7 +697,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) } } - if (msix_capable) { + if (epc_features->msix_capable) { ret = pci_epc_set_msix(epc, epf->func_no, epf->msix_interrupts, epf_test->test_reg_bar, epf_test->msix_table_offset); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] ASoC: amd: Adjust error handling in case of absent codec device
by Zhang Changzhong 20 Aug '24

20 Aug '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> stable inclusion from stable-v6.6.44 commit 99b642dac24f6d09ba3ebf1d690be8aefff86164 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ4U CVE: CVE-2024-43818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5080808c3339de2220c602ab7c7fa23dc6c1a5a3 ] acpi_get_first_physical_node() can return NULL in several cases (no such device, ACPI table error, reference count drop to 0, etc). Existing check just emit error message, but doesn't perform return. Then this NULL pointer is passed to devm_acpi_dev_add_driver_gpios() where it is dereferenced. Adjust this error handling by adding error code return. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 02527c3f2300 ("ASoC: amd: add Machine driver for Jadeite platform") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Link: https://patch.msgid.link/20240703191007.8524-1-amishin@t-argos.ru Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- sound/soc/amd/acp-es8336.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/amd/acp-es8336.c b/sound/soc/amd/acp-es8336.c index 5e56d3a..49bffc5 100644 --- a/sound/soc/amd/acp-es8336.c +++ b/sound/soc/amd/acp-es8336.c @@ -203,8 +203,10 @@ static int st_es8336_late_probe(struct snd_soc_card *card) codec_dev = acpi_get_first_physical_node(adev); acpi_dev_put(adev); - if (!codec_dev) + if (!codec_dev) { dev_err(card->dev, "can not find codec dev\n"); + return -ENODEV; + } ret = devm_acpi_dev_add_driver_gpios(codec_dev, acpi_es8336_gpios); if (ret) -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] ipvs: properly dereference pe in ip_vs_add_service
by Zhengchao Shao 20 Aug '24

20 Aug '24

From: Chen Hanxiao <chenhx.fnst(a)fujitsu.com> mainline inclusion from mainline-v6.11-rc1 commit cbd070a4ae62f119058973f6d2c984e325bce6e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ7N CVE: CVE-2024-42322 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- Use pe directly to resolve sparse warning: net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression Fixes: 39b972231536 ("ipvs: handle connections started by real-servers") Signed-off-by: Chen Hanxiao <chenhx.fnst(a)fujitsu.com> Acked-by: Julian Anastasov <ja(a)ssi.bg> Acked-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipvs/ip_vs_ctl.c [The conflict occurs because the commit 705dd3444081("ipvs: use kthreads for stats estimation") is not merged] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/ipvs/ip_vs_ctl.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index 29ec3ef63edc..0b37ffe0449a 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -1384,18 +1384,18 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, sched = NULL; } - /* Bind the ct retriever */ - RCU_INIT_POINTER(svc->pe, pe); - pe = NULL; - /* Update the virtual service counters */ if (svc->port == FTPPORT) atomic_inc(&ipvs->ftpsvc_counter); else if (svc->port == 0) atomic_inc(&ipvs->nullsvc_counter); - if (svc->pe && svc->pe->conn_out) + if (pe && pe->conn_out) atomic_inc(&ipvs->conn_out_counter); + /* Bind the ct retriever */ + RCU_INIT_POINTER(svc->pe, pe); + pe = NULL; + ip_vs_start_estimator(ipvs, &svc->stats); /* Count only IPv4 services for old get/setsockopt interface */ -- 2.34.1

2 1

[PATCH OLK-5.10] ipvs: properly dereference pe in ip_vs_add_service
by Zhengchao Shao 20 Aug '24

20 Aug '24

From: Chen Hanxiao <chenhx.fnst(a)fujitsu.com> mainline inclusion from mainline-v6.11-rc1 commit cbd070a4ae62f119058973f6d2c984e325bce6e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ7N CVE: CVE-2024-42322 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- Use pe directly to resolve sparse warning: net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression Fixes: 39b972231536 ("ipvs: handle connections started by real-servers") Signed-off-by: Chen Hanxiao <chenhx.fnst(a)fujitsu.com> Acked-by: Julian Anastasov <ja(a)ssi.bg> Acked-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipvs/ip_vs_ctl.c [The conflict occurs because the commit 705dd3444081("ipvs: use kthreads for stats estimation") is not merged] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/ipvs/ip_vs_ctl.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index d0b64c36471d..9dab1e286dff 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -1384,18 +1384,18 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, sched = NULL; } - /* Bind the ct retriever */ - RCU_INIT_POINTER(svc->pe, pe); - pe = NULL; - /* Update the virtual service counters */ if (svc->port == FTPPORT) atomic_inc(&ipvs->ftpsvc_counter); else if (svc->port == 0) atomic_inc(&ipvs->nullsvc_counter); - if (svc->pe && svc->pe->conn_out) + if (pe && pe->conn_out) atomic_inc(&ipvs->conn_out_counter); + /* Bind the ct retriever */ + RCU_INIT_POINTER(svc->pe, pe); + pe = NULL; + ip_vs_start_estimator(ipvs, &svc->stats); /* Count only IPv4 services for old get/setsockopt interface */ -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] media: venus: fix use after free in vdec_close
by Xia Fukun 20 Aug '24

20 Aug '24

From: Dikshita Agarwal <quic_dikshita(a)quicinc.com> stable inclusion from stable-v4.19.320 commit ad8cf035baf29467158e0550c7a42b7bb43d1db6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ1L CVE: CVE-2024-42313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit a0157b5aa34eb43ec4c5510f9c260bbb03be937e upstream. There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close. Cc: stable(a)vger.kernel.org Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") Signed-off-by: Dikshita Agarwal <quic_dikshita(a)quicinc.com> Acked-by: Vikash Garodia <quic_vgarodia(a)quicinc.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/media/platform/qcom/venus/vdec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c index e3972dbf4c9a3..297a0e84b8dfd 100644 --- a/drivers/media/platform/qcom/venus/vdec.c +++ b/drivers/media/platform/qcom/venus/vdec.c @@ -1094,6 +1094,7 @@ static int vdec_close(struct file *file) { struct venus_inst *inst = to_inst(file); + cancel_work_sync(&inst->delayed_process_work); v4l2_m2m_ctx_release(inst->m2m_ctx); v4l2_m2m_release(inst->m2m_dev); vdec_ctrl_deinit(inst); -- 2.34.1

2 1

[PATCH OLK-5.10] s390/sclp: Fix sclp_init() cleanup on failure
by Guo Mengqi 20 Aug '24

20 Aug '24

From: Heiko Carstens <hca(a)linux.ibm.com> stable inclusion from stable-v5.10.223 commit 2e51db7ab71b89dc5a17068f5e201c69f13a4c9a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEM8 CVE: CVE-2024-41068 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6434b33faaa063df500af355ee6c3942e0f8d982 ] If sclp_init() fails it only partially cleans up: if there are multiple failing calls to sclp_init() sclp_state_change_event will be added several times to sclp_reg_list, which results in the following warning: ------------[ cut here ]------------ list_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10. WARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3 Krnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 ... Call Trace: [<000003ffe0d6076a>] __list_add_valid_or_report+0xe2/0xf8 ([<000003ffe0d60766>] __list_add_valid_or_report+0xde/0xf8) [<000003ffe0a8d37e>] sclp_init+0x40e/0x450 [<000003ffe00009f2>] do_one_initcall+0x42/0x1e0 [<000003ffe15b77a6>] do_initcalls+0x126/0x150 [<000003ffe15b7a0a>] kernel_init_freeable+0x1ba/0x1f8 [<000003ffe0d6650e>] kernel_init+0x2e/0x180 [<000003ffe000301c>] __ret_from_fork+0x3c/0x60 [<000003ffe0d759ca>] ret_from_fork+0xa/0x30 Fix this by removing sclp_state_change_event from sclp_reg_list when sclp_init() fails. Reviewed-by: Peter Oberparleiter <oberpar(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/s390/char/sclp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c index d2ab3f07c008..8296e6bc229e 100644 --- a/drivers/s390/char/sclp.c +++ b/drivers/s390/char/sclp.c @@ -1208,6 +1208,7 @@ sclp_init(void) fail_unregister_reboot_notifier: unregister_reboot_notifier(&sclp_reboot_notifier); fail_init_state_uninitialized: + list_del(&sclp_state_change_event.list); sclp_init_state = sclp_init_state_uninitialized; free_page((unsigned long) sclp_read_sccb); free_page((unsigned long) sclp_init_sccb); -- 2.17.1

