- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP2] HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
by Yang Yingliang 25 May '24

25 May '24

From: Nam Cao <namcao(a)linutronix.de> mainline inclusion from mainline-v6.9-rc6 commit 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRN6 CVE: CVE-2024-35997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that. More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop. Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up. Delete this unnecessary flag. Reported-and-tested-by: Eva Kurchatova <nyandarknessgirl(a)gmail.com> Closes: https://lore.kernel.org/r/CA+eeCSPUDpUg76ZO8dszSbAGn+UHjcyv8F1J-CUPVARAzEtW… Fixes: 4a200c3b9a40 ("HID: i2c-hid: introduce HID over i2c specification implementation") Cc: <stable(a)vger.kernel.org> Signed-off-by: Nam Cao <namcao(a)linutronix.de> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Conflicts: drivers/hid/i2c-hid/i2c-hid-core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hid/i2c-hid/i2c-hid-core.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index 14811d42a5a9..4f8e8f392dab 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -56,7 +56,6 @@ /* flags */ #define I2C_HID_STARTED 0 #define I2C_HID_RESET_PENDING 1 -#define I2C_HID_READ_PENDING 2 #define I2C_HID_PWR_ON 0x00 #define I2C_HID_PWR_SLEEP 0x01 @@ -256,7 +255,6 @@ static int __i2c_hid_command(struct i2c_client *client, msg[1].len = data_len; msg[1].buf = buf_recv; msg_num = 2; - set_bit(I2C_HID_READ_PENDING, &ihid->flags); } if (wait) @@ -264,9 +262,6 @@ static int __i2c_hid_command(struct i2c_client *client, ret = i2c_transfer(client->adapter, msg, msg_num); - if (data_len > 0) - clear_bit(I2C_HID_READ_PENDING, &ihid->flags); - if (ret != msg_num) return ret < 0 ? ret : -EIO; @@ -538,9 +533,6 @@ static irqreturn_t i2c_hid_irq(int irq, void *dev_id) { struct i2c_hid *ihid = dev_id; - if (test_bit(I2C_HID_READ_PENDING, &ihid->flags)) - return IRQ_HANDLED; - i2c_hid_get_input(ihid); return IRQ_HANDLED; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
by Yang Yingliang 25 May '24

25 May '24

From: Nam Cao <namcao(a)linutronix.de> mainline inclusion from mainline-v6.9-rc6 commit 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRN6 CVE: CVE-2024-35997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that. More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop. Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up. Delete this unnecessary flag. Reported-and-tested-by: Eva Kurchatova <nyandarknessgirl(a)gmail.com> Closes: https://lore.kernel.org/r/CA+eeCSPUDpUg76ZO8dszSbAGn+UHjcyv8F1J-CUPVARAzEtW… Fixes: 4a200c3b9a40 ("HID: i2c-hid: introduce HID over i2c specification implementation") Cc: <stable(a)vger.kernel.org> Signed-off-by: Nam Cao <namcao(a)linutronix.de> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Conflicts: drivers/hid/i2c-hid/i2c-hid-core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hid/i2c-hid/i2c-hid-core.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index 14811d42a5a9..4f8e8f392dab 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -56,7 +56,6 @@ /* flags */ #define I2C_HID_STARTED 0 #define I2C_HID_RESET_PENDING 1 -#define I2C_HID_READ_PENDING 2 #define I2C_HID_PWR_ON 0x00 #define I2C_HID_PWR_SLEEP 0x01 @@ -256,7 +255,6 @@ static int __i2c_hid_command(struct i2c_client *client, msg[1].len = data_len; msg[1].buf = buf_recv; msg_num = 2; - set_bit(I2C_HID_READ_PENDING, &ihid->flags); } if (wait) @@ -264,9 +262,6 @@ static int __i2c_hid_command(struct i2c_client *client, ret = i2c_transfer(client->adapter, msg, msg_num); - if (data_len > 0) - clear_bit(I2C_HID_READ_PENDING, &ihid->flags); - if (ret != msg_num) return ret < 0 ? ret : -EIO; @@ -538,9 +533,6 @@ static irqreturn_t i2c_hid_irq(int irq, void *dev_id) { struct i2c_hid *ihid = dev_id; - if (test_bit(I2C_HID_READ_PENDING, &ihid->flags)) - return IRQ_HANDLED; - i2c_hid_get_input(ihid); return IRQ_HANDLED; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS] HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
by Yang Yingliang 25 May '24

25 May '24

From: Nam Cao <namcao(a)linutronix.de> mainline inclusion from mainline-v6.9-rc6 commit 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRN6 CVE: CVE-2024-35997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that. More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop. Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up. Delete this unnecessary flag. Reported-and-tested-by: Eva Kurchatova <nyandarknessgirl(a)gmail.com> Closes: https://lore.kernel.org/r/CA+eeCSPUDpUg76ZO8dszSbAGn+UHjcyv8F1J-CUPVARAzEtW… Fixes: 4a200c3b9a40 ("HID: i2c-hid: introduce HID over i2c specification implementation") Cc: <stable(a)vger.kernel.org> Signed-off-by: Nam Cao <namcao(a)linutronix.de> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Conflicts: drivers/hid/i2c-hid/i2c-hid-core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hid/i2c-hid/i2c-hid-core.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index 14811d42a5a9..4f8e8f392dab 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -56,7 +56,6 @@ /* flags */ #define I2C_HID_STARTED 0 #define I2C_HID_RESET_PENDING 1 -#define I2C_HID_READ_PENDING 2 #define I2C_HID_PWR_ON 0x00 #define I2C_HID_PWR_SLEEP 0x01 @@ -256,7 +255,6 @@ static int __i2c_hid_command(struct i2c_client *client, msg[1].len = data_len; msg[1].buf = buf_recv; msg_num = 2; - set_bit(I2C_HID_READ_PENDING, &ihid->flags); } if (wait) @@ -264,9 +262,6 @@ static int __i2c_hid_command(struct i2c_client *client, ret = i2c_transfer(client->adapter, msg, msg_num); - if (data_len > 0) - clear_bit(I2C_HID_READ_PENDING, &ihid->flags); - if (ret != msg_num) return ret < 0 ? ret : -EIO; @@ -538,9 +533,6 @@ static irqreturn_t i2c_hid_irq(int irq, void *dev_id) { struct i2c_hid *ihid = dev_id; - if (test_bit(I2C_HID_READ_PENDING, &ihid->flags)) - return IRQ_HANDLED; - i2c_hid_get_input(ihid); return IRQ_HANDLED; -- 2.25.1

2 1

[PATCH OLK-5.10] HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
by Yang Yingliang 25 May '24

25 May '24

From: Nam Cao <namcao(a)linutronix.de> mainline inclusion from mainline-v6.9-rc6 commit 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRN6 CVE: CVE-2024-35997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that. More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop. Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up. Delete this unnecessary flag. Reported-and-tested-by: Eva Kurchatova <nyandarknessgirl(a)gmail.com> Closes: https://lore.kernel.org/r/CA+eeCSPUDpUg76ZO8dszSbAGn+UHjcyv8F1J-CUPVARAzEtW… Fixes: 4a200c3b9a40 ("HID: i2c-hid: introduce HID over i2c specification implementation") Cc: <stable(a)vger.kernel.org> Signed-off-by: Nam Cao <namcao(a)linutronix.de> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Conflicts: drivers/hid/i2c-hid/i2c-hid-core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hid/i2c-hid/i2c-hid-core.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index 14811d42a5a9..4f8e8f392dab 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -56,7 +56,6 @@ /* flags */ #define I2C_HID_STARTED 0 #define I2C_HID_RESET_PENDING 1 -#define I2C_HID_READ_PENDING 2 #define I2C_HID_PWR_ON 0x00 #define I2C_HID_PWR_SLEEP 0x01 @@ -256,7 +255,6 @@ static int __i2c_hid_command(struct i2c_client *client, msg[1].len = data_len; msg[1].buf = buf_recv; msg_num = 2; - set_bit(I2C_HID_READ_PENDING, &ihid->flags); } if (wait) @@ -264,9 +262,6 @@ static int __i2c_hid_command(struct i2c_client *client, ret = i2c_transfer(client->adapter, msg, msg_num); - if (data_len > 0) - clear_bit(I2C_HID_READ_PENDING, &ihid->flags); - if (ret != msg_num) return ret < 0 ? ret : -EIO; @@ -538,9 +533,6 @@ static irqreturn_t i2c_hid_irq(int irq, void *dev_id) { struct i2c_hid *ihid = dev_id; - if (test_bit(I2C_HID_READ_PENDING, &ihid->flags)) - return IRQ_HANDLED; - i2c_hid_get_input(ihid); return IRQ_HANDLED; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/tls: Fix flipped sign in tls_err_abort() calls
by Ziyang Xuan 25 May '24

25 May '24

From: Daniel Jordan <daniel.m.jordan(a)oracle.com> mainline inclusion from mainline-v5.15 commit da353fac65fede6b8b4cfe207f0d9408e3121105 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RCYN CVE: CVE-2021-47496 -------------------------------- sk->sk_err appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other code. For instance, [kworker] tls_encrypt_done(..., err=<negative error from crypto request>) tls_err_abort(.., err) sk->sk_err = err; [task] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk->sk_err) { ret = -sk->sk_err; // ret is positive splice_from_pipe_feed (continued) ret = actor(...) // ret is still positive and interpreted as bytes // written, resulting in underflow of buf->len and // sd->len, leading to huge buf->offset and bogus // addresses computed in later calls to actor() Fix all tls_err_abort() callers to pass a negative error code consistently and centralize the error-prone sign flip there, throwing in a warning to catch future misuse and uninlining the function so it really does only warn once. Cc: stable(a)vger.kernel.org Fixes: c46234ebb4d1e ("tls: RX path for ktls") Reported-by: syzbot+b187b77c8474f9648fae(a)syzkaller.appspotmail.com Signed-off-by: Daniel Jordan <daniel.m.jordan(a)oracle.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: include/net/tls.h net/tls/tls_sw.c [The version does not include commit a42055e8d2c3.] Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- include/net/tls.h | 9 ++------- net/tls/tls_sw.c | 15 ++++++++++++--- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/include/net/tls.h b/include/net/tls.h index 4457bc67f2e6..de16c863fd66 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -272,6 +272,7 @@ int tls_sk_query(struct sock *sk, int optname, char __user *optval, int __user *optlen); int tls_sk_attach(struct sock *sk, int optname, char __user *optval, unsigned int optlen); +void tls_err_abort(struct sock *sk, int err); int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx); int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size); @@ -365,12 +366,6 @@ static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk) #endif } -static inline void tls_err_abort(struct sock *sk, int err) -{ - sk->sk_err = err; - sk->sk_error_report(sk); -} - static inline bool tls_bigint_increment(unsigned char *seq, int len) { int i; @@ -388,7 +383,7 @@ static inline void tls_advance_record_sn(struct sock *sk, struct cipher_context *ctx) { if (tls_bigint_increment(ctx->rec_seq, ctx->rec_seq_size)) - tls_err_abort(sk, EBADMSG); + tls_err_abort(sk, -EBADMSG); tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, ctx->iv_size); } diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 7d761244a360..b4c68786077a 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -34,6 +34,7 @@ * SOFTWARE. */ +#include <linux/bug.h> #include <linux/sched/signal.h> #include <linux/module.h> #include <crypto/aead.h> @@ -43,6 +44,14 @@ #define MAX_IV_SIZE TLS_CIPHER_AES_GCM_128_IV_SIZE +noinline void tls_err_abort(struct sock *sk, int err) +{ + WARN_ON_ONCE(err >= 0); + /* sk->sk_err should contain a positive error code. */ + sk->sk_err = -err; + sk_error_report(sk); +} + static int tls_do_decryption(struct sock *sk, struct scatterlist *sgin, struct scatterlist *sgout, @@ -244,7 +253,7 @@ static int tls_push_record(struct sock *sk, int flags, /* Only pass through MSG_DONTWAIT and MSG_NOSIGNAL flags */ rc = tls_push_sg(sk, tls_ctx, ctx->sg_encrypted_data, 0, flags); if (rc < 0 && rc != -EAGAIN) - tls_err_abort(sk, EBADMSG); + tls_err_abort(sk, -EBADMSG); tls_advance_record_sn(sk, &tls_ctx->tx); out_req: @@ -911,7 +920,7 @@ int tls_sw_recvmsg(struct sock *sk, err = decrypt_skb_update(sk, skb, &msg->msg_iter, &chunk, &zc); if (err < 0) { - tls_err_abort(sk, EBADMSG); + tls_err_abort(sk, -EBADMSG); goto recv_end; } ctx->decrypted = true; @@ -991,7 +1000,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, err = decrypt_skb_update(sk, skb, NULL, &chunk, &zc); if (err < 0) { - tls_err_abort(sk, EBADMSG); + tls_err_abort(sk, -EBADMSG); goto splice_read_end; } ctx->decrypted = true; -- 2.25.1

2 1

[PATCH OLK-6.6 0/8] mm: some misc bugfix
by Kefeng Wang 25 May '24

25 May '24

Most of bugfix about large folio, one about fault around and one about vmalloc, two small code optimization. Baolin Wang (1): mm: huge_memory: add the missing folio_test_pmd_mappable() for THP split statistics Barry Song (1): mm: prohibit the last subpage from reusing the entire large folio John Hubbard (1): mm/memory.c: do_numa_page(): remove a redundant page table read Kefeng Wang (2): mm: memory: fix shift-out-of-bounds in fault_around_bytes_set Revert "mm: support multi-size THP numa balancing" Matthew Wilcox (1): mm: simplify thp_vma_allowable_order Uladzislau Rezki (Sony) (1): mm: vmalloc: bail out early in find_vmap_area() if vmap is not init Zi Yan (1): mm/huge_memory: skip invalid debugfs new_order input for folio split fs/proc/task_mmu.c | 4 +- include/linux/huge_mm.h | 29 ++++++------ mm/huge_memory.c | 20 +++++++-- mm/khugepaged.c | 16 +++---- mm/memory.c | 97 +++++++++++++++-------------------------- mm/mprotect.c | 3 +- mm/vmalloc.c | 3 ++ 7 files changed, 80 insertions(+), 92 deletions(-) -- 2.27.0