2 1

[PATCH OLK-5.10] drm/amd/display: Add NULL pointer check for kzalloc
by Guo Mengqi 20 Aug '24

20 Aug '24

From: Hersen Wu <hersenxs.wu(a)amd.com> mainline inclusion from mainline-v6.10-rc1 commit 8e65a1b7118acf6af96449e1e66b7adbc9396912 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGWWS CVE: CVE-2024-42122 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [Why & How] Check return pointer of kzalloc before using it. Reviewed-by: Alex Hung <alex.hung(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c [adjust context conflicts] Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- .../gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c | 8 ++++++++ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 3 +++ 2 files changed, 11 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c index cab47bb21172..77c51e052118 100644 --- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c +++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c @@ -549,11 +549,19 @@ void dcn3_clk_mgr_construct( dce_clock_read_ss_info(clk_mgr); clk_mgr->base.bw_params = kzalloc(sizeof(*clk_mgr->base.bw_params), GFP_KERNEL); + if (!clk_mgr->base.bw_params) { + BREAK_TO_DEBUGGER(); + return; + } /* need physical address of table to give to PMFW */ clk_mgr->wm_range_table = dm_helpers_allocate_gpu_mem(clk_mgr->base.ctx, DC_MEM_ALLOC_TYPE_GART, sizeof(WatermarksExternal_t), &clk_mgr->wm_range_table_addr); + if (!clk_mgr->wm_range_table) { + BREAK_TO_DEBUGGER(); + return; + } } void dcn3_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c index 32993ce24a58..7f6a3c679a2e 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c @@ -2373,6 +2373,9 @@ bool dcn30_validate_bandwidth(struct dc *dc, BW_VAL_TRACE_COUNT(); + if (!pipes) + goto validate_fail; + out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate); if (pipe_cnt == 0) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Add NULL pointer check for kzalloc
by Guo Mengqi 20 Aug '24

20 Aug '24

From: Hersen Wu <hersenxs.wu(a)amd.com> mainline inclusion from mainline-v6.10-rc1 commit 8e65a1b7118acf6af96449e1e66b7adbc9396912 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGWWS CVE: CVE-2024-42122 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [Why & How] Check return pointer of kzalloc before using it. Reviewed-by: Alex Hung <alex.hung(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c [adjust context conflicts] Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- .../gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c | 8 ++++++++ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 3 +++ 2 files changed, 11 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c index cab47bb21172..77c51e052118 100644 --- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c +++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c @@ -549,11 +549,19 @@ void dcn3_clk_mgr_construct( dce_clock_read_ss_info(clk_mgr); clk_mgr->base.bw_params = kzalloc(sizeof(*clk_mgr->base.bw_params), GFP_KERNEL); + if (!clk_mgr->base.bw_params) { + BREAK_TO_DEBUGGER(); + return; + } /* need physical address of table to give to PMFW */ clk_mgr->wm_range_table = dm_helpers_allocate_gpu_mem(clk_mgr->base.ctx, DC_MEM_ALLOC_TYPE_GART, sizeof(WatermarksExternal_t), &clk_mgr->wm_range_table_addr); + if (!clk_mgr->wm_range_table) { + BREAK_TO_DEBUGGER(); + return; + } } void dcn3_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c index 32993ce24a58..7f6a3c679a2e 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c @@ -2373,6 +2373,9 @@ bool dcn30_validate_bandwidth(struct dc *dc, BW_VAL_TRACE_COUNT(); + if (!pipes) + goto validate_fail; + out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate); if (pipe_cnt == 0) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] s390/sclp: Fix sclp_init() cleanup on failure
by Guo Mengqi 20 Aug '24

20 Aug '24

From: Heiko Carstens <hca(a)linux.ibm.com> stable inclusion from stable-v5.10.223 commit 2e51db7ab71b89dc5a17068f5e201c69f13a4c9a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEM8 CVE: CVE-2024-41068 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6434b33faaa063df500af355ee6c3942e0f8d982 ] If sclp_init() fails it only partially cleans up: if there are multiple failing calls to sclp_init() sclp_state_change_event will be added several times to sclp_reg_list, which results in the following warning: ------------[ cut here ]------------ list_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10. WARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3 Krnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 ... Call Trace: [<000003ffe0d6076a>] __list_add_valid_or_report+0xe2/0xf8 ([<000003ffe0d60766>] __list_add_valid_or_report+0xde/0xf8) [<000003ffe0a8d37e>] sclp_init+0x40e/0x450 [<000003ffe00009f2>] do_one_initcall+0x42/0x1e0 [<000003ffe15b77a6>] do_initcalls+0x126/0x150 [<000003ffe15b7a0a>] kernel_init_freeable+0x1ba/0x1f8 [<000003ffe0d6650e>] kernel_init+0x2e/0x180 [<000003ffe000301c>] __ret_from_fork+0x3c/0x60 [<000003ffe0d759ca>] ret_from_fork+0xa/0x30 Fix this by removing sclp_state_change_event from sclp_reg_list when sclp_init() fails. Reviewed-by: Peter Oberparleiter <oberpar(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/s390/char/sclp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c index d2ab3f07c008..8296e6bc229e 100644 --- a/drivers/s390/char/sclp.c +++ b/drivers/s390/char/sclp.c @@ -1208,6 +1208,7 @@ sclp_init(void) fail_unregister_reboot_notifier: unregister_reboot_notifier(&sclp_reboot_notifier); fail_init_state_uninitialized: + list_del(&sclp_state_change_event.list); sclp_init_state = sclp_init_state_uninitialized; free_page((unsigned long) sclp_read_sccb); free_page((unsigned long) sclp_init_sccb); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
by Liu Jian 20 Aug '24

20 Aug '24

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v6.11-rc1 commit aee2424246f9f1dadc33faa78990c1e2eb7826e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQB2 CVE: CVE-2024-42285 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_id->cm_id.iw = cm_id; cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler; rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished. Cc: stable(a)vger.kernel.org Fixes: 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20240605145117.397751-6-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/core/iwcm.c [Did not backport 54102dd410b03.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/core/iwcm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c index 5d676cff41f4..720e1a5b34ad 100644 --- a/drivers/infiniband/core/iwcm.c +++ b/drivers/infiniband/core/iwcm.c @@ -367,8 +367,10 @@ EXPORT_SYMBOL(iw_cm_disconnect); * * Clean up all resources associated with the connection and release * the initial reference taken by iw_create_cm_id. + * + * Returns true if and only if the last cm_id_priv reference has been dropped. */ -static void destroy_cm_id(struct iw_cm_id *cm_id) +static bool destroy_cm_id(struct iw_cm_id *cm_id) { struct iwcm_id_private *cm_id_priv; unsigned long flags; @@ -436,7 +438,7 @@ static void destroy_cm_id(struct iw_cm_id *cm_id) iwpm_remove_mapping(&cm_id->local_addr, RDMA_NL_IWCM); } - (void)iwcm_deref_id(cm_id_priv); + return iwcm_deref_id(cm_id_priv); } /* @@ -447,7 +449,8 @@ static void destroy_cm_id(struct iw_cm_id *cm_id) */ void iw_destroy_cm_id(struct iw_cm_id *cm_id) { - destroy_cm_id(cm_id); + if (!destroy_cm_id(cm_id)) + flush_workqueue(iwcm_wq); } EXPORT_SYMBOL(iw_destroy_cm_id); @@ -1020,7 +1023,7 @@ static void cm_work_handler(struct work_struct *_work) if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) { ret = process_event(cm_id_priv, &levent); if (ret) - destroy_cm_id(&cm_id_priv->id); + WARN_ON_ONCE(destroy_cm_id(&cm_id_priv->id)); } else pr_debug("dropping event %d\n", levent.event); if (iwcm_deref_id(cm_id_priv)) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
by Liu Jian 20 Aug '24