2 9

[PATCH OLK-5.10] cvm_tsi: add cvm tsi interface
by Shengjie Li 25 May '24

25 May '24

virtcca inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9Q85J -------------------------------- Add TSI interface for Confidential VMs: 1. Add smc call for Confidential cVMs 2. Add TSI interface driver Signed-off-by: Shengjie Li <lishengjie12(a)huawei.com> --- arch/arm64/include/asm/cvm_guest.h | 4 + arch/arm64/include/asm/cvm_smc.h | 168 ++++++++++++++++++ arch/arm64/include/uapi/asm/cvm_tsi.h | 78 ++++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/cvm_guest.c | 30 +++- arch/arm64/kernel/cvm_tsi.c | 246 ++++++++++++++++++++++++++ arch/arm64/kernel/setup.c | 4 + 7 files changed, 530 insertions(+), 2 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_smc.h create mode 100644 arch/arm64/include/uapi/asm/cvm_tsi.h create mode 100644 arch/arm64/kernel/cvm_tsi.c diff --git a/arch/arm64/include/asm/cvm_guest.h b/arch/arm64/include/asm/cvm_guest.h index cd487b27ae..46fcfc3c92 100644 --- a/arch/arm64/include/asm/cvm_guest.h +++ b/arch/arm64/include/asm/cvm_guest.h @@ -23,6 +23,8 @@ static inline bool is_swiotlb_for_alloc(struct device *dev) extern void __init swiotlb_cvm_update_mem_attributes(void); +extern void cvm_tsi_init(void); + #else static inline int set_cvm_memory_encrypted(unsigned long addr, int numpages) @@ -42,5 +44,7 @@ static inline bool is_cvm_world(void) static inline void __init swiotlb_cvm_update_mem_attributes(void) {} +static inline void cvm_tsi_init(void) {} + #endif /* CONFIG_CVM_GUEST */ #endif /* __CVM_GUEST_H */ diff --git a/arch/arm64/include/asm/cvm_smc.h b/arch/arm64/include/asm/cvm_smc.h new file mode 100644 index 0000000000..c4d56333e3 --- /dev/null +++ b/arch/arm64/include/asm/cvm_smc.h @@ -0,0 +1,168 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef __ASM_CVM_SMC_H_ +#define __ASM_CVM_SMC_H_ + +#ifdef CONFIG_CVM_GUEST + +#include <linux/arm-smccc.h> +#include <asm/cvm_tsi.h> +#include <linux/slab.h> + +#define SMC_TSI_CALL_BASE 0xC4000000 +#define TSI_ABI_VERSION_MAJOR 1 +#define TSI_ABI_VERSION_MINOR 0 +#define TSI_ABI_VERSION ((TSI_ABI_VERSION_MAJOR << 16) | TSI_ABI_VERSION_MINOR) + +#define TSI_ABI_VERSION_GET_MAJOR(_version) ((_version) >> 16) +#define TSI_ABI_VERSION_GET_MINOR(_version) ((_version) & 0xFFFF) + +#define TSI_SUCCESS 0 +#define TSI_ERROR_INPUT 1 +#define TSI_ERROR_STATE 2 +#define TSI_INCOMPLETE 3 + +#define SMC_TSI_FID(_x) (SMC_TSI_CALL_BASE + (_x)) +#define SMC_TSI_ABI_VERSION SMC_TSI_FID(0x190) + +/* + * arg1: Index, which measurements slot to read + * arg2: Measurement value + * ret0: Status / error + */ +#define SMC_TSI_MEASUREMENT_READ SMC_TSI_FID(0x192) + +/* + * arg1: Index, which measurements slot to extend + * arg2: Size of realm measurement in bytes, max 64 bytes + * arg3: Measurement value + * ret0: Status / error + */ +#define SMC_TSI_MEASUREMENT_EXTEND SMC_TSI_FID(0x193) + +/* + * arg1: Challenge value + * ret0: Status / error + * ret1: Upper bound on attestation token size in bytes + */ +#define SMC_TSI_ATTESTATION_TOKEN_INIT SMC_TSI_FID(0x194) + +/* + * arg1: IPA of the Granule to which the token will be written + * arg2: Offset within Granule to start of buffer in bytes + * arg3: Size of buffer in bytes + * ret0: Status / error + * ret1: Number of bytes written to buffer + */ +#define SMC_TSI_ATTESTATION_TOKEN_CONTINUE SMC_TSI_FID(0x195) + +/* + * arg1: struct cVM config addr + * ret0: Status / error + */ +#define SMC_TSI_CVM_CONFIG SMC_TSI_FID(0x196) + +/* + * arg1: Device cert buffer + * arg2: Size of buffer in bytes + * ret0: Status / error + */ +#define SMC_TSI_DEVICE_CERT SMC_TSI_FID(0x19A) + +static inline unsigned long tsi_get_version(void) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_ABI_VERSION, &res); + + return res.a0; +} + +static inline unsigned long tsi_get_cvm_config(struct cvm_config *cfg) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_CVM_CONFIG, &res); + + cfg->ipa_bits = res.a1; + cfg->algorithm = res.a2; + + return res.a0; +} + +static inline unsigned long tsi_measurement_extend(struct cvm_measurement_extend *cvm_meas_ext) +{ + + struct arm_smccc_res res; + unsigned char *value; + + value = kmalloc(MAX_MEASUREMENT_SIZE, GFP_KERNEL); + if (!value) + return -ENOMEM; + memcpy(value, cvm_meas_ext->value, MAX_MEASUREMENT_SIZE); + + arm_smccc_1_1_smc(SMC_TSI_MEASUREMENT_EXTEND, cvm_meas_ext->index, + cvm_meas_ext->size, virt_to_phys(value), &res); + kfree(value); + + return res.a0; +} + +static inline unsigned long tsi_measurement_read(struct cvm_measurement *cvm_meas) +{ + struct arm_smccc_res res; + unsigned char *value; + + value = kmalloc(MAX_MEASUREMENT_SIZE, GFP_KERNEL); + if (!value) + return -ENOMEM; + arm_smccc_1_1_smc(SMC_TSI_MEASUREMENT_READ, cvm_meas->index, + virt_to_phys(value), &res); + + memcpy(cvm_meas->value, value, MAX_MEASUREMENT_SIZE); + kfree(value); + + return res.a0; +} + +static inline unsigned long tsi_attestation_token_init(struct cvm_attestation_cmd *attest_cmd) +{ + struct arm_smccc_res res; + unsigned char *challenge; + + challenge = kmalloc(CHALLENGE_SIZE, GFP_KERNEL); + if (!challenge) + return -ENOMEM; + memcpy(challenge, attest_cmd->challenge, CHALLENGE_SIZE); + + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_INIT, virt_to_phys(challenge), &res); + kfree(challenge); + + return res.a0; +} + +static inline unsigned long tsi_attestation_token_continue(struct cvm_attestation_cmd *attest_cmd) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_CONTINUE, virt_to_phys(attest_cmd->granule_ipa), + attest_cmd->offset, attest_cmd->size, &res); + + attest_cmd->num_wr_bytes = res.a1; + + return res.a0; +} + +static inline unsigned long tsi_get_device_cert(unsigned char *device_cert, + unsigned long *device_cert_size) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_DEVICE_CERT, virt_to_phys(device_cert), *device_cert_size, &res); + + *device_cert_size = res.a1; + + return res.a0; +} + +#endif /* CONFIG_CVM_GUEST */ +#endif /* __ASM_CVM_SMC_H_ */ diff --git a/arch/arm64/include/uapi/asm/cvm_tsi.h b/arch/arm64/include/uapi/asm/cvm_tsi.h new file mode 100644 index 0000000000..43e17a0da0 --- /dev/null +++ b/arch/arm64/include/uapi/asm/cvm_tsi.h @@ -0,0 +1,78 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ +#ifndef __ASM_CVM_TSI_H_ +#define __ASM_CVM_TSI_H_ + +#include <linux/ioctl.h> + +#define TSI_MAGIC 'T' + +/* Measurement slot reserved for RIM */ +#define RIM_MEASUREMENT_SLOT (0U) + +/* Maximum number of measurements */ +#define MEASUREMENT_SLOT_NR (5U) + +/* Size in bytes of the SHA256 measurement */ +#define SHA256_SIZE (32U) + +/* Size in bytes of the SHA512 measurement */ +#define SHA512_SIZE (64U) + +/* + * Size in bytes of the largest measurement type that can be supported. + * This macro needs to be updated accordingly if new algorithms are supported. + */ +#define MAX_MEASUREMENT_SIZE SHA512_SIZE +#define MAX_DEV_CERT_SIZE 4096 + +#define MAX_TOKEN_GRANULE_PAGE (10U) +#define CHALLENGE_SIZE (64U) + +struct cvm_attester { + int dev_fd; +}; + +struct cvm_measurement { + int index; + unsigned char value[MAX_MEASUREMENT_SIZE]; +}; + +struct cvm_tsi_version { + int major; + int minor; +}; + +struct cvm_config { + unsigned long ipa_bits; /* Width of IPA in bits */ + unsigned long algorithm; /* Hash algorithm */ +}; + +struct cvm_measurement_extend { + unsigned long index; + unsigned long size; + unsigned char value[MAX_MEASUREMENT_SIZE]; +}; + +struct cvm_attestation_cmd { + unsigned char challenge[CHALLENGE_SIZE]; /* input: challenge value */ + unsigned long token_size; /* return: challenge value */ + void *granule_head; + void *granule_ipa; /* IPA of the Granule to which the token will be written */ + unsigned long granule_count; + unsigned long offset; /* Offset within Granule to start of buffer in bytes */ + unsigned long size; /* Size of buffer in bytes */ + unsigned long num_wr_bytes; /* Number of bytes written to buffer */ +}; + +struct cca_device_cert { + unsigned long size; + unsigned char value[MAX_DEV_CERT_SIZE]; +}; + +#define TMM_GET_TSI_VERSION _IOR(TSI_MAGIC, 0, struct cvm_tsi_version) + +#define TMM_GET_ATTESTATION_TOKEN _IOWR(TSI_MAGIC, 1, struct cvm_attestation_cmd) + +#define TMM_GET_DEVICE_CERT _IOR(TSI_MAGIC, 2, struct cca_device_cert) + +#endif /* __ASM_CVM_TSI_H_ */ diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index 4c6eb5e78e..c839a123aa 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -73,7 +73,7 @@ obj-$(CONFIG_ARM64_PTR_AUTH) += pointer_auth.o obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o obj-$(CONFIG_ARM64_MTE) += mte.o obj-$(CONFIG_MPAM) += mpam/ -obj-$(CONFIG_CVM_GUEST) += cvm_guest.o +obj-$(CONFIG_CVM_GUEST) += cvm_guest.o cvm_tsi.o obj-y += vdso/ probes/ obj-$(CONFIG_COMPAT_VDSO) += vdso32/ diff --git a/arch/arm64/kernel/cvm_guest.c b/arch/arm64/kernel/cvm_guest.c index c1f27992ad..de60abcf09 100644 --- a/arch/arm64/kernel/cvm_guest.c +++ b/arch/arm64/kernel/cvm_guest.c @@ -11,11 +11,13 @@ #include <asm/cacheflush.h> #include <asm/set_memory.h> #include <asm/tlbflush.h> +#include <asm/cvm_smc.h> #define CVM_PTE_NS_BIT 5 #define CVM_PTE_NS_MASK (1 << CVM_PTE_NS_BIT) static bool cvm_guest_enable __read_mostly; +DEFINE_STATIC_KEY_FALSE_RO(cvm_tsi_present); /* please use 'cvm_guest=1' to enable cvm guest feature */ static int __init setup_cvm_guest(char *str) @@ -37,9 +39,35 @@ static int __init setup_cvm_guest(char *str) } early_param("cvm_guest", setup_cvm_guest); +static bool tsi_version_matches(void) +{ + unsigned long ver = tsi_get_version(); + + if (ver == SMCCC_RET_NOT_SUPPORTED) + return false; + + pr_info("RME: TSI version %lu.%lu advertised\n", + TSI_ABI_VERSION_GET_MAJOR(ver), + TSI_ABI_VERSION_GET_MINOR(ver)); + + return (ver >= TSI_ABI_VERSION && + TSI_ABI_VERSION_GET_MAJOR(ver) == TSI_ABI_VERSION_MAJOR); +} + +void __init cvm_tsi_init(void) +{ + if (!cvm_guest_enable) + return; + + if (!tsi_version_matches()) + return; + + static_branch_enable(&cvm_tsi_present); +} + bool is_cvm_world(void) { - return cvm_guest_enable; + return cvm_guest_enable && static_branch_likely(&cvm_tsi_present); } static int change_page_range_cvm(pte_t *ptep, unsigned long addr, void *data) diff --git a/arch/arm64/kernel/cvm_tsi.c b/arch/arm64/kernel/cvm_tsi.c new file mode 100644 index 0000000000..b48e5b17f4 --- /dev/null +++ b/arch/arm64/kernel/cvm_tsi.c @@ -0,0 +1,246 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include <linux/module.h> +#include <linux/memblock.h> +#include <linux/slab.h> +#include <linux/miscdevice.h> +#include <linux/preempt.h> +#include <asm/cvm_smc.h> +#include <asm/cvm_tsi.h> + +#define GRANULE_SIZE PAGE_SIZE + +struct attestation_token { + void *buf; + unsigned long size; +}; + +static struct attestation_token token; + +static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg); +static int tmm_tsi_release(struct inode *inode, struct file *file); +static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, + size_t size, loff_t *offset); + +static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg); +static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg, + struct attestation_token *attest_token); +static int tmm_get_device_cert(struct cca_device_cert __user *arg); + +static const struct file_operations tmm_tsi_fops = { + .owner = THIS_MODULE, + .read = tmm_token_read, + .release = tmm_tsi_release, + .unlocked_ioctl = tmm_tsi_ioctl +}; + +static struct miscdevice ioctl_dev = { + MISC_DYNAMIC_MINOR, + "tsi", + &tmm_tsi_fops, +}; + +static int __init tmm_tsi_init(void) +{ + unsigned long ver; + int ret; + + ver = tsi_get_version(); + if (ver == SMCCC_RET_NOT_SUPPORTED) { + pr_err("tmm_tsi: SMC return not supported!\n"); + return -EIO; + } + + ret = misc_register(&ioctl_dev); + if (ret) { + pr_err("tmm_tsi: misc device register failed (%d)!\n", ret); + return ret; + } + + pr_warn("tmm_tsi: module loaded (version %lu.%lu).\n", + TSI_ABI_VERSION_GET_MAJOR(ver), + TSI_ABI_VERSION_GET_MINOR(ver)); + + return 0; +} + +static void __exit tmm_tsi_exit(void) +{ + if (token.buf != NULL) + kfree(token.buf); + misc_deregister(&ioctl_dev); + pr_warn("tmm_tsi: module unloaded.\n"); +} + +static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + int ret; + + switch (cmd) { + case TMM_GET_TSI_VERSION: + ret = tmm_get_tsi_version((struct cvm_tsi_version *)arg); + break; + case TMM_GET_ATTESTATION_TOKEN: + ret = tmm_get_attestation_token((struct cvm_attestation_cmd *)arg, &token); + break; + case TMM_GET_DEVICE_CERT: + ret = tmm_get_device_cert((struct cca_device_cert *)arg); + break; + default: + pr_err("tmm_tsi: unknown ioctl command (0x%x)!\n", cmd); + return -ENOTTY; + } + + return ret; +} + +static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, + size_t size, loff_t *offset) +{ + int ret; + int to_copy; + + if (*offset >= token.size) + return 0; + + to_copy = min((int)size, (int)(token.size - *offset)); + ret = copy_to_user(user_buffer, token.buf + *offset, to_copy); + if (ret) { + pr_err("tmm_tsi: copy token to user failed (%d)!\n", ret); + return -1; + } + + *offset += to_copy; + return to_copy; +} + +static int tmm_tsi_release(struct inode *inode, struct file *file) +{ + if (token.buf != NULL) { + memset(token.buf, 0, GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE); + kfree(token.buf); + } + return 0; +} + +static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg) +{ + struct cvm_tsi_version ver_measured = {0}; + unsigned long ver; + unsigned long ret; + + ver = tsi_get_version(); + ver_measured.major = TSI_ABI_VERSION_GET_MAJOR(ver); + ver_measured.minor = TSI_ABI_VERSION_GET_MINOR(ver); + + ret = copy_to_user(arg, &ver_measured, sizeof(struct cvm_tsi_version)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg, + struct attestation_token *attest_token) +{ + unsigned long ret; + struct cvm_attestation_cmd cmd = {0}; + + ret = copy_from_user(&(cmd.challenge), &(arg->challenge), sizeof(cmd.challenge)); + if (ret) { + pr_err("tmm_tsi: copy data from user failed (%lu)!\n", ret); + return -EFAULT; + } + + /* Allocate a large memory */ + attest_token->buf = kmalloc(GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE, GFP_KERNEL); + if (!attest_token->buf) + return -ENOMEM; + cmd.granule_head = attest_token->buf; + cmd.granule_ipa = cmd.granule_head; + + /* preempt_disable(); */ + + ret = tsi_attestation_token_init(&cmd); + if (ret) { + pr_err("tmm_tsi: tsi call tsi_attestation_token_init failed (%lu)!\n", ret); + return -EIO; + } + + do { /* Retrieve one Granule of data per loop iteration */ + cmd.granule_ipa = cmd.granule_head + + (unsigned long)(cmd.granule_count * GRANULE_SIZE); + cmd.offset = 0; + + do { /* Retrieve sub-Granule chunk of data per loop iteration */ + cmd.size = GRANULE_SIZE - cmd.offset; + ret = tsi_attestation_token_continue(&cmd); + cmd.offset += cmd.num_wr_bytes; + } while (ret == TSI_INCOMPLETE && cmd.offset < GRANULE_SIZE); + + cmd.granule_count += 1; + if (cmd.granule_count >= MAX_TOKEN_GRANULE_PAGE && ret == TSI_INCOMPLETE) { + pr_err("tmm_tsi: macro MAX_TOKEN_GRANULE_PAGE (%d) is too small!\n", + MAX_TOKEN_GRANULE_PAGE); + return -ENOMEM; + } + + } while (ret == TSI_INCOMPLETE); + + /* preempt_enable(); */ + + /* Send to user space the total size of the token */ + cmd.granule_count = cmd.granule_count - 1; + cmd.token_size = (unsigned long)(GRANULE_SIZE * cmd.granule_count) + cmd.offset; + attest_token->size = cmd.token_size; + + ret = copy_to_user(&(arg->token_size), &(cmd.token_size), sizeof(cmd.token_size)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +static int tmm_get_device_cert(struct cca_device_cert __user *arg) +{ + unsigned long ret; + unsigned char *device_cert; + unsigned long device_cert_size; + + device_cert_size = MAX_DEV_CERT_SIZE; + device_cert = kmalloc(device_cert_size, GFP_KERNEL); + if (!device_cert) + return -ENOMEM; + ret = tsi_get_device_cert(device_cert, &device_cert_size); + if (ret != TSI_SUCCESS) { + pr_err("tmm_tsi: tsi call tsi_get_device_cert failed (%lu)!\n", ret); + kfree(device_cert); + return -EIO; + } + + ret = copy_to_user(arg->value, device_cert, device_cert_size); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + kfree(device_cert); + return -EFAULT; + } + kfree(device_cert); + + ret = copy_to_user(&(arg->size), &device_cert_size, sizeof(device_cert_size)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +module_init(tmm_tsi_init); +module_exit(tmm_tsi_exit); + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("HUAWEI TECHNOLOGIES CO., LTD."); +MODULE_DESCRIPTION("Interacting with TMM through TSI interface from user space."); diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index c687866612..2148f5cbb5 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -43,6 +43,7 @@ #include <asm/cpu_ops.h> #include <asm/kasan.h> #include <asm/numa.h> +#include <asm/cvm_guest.h> #include <asm/sections.h> #include <asm/setup.h> #include <asm/smp_plat.h> @@ -386,6 +387,9 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) jump_label_init(); parse_early_param(); + /* Init TSI after jump_labels are active */ + cvm_tsi_init(); + /* * Unmask asynchronous aborts and fiq after bringing up possible * earlycon. (Report possible System Errors once we can report this -- 2.37.2.windows.2

2 1

[PATCH OLK-5.10] cvm_tsi: add cvm tsi interface
by Shengjie Li 25 May '24

25 May '24

virtcca inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9Q85J -------------------------------- Add TSI interface for Confidential VMs: 1. Add smc call for Confidential cVMs 2. Add TSI interface driver Signed-off-by: Shengjie Li <lishengjie12(a)huawei.com> --- arch/arm64/include/asm/cvm_guest.h | 4 + arch/arm64/include/asm/cvm_smc.h | 168 ++++++++++++++++++ arch/arm64/include/uapi/asm/cvm_tsi.h | 81 +++++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/cvm_guest.c | 30 +++- arch/arm64/kernel/cvm_tsi.c | 246 ++++++++++++++++++++++++++ arch/arm64/kernel/setup.c | 4 + 7 files changed, 533 insertions(+), 2 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_smc.h create mode 100644 arch/arm64/include/uapi/asm/cvm_tsi.h create mode 100644 arch/arm64/kernel/cvm_tsi.c diff --git a/arch/arm64/include/asm/cvm_guest.h b/arch/arm64/include/asm/cvm_guest.h index cd487b27ae..46fcfc3c92 100644 --- a/arch/arm64/include/asm/cvm_guest.h +++ b/arch/arm64/include/asm/cvm_guest.h @@ -23,6 +23,8 @@ static inline bool is_swiotlb_for_alloc(struct device *dev) extern void __init swiotlb_cvm_update_mem_attributes(void); +extern void cvm_tsi_init(void); + #else static inline int set_cvm_memory_encrypted(unsigned long addr, int numpages) @@ -42,5 +44,7 @@ static inline bool is_cvm_world(void) static inline void __init swiotlb_cvm_update_mem_attributes(void) {} +static inline void cvm_tsi_init(void) {} + #endif /* CONFIG_CVM_GUEST */ #endif /* __CVM_GUEST_H */ diff --git a/arch/arm64/include/asm/cvm_smc.h b/arch/arm64/include/asm/cvm_smc.h new file mode 100644 index 0000000000..c4d56333e3 --- /dev/null +++ b/arch/arm64/include/asm/cvm_smc.h @@ -0,0 +1,168 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef __ASM_CVM_SMC_H_ +#define __ASM_CVM_SMC_H_ + +#ifdef CONFIG_CVM_GUEST + +#include <linux/arm-smccc.h> +#include <asm/cvm_tsi.h> +#include <linux/slab.h> + +#define SMC_TSI_CALL_BASE 0xC4000000 +#define TSI_ABI_VERSION_MAJOR 1 +#define TSI_ABI_VERSION_MINOR 0 +#define TSI_ABI_VERSION ((TSI_ABI_VERSION_MAJOR << 16) | TSI_ABI_VERSION_MINOR) + +#define TSI_ABI_VERSION_GET_MAJOR(_version) ((_version) >> 16) +#define TSI_ABI_VERSION_GET_MINOR(_version) ((_version) & 0xFFFF) + +#define TSI_SUCCESS 0 +#define TSI_ERROR_INPUT 1 +#define TSI_ERROR_STATE 2 +#define TSI_INCOMPLETE 3 + +#define SMC_TSI_FID(_x) (SMC_TSI_CALL_BASE + (_x)) +#define SMC_TSI_ABI_VERSION SMC_TSI_FID(0x190) + +/* + * arg1: Index, which measurements slot to read + * arg2: Measurement value + * ret0: Status / error + */ +#define SMC_TSI_MEASUREMENT_READ SMC_TSI_FID(0x192) + +/* + * arg1: Index, which measurements slot to extend + * arg2: Size of realm measurement in bytes, max 64 bytes + * arg3: Measurement value + * ret0: Status / error + */ +#define SMC_TSI_MEASUREMENT_EXTEND SMC_TSI_FID(0x193) + +/* + * arg1: Challenge value + * ret0: Status / error + * ret1: Upper bound on attestation token size in bytes + */ +#define SMC_TSI_ATTESTATION_TOKEN_INIT SMC_TSI_FID(0x194) + +/* + * arg1: IPA of the Granule to which the token will be written + * arg2: Offset within Granule to start of buffer in bytes + * arg3: Size of buffer in bytes + * ret0: Status / error + * ret1: Number of bytes written to buffer + */ +#define SMC_TSI_ATTESTATION_TOKEN_CONTINUE SMC_TSI_FID(0x195) + +/* + * arg1: struct cVM config addr + * ret0: Status / error + */ +#define SMC_TSI_CVM_CONFIG SMC_TSI_FID(0x196) + +/* + * arg1: Device cert buffer + * arg2: Size of buffer in bytes + * ret0: Status / error + */ +#define SMC_TSI_DEVICE_CERT SMC_TSI_FID(0x19A) + +static inline unsigned long tsi_get_version(void) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_ABI_VERSION, &res); + + return res.a0; +} + +static inline unsigned long tsi_get_cvm_config(struct cvm_config *cfg) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_CVM_CONFIG, &res); + + cfg->ipa_bits = res.a1; + cfg->algorithm = res.a2; + + return res.a0; +} + +static inline unsigned long tsi_measurement_extend(struct cvm_measurement_extend *cvm_meas_ext) +{ + + struct arm_smccc_res res; + unsigned char *value; + + value = kmalloc(MAX_MEASUREMENT_SIZE, GFP_KERNEL); + if (!value) + return -ENOMEM; + memcpy(value, cvm_meas_ext->value, MAX_MEASUREMENT_SIZE); + + arm_smccc_1_1_smc(SMC_TSI_MEASUREMENT_EXTEND, cvm_meas_ext->index, + cvm_meas_ext->size, virt_to_phys(value), &res); + kfree(value); + + return res.a0; +} + +static inline unsigned long tsi_measurement_read(struct cvm_measurement *cvm_meas) +{ + struct arm_smccc_res res; + unsigned char *value; + + value = kmalloc(MAX_MEASUREMENT_SIZE, GFP_KERNEL); + if (!value) + return -ENOMEM; + arm_smccc_1_1_smc(SMC_TSI_MEASUREMENT_READ, cvm_meas->index, + virt_to_phys(value), &res); + + memcpy(cvm_meas->value, value, MAX_MEASUREMENT_SIZE); + kfree(value); + + return res.a0; +} + +static inline unsigned long tsi_attestation_token_init(struct cvm_attestation_cmd *attest_cmd) +{ + struct arm_smccc_res res; + unsigned char *challenge; + + challenge = kmalloc(CHALLENGE_SIZE, GFP_KERNEL); + if (!challenge) + return -ENOMEM; + memcpy(challenge, attest_cmd->challenge, CHALLENGE_SIZE); + + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_INIT, virt_to_phys(challenge), &res); + kfree(challenge); + + return res.a0; +} + +static inline unsigned long tsi_attestation_token_continue(struct cvm_attestation_cmd *attest_cmd) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_CONTINUE, virt_to_phys(attest_cmd->granule_ipa), + attest_cmd->offset, attest_cmd->size, &res); + + attest_cmd->num_wr_bytes = res.a1; + + return res.a0; +} + +static inline unsigned long tsi_get_device_cert(unsigned char *device_cert, + unsigned long *device_cert_size) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_DEVICE_CERT, virt_to_phys(device_cert), *device_cert_size, &res); + + *device_cert_size = res.a1; + + return res.a0; +} + +#endif /* CONFIG_CVM_GUEST */ +#endif /* __ASM_CVM_SMC_H_ */ diff --git a/arch/arm64/include/uapi/asm/cvm_tsi.h b/arch/arm64/include/uapi/asm/cvm_tsi.h new file mode 100644 index 0000000000..6dd419aed2 --- /dev/null +++ b/arch/arm64/include/uapi/asm/cvm_tsi.h @@ -0,0 +1,81 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ +#ifndef __ASM_CVM_TSI_H_ +#define __ASM_CVM_TSI_H_ + +#ifdef CONFIG_CVM_GUEST + +#include <linux/ioctl.h> + +#define TSI_MAGIC 'T' + +/* Measurement slot reserved for RIM */ +#define RIM_MEASUREMENT_SLOT (0U) + +/* Maximum number of measurements */ +#define MEASUREMENT_SLOT_NR (5U) + +/* Size in bytes of the SHA256 measurement */ +#define SHA256_SIZE (32U) + +/* Size in bytes of the SHA512 measurement */ +#define SHA512_SIZE (64U) + +/* + * Size in bytes of the largest measurement type that can be supported. + * This macro needs to be updated accordingly if new algorithms are supported. + */ +#define MAX_MEASUREMENT_SIZE SHA512_SIZE +#define MAX_DEV_CERT_SIZE 4096 + +#define MAX_TOKEN_GRANULE_PAGE (10U) +#define CHALLENGE_SIZE (64U) + +struct cvm_attester { + int dev_fd; +}; + +struct cvm_measurement { + int index; + unsigned char value[MAX_MEASUREMENT_SIZE]; +}; + +struct cvm_tsi_version { + int major; + int minor; +}; + +struct cvm_config { + unsigned long ipa_bits; /* Width of IPA in bits */ + unsigned long algorithm; /* Hash algorithm */ +}; + +struct cvm_measurement_extend { + unsigned long index; + unsigned long size; + unsigned char value[MAX_MEASUREMENT_SIZE]; +}; + +struct cvm_attestation_cmd { + unsigned char challenge[CHALLENGE_SIZE]; /* input: challenge value */ + unsigned long token_size; /* return: challenge value */ + void *granule_head; + void *granule_ipa; /* IPA of the Granule to which the token will be written */ + unsigned long granule_count; + unsigned long offset; /* Offset within Granule to start of buffer in bytes */ + unsigned long size; /* Size of buffer in bytes */ + unsigned long num_wr_bytes; /* Number of bytes written to buffer */ +}; + +struct cca_device_cert { + unsigned long size; + unsigned char value[MAX_DEV_CERT_SIZE]; +}; + +#define TMM_GET_TSI_VERSION _IOR(TSI_MAGIC, 0, struct cvm_tsi_version) + +#define TMM_GET_ATTESTATION_TOKEN _IOWR(TSI_MAGIC, 1, struct cvm_attestation_cmd) + +#define TMM_GET_DEVICE_CERT _IOR(TSI_MAGIC, 2, struct cca_device_cert) + +#endif /* CONFIG_CVM_GUEST */ +#endif /* __ASM_CVM_TSI_H_ */ diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index 4c6eb5e78e..c839a123aa 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -73,7 +73,7 @@ obj-$(CONFIG_ARM64_PTR_AUTH) += pointer_auth.o obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o obj-$(CONFIG_ARM64_MTE) += mte.o obj-$(CONFIG_MPAM) += mpam/ -obj-$(CONFIG_CVM_GUEST) += cvm_guest.o +obj-$(CONFIG_CVM_GUEST) += cvm_guest.o cvm_tsi.o obj-y += vdso/ probes/ obj-$(CONFIG_COMPAT_VDSO) += vdso32/ diff --git a/arch/arm64/kernel/cvm_guest.c b/arch/arm64/kernel/cvm_guest.c index c1f27992ad..de60abcf09 100644 --- a/arch/arm64/kernel/cvm_guest.c +++ b/arch/arm64/kernel/cvm_guest.c @@ -11,11 +11,13 @@ #include <asm/cacheflush.h> #include <asm/set_memory.h> #include <asm/tlbflush.h> +#include <asm/cvm_smc.h> #define CVM_PTE_NS_BIT 5 #define CVM_PTE_NS_MASK (1 << CVM_PTE_NS_BIT) static bool cvm_guest_enable __read_mostly; +DEFINE_STATIC_KEY_FALSE_RO(cvm_tsi_present); /* please use 'cvm_guest=1' to enable cvm guest feature */ static int __init setup_cvm_guest(char *str) @@ -37,9 +39,35 @@ static int __init setup_cvm_guest(char *str) } early_param("cvm_guest", setup_cvm_guest); +static bool tsi_version_matches(void) +{ + unsigned long ver = tsi_get_version(); + + if (ver == SMCCC_RET_NOT_SUPPORTED) + return false; + + pr_info("RME: TSI version %lu.%lu advertised\n", + TSI_ABI_VERSION_GET_MAJOR(ver), + TSI_ABI_VERSION_GET_MINOR(ver)); + + return (ver >= TSI_ABI_VERSION && + TSI_ABI_VERSION_GET_MAJOR(ver) == TSI_ABI_VERSION_MAJOR); +} + +void __init cvm_tsi_init(void) +{ + if (!cvm_guest_enable) + return; + + if (!tsi_version_matches()) + return; + + static_branch_enable(&cvm_tsi_present); +} + bool is_cvm_world(void) { - return cvm_guest_enable; + return cvm_guest_enable && static_branch_likely(&cvm_tsi_present); } static int change_page_range_cvm(pte_t *ptep, unsigned long addr, void *data) diff --git a/arch/arm64/kernel/cvm_tsi.c b/arch/arm64/kernel/cvm_tsi.c new file mode 100644 index 0000000000..b48e5b17f4 --- /dev/null +++ b/arch/arm64/kernel/cvm_tsi.c @@ -0,0 +1,246 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include <linux/module.h> +#include <linux/memblock.h> +#include <linux/slab.h> +#include <linux/miscdevice.h> +#include <linux/preempt.h> +#include <asm/cvm_smc.h> +#include <asm/cvm_tsi.h> + +#define GRANULE_SIZE PAGE_SIZE + +struct attestation_token { + void *buf; + unsigned long size; +}; + +static struct attestation_token token; + +static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg); +static int tmm_tsi_release(struct inode *inode, struct file *file); +static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, + size_t size, loff_t *offset); + +static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg); +static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg, + struct attestation_token *attest_token); +static int tmm_get_device_cert(struct cca_device_cert __user *arg); + +static const struct file_operations tmm_tsi_fops = { + .owner = THIS_MODULE, + .read = tmm_token_read, + .release = tmm_tsi_release, + .unlocked_ioctl = tmm_tsi_ioctl +}; + +static struct miscdevice ioctl_dev = { + MISC_DYNAMIC_MINOR, + "tsi", + &tmm_tsi_fops, +}; + +static int __init tmm_tsi_init(void) +{ + unsigned long ver; + int ret; + + ver = tsi_get_version(); + if (ver == SMCCC_RET_NOT_SUPPORTED) { + pr_err("tmm_tsi: SMC return not supported!\n"); + return -EIO; + } + + ret = misc_register(&ioctl_dev); + if (ret) { + pr_err("tmm_tsi: misc device register failed (%d)!\n", ret); + return ret; + } + + pr_warn("tmm_tsi: module loaded (version %lu.%lu).\n", + TSI_ABI_VERSION_GET_MAJOR(ver), + TSI_ABI_VERSION_GET_MINOR(ver)); + + return 0; +} + +static void __exit tmm_tsi_exit(void) +{ + if (token.buf != NULL) + kfree(token.buf); + misc_deregister(&ioctl_dev); + pr_warn("tmm_tsi: module unloaded.\n"); +} + +static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + int ret; + + switch (cmd) { + case TMM_GET_TSI_VERSION: + ret = tmm_get_tsi_version((struct cvm_tsi_version *)arg); + break; + case TMM_GET_ATTESTATION_TOKEN: + ret = tmm_get_attestation_token((struct cvm_attestation_cmd *)arg, &token); + break; + case TMM_GET_DEVICE_CERT: + ret = tmm_get_device_cert((struct cca_device_cert *)arg); + break; + default: + pr_err("tmm_tsi: unknown ioctl command (0x%x)!\n", cmd); + return -ENOTTY; + } + + return ret; +} + +static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, + size_t size, loff_t *offset) +{ + int ret; + int to_copy; + + if (*offset >= token.size) + return 0; + + to_copy = min((int)size, (int)(token.size - *offset)); + ret = copy_to_user(user_buffer, token.buf + *offset, to_copy); + if (ret) { + pr_err("tmm_tsi: copy token to user failed (%d)!\n", ret); + return -1; + } + + *offset += to_copy; + return to_copy; +} + +static int tmm_tsi_release(struct inode *inode, struct file *file) +{ + if (token.buf != NULL) { + memset(token.buf, 0, GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE); + kfree(token.buf); + } + return 0; +} + +static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg) +{ + struct cvm_tsi_version ver_measured = {0}; + unsigned long ver; + unsigned long ret; + + ver = tsi_get_version(); + ver_measured.major = TSI_ABI_VERSION_GET_MAJOR(ver); + ver_measured.minor = TSI_ABI_VERSION_GET_MINOR(ver); + + ret = copy_to_user(arg, &ver_measured, sizeof(struct cvm_tsi_version)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg, + struct attestation_token *attest_token) +{ + unsigned long ret; + struct cvm_attestation_cmd cmd = {0}; + + ret = copy_from_user(&(cmd.challenge), &(arg->challenge), sizeof(cmd.challenge)); + if (ret) { + pr_err("tmm_tsi: copy data from user failed (%lu)!\n", ret); + return -EFAULT; + } + + /* Allocate a large memory */ + attest_token->buf = kmalloc(GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE, GFP_KERNEL); + if (!attest_token->buf) + return -ENOMEM; + cmd.granule_head = attest_token->buf; + cmd.granule_ipa = cmd.granule_head; + + /* preempt_disable(); */ + + ret = tsi_attestation_token_init(&cmd); + if (ret) { + pr_err("tmm_tsi: tsi call tsi_attestation_token_init failed (%lu)!\n", ret); + return -EIO; + } + + do { /* Retrieve one Granule of data per loop iteration */ + cmd.granule_ipa = cmd.granule_head + + (unsigned long)(cmd.granule_count * GRANULE_SIZE); + cmd.offset = 0; + + do { /* Retrieve sub-Granule chunk of data per loop iteration */ + cmd.size = GRANULE_SIZE - cmd.offset; + ret = tsi_attestation_token_continue(&cmd); + cmd.offset += cmd.num_wr_bytes; + } while (ret == TSI_INCOMPLETE && cmd.offset < GRANULE_SIZE); + + cmd.granule_count += 1; + if (cmd.granule_count >= MAX_TOKEN_GRANULE_PAGE && ret == TSI_INCOMPLETE) { + pr_err("tmm_tsi: macro MAX_TOKEN_GRANULE_PAGE (%d) is too small!\n", + MAX_TOKEN_GRANULE_PAGE); + return -ENOMEM; + } + + } while (ret == TSI_INCOMPLETE); + + /* preempt_enable(); */ + + /* Send to user space the total size of the token */ + cmd.granule_count = cmd.granule_count - 1; + cmd.token_size = (unsigned long)(GRANULE_SIZE * cmd.granule_count) + cmd.offset; + attest_token->size = cmd.token_size; + + ret = copy_to_user(&(arg->token_size), &(cmd.token_size), sizeof(cmd.token_size)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +static int tmm_get_device_cert(struct cca_device_cert __user *arg) +{ + unsigned long ret; + unsigned char *device_cert; + unsigned long device_cert_size; + + device_cert_size = MAX_DEV_CERT_SIZE; + device_cert = kmalloc(device_cert_size, GFP_KERNEL); + if (!device_cert) + return -ENOMEM; + ret = tsi_get_device_cert(device_cert, &device_cert_size); + if (ret != TSI_SUCCESS) { + pr_err("tmm_tsi: tsi call tsi_get_device_cert failed (%lu)!\n", ret); + kfree(device_cert); + return -EIO; + } + + ret = copy_to_user(arg->value, device_cert, device_cert_size); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + kfree(device_cert); + return -EFAULT; + } + kfree(device_cert); + + ret = copy_to_user(&(arg->size), &device_cert_size, sizeof(device_cert_size)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +module_init(tmm_tsi_init); +module_exit(tmm_tsi_exit); + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("HUAWEI TECHNOLOGIES CO., LTD."); +MODULE_DESCRIPTION("Interacting with TMM through TSI interface from user space."); diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index c687866612..2148f5cbb5 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -43,6 +43,7 @@ #include <asm/cpu_ops.h> #include <asm/kasan.h> #include <asm/numa.h> +#include <asm/cvm_guest.h> #include <asm/sections.h> #include <asm/setup.h> #include <asm/smp_plat.h> @@ -386,6 +387,9 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) jump_label_init(); parse_early_param(); + /* Init TSI after jump_labels are active */ + cvm_tsi_init(); + /* * Unmask asynchronous aborts and fiq after bringing up possible * earlycon. (Report possible System Errors once we can report this -- 2.37.2.windows.2