20 Aug '24

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v6.11-rc1 commit aee2424246f9f1dadc33faa78990c1e2eb7826e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQB2 CVE: CVE-2024-42285 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_id->cm_id.iw = cm_id; cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler; rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished. Cc: stable(a)vger.kernel.org Fixes: 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20240605145117.397751-6-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/core/iwcm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c index 75b6da00065a..7a6747850aea 100644 --- a/drivers/infiniband/core/iwcm.c +++ b/drivers/infiniband/core/iwcm.c @@ -370,8 +370,10 @@ EXPORT_SYMBOL(iw_cm_disconnect); * * Clean up all resources associated with the connection and release * the initial reference taken by iw_create_cm_id. + * + * Returns true if and only if the last cm_id_priv reference has been dropped. */ -static void destroy_cm_id(struct iw_cm_id *cm_id) +static bool destroy_cm_id(struct iw_cm_id *cm_id) { struct iwcm_id_private *cm_id_priv; struct ib_qp *qp; @@ -441,7 +443,7 @@ static void destroy_cm_id(struct iw_cm_id *cm_id) iwpm_remove_mapping(&cm_id->local_addr, RDMA_NL_IWCM); } - (void)iwcm_deref_id(cm_id_priv); + return iwcm_deref_id(cm_id_priv); } /* @@ -452,7 +454,8 @@ static void destroy_cm_id(struct iw_cm_id *cm_id) */ void iw_destroy_cm_id(struct iw_cm_id *cm_id) { - destroy_cm_id(cm_id); + if (!destroy_cm_id(cm_id)) + flush_workqueue(iwcm_wq); } EXPORT_SYMBOL(iw_destroy_cm_id); @@ -1036,7 +1039,7 @@ static void cm_work_handler(struct work_struct *_work) if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) { ret = process_event(cm_id_priv, &levent); if (ret) - destroy_cm_id(&cm_id_priv->id); + WARN_ON_ONCE(destroy_cm_id(&cm_id_priv->id)); } else pr_debug("dropping event %d\n", levent.event); if (iwcm_deref_id(cm_id_priv)) -- 2.34.1

2 1

[PATCH OLK-5.10] RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
by Liu Jian 20 Aug '24

20 Aug '24

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v6.11-rc1 commit aee2424246f9f1dadc33faa78990c1e2eb7826e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQB2 CVE: CVE-2024-42285 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_id->cm_id.iw = cm_id; cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler; rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished. Cc: stable(a)vger.kernel.org Fixes: 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20240605145117.397751-6-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/core/iwcm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c index 75b6da00065a..7a6747850aea 100644 --- a/drivers/infiniband/core/iwcm.c +++ b/drivers/infiniband/core/iwcm.c @@ -370,8 +370,10 @@ EXPORT_SYMBOL(iw_cm_disconnect); * * Clean up all resources associated with the connection and release * the initial reference taken by iw_create_cm_id. + * + * Returns true if and only if the last cm_id_priv reference has been dropped. */ -static void destroy_cm_id(struct iw_cm_id *cm_id) +static bool destroy_cm_id(struct iw_cm_id *cm_id) { struct iwcm_id_private *cm_id_priv; struct ib_qp *qp; @@ -441,7 +443,7 @@ static void destroy_cm_id(struct iw_cm_id *cm_id) iwpm_remove_mapping(&cm_id->local_addr, RDMA_NL_IWCM); } - (void)iwcm_deref_id(cm_id_priv); + return iwcm_deref_id(cm_id_priv); } /* @@ -452,7 +454,8 @@ static void destroy_cm_id(struct iw_cm_id *cm_id) */ void iw_destroy_cm_id(struct iw_cm_id *cm_id) { - destroy_cm_id(cm_id); + if (!destroy_cm_id(cm_id)) + flush_workqueue(iwcm_wq); } EXPORT_SYMBOL(iw_destroy_cm_id); @@ -1036,7 +1039,7 @@ static void cm_work_handler(struct work_struct *_work) if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) { ret = process_event(cm_id_priv, &levent); if (ret) - destroy_cm_id(&cm_id_priv->id); + WARN_ON_ONCE(destroy_cm_id(&cm_id_priv->id)); } else pr_debug("dropping event %d\n", levent.event); if (iwcm_deref_id(cm_id_priv)) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
by Liu Chuang 20 Aug '24

20 Aug '24

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.10.224 commit b6ac46a00188cde50ffba233e6efb366354a1de5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXH CVE: CVE-2024-42310 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit cb520c3f366c77e8d69e4e2e2781a8ce48d98e79 upstream. In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Fixes: 6a227d5fd6c4 ("gma500: Add support for Cedarview") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240709113311.37168-1-make24… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/gma500/cdv_intel_lvds.c b/drivers/gpu/drm/gma500/cdv_intel_lvds.c index eaaf4efec217..b13c34fa29ed 100644 --- a/drivers/gpu/drm/gma500/cdv_intel_lvds.c +++ b/drivers/gpu/drm/gma500/cdv_intel_lvds.c @@ -310,6 +310,9 @@ static int cdv_intel_lvds_get_modes(struct drm_connector *connector) if (mode_dev->panel_fixed_mode != NULL) { struct drm_display_mode *mode = drm_mode_duplicate(dev, mode_dev->panel_fixed_mode); + if (!mode) + return 0; + drm_mode_probed_add(connector, mode); return 1; } -- 2.34.1

2 1

[PATCH OLK-5.10] drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
by Liu Chuang 20 Aug '24

20 Aug '24

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.10.224 commit b6ac46a00188cde50ffba233e6efb366354a1de5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXH CVE: CVE-2024-42310 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit cb520c3f366c77e8d69e4e2e2781a8ce48d98e79 upstream. In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Fixes: 6a227d5fd6c4 ("gma500: Add support for Cedarview") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240709113311.37168-1-make24… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/gma500/cdv_intel_lvds.c b/drivers/gpu/drm/gma500/cdv_intel_lvds.c index eaaf4efec217..b13c34fa29ed 100644 --- a/drivers/gpu/drm/gma500/cdv_intel_lvds.c +++ b/drivers/gpu/drm/gma500/cdv_intel_lvds.c @@ -310,6 +310,9 @@ static int cdv_intel_lvds_get_modes(struct drm_connector *connector) if (mode_dev->panel_fixed_mode != NULL) { struct drm_display_mode *mode = drm_mode_duplicate(dev, mode_dev->panel_fixed_mode); + if (!mode) + return 0; + drm_mode_probed_add(connector, mode); return 1; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-42304
by Yifan Qiao 20 Aug '24

20 Aug '24

Baokun Li (2): ext4: check dot and dotdot of dx_root before making dir indexed ext4: make sure the first directory block is not a hole fs/ext4/namei.c | 73 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 57 insertions(+), 16 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] CVE-2024-42304
by Yifan Qiao 20 Aug '24

20 Aug '24

Baokun Li (2): ext4: check dot and dotdot of dx_root before making dir indexed ext4: make sure the first directory block is not a hole fs/ext4/namei.c | 73 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 57 insertions(+), 16 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-42304
by Yifan Qiao 20 Aug '24

20 Aug '24

Baokun Li (2): ext4: check dot and dotdot of dx_root before making dir indexed ext4: make sure the first directory block is not a hole fs/ext4/namei.c | 73 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 57 insertions(+), 16 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/2] CVE-2024-42126
by Jinjie Ruan 20 Aug '24

20 Aug '24

CVE-2024-42126 Jinjie Ruan (1): Revert "powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt." Mahesh Salgaonkar (1): powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. arch/powerpc/kernel/mce.c | 2 +- arch/powerpc/kernel/traps.c | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] ext4: fix infinite loop when replaying fast_commit
by Zhihao Cheng 20 Aug '24

20 Aug '24

From: "Luis Henriques (SUSE)" <luis.henriques(a)linux.dev> mainline inclusion from mainline-v6.11-rc1 commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ7X CVE: CVE-2024-43828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem! Fixes: 8016e29f4362 ("ext4: fast commit recovery path") Signed-off-by: Luis Henriques (SUSE) <luis.henriques(a)linux.dev> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20240515082857.32730-1-luis.henriques@linux.dev Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/extents_status.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c index dd679014db98..1b4f07949136 100644 --- a/fs/ext4/extents_status.c +++ b/fs/ext4/extents_status.c @@ -311,6 +311,8 @@ void ext4_es_find_extent_range(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t end, struct extent_status *es) { + es->es_lblk = es->es_len = es->es_pblk = 0; + if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) return; -- 2.31.1

2 1

[PATCH OLK-5.10] ext4: fix infinite loop when replaying fast_commit
by Zhihao Cheng 20 Aug '24

20 Aug '24

From: "Luis Henriques (SUSE)" <luis.henriques(a)linux.dev> mainline inclusion from mainline-v6.11-rc1 commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ7X CVE: CVE-2024-43828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem! Fixes: 8016e29f4362 ("ext4: fast commit recovery path") Signed-off-by: Luis Henriques (SUSE) <luis.henriques(a)linux.dev> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20240515082857.32730-1-luis.henriques@linux.dev Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/extents_status.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c index 783f6205cc9f..cf6e1e001ac7 100644 --- a/fs/ext4/extents_status.c +++ b/fs/ext4/extents_status.c @@ -311,6 +311,8 @@ void ext4_es_find_extent_range(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t end, struct extent_status *es) { + es->es_lblk = es->es_len = es->es_pblk = 0; + if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) return; -- 2.31.1

2 1

[PATCH OLK-5.10] PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
by liwei 20 Aug '24

20 Aug '24

From: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> mainline inclusion from mainline-v6.11-rc1 commit 5a5095a8bd1bd349cce1c879e5e44407a34dda8a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5P CVE: CVE-2024-43824 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Instead of getting the epc_features from pci_epc_get_features() API, use the cached pci_epf_test::epc_features value to avoid the NULL check. Since the NULL check is already performed in pci_epf_test_bind(), having one more check in pci_epf_test_core_init() is redundant and it is not possible to hit the NULL pointer dereference. Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier" flag"), 'epc_features' got dereferenced without the NULL check, leading to the following false positive Smatch warning: drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747) Thus, remove the redundant NULL check and also use the epc_features:: {msix_capable/msi_capable} flags directly to avoid local variables. [kwilczynski: commit log] Fixes: 5e50ee27d4a5 ("PCI: pci-epf-test: Add support to defer core initialization") Closes: https://lore.kernel.org/linux-pci/024b5826-7180-4076-ae08-57d2584cca3f@moro… Link: https://lore.kernel.org/linux-pci/20240418-pci-epf-test-fix-v2-1-eacd548314… Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Frank Li <Frank.Li(a)nxp.com> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-test.c [context conflicts] Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/endpoint/functions/pci-epf-test.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c index ef52f5097eb3..219ac744275d 100644 --- a/drivers/pci/endpoint/functions/pci-epf-test.c +++ b/drivers/pci/endpoint/functions/pci-epf-test.c @@ -674,19 +674,11 @@ static int pci_epf_test_core_init(struct pci_epf *epf) { struct pci_epf_test *epf_test = epf_get_drvdata(epf); struct pci_epf_header *header = epf->header; - const struct pci_epc_features *epc_features; + const struct pci_epc_features *epc_features = epf_test->epc_features; struct pci_epc *epc = epf->epc; struct device *dev = &epf->dev; - bool msix_capable = false; - bool msi_capable = true; int ret; - epc_features = pci_epc_get_features(epc, epf->func_no); - if (epc_features) { - msix_capable = epc_features->msix_capable; - msi_capable = epc_features->msi_capable; - } - ret = pci_epc_write_header(epc, epf->func_no, header); if (ret) { dev_err(dev, "Configuration header write failed\n"); @@ -697,7 +689,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) if (ret) return ret; - if (msi_capable) { + if (epc_features->msi_capable) { ret = pci_epc_set_msi(epc, epf->func_no, epf->msi_interrupts); if (ret) { dev_err(dev, "MSI configuration failed\n"); @@ -705,7 +697,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) } } - if (msix_capable) { + if (epc_features->msix_capable) { ret = pci_epc_set_msix(epc, epf->func_no, epf->msix_interrupts, epf_test->test_reg_bar, epf_test->msix_table_offset); -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS feb0fe58d128f9c077800989f8b392a3daa7f636
by kernel test robot 20 Aug '24

20 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: feb0fe58d128f9c077800989f8b392a3daa7f636 !10931 drm/lima: fix shared irq handling on driver remove elapsed time: 735m configs tested: 35 configs skipped: 138 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240820 clang-20 arm64 randconfig-002-20240820 clang-20 arm64 randconfig-003-20240820 gcc-14.1.0 arm64 randconfig-004-20240820 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240820 clang-18 x86_64 buildonly-randconfig-002-20240820 gcc-11 x86_64 buildonly-randconfig-003-20240820 clang-18 x86_64 buildonly-randconfig-004-20240820 clang-18 x86_64 buildonly-randconfig-005-20240820 clang-18 x86_64 buildonly-randconfig-006-20240820 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240820 gcc-12 x86_64 randconfig-002-20240820 gcc-12 x86_64 randconfig-003-20240820 clang-18 x86_64 randconfig-004-20240820 gcc-12 x86_64 randconfig-005-20240820 clang-18 x86_64 randconfig-006-20240820 gcc-12 x86_64 randconfig-011-20240820 clang-18 x86_64 randconfig-012-20240820 gcc-12 x86_64 randconfig-013-20240820 clang-18 x86_64 randconfig-014-20240820 clang-18 x86_64 randconfig-015-20240820 gcc-12 x86_64 randconfig-016-20240820 clang-18 x86_64 randconfig-071-20240820 gcc-12 x86_64 randconfig-072-20240820 gcc-12 x86_64 randconfig-073-20240820 gcc-12 x86_64 randconfig-074-20240820 clang-18 x86_64 randconfig-075-20240820 clang-18 x86_64 randconfig-076-20240820 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 36fe9923e738b237c70af2304f0d1d2a033fc632
by kernel test robot 20 Aug '24