2 1

[PATCH OLK-5.10 v2 0/4] Enhance memcg KSM feature.
by Jinjiang Tu 25 May '24

25 May '24

Enhance memcg KSM feature. Changelog since v1: * update commit log Jinjiang Tu (3): mm/ksm: fix ksm exec support for prctl mm/memcontrol: add ksm state for memcg mm/memcontrol: enable KSM for tasks moving to new memcg Stefan Roesch (1): mm/ksm: support fork/exec for prctl fs/exec.c | 13 ++++++ include/linux/ksm.h | 13 ++++++ include/linux/memcontrol.h | 4 ++ include/linux/sched/coredump.h | 6 ++- mm/memcontrol.c | 73 +++++++++++++++++++++++++++++++++- 5 files changed, 106 insertions(+), 3 deletions(-) -- 2.25.1

2 5

[PATCH OLK-5.10] cvm_tsi: add cvm tsi interface
by Shengjie Li 25 May '24

25 May '24

virtcca inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9Q85J -------------------------------- Add TSI interface for Confidential VMs: 1. Add smc call for Confidential cVMs 2. Add TSI interface driver Signed-off-by: Shengjie Li <lishengjie12(a)huawei.com> --- arch/arm64/include/asm/cvm_guest.h | 4 + arch/arm64/include/asm/cvm_smc.h | 168 +++++++++++++++++ arch/arm64/include/uapi/asm/cvm_tsi.h | 81 +++++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/cvm_guest.c | 30 ++- arch/arm64/kernel/cvm_tsi.c | 253 ++++++++++++++++++++++++++ arch/arm64/kernel/setup.c | 5 + 7 files changed, 541 insertions(+), 2 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_smc.h create mode 100644 arch/arm64/include/uapi/asm/cvm_tsi.h create mode 100644 arch/arm64/kernel/cvm_tsi.c diff --git a/arch/arm64/include/asm/cvm_guest.h b/arch/arm64/include/asm/cvm_guest.h index cd487b27ae..46fcfc3c92 100644 --- a/arch/arm64/include/asm/cvm_guest.h +++ b/arch/arm64/include/asm/cvm_guest.h @@ -23,6 +23,8 @@ static inline bool is_swiotlb_for_alloc(struct device *dev) extern void __init swiotlb_cvm_update_mem_attributes(void); +extern void cvm_tsi_init(void); + #else static inline int set_cvm_memory_encrypted(unsigned long addr, int numpages) @@ -42,5 +44,7 @@ static inline bool is_cvm_world(void) static inline void __init swiotlb_cvm_update_mem_attributes(void) {} +static inline void cvm_tsi_init(void) {} + #endif /* CONFIG_CVM_GUEST */ #endif /* __CVM_GUEST_H */ diff --git a/arch/arm64/include/asm/cvm_smc.h b/arch/arm64/include/asm/cvm_smc.h new file mode 100644 index 0000000000..8033383ae5 --- /dev/null +++ b/arch/arm64/include/asm/cvm_smc.h @@ -0,0 +1,168 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef __ASM_CVM_SMC_H_ +#define __ASM_CVM_SMC_H_ + +#ifdef CONFIG_CVM_GUEST + +#include <linux/arm-smccc.h> +#include <asm/cvm_tsi.h> +#include <linux/slab.h> + +#define SMC_TSI_CALL_BASE 0xC4000000 +#define TSI_ABI_VERSION_MAJOR 12 +#define TSI_ABI_VERSION_MINOR 0 +#define TSI_ABI_VERSION ((TSI_ABI_VERSION_MAJOR << 16) | TSI_ABI_VERSION_MINOR) + +#define TSI_ABI_VERSION_GET_MAJOR(_version) ((_version) >> 16) +#define TSI_ABI_VERSION_GET_MINOR(_version) ((_version) & 0xFFFF) + +#define TSI_SUCCESS 0 +#define TSI_ERROR_INPUT 1 +#define TSI_ERROR_STATE 2 +#define TSI_INCOMPLETE 3 + +#define SMC_TSI_FID(_x) (SMC_TSI_CALL_BASE + (_x)) +#define SMC_TSI_ABI_VERSION SMC_TSI_FID(0x190) + +/* + * arg1: Index, which measurements slot to read + * arg2: Measurement value + * ret0: Status / error + */ +#define SMC_TSI_MEASUREMENT_READ SMC_TSI_FID(0x192) + +/* + * arg1: Index, which measurements slot to extend + * arg2: Size of realm measurement in bytes, max 64 bytes + * arg3: Measurement value + * ret0: Status / error + */ +#define SMC_TSI_MEASUREMENT_EXTEND SMC_TSI_FID(0x193) + +/* + * arg1: Challenge value + * ret0: Status / error + * ret1: Upper bound on attestation token size in bytes + */ +#define SMC_TSI_ATTESTATION_TOKEN_INIT SMC_TSI_FID(0x194) + +/* + * arg1: IPA of the Granule to which the token will be written + * arg2: Offset within Granule to start of buffer in bytes + * arg3: Size of buffer in bytes + * ret0: Status / error + * ret1: Number of bytes written to buffer + */ +#define SMC_TSI_ATTESTATION_TOKEN_CONTINUE SMC_TSI_FID(0x195) + +/* + * arg1: struct cVM config addr + * ret0: Status / error + */ +#define SMC_TSI_CVM_CONFIG SMC_TSI_FID(0x196) + +/* + * arg1: Device cert buffer + * arg2: Size of buffer in bytes + * ret0: Status / error + */ +#define SMC_TSI_DEVICE_CERT SMC_TSI_FID(0x19A) + +static inline unsigned long tsi_get_version(void) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_ABI_VERSION, &res); + + return res.a0; +} + +static inline unsigned long tsi_get_cvm_config(struct cvm_config *cfg) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_CVM_CONFIG, &res); + + cfg->ipa_bits = res.a1; + cfg->algorithm = res.a2; + + return res.a0; +} + +static inline unsigned long tsi_measurement_extend(struct cvm_measurement_extend *cvm_meas_ext) +{ + + struct arm_smccc_res res; + unsigned char *value; + + value = kmalloc(MAX_MEASUREMENT_SIZE, GFP_KERNEL); + if (!value) + return -ENOMEM; + memcpy(value, cvm_meas_ext->value, MAX_MEASUREMENT_SIZE); + + arm_smccc_1_1_smc(SMC_TSI_MEASUREMENT_EXTEND, cvm_meas_ext->index, + cvm_meas_ext->size, virt_to_phys(value), &res); + kfree(value); + + return res.a0; +} + +static inline unsigned long tsi_measurement_read(struct cvm_measurement *cvm_meas) +{ + struct arm_smccc_res res; + unsigned char *value; + + value = kmalloc(MAX_MEASUREMENT_SIZE, GFP_KERNEL); + if (!value) + return -ENOMEM; + arm_smccc_1_1_smc(SMC_TSI_MEASUREMENT_READ, cvm_meas->index, + virt_to_phys(value), &res); + + memcpy(cvm_meas->value, value, MAX_MEASUREMENT_SIZE); + kfree(value); + + return res.a0; +} + +static inline unsigned long tsi_attestation_token_init(struct cvm_attestation_cmd *attest_cmd) +{ + struct arm_smccc_res res; + unsigned char *challenge; + + challenge = kmalloc(CHALLENGE_SIZE, GFP_KERNEL); + if (!challenge) + return -ENOMEM; + memcpy(challenge, attest_cmd->challenge, CHALLENGE_SIZE); + + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_INIT, virt_to_phys(challenge), &res); + kfree(challenge); + + return res.a0; +} + +static inline unsigned long tsi_attestation_token_continue(struct cvm_attestation_cmd *attest_cmd) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_CONTINUE, virt_to_phys(attest_cmd->granule_ipa), + attest_cmd->offset, attest_cmd->size, &res); + + attest_cmd->num_wr_bytes = res.a1; + + return res.a0; +} + +static inline unsigned long tsi_get_device_cert(unsigned char *device_cert, + unsigned long *device_cert_size) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_DEVICE_CERT, virt_to_phys(device_cert), *device_cert_size, &res); + + *device_cert_size = res.a1; + + return res.a0; +} + +#endif /* CONFIG_CVM_GUEST */ +#endif /* __ASM_CVM_SMC_H_ */ diff --git a/arch/arm64/include/uapi/asm/cvm_tsi.h b/arch/arm64/include/uapi/asm/cvm_tsi.h new file mode 100644 index 0000000000..6dd419aed2 --- /dev/null +++ b/arch/arm64/include/uapi/asm/cvm_tsi.h @@ -0,0 +1,81 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ +#ifndef __ASM_CVM_TSI_H_ +#define __ASM_CVM_TSI_H_ + +#ifdef CONFIG_CVM_GUEST + +#include <linux/ioctl.h> + +#define TSI_MAGIC 'T' + +/* Measurement slot reserved for RIM */ +#define RIM_MEASUREMENT_SLOT (0U) + +/* Maximum number of measurements */ +#define MEASUREMENT_SLOT_NR (5U) + +/* Size in bytes of the SHA256 measurement */ +#define SHA256_SIZE (32U) + +/* Size in bytes of the SHA512 measurement */ +#define SHA512_SIZE (64U) + +/* + * Size in bytes of the largest measurement type that can be supported. + * This macro needs to be updated accordingly if new algorithms are supported. + */ +#define MAX_MEASUREMENT_SIZE SHA512_SIZE +#define MAX_DEV_CERT_SIZE 4096 + +#define MAX_TOKEN_GRANULE_PAGE (10U) +#define CHALLENGE_SIZE (64U) + +struct cvm_attester { + int dev_fd; +}; + +struct cvm_measurement { + int index; + unsigned char value[MAX_MEASUREMENT_SIZE]; +}; + +struct cvm_tsi_version { + int major; + int minor; +}; + +struct cvm_config { + unsigned long ipa_bits; /* Width of IPA in bits */ + unsigned long algorithm; /* Hash algorithm */ +}; + +struct cvm_measurement_extend { + unsigned long index; + unsigned long size; + unsigned char value[MAX_MEASUREMENT_SIZE]; +}; + +struct cvm_attestation_cmd { + unsigned char challenge[CHALLENGE_SIZE]; /* input: challenge value */ + unsigned long token_size; /* return: challenge value */ + void *granule_head; + void *granule_ipa; /* IPA of the Granule to which the token will be written */ + unsigned long granule_count; + unsigned long offset; /* Offset within Granule to start of buffer in bytes */ + unsigned long size; /* Size of buffer in bytes */ + unsigned long num_wr_bytes; /* Number of bytes written to buffer */ +}; + +struct cca_device_cert { + unsigned long size; + unsigned char value[MAX_DEV_CERT_SIZE]; +}; + +#define TMM_GET_TSI_VERSION _IOR(TSI_MAGIC, 0, struct cvm_tsi_version) + +#define TMM_GET_ATTESTATION_TOKEN _IOWR(TSI_MAGIC, 1, struct cvm_attestation_cmd) + +#define TMM_GET_DEVICE_CERT _IOR(TSI_MAGIC, 2, struct cca_device_cert) + +#endif /* CONFIG_CVM_GUEST */ +#endif /* __ASM_CVM_TSI_H_ */ diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index 4c6eb5e78e..c839a123aa 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -73,7 +73,7 @@ obj-$(CONFIG_ARM64_PTR_AUTH) += pointer_auth.o obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o obj-$(CONFIG_ARM64_MTE) += mte.o obj-$(CONFIG_MPAM) += mpam/ -obj-$(CONFIG_CVM_GUEST) += cvm_guest.o +obj-$(CONFIG_CVM_GUEST) += cvm_guest.o cvm_tsi.o obj-y += vdso/ probes/ obj-$(CONFIG_COMPAT_VDSO) += vdso32/ diff --git a/arch/arm64/kernel/cvm_guest.c b/arch/arm64/kernel/cvm_guest.c index c1f27992ad..de60abcf09 100644 --- a/arch/arm64/kernel/cvm_guest.c +++ b/arch/arm64/kernel/cvm_guest.c @@ -11,11 +11,13 @@ #include <asm/cacheflush.h> #include <asm/set_memory.h> #include <asm/tlbflush.h> +#include <asm/cvm_smc.h> #define CVM_PTE_NS_BIT 5 #define CVM_PTE_NS_MASK (1 << CVM_PTE_NS_BIT) static bool cvm_guest_enable __read_mostly; +DEFINE_STATIC_KEY_FALSE_RO(cvm_tsi_present); /* please use 'cvm_guest=1' to enable cvm guest feature */ static int __init setup_cvm_guest(char *str) @@ -37,9 +39,35 @@ static int __init setup_cvm_guest(char *str) } early_param("cvm_guest", setup_cvm_guest); +static bool tsi_version_matches(void) +{ + unsigned long ver = tsi_get_version(); + + if (ver == SMCCC_RET_NOT_SUPPORTED) + return false; + + pr_info("RME: TSI version %lu.