20 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 36fe9923e738b237c70af2304f0d1d2a033fc632 !10930 libceph: fix race between delayed_work() and ceph_monc_stop() elapsed time: 727m configs tested: 35 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240819 gcc-14.1.0 arm64 randconfig-002-20240819 gcc-14.1.0 arm64 randconfig-003-20240819 gcc-14.1.0 arm64 randconfig-004-20240819 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240819 gcc-12 x86_64 buildonly-randconfig-002-20240819 gcc-12 x86_64 buildonly-randconfig-003-20240819 gcc-12 x86_64 buildonly-randconfig-004-20240819 gcc-12 x86_64 buildonly-randconfig-005-20240819 gcc-12 x86_64 buildonly-randconfig-006-20240819 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240819 clang-18 x86_64 randconfig-002-20240819 clang-18 x86_64 randconfig-003-20240819 gcc-12 x86_64 randconfig-004-20240819 gcc-12 x86_64 randconfig-005-20240819 clang-18 x86_64 randconfig-006-20240819 clang-18 x86_64 randconfig-011-20240819 gcc-12 x86_64 randconfig-012-20240819 clang-18 x86_64 randconfig-013-20240819 clang-18 x86_64 randconfig-014-20240819 gcc-12 x86_64 randconfig-015-20240819 gcc-12 x86_64 randconfig-016-20240819 gcc-12 x86_64 randconfig-071-20240819 gcc-12 x86_64 randconfig-072-20240819 gcc-12 x86_64 randconfig-073-20240819 clang-18 x86_64 randconfig-074-20240819 gcc-12 x86_64 randconfig-075-20240819 gcc-12 x86_64 randconfig-076-20240819 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 063fb5b67877d27a0adebef0dd88bab842d8de07
by kernel test robot 20 Aug '24

20 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 063fb5b67877d27a0adebef0dd88bab842d8de07 !10407 Intel: Backport SPR/EMR CXL and HBM perfmon support to kernel 6.6 Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202408200033.m00Dx7hV-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202408200124.eAjYI7Na-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202408200300.4dy9MKnd-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) arch/arm64/kvm/tmi.c:131:5: warning: no previous prototype for 'tmi_tmm_inf_test' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:244:5: warning: no previous prototype for 'kvm_cvm_create_ttt_levels' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:311:5: warning: no previous prototype for 'kvm_cvm_populate_par_region' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:70:6: warning: no previous prototype for 'kvm_cvm_supports_sve' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:75:6: warning: no previous prototype for 'kvm_cvm_supports_pmu' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:80:5: warning: no previous prototype for 'kvm_cvm_ipa_limit' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:85:5: warning: no previous prototype for 'kvm_cvm_get_num_brps' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:90:5: warning: no previous prototype for 'kvm_cvm_get_num_wrps' [-Wmissing-prototypes] drivers/crypto/ccp/hygon/tdm-dev.c:340:61: error: invalid use of undefined type 'struct module' drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:37: error: 'NR_syscalls' undeclared (first use in this function); did you mean 'si_syscall'? Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- arm64-randconfig-003-20240820 | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-001-20240819 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-002-20240819 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-004-20240819 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-006-20240819 | `-- drivers-crypto-ccp-hygon-tdm-dev.c:error:invalid-use-of-undefined-type-struct-module `-- x86_64-randconfig-004-20240819 `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:NR_syscalls-undeclared-(first-use-in-this-function) elapsed time: 727m configs tested: 34 configs skipped: 134 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240820 clang-20 arm64 randconfig-002-20240820 clang-20 arm64 randconfig-003-20240820 gcc-14.1.0 arm64 randconfig-004-20240820 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240820 gcc-14.1.0 loongarch randconfig-002-20240820 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240819 gcc-12 x86_64 buildonly-randconfig-002-20240819 gcc-12 x86_64 buildonly-randconfig-003-20240819 gcc-12 x86_64 buildonly-randconfig-004-20240819 gcc-12 x86_64 buildonly-randconfig-005-20240819 gcc-12 x86_64 buildonly-randconfig-006-20240819 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240819 clang-18 x86_64 randconfig-002-20240819 clang-18 x86_64 randconfig-003-20240819 gcc-12 x86_64 randconfig-004-20240819 gcc-12 x86_64 randconfig-005-20240819 clang-18 x86_64 randconfig-006-20240819 clang-18 x86_64 randconfig-011-20240819 gcc-12 x86_64 randconfig-012-20240819 clang-18 x86_64 randconfig-013-20240819 clang-18 x86_64 randconfig-014-20240819 gcc-12 x86_64 randconfig-015-20240819 gcc-12 x86_64 randconfig-016-20240819 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13311/13455] drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:37: error: 'NR_syscalls' undeclared; did you mean 'si_syscall'?
by kernel test robot 20 Aug '24

20 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 063fb5b67877d27a0adebef0dd88bab842d8de07 commit: 3ad98583441f7c8a2553e1e8d6340ed4397033e2 [13311/13455] crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM config: x86_64-randconfig-004-20240819 (https://download.01.org/0day-ci/archive/20240820/202408200300.4dy9MKnd-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240820/202408200300.4dy9MKnd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408200300.4dy9MKnd-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: warning: no previous prototype for 'tdm_service_run' [-Wmissing-prototypes] 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^~~~~~~~~~~~~~~ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:5: warning: no previous prototype for 'tdm_service_exit' [-Wmissing-prototypes] 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^~~~~~~~~~~~~~~~ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:243:15: warning: no previous prototype for 'kprobe_symbol_address_byname' [-Wmissing-prototypes] 243 | unsigned long kprobe_symbol_address_byname(const char *name) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/crypto/ccp/hygon/tdm-kernel-guard.c: In function 'kernel_security_enhance_init': >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:37: error: 'NR_syscalls' undeclared (first use in this function); did you mean 'si_syscall'? 308 | eh_objs[SCT].size = NR_syscalls * sizeof(char *); | ^~~~~~~~~~~ | si_syscall drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:37: note: each undeclared identifier is reported only once for each function it appears in Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ACPI_HOTPLUG_IGNORE_OSC Depends on [n]: ACPI [=y] && ACPI_HOTPLUG_CPU [=n] Selected by [y]: - X86 [=y] && ACPI [=y] && HOTPLUG_CPU [=y] vim +308 drivers/crypto/ccp/hygon/tdm-kernel-guard.c 286 287 sct_addr = (unsigned long *)kallsyms_lookup_name("sys_call_table"); 288 #endif 289 if (!sct_addr) { 290 ret = -DYN_ERR_API; 291 pr_err("kallsyms_lookup_name for sys_call_table failed!"); 292 goto end; 293 } 294 295 asm("sidt %0":"=m"(idtr)); 296 297 if (!psp_check_tdm_support()) 298 return 0; 299 300 for (i = 0; i < MAX_OBJ; i++) { 301 memset(&eh_objs[i], 0, sizeof(eh_objs[i])); 302 eh_objs[i].context = CONTEXT_CHECK_MODNAME; 303 eh_objs[i].obj_name = obj_names[i]; 304 } 305 306 if ((eh_obj == -1) || (eh_obj & (1 << SCT))) { 307 eh_objs[SCT].vaddr = (uint64_t)sct_addr; > 308 eh_objs[SCT].size = NR_syscalls * sizeof(char *); 309 } 310 if ((eh_obj == -1) || (eh_obj & (1 << IDT))) { 311 eh_objs[IDT].vaddr = idtr.address; 312 eh_objs[IDT].size = idtr.size; 313 } 314 315 for (i = 0; i < MAX_OBJ; i++) { 316 if (eh_objs[i].vaddr) 317 tdm_service_run(&eh_objs[i]); 318 } 319 320 pr_info("Hygon TDM guard load successfully!\n"); 321 322 end: 323 return ret; 324 } 325 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13310/13455] drivers/crypto/ccp/hygon/tdm-dev.c:340:61: error: invalid use of undefined type 'struct module'
by kernel test robot 20 Aug '24

20 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 063fb5b67877d27a0adebef0dd88bab842d8de07 commit: a1dd4972da4e66d9a9d1a89b3dfd8f742c20193b [13310/13455] crypto: tdm: Add Hygon TDM driver config: x86_64-buildonly-randconfig-006-20240819 (https://download.01.org/0day-ci/archive/20240820/202408200124.eAjYI7Na-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240820/202408200124.eAjYI7Na-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408200124.eAjYI7Na-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/tdm-dev.c: In function 'list_enqueue': drivers/crypto/ccp/hygon/tdm-dev.c:94:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 94 | int ret = 0; | ^~~ drivers/crypto/ccp/hygon/tdm-dev.c: In function 'tdm_get_cmd_context_hash': >> drivers/crypto/ccp/hygon/tdm-dev.c:340:61: error: invalid use of undefined type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~ drivers/crypto/ccp/hygon/tdm-dev.c:340:84: error: invalid use of undefined type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ^~ drivers/crypto/ccp/hygon/tdm-dev.c: In function 'psp_create_measure_task': drivers/crypto/ccp/hygon/tdm-dev.c:606:27: warning: variable 'head' set but not used [-Wunused-but-set-variable] 606 | struct list_head *head = NULL; | ^~~~ vim +340 drivers/crypto/ccp/hygon/tdm-dev.c 323 324 if (!hash) { 325 ret = -DYN_NULL_POINTER; 326 pr_err("Null pointer\n"); 327 goto end; 328 } 329 330 ctx_msg.flag = flag; 331 ctx_msg.pid = current->pid; 332 memcpy(ctx_msg.comm, current->comm, sizeof(current->comm)); 333 334 return_address = CALLER_ADDR1; 335 if (return_address) { 336 #if IS_BUILTIN(CONFIG_CRYPTO_DEV_CCP_DD) 337 p_module = __module_address(return_address); 338 // caller is module 339 if (p_module) > 340 memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); 341 // caller is build-in 342 else 343 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 344 #elif IS_ENABLED(CONFIG_KALLSYMS) 345 symbol_len = sprint_symbol((char *)symbol_buf, return_address); 346 if (!symbol_len) { 347 ret = -DYN_ERR_API; 348 pr_err("sprint_symbol failed\n"); 349 goto end; 350 } 351 symbol_begin = strchr((char *)symbol_buf, '['); 352 if (!symbol_begin) { 353 ret = -DYN_NULL_POINTER; 354 pr_err("module name is not exist\n"); 355 goto end; 356 } 357 symbol_end = strchr((char *)symbol_buf, ']'); 358 if (!symbol_end) { 359 ret = -DYN_NULL_POINTER; 360 pr_err("module name is not exist\n"); 361 goto end; 362 } 363 symbol_begin++; 364 if (symbol_end - symbol_begin) 365 memcpy(ctx_msg.module_name, symbol_begin, symbol_end - symbol_begin); 366 else 367 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 368 #else 369 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 370 #endif 371 } else 372 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 373 374 ret = calc_task_context_hash(ctx_msg, hash); 375 if (ret) { 376 pr_err("calc_task_context_hash failed\n"); 377 goto end; 378 } 379 380 end: 381 return ret; 382 } 383 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 10131/23506] kernel/sched/debug.o: warning: objtool: missing symbol for section .text.unlikely
by kernel test robot 20 Aug '24

20 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 36fe9923e738b237c70af2304f0d1d2a033fc632 commit: acfa0f545c7dd43f959c28e8ab4b139c927ba387 [10131/23506] svm: reduce log of run queue and atomic->atomic64 config: x86_64-buildonly-randconfig-001-20240819 (https://download.01.org/0day-ci/archive/20240820/202408200045.LpVCr73z-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240820/202408200045.LpVCr73z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408200045.LpVCr73z-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/sched/debug.c:797:6: warning: no previous prototype for 'sysrq_sched_debug_tidy' [-Wmissing-prototypes] 797 | void sysrq_sched_debug_tidy(void) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/debug.o: warning: objtool: missing symbol for section .text.unlikely -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 12432/13455] arch/arm64/kvm/virtcca_cvm.c:70:6: warning: no previous prototype for 'kvm_cvm_supports_sve'
by kernel test robot 20 Aug '24