%lu advertised\n", + TSI_ABI_VERSION_GET_MAJOR(ver), + TSI_ABI_VERSION_GET_MINOR(ver)); + + return (ver >= TSI_ABI_VERSION && + TSI_ABI_VERSION_GET_MAJOR(ver) == TSI_ABI_VERSION_MAJOR); +} + +void __init cvm_tsi_init(void) +{ + if (!cvm_guest_enable) + return; + + if (!tsi_version_matches()) + return; + + static_branch_enable(&cvm_tsi_present); +} + bool is_cvm_world(void) { - return cvm_guest_enable; + return cvm_guest_enable && static_branch_likely(&cvm_tsi_present); } static int change_page_range_cvm(pte_t *ptep, unsigned long addr, void *data) diff --git a/arch/arm64/kernel/cvm_tsi.c b/arch/arm64/kernel/cvm_tsi.c new file mode 100644 index 0000000000..6dc3c0f9b5 --- /dev/null +++ b/arch/arm64/kernel/cvm_tsi.c @@ -0,0 +1,253 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include <linux/module.h> +#include <linux/memblock.h> +#include <linux/slab.h> +#include <linux/miscdevice.h> +#include <linux/preempt.h> +#include <asm/cvm_smc.h> +#include <asm/cvm_tsi.h> + +#define GRANULE_SIZE PAGE_SIZE + +struct attestation_token { + void *buf; + unsigned long size; +}; + +static struct attestation_token token; + +static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg); +static int tmm_tsi_open(struct inode *inode, struct file *file); +static int tmm_tsi_release(struct inode *inode, struct file *file); +static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, + size_t size, loff_t *offset); + +static int tmm_get_tsi_version(struct cvm_tsi_version *arg); +static int tmm_get_attestation_token(struct cvm_attestation_cmd *arg, + struct attestation_token *attest_token); +static int tmm_get_device_cert(struct cca_device_cert *arg); + +static const struct file_operations tmm_tsi_fops = { + .owner = THIS_MODULE, + .open = tmm_tsi_open, + .read = tmm_token_read, + .release = tmm_tsi_release, + .unlocked_ioctl = tmm_tsi_ioctl +}; + +static struct miscdevice ioctl_dev = { + MISC_DYNAMIC_MINOR, + "tsi", + &tmm_tsi_fops, +}; + +static int __init tmm_tsi_init(void) +{ + unsigned long ver; + int ret; + + ver = tsi_get_version(); + + if (ver == SMCCC_RET_NOT_SUPPORTED) { + pr_err("tmm_tsi: SMC return not supported!\n"); + return -EIO; + } + + ret = misc_register(&ioctl_dev); + if (ret) { + pr_err("tmm_tsi: misc device register failed (%d)!\n", ret); + return ret; + } + + pr_warn("tmm_tsi: module loaded (version %lu.%lu).\n", + TSI_ABI_VERSION_GET_MAJOR(ver), + TSI_ABI_VERSION_GET_MINOR(ver)); + + return 0; +} + +static void __exit tmm_tsi_exit(void) +{ + if (token.buf != NULL) + kfree(token.buf); + misc_deregister(&ioctl_dev); + pr_warn("tmm_tsi: module unloaded.\n"); +} + +static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + int ret; + + switch (cmd) { + case TMM_GET_TSI_VERSION: + ret = tmm_get_tsi_version((struct cvm_tsi_version *)arg); + break; + case TMM_GET_ATTESTATION_TOKEN: + ret = tmm_get_attestation_token((struct cvm_attestation_cmd *)arg, &token); + break; + case TMM_GET_DEVICE_CERT: + ret = tmm_get_device_cert((struct cca_device_cert *)arg); + break; + default: + pr_err("tmm_tsi: unknown ioctl command (0x%x)!\n", cmd); + return -ENOTTY; + } + + return ret; +} + +static int tmm_tsi_open(struct inode *inode, struct file *file) +{ + token.buf = NULL; + return 0; +} + +static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, + size_t size, loff_t *offset) +{ + int ret; + int to_copy; + + if (*offset >= token.size) + return 0; + + to_copy = min((int)size, (int)(token.size - *offset)); + ret = copy_to_user(user_buffer, token.buf + *offset, to_copy); + if (ret) { + pr_err("tmm_tsi: copy token to user failed (%d)!\n", ret); + return -1; + } + + *offset += to_copy; + return to_copy; +} + +static int tmm_tsi_release(struct inode *inode, struct file *file) +{ + if (token.buf != NULL) + kfree(token.buf); + return 0; +} + +static int tmm_get_tsi_version(struct cvm_tsi_version *arg) +{ + struct cvm_tsi_version ver_measured = {0}; + unsigned long ver; + unsigned long ret; + + ver = tsi_get_version(); + ver_measured.major = TSI_ABI_VERSION_GET_MAJOR(ver); + ver_measured.minor = TSI_ABI_VERSION_GET_MINOR(ver); + + ret = copy_to_user(arg, &ver_measured, sizeof(struct cvm_tsi_version)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +static int tmm_get_attestation_token(struct cvm_attestation_cmd *arg, + struct attestation_token *attest_token) +{ + unsigned long ret; + struct cvm_attestation_cmd cmd = {0}; + + ret = copy_from_user(&(cmd.challenge), &(arg->challenge), sizeof(cmd.challenge)); + if (ret) { + pr_err("tmm_tsi: copy data from user failed (%lu)!\n", ret); + return -EFAULT; + } + + /* Allocate a large memory */ + attest_token->buf = kmalloc(GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE, GFP_KERNEL); + if (!attest_token->buf) + return -ENOMEM; + cmd.granule_head = attest_token->buf; + cmd.granule_ipa = cmd.granule_head; + + /* preempt_disable(); */ + + ret = tsi_attestation_token_init(&cmd); + if (ret) { + pr_err("tmm_tsi: tsi call tsi_attestation_token_init failed (%lu)!\n", ret); + return -EIO; + } + + do { /* Retrieve one Granule of data per loop iteration */ + cmd.granule_ipa = cmd.granule_head + + (unsigned long)(cmd.granule_count * GRANULE_SIZE); + cmd.offset = 0; + + do { /* Retrieve sub-Granule chunk of data per loop iteration */ + cmd.size = GRANULE_SIZE - cmd.offset; + ret = tsi_attestation_token_continue(&cmd); + cmd.offset += cmd.num_wr_bytes; + } while (ret == TSI_INCOMPLETE && cmd.offset < GRANULE_SIZE); + + cmd.granule_count += 1; + if (cmd.granule_count >= MAX_TOKEN_GRANULE_PAGE && ret == TSI_INCOMPLETE) { + pr_err("tmm_tsi: macro MAX_TOKEN_GRANULE_PAGE (%d) is too small!\n", + MAX_TOKEN_GRANULE_PAGE); + return -ENOMEM; + } + + } while (ret == TSI_INCOMPLETE); + + /* preempt_enable(); */ + + /* Send to user space the total size of the token */ + cmd.granule_count = cmd.granule_count - 1; + cmd.token_size = (unsigned long)(GRANULE_SIZE * cmd.granule_count) + cmd.offset; + attest_token->size = cmd.token_size; + + ret = copy_to_user(&(arg->token_size), &(cmd.token_size), sizeof(cmd.token_size)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +static int tmm_get_device_cert(struct cca_device_cert *arg) +{ + unsigned long ret; + unsigned char *device_cert; + unsigned long device_cert_size; + + device_cert_size = MAX_DEV_CERT_SIZE; + device_cert = kmalloc(device_cert_size, GFP_KERNEL); + if (!device_cert) + return -ENOMEM; + ret = tsi_get_device_cert(device_cert, &device_cert_size); + if (ret != TSI_SUCCESS) { + pr_err("tmm_tsi: tsi call tsi_get_device_cert failed (%lu)!\n", ret); + kfree(device_cert); + return -EIO; + } + + ret = copy_to_user(arg->value, device_cert, device_cert_size); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + kfree(device_cert); + return -EFAULT; + } + kfree(device_cert); + + ret = copy_to_user(&(arg->size), &device_cert_size, sizeof(device_cert_size)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +module_init(tmm_tsi_init); +module_exit(tmm_tsi_exit); + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("HUAWEI TECHNOLOGIES CO., LTD."); +MODULE_DESCRIPTION("Interacting with TMM through TSI interface from user space."); diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index c687866612..48da239193 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -43,6 +43,7 @@ #include <asm/cpu_ops.h> #include <asm/kasan.h> #include <asm/numa.h> +#include <asm/cvm_guest.h> #include <asm/sections.h> #include <asm/setup.h> #include <asm/smp_plat.h> @@ -384,8 +385,12 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) * cpufeature code and early parameters. */ jump_label_init(); + parse_early_param(); + /* Init TSI after jump_labels are active */ + cvm_tsi_init(); + /* * Unmask asynchronous aborts and fiq after bringing up possible * earlycon. (Report possible System Errors once we can report this -- 2.37.2.windows.2