20 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 063fb5b67877d27a0adebef0dd88bab842d8de07 commit: 67e11ee6347c43a97e8987b03a5b3534cd8095d9 [12432/13455] kvm: add virtcca cvm host feature config: arm64-randconfig-003-20240820 (https://download.01.org/0day-ci/archive/20240820/202408200033.m00Dx7hV-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240820/202408200033.m00Dx7hV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408200033.m00Dx7hV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kvm/virtcca_cvm.c:70:6: warning: no previous prototype for 'kvm_cvm_supports_sve' [-Wmissing-prototypes] 70 | bool kvm_cvm_supports_sve(void) | ^~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:75:6: warning: no previous prototype for 'kvm_cvm_supports_pmu' [-Wmissing-prototypes] 75 | bool kvm_cvm_supports_pmu(void) | ^~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:80:5: warning: no previous prototype for 'kvm_cvm_ipa_limit' [-Wmissing-prototypes] 80 | u32 kvm_cvm_ipa_limit(void) | ^~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:85:5: warning: no previous prototype for 'kvm_cvm_get_num_brps' [-Wmissing-prototypes] 85 | u32 kvm_cvm_get_num_brps(void) | ^~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:90:5: warning: no previous prototype for 'kvm_cvm_get_num_wrps' [-Wmissing-prototypes] 90 | u32 kvm_cvm_get_num_wrps(void) | ^~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:244:5: warning: no previous prototype for 'kvm_cvm_create_ttt_levels' [-Wmissing-prototypes] 244 | int kvm_cvm_create_ttt_levels(struct kvm *kvm, struct virtcca_cvm *cvm, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:311:5: warning: no previous prototype for 'kvm_cvm_populate_par_region' [-Wmissing-prototypes] 311 | int kvm_cvm_populate_par_region(struct kvm *kvm, u64 numa_set, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> arch/arm64/kvm/tmi.c:131:5: warning: no previous prototype for 'tmi_tmm_inf_test' [-Wmissing-prototypes] 131 | u64 tmi_tmm_inf_test(u64 x1, u64 x2, u64 x3, u64 x4, u64 x5) | ^~~~~~~~~~~~~~~~ vim +/kvm_cvm_supports_sve +70 arch/arm64/kvm/virtcca_cvm.c 69 > 70 bool kvm_cvm_supports_sve(void) 71 { 72 return tmm_supports(TMI_FEATURE_REGISTER_0_SVE_EN); 73 } 74 > 75 bool kvm_cvm_supports_pmu(void) 76 { 77 return tmm_supports(TMI_FEATURE_REGISTER_0_PMU_EN); 78 } 79 > 80 u32 kvm_cvm_ipa_limit(void) 81 { 82 return u64_get_bits(tmm_feat_reg0, TMI_FEATURE_REGISTER_0_S2SZ); 83 } 84 > 85 u32 kvm_cvm_get_num_brps(void) 86 { 87 return u64_get_bits(tmm_feat_reg0, TMI_FEATURE_REGISTER_0_NUM_BPS); 88 } 89 > 90 u32 kvm_cvm_get_num_wrps(void) 91 { 92 return u64_get_bits(tmm_feat_reg0, TMI_FEATURE_REGISTER_0_NUM_WPS); 93 } 94 95 static int cvm_vmid_reserve(void) 96 { 97 int ret; 98 unsigned int vmid_count = 1 << kvm_get_vmid_bits(); 99 100 spin_lock(&cvm_vmid_lock); 101 ret = bitmap_find_free_region(cvm_vmid_bitmap, vmid_count, 0); 102 spin_unlock(&cvm_vmid_lock); 103 104 return ret; 105 } 106 107 static void cvm_vmid_release(unsigned int vmid) 108 { 109 spin_lock(&cvm_vmid_lock); 110 bitmap_release_region(cvm_vmid_bitmap, vmid, 0); 111 spin_unlock(&cvm_vmid_lock); 112 } 113 114 static u32 __kvm_pgd_page_idx(struct kvm_pgtable *pgt, u64 addr) 115 { 116 u64 shift = ARM64_HW_PGTABLE_LEVEL_SHIFT(pgt->start_level - 1); 117 u64 mask = BIT(pgt->ia_bits) - 1; 118 119 return (addr & mask) >> shift; 120 } 121 122 static u32 kvm_pgd_pages(u32 ia_bits, u32 start_level) 123 { 124 struct kvm_pgtable pgt = { 125 .ia_bits = ia_bits, 126 .start_level = start_level, 127 }; 128 return __kvm_pgd_page_idx(&pgt, -1ULL) + 1; 129 } 130 131 /* 132 * the configurable physical numa range in QEMU is 0-127, 133 * but in real scenarios, 0-63 is sufficient. 134 */ 135 static u64 kvm_get_host_numa_set_by_vcpu(u64 vcpu, struct kvm *kvm) 136 { 137 int64_t i; 138 struct virtcca_cvm *cvm = kvm->arch.virtcca_cvm; 139 struct kvm_numa_info *numa_info = &cvm->numa_info; 140 141 for (i = 0; i < numa_info->numa_cnt && i < MAX_NUMA_NODE; i++) { 142 if (test_bit(vcpu, (unsigned long *)numa_info->numa_nodes[i].cpu_id)) 143 return numa_info->numa_nodes[i].host_numa_nodes[0]; 144 } 145 return NO_NUMA; 146 } 147 148 static u64 kvm_get_first_binded_numa_set(struct kvm *kvm) 149 { 150 struct virtcca_cvm *cvm = kvm->arch.virtcca_cvm; 151 struct kvm_numa_info *numa_info = &cvm->numa_info; 152 153 if (numa_info->numa_cnt > 0) 154 return numa_info->numa_nodes[0].host_numa_nodes[0]; 155 return NO_NUMA; 156 } 157 158 int kvm_arm_create_cvm(struct kvm *kvm) 159 { 160 int ret; 161 struct kvm_pgtable *pgt = kvm->arch.mmu.pgt; 162 unsigned int pgd_sz; 163 struct virtcca_cvm *cvm = kvm->arch.virtcca_cvm; 164 /* get affine host numa set by default vcpu 0 */ 165 u64 numa_set = kvm_get_host_numa_set_by_vcpu(0, kvm); 166 167 if (!kvm_is_virtcca_cvm(kvm) || virtcca_cvm_state(kvm) != CVM_STATE_NONE) 168 return 0; 169 170 if (!cvm->params) { 171 ret = -EFAULT; 172 goto out; 173 } 174 175 ret = cvm_vmid_reserve(); 176 if (ret < 0) 177 goto out; 178 179 cvm->cvm_vmid = ret; 180 181 pgd_sz = kvm_pgd_pages(pgt->ia_bits, pgt->start_level); 182 183 cvm->params->ttt_level_start = kvm->arch.mmu.pgt->start_level; 184 cvm->params->ttt_num_start = pgd_sz; 185 cvm->params->s2sz = VTCR_EL2_IPA(kvm->arch.vtcr); 186 cvm->params->vmid = cvm->cvm_vmid; 187 cvm->params->ns_vtcr = kvm->arch.vtcr; 188 cvm->params->vttbr_el2 = kvm->arch.mmu.pgd_phys; 189 memcpy(cvm->params->rpv, &cvm->cvm_vmid, sizeof(cvm->cvm_vmid)); 190 cvm->rd = tmi_cvm_create(__pa(cvm->params), numa_set); 191 if (!cvm->rd) { 192 kvm_err("KVM creates cVM failed: %d\n", cvm->cvm_vmid); 193 ret = -ENOMEM; 194 goto out; 195 } 196 197 WRITE_ONCE(cvm->state, CVM_STATE_NEW); 198 ret = 0; 199 out: 200 kfree(cvm->params); 201 cvm->params = NULL; 202 if (ret < 0) { 203 kfree(cvm); 204 kvm->arch.virtcca_cvm = NULL; 205 } 206 return ret; 207 } 208 209 void kvm_destroy_cvm(struct kvm *kvm) 210 { 211 struct virtcca_cvm *cvm = kvm->arch.virtcca_cvm; 212 uint32_t cvm_vmid; 213 214 if (!cvm) 215 return; 216 217 cvm_vmid = cvm->cvm_vmid; 218 kfree(cvm->params); 219 cvm->params = NULL; 220 221 if (virtcca_cvm_state(kvm) == CVM_STATE_NONE) 222 return; 223 224 cvm_vmid_release(cvm_vmid); 225 226 WRITE_ONCE(cvm->state, CVM_STATE_DYING); 227 228 if (!tmi_cvm_destroy(cvm->rd)) 229 kvm_info("KVM has destroyed cVM: %d\n", cvm->cvm_vmid); 230 231 kfree(cvm); 232 kvm->arch.virtcca_cvm = NULL; 233 } 234 235 static int kvm_cvm_ttt_create(struct virtcca_cvm *cvm, 236 unsigned long addr, 237 int level, 238 u64 numa_set) 239 { 240 addr = ALIGN_DOWN(addr, cvm_ttt_level_mapsize(level - 1)); 241 return tmi_ttt_create(numa_set, cvm->rd, addr, level); 242 } 243 > 244 int kvm_cvm_create_ttt_levels(struct kvm *kvm, struct virtcca_cvm *cvm, 245 unsigned long ipa, 246 int level, 247 int max_level, 248 struct kvm_mmu_memory_cache *mc) 249 { 250 int ret = 0; 251 if (WARN_ON(level == max_level)) 252 return 0; 253 254 while (level++ < max_level) { 255 u64 numa_set = kvm_get_first_binded_numa_set(kvm); 256 257 ret = kvm_cvm_ttt_create(cvm, ipa, level, numa_set); 258 if (ret) 259 return -ENXIO; 260 } 261 262 return 0; 263 } 264 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
by Tengda Wu 19 Aug '24

19 Aug '24

From: Puranjay Mohan <puranjay(a)kernel.org> mainline inclusion from mainline-v6.11-rc1 commit 19d3c179a37730caf600a97fed3794feac2b197b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ62 CVE: CVE-2024-43840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls __bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them the struct bpf_tramp_image *im pointer as an argument in R0. The trampoline generation code uses emit_addr_mov_i64() to emit instructions for moving the bpf_tramp_image address into R0, but emit_addr_mov_i64() assumes the address to be in the vmalloc() space and uses only 48 bits. Because bpf_tramp_image is allocated using kzalloc(), its address can use more than 48-bits, in this case the trampoline will pass an invalid address to __bpf_tramp_enter/exit() causing a kernel crash. Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64() as it can work with addresses that are greater than 48-bits. Fixes: efc9909fdce0 ("bpf, arm64: Add bpf trampoline for arm64") Signed-off-by: Puranjay Mohan <puranjay(a)kernel.org> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Closes: https://lore.kernel.org/all/SJ0PR15MB461564D3F7E7A763498CA6A8CBDB2@SJ0PR15M… Link: https://lore.kernel.org/bpf/20240711151838.43469-1-puranjay@kernel.org Conflicts: arch/arm64/net/bpf_jit_comp.c [The conflict is due to commit 96b0f5addc7a ("arm64, bpf: Use bpf_prog_pack for arm64 bpf trampoline"), a perf commit, which changes ctx->image to ctx->ro_image] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 166619348b98..0618c95af103 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1942,7 +1942,7 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, emit(A64_STR64I(A64_R(20), A64_SP, regs_off + 8), ctx); if (flags & BPF_TRAMP_F_CALL_ORIG) { - emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_enter, ctx); } @@ -1986,7 +1986,7 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, if (flags & BPF_TRAMP_F_CALL_ORIG) { im->ip_epilogue = ctx->image + ctx->idx; - emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_exit, ctx); } -- 2.34.1

2 1

[PATCH OLK-5.10] bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
by Tengda Wu 19 Aug '24

19 Aug '24

From: Puranjay Mohan <puranjay(a)kernel.org> mainline inclusion from mainline-v6.11-rc1 commit 19d3c179a37730caf600a97fed3794feac2b197b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ62 CVE: CVE-2024-43840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls __bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them the struct bpf_tramp_image *im pointer as an argument in R0. The trampoline generation code uses emit_addr_mov_i64() to emit instructions for moving the bpf_tramp_image address into R0, but emit_addr_mov_i64() assumes the address to be in the vmalloc() space and uses only 48 bits. Because bpf_tramp_image is allocated using kzalloc(), its address can use more than 48-bits, in this case the trampoline will pass an invalid address to __bpf_tramp_enter/exit() causing a kernel crash. Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64() as it can work with addresses that are greater than 48-bits. Fixes: efc9909fdce0 ("bpf, arm64: Add bpf trampoline for arm64") Signed-off-by: Puranjay Mohan <puranjay(a)kernel.org> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Closes: https://lore.kernel.org/all/SJ0PR15MB461564D3F7E7A763498CA6A8CBDB2@SJ0PR15M… Link: https://lore.kernel.org/bpf/20240711151838.43469-1-puranjay@kernel.org Conflicts: arch/arm64/net/bpf_jit_comp.c [The conflict is due to commit 96b0f5addc7a ("arm64, bpf: Use bpf_prog_pack for arm64 bpf trampoline"), a perf commit, which changes ctx->image to ctx->ro_image] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 5560d20f68f4..f6e790058b0a 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1640,7 +1640,7 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, emit(A64_STR64I(A64_R(19), A64_SP, regs_off), ctx); if (flags & BPF_TRAMP_F_CALL_ORIG) { - emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_enter, ctx); } @@ -1681,7 +1681,7 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, if (flags & BPF_TRAMP_F_CALL_ORIG) { im->ip_epilogue = ctx->image + ctx->idx; - emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); + emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); emit_call((const u64)__bpf_tramp_exit, ctx); } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Revert "kbuild: fix false positive warning/error about missing libelf"
by zhaoxuedong 19 Aug '24

19 Aug '24

openEuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAD5GG?from=project-issue CVE: NA -------------------- When your development environment does not have the libelf library and you compile an external module with the "M=xxx" compilation option, the external module will not have ORC information and there will be no warning or errors. If a machine insmod this module and it's process is calling a function in this module, typing kaptch will result in an error indicating that the stack of this process is not trustworthy. The worst thing is that if this module is a necessary and will be used for a long time, kpatch will be difficult to type. --------------------- Revert "kbuild: fix false positive warning/error about missing libelf" This reverts commit ef7cfd00b2caf6edeb7f169682b64be2d0a798cf. Fixes: ef7cfd00b2ca ("kbuild: fix false positive warning/error about missing libelf") Signed-off-by: Zhao Xuedong <zhaoxuedong(a)meituan.com> --- Makefile | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/Makefile b/Makefile index fbaeeb80a69e..82dcf846d07b 100644 --- a/Makefile +++ b/Makefile @@ -1100,6 +1100,11 @@ ifdef CONFIG_STACK_VALIDATION ifeq ($(has_libelf),1) objtool_target := tools/objtool FORCE else + ifdef CONFIG_UNWINDER_ORC + $(error "Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel") + else + $(warning "Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel") + endif SKIP_STACK_VALIDATION := 1 export SKIP_STACK_VALIDATION endif @@ -1249,14 +1254,6 @@ uapi-asm-generic: PHONY += prepare-objtool prepare-resolve_btfids prepare-objtool: $(objtool_target) -ifeq ($(SKIP_STACK_VALIDATION),1) -ifdef CONFIG_UNWINDER_ORC - @echo "error: Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2 - @false -else - @echo "warning: Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2 -endif -endif prepare-resolve_btfids: $(resolve_btfids_target) ifeq ($(ERROR_RESOLVE_BTFIDS),1) -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] perf: Optimize perf_pmu_migrate_context()
by Liu Chuang 19 Aug '24

19 Aug '24

From: Peter Zijlstra <peterz(a)infradead.org> mainline inclusion from mainline-v6.3-rc6 commit b168098912926236bbeebaf7795eb7aab76d2b45 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAL27E Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- Thomas reported that offlining CPUs spends a lot of time in synchronize_rcu() as called from perf_pmu_migrate_context() even though he's not actually using uncore events. Turns out, the thing is unconditionally waiting for RCU, even if there's no actual events to migrate. Fixes: 0cda4c023132 ("perf: Introduce perf_pmu_migrate_context()") Reported-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Paul E. McKenney <paulmck(a)kernel.org> Link: https://lkml.kernel.org/r/20230403090858.GT4253@hirez.programming.kicks-ass… Conflicts: kernel/events/core.c [Due to not merge previous commit bd27568117664b8b3e259721393df420ed51f57b] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- kernel/events/core.c | 68 +++++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 33 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index be528436a03b..b9667223b050 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11247,42 +11247,44 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu) list_add(&event->migrate_entry, &events); } - /* - * Wait for the events to quiesce before re-instating them. - */ - synchronize_rcu(); + if (!list_empty(&events)) { + /* + * Wait for the events to quiesce before re-instating them. + */ + synchronize_rcu(); - /* - * Re-instate events in 2 passes. - * - * Skip over group leaders and only install siblings on this first - * pass, siblings will not get enabled without a leader, however a - * leader will enable its siblings, even if those are still on the old - * context. - */ - list_for_each_entry_safe(event, tmp, &events, migrate_entry) { - if (event->group_leader == event) - continue; + /* + * Re-instate events in 2 passes. + * + * Skip over group leaders and only install siblings on this first + * pass, siblings will not get enabled without a leader, however a + * leader will enable its siblings, even if those are still on the old + * context. + */ + list_for_each_entry_safe(event, tmp, &events, migrate_entry) { + if (event->group_leader == event) + continue; - list_del(&event->migrate_entry); - if (event->state >= PERF_EVENT_STATE_OFF) - event->state = PERF_EVENT_STATE_INACTIVE; - account_event_cpu(event, dst_cpu); - perf_install_in_context(dst_ctx, event, dst_cpu); - get_ctx(dst_ctx); - } + list_del(&event->migrate_entry); + if (event->state >= PERF_EVENT_STATE_OFF) + event->state = PERF_EVENT_STATE_INACTIVE; + account_event_cpu(event, dst_cpu); + perf_install_in_context(dst_ctx, event, dst_cpu); + get_ctx(dst_ctx); + } - /* - * Once all the siblings are setup properly, install the group leaders - * to make it go. - */ - list_for_each_entry_safe(event, tmp, &events, migrate_entry) { - list_del(&event->migrate_entry); - if (event->state >= PERF_EVENT_STATE_OFF) - event->state = PERF_EVENT_STATE_INACTIVE; - account_event_cpu(event, dst_cpu); - perf_install_in_context(dst_ctx, event, dst_cpu); - get_ctx(dst_ctx); + /* + * Once all the siblings are setup properly, install the group leaders + * to make it go. + */ + list_for_each_entry_safe(event, tmp, &events, migrate_entry) { + list_del(&event->migrate_entry); + if (event->state >= PERF_EVENT_STATE_OFF) + event->state = PERF_EVENT_STATE_INACTIVE; + account_event_cpu(event, dst_cpu); + perf_install_in_context(dst_ctx, event, dst_cpu); + get_ctx(dst_ctx); + } } mutex_unlock(&dst_ctx->mutex); mutex_unlock(&src_ctx->mutex); -- 2.34.1

2 1