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2021-47455
by Zheng Yejian 25 May '24

25 May '24

Carlos Llamas (1): ptp: fix code indentation issues Yang Yingliang (1): ptp: Fix possible memory leak in ptp_clock_register() drivers/ptp/ptp_clock.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2021-47455
by Zheng Yejian 25 May '24

25 May '24

Carlos Llamas (1): ptp: fix code indentation issues Yang Yingliang (1): ptp: Fix possible memory leak in ptp_clock_register() drivers/ptp/ptp_clock.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] drm/radeon: fix a possible null pointer dereference
by Liu Chuang 25 May '24

25 May '24

From: Gong Yuanjun <ruc_gongyuanjun(a)163.com> mainline inclusion from mainline-v5.19-rc1 commit a2b28708b645c5632dc93669ab06e97874c8244f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4KL CVE: CVE-2022-48710 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In radeon_fp_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. The failure status of drm_cvt_mode() on the other path is checked too. Signed-off-by: Gong Yuanjun <ruc_gongyuanjun(a)163.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c index a16892c16f60..58db79921cd3 100644 --- a/drivers/gpu/drm/radeon/radeon_connectors.c +++ b/drivers/gpu/drm/radeon/radeon_connectors.c @@ -473,6 +473,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode native_mode->vdisplay != 0 && native_mode->clock != 0) { mode = drm_mode_duplicate(dev, native_mode); + if (!mode) + return NULL; mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; drm_mode_set_name(mode); @@ -487,6 +489,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode * simpler. */ mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false); + if (!mode) + return NULL; mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] Enhance memcg KSM feature
by Jinjiang Tu 25 May '24

25 May '24

Enhance memcg KSM feature. Jinjiang Tu (3): mm/ksm: fix ksm exec support for prctl mm/memcontrol: add ksm state for memcg mm/memcontrol: enable KSM for tasks moving to new memcg Stefan Roesch (1): mm/ksm: support fork/exec for prctl fs/exec.c | 13 ++++++ include/linux/ksm.h | 13 ++++++ include/linux/memcontrol.h | 4 ++ include/linux/sched/coredump.h | 6 ++- mm/memcontrol.c | 73 +++++++++++++++++++++++++++++++++- 5 files changed, 106 insertions(+), 3 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS] drm/radeon: fix a possible null pointer dereference
by Liu Chuang 25 May '24

25 May '24

From: Gong Yuanjun <ruc_gongyuanjun(a)163.com> mainline inclusion from mainline-v5.19-rc1 commit 8a89bfeef9abe93371e3ea8796377f2d132eee29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4KL CVE: CVE-2022-48710 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In radeon_fp_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. The failure status of drm_cvt_mode() on the other path is checked too. Signed-off-by: Gong Yuanjun <ruc_gongyuanjun(a)163.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c index a16892c16f60..58db79921cd3 100644 --- a/drivers/gpu/drm/radeon/radeon_connectors.c +++ b/drivers/gpu/drm/radeon/radeon_connectors.c @@ -473,6 +473,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode native_mode->vdisplay != 0 && native_mode->clock != 0) { mode = drm_mode_duplicate(dev, native_mode); + if (!mode) + return NULL; mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; drm_mode_set_name(mode); @@ -487,6 +489,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode * simpler. */ mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false); + if (!mode) + return NULL; mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] fbmon: prevent division by zero in fb_videomode_from_videomode()
by Hui Tang 25 May '24

25 May '24

From: Roman Smirnov <r.smirnov(a)omp.ru> stable inclusion from stable-v4.19.312 commit 1fb52bc1de55e9e0bdf71fe078efd4da0889710f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIW CVE: CVE-2024-35922 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit c2d953276b8b27459baed1277a4fdd5dd9bd4126 ] The expression htotal * vtotal can have a zero value on overflow. It is necessary to prevent division by zero like in fb_var_to_videomode(). Found by Linux Verification Center (linuxtesting.org) with Svace. Signed-off-by: Roman Smirnov <r.smirnov(a)omp.ru> Reviewed-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- drivers/video/fbdev/core/fbmon.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c index 8607439d6932..e4040fb860bb 100644 --- a/drivers/video/fbdev/core/fbmon.c +++ b/drivers/video/fbdev/core/fbmon.c @@ -1309,7 +1309,7 @@ int fb_get_mode(int flags, u32 val, struct fb_var_screeninfo *var, struct fb_inf int fb_videomode_from_videomode(const struct videomode *vm, struct fb_videomode *fbmode) { - unsigned int htotal, vtotal; + unsigned int htotal, vtotal, total; fbmode->xres = vm->hactive; fbmode->left_margin = vm->hback_porch; @@ -1342,8 +1342,9 @@ int fb_videomode_from_videomode(const struct videomode *vm, vtotal = vm->vactive + vm->vfront_porch + vm->vback_porch + vm->vsync_len; /* prevent division by zero */ - if (htotal && vtotal) { - fbmode->refresh = vm->pixelclock / (htotal * vtotal); + total = htotal * vtotal; + if (total) { + fbmode->refresh = vm->pixelclock / total; /* a mode must have htotal and vtotal != 0 or it is invalid */ } else { fbmode->refresh = 0; -- 2.34.1

2 1

[PATCH OLK-5.10] fbmon: prevent division by zero in fb_videomode_from_videomode()
by Hui Tang 25 May '24

25 May '24

From: Roman Smirnov <r.smirnov(a)omp.ru> stable inclusion from stable-v5.10.215 commit 951838fee462aa01fa2a6a91d56f9a495082e7f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIW CVE: CVE-2024-35922 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit c2d953276b8b27459baed1277a4fdd5dd9bd4126 ] The expression htotal * vtotal can have a zero value on overflow. It is necessary to prevent division by zero like in fb_var_to_videomode(). Found by Linux Verification Center (linuxtesting.org) with Svace. Signed-off-by: Roman Smirnov <r.smirnov(a)omp.ru> Reviewed-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- drivers/video/fbdev/core/fbmon.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c index 8607439d6932..e4040fb860bb 100644 --- a/drivers/video/fbdev/core/fbmon.c +++ b/drivers/video/fbdev/core/fbmon.c @@ -1309,7 +1309,7 @@ int fb_get_mode(int flags, u32 val, struct fb_var_screeninfo *var, struct fb_inf int fb_videomode_from_videomode(const struct videomode *vm, struct fb_videomode *fbmode) { - unsigned int htotal, vtotal; + unsigned int htotal, vtotal, total; fbmode->xres = vm->hactive; fbmode->left_margin = vm->hback_porch; @@ -1342,8 +1342,9 @@ int fb_videomode_from_videomode(const struct videomode *vm, vtotal = vm->vactive + vm->vfront_porch + vm->vback_porch + vm->vsync_len; /* prevent division by zero */ - if (htotal && vtotal) { - fbmode->refresh = vm->pixelclock / (htotal * vtotal); + total = htotal * vtotal; + if (total) { + fbmode->refresh = vm->pixelclock / total; /* a mode must have htotal and vtotal != 0 or it is invalid */ } else { fbmode->refresh = 0; -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION bc160a8283adf5c4de3fe9d96695fe09aceb3ec0
by kernel test robot 25 May '24

25 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: bc160a8283adf5c4de3fe9d96695fe09aceb3ec0 !7909 Scheduler load balance fixes Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-001-20240525 | `-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used |-- arm64-randconfig-004-20240525 | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-001-20240525 | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-002-20240525 | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-002-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:implicit-declaration-of-function-iommu_get_dma_domain | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:struct-device-has-no-member-named-dma_ops | |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:initialization-of-struct-iommu_domain-from-int-makes-pointer-from-integer-without-a-cast | `-- kernel-dma-contiguous.c:error:is_zhaoxin_kh40000-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-004-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:implicit-declaration-of-function-iommu_get_dma_domain | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:struct-device-has-no-member-named-dma_ops | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:initialization-of-struct-iommu_domain-from-int-makes-pointer-from-integer-without-a-cast |-- x86_64-randconfig-071-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:struct-device-has-no-member-named-dma_ops | `-- kernel-dma-contiguous.c:error:is_zhaoxin_kh40000-undeclared-(first-use-in-this-function) `-- x86_64-randconfig-074-20240525 |-- arch-x86-kernel-zhaoxin_kh40000.c:error:struct-device-has-no-member-named-dma_ops `-- kernel-dma-contiguous.c:error:is_zhaoxin_kh40000-undeclared-(first-use-in-this-function) clang_recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box | `-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create |-- x86_64-allyesconfig | |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-csv_update_api_version | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box | `-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create |-- x86_64-randconfig-001-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | `-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-csv_update_api_version |-- x86_64-randconfig-002-20240525 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-003-20240525 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-004-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:no-member-named-dma_ops-in-struct-device | |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | `-- kernel-dma-contiguous.c:error:use-of-undeclared-identifier-is_zhaoxin_kh40000 |-- x86_64-randconfig-005-20240525 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-006-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:no-member-named-dma_ops-in-struct-device | |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | `-- kernel-dma-contiguous.c:error:use-of-undeclared-identifier-is_zhaoxin_kh40000 |-- x86_64-randconfig-011-20240525 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-012-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | `-- ld.lld:error:undefined-symbol:iova_reserve_domain_addr |-- x86_64-randconfig-014-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | `-- ld.lld:error:undefined-symbol:iova_reserve_domain_addr |-- x86_64-randconfig-016-20240525 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-072-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:no-member-named-dma_ops-in-struct-device | |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | `-- kernel-dma-contiguous.c:error:use-of-undeclared-identifier-is_zhaoxin_kh40000 |-- x86_64-randconfig-073-20240525 | |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-csv_update_api_version | `-- ld.lld:error:undefined-symbol:iova_reserve_domain_addr |-- x86_64-randconfig-076-20240525 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true `-- x86_64-rhel-8.3-rust |-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true `-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-csv_update_api_version elapsed time: 728m configs tested: 40 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240525 gcc arm64 randconfig-002-20240525 clang arm64 randconfig-003-20240525 gcc arm64 randconfig-004-20240525 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240525 gcc loongarch randconfig-002-20240525 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240525 clang x86_64 buildonly-randconfig-002-20240525 gcc x86_64 buildonly-randconfig-003-20240525 gcc x86_64 buildonly-randconfig-004-20240525 gcc x86_64 buildonly-randconfig-005-20240525 gcc x86_64 buildonly-randconfig-006-20240525 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240525 clang x86_64 randconfig-002-20240525 clang x86_64 randconfig-003-20240525 clang x86_64 randconfig-004-20240525 clang x86_64 randconfig-005-20240525 clang x86_64 randconfig-006-20240525 clang x86_64 randconfig-011-20240525 clang x86_64 randconfig-012-20240525 clang x86_64 randconfig-013-20240525 gcc x86_64 randconfig-014-20240525 clang x86_64 randconfig-015-20240525 gcc x86_64 randconfig-016-20240525 clang x86_64 randconfig-071-20240525 gcc x86_64 randconfig-072-20240525 clang x86_64 randconfig-073-20240525 clang x86_64 randconfig-074-20240525 gcc x86_64 randconfig-075-20240525 gcc x86_64 randconfig-076-20240525 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
by Cai Xinchen 25 May '24

25 May '24

From: Stephen Boyd <swboyd(a)chromium.org> stable inclusion from stable-v4.19.213 commit eb0fc8e7170e61eaf65d28dee4a8baf4e86b19ca category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RD7J CVE: CVE-2021-47497 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5d388fa01fa6eb310ac023a363a6cb216d9d8fe9 upstream. If a cell has 'nbits' equal to a multiple of BITS_PER_BYTE the logic *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0); will become undefined behavior because nbits modulo BITS_PER_BYTE is 0, and we subtract one from that making a large number that is then shifted more than the number of bits that fit into an unsigned long. UBSAN reports this problem: UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8 shift exponent 64 is too large for 64-bit type 'unsigned long' CPU: 6 PID: 7 Comm: kworker/u16:0 Not tainted 5.15.0-rc3+ #9 Hardware name: Google Lazor (rev3+) with KB Backlight (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x0/0x170 show_stack+0x24/0x30 dump_stack_lvl+0x64/0x7c dump_stack+0x18/0x38 ubsan_epilogue+0x10/0x54 __ubsan_handle_shift_out_of_bounds+0x180/0x194 __nvmem_cell_read+0x1ec/0x21c nvmem_cell_read+0x58/0x94 nvmem_cell_read_variable_common+0x4c/0xb0 nvmem_cell_read_variable_le_u32+0x40/0x100 a6xx_gpu_init+0x170/0x2f4 adreno_bind+0x174/0x284 component_bind_all+0xf0/0x264 msm_drm_bind+0x1d8/0x7a0 try_to_bring_up_master+0x164/0x1ac __component_add+0xbc/0x13c component_add+0x20/0x2c dp_display_probe+0x340/0x384 platform_probe+0xc0/0x100 really_probe+0x110/0x304 __driver_probe_device+0xb8/0x120 driver_probe_device+0x4c/0xfc __device_attach_driver+0xb0/0x128 bus_for_each_drv+0x90/0xdc __device_attach+0xc8/0x174 device_initial_probe+0x20/0x2c bus_probe_device+0x40/0xa4 deferred_probe_work_func+0x7c/0xb8 process_one_work+0x128/0x21c process_scheduled_works+0x40/0x54 worker_thread+0x1ec/0x2a8 kthread+0x138/0x158 ret_from_fork+0x10/0x20 Fix it by making sure there are any bits to mask out. Fixes: 69aba7948cbe ("nvmem: Add a simple NVMEM framework for consumers") Cc: Douglas Anderson <dianders(a)chromium.org> Cc: stable(a)vger.kernel.org Signed-off-by: Stephen Boyd <swboyd(a)chromium.org> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Link: https://lore.kernel.org/r/20211013124511.18726-1-srinivas.kandagatla@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/nvmem/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index 30c040786fde..2e77d49c2657 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -1061,7 +1061,8 @@ static void nvmem_shift_read_buffer_in_place(struct nvmem_cell *cell, void *buf) *p-- = 0; /* clear msb bits if any leftover in the last byte */ - *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0); + if (cell->nbits % BITS_PER_BYTE) + *p &= GENMASK((cell->nbits % BITS_PER_BYTE) - 1, 0); } static int __nvmem_cell_read(struct nvmem_device *nvmem, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] vt: fix unicode buffer corruption when deleting characters
by Xiang Yang 25 May '24

25 May '24

From: Nicolas Pitre <nico(a)fluxnic.net> stable inclusion from stable-v4.19.312 commit fc7dfe3d123f00e720be80b920da287810a1f37d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q994 CVE: CVE-2024-35823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream. This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers. Signed-off-by: Nicolas Pitre <nico(a)fluxnic.net> Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 163186cbfe79..12ddd82f0dad 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -405,7 +405,7 @@ static void vc_uniscr_delete(struct vc_data *vc, unsigned int nr) char32_t *ln = uniscr->lines[vc->vc_y]; unsigned int x = vc->vc_x, cols = vc->vc_cols; - memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); + memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); memset32(&ln[cols - nr], ' ', nr); } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ipv6: Fix infinite recursion in fib6_dump_done().
by Zhengchao Shao 25 May '24

25 May '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v4.19.312 commit 9472d07cd095cbd3294ac54c42f304a38fbe9bfe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG76 CVE: CVE-2024-35886 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae upstream. syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1] From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then the response was generated. The following recvmmsg() resumed the dump for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due to the fault injection. [0] 12:01:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, ... snip ...) recvmmsg(r0, ... snip ...) (fail_nth: 8) Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call of inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3]. syzkaller stopped receiving the response halfway through, and finally netlink_sock_destruct() called nlk_sk(sk)->cb.done(). fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it is still not NULL. fib6_dump_end() rewrites nlk_sk(sk)->cb.done() by nlk_sk(sk)->cb.args[3], but it has the same function, not NULL, calling itself recursively and hitting the stack guard page. To avoid the issue, let's set the destructor after kzalloc(). [0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117) should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153) should_failslab (mm/slub.c:3733) kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992) inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink.c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c:2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034) [1]: BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb) stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events netlink_sock_destruct_work RIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570) Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d980000 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3 RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358 RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000 R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68 FS: 0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <#DF> </#DF> <TASK> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) ... fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/core/sock.c:2177 (discriminator 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:256) Modules linked in: Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20240401211003.25274-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv6/ip6_fib.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index 92bc56028b8b..63fb9e01eb4e 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -587,19 +587,19 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) if (!w) { /* New dump: * - * 1. hook callback destructor. - */ - cb->args[3] = (long)cb->done; - cb->done = fib6_dump_done; - - /* - * 2. allocate and initialize walker. + * 1. allocate and initialize walker. */ w = kzalloc(sizeof(*w), GFP_ATOMIC); if (!w) return -ENOMEM; w->func = fib6_dump_node; cb->args[2] = (long)w; + + /* 2. hook callback destructor. + */ + cb->args[3] = (long)cb->done; + cb->done = fib6_dump_done; + } arg.skb = skb; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v1] hwmon: (axi-fan-control) Fix possible NULL pointer dereference
by Wenyu Huang 25 May '24

25 May '24

From: Dragos Bogdan <dragos.bogdan(a)analog.com> stable inclusion from stable-v5.10.201 commit 7d870088db4863c514a7f8751cd593751983029a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RL31 CVE: CVE-2023-52863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a5b3370a1d9750eca325292e291c8c7cb8cf2e0 ] axi_fan_control_irq_handler(), dependent on the private axi_fan_control_data structure, might be called before the hwmon device is registered. That will cause an "Unable to handle kernel NULL pointer dereference" error. Fixes: 8412b410fa5e ("hwmon: Support ADI Fan Control IP") Signed-off-by: Dragos Bogdan <dragos.bogdan(a)analog.com> Signed-off-by: Nuno Sa <nuno.sa(a)analog.com> Link: https://lore.kernel.org/r/20231025132100.649499-1-nuno.sa@analog.com Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/hwmon/axi-fan-control.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/drivers/hwmon/axi-fan-control.c b/drivers/hwmon/axi-fan-control.c index e3f6b03e6764..35c14a863faf 100644 --- a/drivers/hwmon/axi-fan-control.c +++ b/drivers/hwmon/axi-fan-control.c @@ -423,6 +423,21 @@ static int axi_fan_control_probe(struct platform_device *pdev) return -ENODEV; } + ret = axi_fan_control_init(ctl, pdev->dev.of_node); + if (ret) { + dev_err(&pdev->dev, "Failed to initialize device\n"); + return ret; + } + + ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev, + name, + ctl, + &axi_chip_info, + NULL); + + if (IS_ERR(ctl->hdev)) + return PTR_ERR(ctl->hdev); + ctl->irq = platform_get_irq(pdev, 0); if (ctl->irq < 0) return ctl->irq; @@ -436,19 +451,7 @@ static int axi_fan_control_probe(struct platform_device *pdev) return ret; } - ret = axi_fan_control_init(ctl, pdev->dev.of_node); - if (ret) { - dev_err(&pdev->dev, "Failed to initialize device\n"); - return ret; - } - - ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev, - name, - ctl, - &axi_chip_info, - NULL); - - return PTR_ERR_OR_ZERO(ctl->hdev); + return 0; } static struct platform_driver axi_fan_control_driver = { -- 2.34.1

2 1

[PATCH OLK-5.10] net: atlantic: eliminate double free in error handling logic
by Ziyang Xuan 25 May '24

25 May '24

From: Igor Russkikh <irusskikh(a)marvell.com> mainline inclusion from mainline-v6.8-rc1 commit b3cb7a830a24527877b0bc900b9bd74a96aea928 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q919 CVE: CVE-2023-52664 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error. Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member. Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer. Signed-off-by: Igor Russkikh <irusskikh(a)marvell.com> Link: https://lore.kernel.org/r/20231213095044.23146-1-irusskikh@marvell.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/aquantia/atlantic/aq_ring.h drivers/net/ethernet/aquantia/atlantic/aq_ring.c drivers/net/ethernet/aquantia/atlantic/aq_vec.c [The version does not include commit 0d14657f4083.] Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- .../net/ethernet/aquantia/atlantic/aq_ptp.c | 28 +++------ .../net/ethernet/aquantia/atlantic/aq_ring.c | 61 +++++-------------- .../net/ethernet/aquantia/atlantic/aq_ring.h | 24 ++++---- .../net/ethernet/aquantia/atlantic/aq_vec.c | 16 ++--- 4 files changed, 45 insertions(+), 84 deletions(-) diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c index e54357f02205..02b3f67e07b8 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c @@ -953,8 +953,6 @@ int aq_ptp_ring_alloc(struct aq_nic_s *aq_nic) { struct aq_ptp_s *aq_ptp = aq_nic->aq_ptp; unsigned int tx_ring_idx, rx_ring_idx; - struct aq_ring_s *hwts; - struct aq_ring_s *ring; int err; if (!aq_ptp) @@ -962,29 +960,23 @@ int aq_ptp_ring_alloc(struct aq_nic_s *aq_nic) tx_ring_idx = aq_ptp_ring_idx(aq_nic->aq_nic_cfg.tc_mode); - ring = aq_ring_tx_alloc(&aq_ptp->ptp_tx, aq_nic, - tx_ring_idx, &aq_nic->aq_nic_cfg); - if (!ring) { - err = -ENOMEM; + err = aq_ring_tx_alloc(&aq_ptp->ptp_tx, aq_nic, + tx_ring_idx, &aq_nic->aq_nic_cfg); + if (err) goto err_exit; - } rx_ring_idx = aq_ptp_ring_idx(aq_nic->aq_nic_cfg.tc_mode); - ring = aq_ring_rx_alloc(&aq_ptp->ptp_rx, aq_nic, - rx_ring_idx, &aq_nic->aq_nic_cfg); - if (!ring) { - err = -ENOMEM; + err = aq_ring_rx_alloc(&aq_ptp->ptp_rx, aq_nic, + rx_ring_idx, &aq_nic->aq_nic_cfg); + if (err) goto err_exit_ptp_tx; - } - hwts = aq_ring_hwts_rx_alloc(&aq_ptp->hwts_rx, aq_nic, PTP_HWST_RING_IDX, - aq_nic->aq_nic_cfg.rxds, - aq_nic->aq_nic_cfg.aq_hw_caps->rxd_size); - if (!hwts) { - err = -ENOMEM; + err = aq_ring_hwts_rx_alloc(&aq_ptp->hwts_rx, aq_nic, PTP_HWST_RING_IDX, + aq_nic->aq_nic_cfg.rxds, + aq_nic->aq_nic_cfg.aq_hw_caps->rxd_size); + if (err) goto err_exit_ptp_rx; - } err = aq_ptp_skb_ring_init(&aq_ptp->skb_ring, aq_nic->aq_nic_cfg.rxds); if (err != 0) { diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c index 3a83241aebb9..a50f40eea778 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c @@ -105,8 +105,8 @@ static int aq_get_rxpages(struct aq_ring_s *self, struct aq_ring_buff_s *rxbuf, return 0; } -static struct aq_ring_s *aq_ring_alloc(struct aq_ring_s *self, - struct aq_nic_s *aq_nic) +static int aq_ring_alloc(struct aq_ring_s *self, + struct aq_nic_s *aq_nic) { int err = 0; @@ -128,46 +128,29 @@ static struct aq_ring_s *aq_ring_alloc(struct aq_ring_s *self, err_exit: if (err < 0) { aq_ring_free(self); - self = NULL; } - return self; + return err; } -struct aq_ring_s *aq_ring_tx_alloc(struct aq_ring_s *self, - struct aq_nic_s *aq_nic, - unsigned int idx, - struct aq_nic_cfg_s *aq_nic_cfg) +int aq_ring_tx_alloc(struct aq_ring_s *self, + struct aq_nic_s *aq_nic, + unsigned int idx, + struct aq_nic_cfg_s *aq_nic_cfg) { - int err = 0; - self->aq_nic = aq_nic; self->idx = idx; self->size = aq_nic_cfg->txds; self->dx_size = aq_nic_cfg->aq_hw_caps->txd_size; - self = aq_ring_alloc(self, aq_nic); - if (!self) { - err = -ENOMEM; - goto err_exit; - } - -err_exit: - if (err < 0) { - aq_ring_free(self); - self = NULL; - } - - return self; + return aq_ring_alloc(self, aq_nic); } -struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self, - struct aq_nic_s *aq_nic, - unsigned int idx, - struct aq_nic_cfg_s *aq_nic_cfg) +int aq_ring_rx_alloc(struct aq_ring_s *self, + struct aq_nic_s *aq_nic, + unsigned int idx, + struct aq_nic_cfg_s *aq_nic_cfg) { - int err = 0; - self->aq_nic = aq_nic; self->idx = idx; self->size = aq_nic_cfg->rxds; @@ -178,22 +161,10 @@ struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self, if (aq_nic_cfg->rxpageorder > self->page_order) self->page_order = aq_nic_cfg->rxpageorder; - self = aq_ring_alloc(self, aq_nic); - if (!self) { - err = -ENOMEM; - goto err_exit; - } - -err_exit: - if (err < 0) { - aq_ring_free(self); - self = NULL; - } - - return self; + return aq_ring_alloc(self, aq_nic); } -struct aq_ring_s * +int aq_ring_hwts_rx_alloc(struct aq_ring_s *self, struct aq_nic_s *aq_nic, unsigned int idx, unsigned int size, unsigned int dx_size) { @@ -211,10 +182,10 @@ aq_ring_hwts_rx_alloc(struct aq_ring_s *self, struct aq_nic_s *aq_nic, GFP_KERNEL); if (!self->dx_ring) { aq_ring_free(self); - return NULL; + return -ENOMEM; } - return self; + return 0; } int aq_ring_init(struct aq_ring_s *self, const enum atl_ring_type ring_type) diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h index 9844d5998b7d..892d48065e1e 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h @@ -167,14 +167,15 @@ static inline unsigned int aq_ring_avail_dx(struct aq_ring_s *self) self->sw_head - self->sw_tail - 1); } -struct aq_ring_s *aq_ring_tx_alloc(struct aq_ring_s *self, - struct aq_nic_s *aq_nic, - unsigned int idx, - struct aq_nic_cfg_s *aq_nic_cfg); -struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self, - struct aq_nic_s *aq_nic, - unsigned int idx, - struct aq_nic_cfg_s *aq_nic_cfg); +int aq_ring_tx_alloc(struct aq_ring_s *self, + struct aq_nic_s *aq_nic, + unsigned int idx, + struct aq_nic_cfg_s *aq_nic_cfg); +int aq_ring_rx_alloc(struct aq_ring_s *self, + struct aq_nic_s *aq_nic, + unsigned int idx, + struct aq_nic_cfg_s *aq_nic_cfg); + int aq_ring_init(struct aq_ring_s *self, const enum atl_ring_type ring_type); void aq_ring_rx_deinit(struct aq_ring_s *self); void aq_ring_free(struct aq_ring_s *self); @@ -188,9 +189,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, int budget); int aq_ring_rx_fill(struct aq_ring_s *self); -struct aq_ring_s *aq_ring_hwts_rx_alloc(struct aq_ring_s *self, - struct aq_nic_s *aq_nic, unsigned int idx, - unsigned int size, unsigned int dx_size); +int aq_ring_hwts_rx_alloc(struct aq_ring_s *self, + struct aq_nic_s *aq_nic, unsigned int idx, + unsigned int size, unsigned int dx_size); + void aq_ring_hwts_rx_free(struct aq_ring_s *self); void aq_ring_hwts_rx_clean(struct aq_ring_s *self, struct aq_nic_s *aq_nic); diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c index 6ab1f3212d24..289cc63e009e 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c @@ -142,23 +142,19 @@ int aq_vec_ring_alloc(struct aq_vec_s *self, struct aq_nic_s *aq_nic, const unsigned int idx_ring = AQ_NIC_CFG_TCVEC2RING(aq_nic_cfg, i, idx); - ring = aq_ring_tx_alloc(&self->ring[i][AQ_VEC_TX_ID], aq_nic, - idx_ring, aq_nic_cfg); - if (!ring) { - err = -ENOMEM; + ring = &self->ring[i][AQ_VEC_TX_ID]; + err = aq_ring_tx_alloc(ring, aq_nic, idx_ring, aq_nic_cfg); + if (err) goto err_exit; - } ++self->tx_rings; aq_nic_set_tx_ring(aq_nic, idx_ring, ring); - ring = aq_ring_rx_alloc(&self->ring[i][AQ_VEC_RX_ID], aq_nic, - idx_ring, aq_nic_cfg); - if (!ring) { - err = -ENOMEM; + ring = &self->ring[i][AQ_VEC_RX_ID]; + err = aq_ring_rx_alloc(ring, aq_nic, idx_ring, aq_nic_cfg); + if (err) goto err_exit; - } ++self->rx_rings; } -- 2.25.1

2 1

[PATCH OLK-5.10] ipv6: Fix infinite recursion in fib6_dump_done().
by Zhengchao Shao 25 May '24

25 May '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v5.10.215 commit fd307f2d91d40fa7bc55df3e2cd1253fabf8a2d6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG76 CVE: CVE-2024-35886 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d21d40605bca7bd5fc23ef03d4c1ca1f48bc2cae upstream. syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1] From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then the response was generated. The following recvmmsg() resumed the dump for IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due to the fault injection. [0] 12:01:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, ... snip ...) recvmmsg(r0, ... snip ...) (fail_nth: 8) Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call of inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3]. syzkaller stopped receiving the response halfway through, and finally netlink_sock_destruct() called nlk_sk(sk)->cb.done(). fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it is still not NULL. fib6_dump_end() rewrites nlk_sk(sk)->cb.done() by nlk_sk(sk)->cb.args[3], but it has the same function, not NULL, calling itself recursively and hitting the stack guard page. To avoid the issue, let's set the destructor after kzalloc(). [0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117) should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153) should_failslab (mm/slub.c:3733) kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992) inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink.c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c:2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034) [1]: BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb) stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events netlink_sock_destruct_work RIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570) Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d980000 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3 RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358 RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000 R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68 FS: 0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <#DF> </#DF> <TASK> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) ... fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/core/sock.c:2177 (discriminator 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:256) Modules linked in: Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20240401211003.25274-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv6/ip6_fib.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index cb8122c33165..23881e5ebb3d 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -644,19 +644,19 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) if (!w) { /* New dump: * - * 1. hook callback destructor. - */ - cb->args[3] = (long)cb->done; - cb->done = fib6_dump_done; - - /* - * 2. allocate and initialize walker. + * 1. allocate and initialize walker. */ w = kzalloc(sizeof(*w), GFP_ATOMIC); if (!w) return -ENOMEM; w->func = fib6_dump_node; cb->args[2] = (long)w; + + /* 2. hook callback destructor. + */ + cb->args[3] = (long)cb->done; + cb->done = fib6_dump_done; + } arg.skb = skb; -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 8d7f48064dc365d3e6bfdf6b71a9561d5aa6d3eb
by kernel test robot 25 May '24

25 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 8d7f48064dc365d3e6bfdf6b71a9561d5aa6d3eb !5484 [OLK-5.10] Add support for Mucse Virtual Function Network Adapter(N500/N210) Unverified Warning (likely false positive, please contact us if interested): Documentation/devicetree/bindings/iio/addac/adi,ad74413r.yaml: ^channel@[0-3]$: Missing additionalProperties/unevaluatedProperties constraint Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml: ^codec(-[0-9]+)?$: Missing additionalProperties/unevaluatedProperties constraint Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-iio-addac-adi-ad74413r.yaml:channel:Missing-additionalProperties-unevaluatedProperties-constraint | `-- Documentation-devicetree-bindings-sound-amlogic-gx-sound-card.yaml:codec(-):Missing-additionalProperties-unevaluatedProperties-constraint `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:common-qp.h-is-included-more-than-once. |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 743m configs tested: 35 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240525 gcc arm64 randconfig-002-20240525 clang arm64 randconfig-003-20240525 gcc arm64 randconfig-004-20240525 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240525 clang x86_64 buildonly-randconfig-002-20240525 gcc x86_64 buildonly-randconfig-003-20240525 gcc x86_64 buildonly-randconfig-004-20240525 gcc x86_64 buildonly-randconfig-005-20240525 gcc x86_64 buildonly-randconfig-006-20240525 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240525 clang x86_64 randconfig-002-20240525 clang x86_64 randconfig-003-20240525 clang x86_64 randconfig-004-20240525 clang x86_64 randconfig-005-20240525 clang x86_64 randconfig-006-20240525 clang x86_64 randconfig-011-20240525 clang x86_64 randconfig-012-20240525 clang x86_64 randconfig-013-20240525 gcc x86_64 randconfig-014-20240525 clang x86_64 randconfig-015-20240525 gcc x86_64 randconfig-016-20240525 clang x86_64 randconfig-071-20240525 gcc x86_64 randconfig-072-20240525 clang x86_64 randconfig-073-20240525 clang x86_64 randconfig-074-20240525 gcc x86_64 randconfig-075-20240525 gcc x86_64 randconfig-076-20240525 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS dde5bc8e6ecba8eecddbef68842609d9ea951a33
by kernel test robot 25 May '24

25 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: dde5bc8e6ecba8eecddbef68842609d9ea951a33 !7811 Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- x86_64-buildonly-randconfig-002-20240524 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-003-20240524 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension `-- x86_64-randconfig-012-20240524 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension elapsed time: 735m configs tested: 25 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240524 gcc arm64 randconfig-002-20240524 gcc arm64 randconfig-003-20240524 gcc arm64 randconfig-004-20240524 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240524 gcc x86_64 buildonly-randconfig-002-20240524 gcc x86_64 buildonly-randconfig-003-20240524 clang x86_64 buildonly-randconfig-004-20240524 gcc x86_64 buildonly-randconfig-005-20240524 gcc x86_64 buildonly-randconfig-006-20240524 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240524 gcc x86_64 randconfig-002-20240524 clang x86_64 randconfig-003-20240524 clang x86_64 randconfig-004-20240524 clang x86_64 randconfig-005-20240524 clang x86_64 randconfig-006-20240524 gcc x86_64 randconfig-011-20240524 gcc x86_64 randconfig-012-20240524 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v2 0/6] Add network relationship for NUMA isolation and consolidation
by Liu Jian 24 May '24

24 May '24

Add network relationship for NUMA isolation and consolidation Eric Dumazet (1): net: initialize net->net_cookie at netns setup Liu Jian (4): net: fix kabi breakage in struct net net: add one bpf prog type for network numa relationship net: add some bpf hooks in tcp stack for network numa relationship config: Add new config entry to default config file to fix CI warning Martynas Pumputis (1): net: retrieve netns cookie via getsocketopt arch/alpha/include/uapi/asm/socket.h | 2 + arch/mips/include/uapi/asm/socket.h | 2 + arch/parisc/include/uapi/asm/socket.h | 2 + arch/sparc/include/uapi/asm/socket.h | 2 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/bpf_types.h | 4 + include/linux/filter.h | 68 ++++++ include/linux/skbuff.h | 4 + include/net/net_namespace.h | 8 +- include/net/net_rship.h | 329 ++++++++++++++++++++++++++ include/net/sock.h | 4 + include/uapi/asm-generic/socket.h | 2 + include/uapi/linux/bpf.h | 23 ++ init/Kconfig | 1 + kernel/bpf/syscall.c | 19 ++ net/Kconfig | 6 + net/core/dev.c | 4 + net/core/filter.c | 218 ++++++++++++++++- net/core/net_namespace.c | 19 +- net/core/skbuff.c | 17 +- net/core/sock.c | 28 +++ net/core/sysctl_net_core.c | 18 ++ net/ipv4/tcp.c | 6 + net/ipv4/tcp_output.c | 3 + tools/bpf/bpftool/prog.c | 5 + tools/include/uapi/linux/bpf.h | 27 +++ tools/lib/bpf/libbpf.c | 8 + tools/lib/bpf/libbpf_probes.c | 1 + 28 files changed, 806 insertions(+), 25 deletions(-) create mode 100644 include/net/net_rship.h -- 2.34.1

2 7

[PATCH openEuler-1.0-LTS] dm rq: don't queue request to blk-mq during DM suspend
by Li Lingfeng 24 May '24

24 May '24

From: Ming Lei <ming.lei(a)redhat.com> mainline inclusion from mainline-v5.15-rc6 commit commit b4459b11e84092658fa195a2587aff3b9637f0e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RD8R CVE: CVE-2021-47498 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… b4459b11e84092658fa195a2587aff3b9637f0e7 -------------------------------- DM uses blk-mq's quiesce/unquiesce to stop/start device mapper queue. But blk-mq's unquiesce may come from outside events, such as elevator switch, updating nr_requests or others, and request may come during suspend, so simply ask for blk-mq to requeue it. Fixes one kernel panic issue when running updating nr_requests and dm-mpath suspend/resume stress test. Cc: stable(a)vger.kernel.org Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)redhat.com> Conflicts: drivers/md/dm-rq.c [Commit fa247089de99 ("dm: requeue IO if mapping table not yet available") has been applied in hulk code before while it was applied after this patch in mainline] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-rq.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c index 288064e94e52..fc4eaed2d986 100644 --- a/drivers/md/dm-rq.c +++ b/drivers/md/dm-rq.c @@ -750,6 +750,14 @@ static blk_status_t dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx, struct mapped_device *md = tio->md; struct dm_target *ti = md->immutable_target; + /* + * blk-mq's unquiesce may come from outside events, such as + * elevator switch, updating nr_requests or others, and request may + * come during suspend, so simply ask for blk-mq to requeue it. + */ + if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags))) + return BLK_STS_RESOURCE; + if (unlikely(!ti)) { int srcu_idx; struct dm_table *map; -- 2.31.1

2 1

[PATCH OLK-5.10 0/5] Add network relationship for NUMA isolation and consolidation
by Liu Jian 24 May '24

24 May '24

Add network relationship for NUMA isolation and consolidation. Eric Dumazet (1): net: initialize net->net_cookie at netns setup Liu Jian (3): net: fix kabi breakage in struct net net: add one bpf prog type for network numa relationship net: add some bpf hooks in tcp stack for network numa relationship Martynas Pumputis (1): net: retrieve netns cookie via getsocketopt arch/alpha/include/uapi/asm/socket.h | 2 + arch/mips/include/uapi/asm/socket.h | 2 + arch/parisc/include/uapi/asm/socket.h | 2 + arch/sparc/include/uapi/asm/socket.h | 2 + include/linux/bpf_types.h | 4 + include/linux/filter.h | 67 ++++++ include/linux/skbuff.h | 4 + include/net/net_namespace.h | 8 +- include/net/net_rship.h | 329 ++++++++++++++++++++++++++ include/net/sock.h | 4 + include/uapi/asm-generic/socket.h | 2 + include/uapi/linux/bpf.h | 23 ++ init/Kconfig | 1 + kernel/bpf/syscall.c | 19 ++ net/Kconfig | 6 + net/core/dev.c | 4 + net/core/filter.c | 218 ++++++++++++++++- net/core/net_namespace.c | 19 +- net/core/skbuff.c | 17 +- net/core/sock.c | 28 +++ net/core/sysctl_net_core.c | 18 ++ net/ipv4/tcp.c | 6 + net/ipv4/tcp_output.c | 3 + tools/bpf/bpftool/prog.c | 5 + tools/include/uapi/linux/bpf.h | 27 +++ tools/lib/bpf/libbpf.c | 8 + tools/lib/bpf/libbpf_probes.c | 1 + 27 files changed, 804 insertions(+), 25 deletions(-) create mode 100644 include/net/net_rship.h -- 2.34.1

2 6

[PATCH OLK-5.10 v3 0/2] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
by Yipeng Zou 24 May '24

24 May '24

It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. Yipeng Zou (2): Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED" sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/5] Add network relationship for NUMA isolation and consolidation
by Liu Jian 24 May '24

24 May '24

Add network relationship for NUMA isolation and consolidation. Eric Dumazet (1): net: initialize net->net_cookie at netns setup Liu Jian (3): net: fix kabi breakage in struct net net: add one bpf prog type for network numa relationship net: add some bpf hooks in tcp stack for network numa relationship Martynas Pumputis (1): net: retrieve netns cookie via getsocketopt arch/alpha/include/uapi/asm/socket.h | 2 + arch/mips/include/uapi/asm/socket.h | 2 + arch/parisc/include/uapi/asm/socket.h | 2 + arch/sparc/include/uapi/asm/socket.h | 2 + include/linux/bpf_types.h | 4 + include/linux/filter.h | 67 ++++++ include/linux/skbuff.h | 4 + include/net/net_namespace.h | 8 +- include/net/net_rship.h | 329 ++++++++++++++++++++++++++ include/net/sock.h | 4 + include/uapi/asm-generic/socket.h | 2 + include/uapi/linux/bpf.h | 23 ++ init/Kconfig | 1 + kernel/bpf/syscall.c | 19 ++ net/Kconfig | 6 + net/core/dev.c | 4 + net/core/filter.c | 218 ++++++++++++++++- net/core/net_namespace.c | 19 +- net/core/skbuff.c | 17 +- net/core/sock.c | 28 +++ net/core/sysctl_net_core.c | 18 ++ net/ipv4/tcp.c | 6 + net/ipv4/tcp_output.c | 3 + tools/bpf/bpftool/prog.c | 5 + tools/include/uapi/linux/bpf.h | 27 +++ tools/lib/bpf/libbpf.c | 8 + tools/lib/bpf/libbpf_probes.c | 1 + 27 files changed, 804 insertions(+), 25 deletions(-) create mode 100644 include/net/net_rship.h -- 2.34.1

2 6

[PATCH openEuler-22.03-LTS-SP1] media: vidtv: psi: Add check for kstrdup
by Cai Xinchen 24 May '24

24 May '24

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v5.10.201 commit 3387490c89b10aeb4e71d78b65dbc9ba4b2385b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFIR CVE: CVE-2023-52844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76a2c5df6ca8bd8ada45e953b8c72b746f42918d ] Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: 7a7899f6f58e ("media: vidtv: psi: Implement an Event Information Table (EIT)") Fixes: c2f78f0cb294 ("media: vidtv: psi: add a Network Information Table (NIT)") Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/media/test-drivers/vidtv/vidtv_psi.c | 45 +++++++++++++++++--- 1 file changed, 40 insertions(+), 5 deletions(-) diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.c b/drivers/media/test-drivers/vidtv/vidtv_psi.c index 1724bb485e67..1726e76f0106 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_psi.c +++ b/drivers/media/test-drivers/vidtv/vidtv_psi.c @@ -308,16 +308,29 @@ struct vidtv_psi_desc_service *vidtv_psi_service_desc_init(struct vidtv_psi_desc desc->service_name_len = service_name_len; - if (service_name && service_name_len) + if (service_name && service_name_len) { desc->service_name = kstrdup(service_name, GFP_KERNEL); + if (!desc->service_name) + goto free_desc; + } desc->provider_name_len = provider_name_len; - if (provider_name && provider_name_len) + if (provider_name && provider_name_len) { desc->provider_name = kstrdup(provider_name, GFP_KERNEL); + if (!desc->provider_name) + goto free_desc_service_name; + } vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc); return desc; + +free_desc_service_name: + if (service_name && service_name_len) + kfree(desc->service_name); +free_desc: + kfree(desc); + return NULL; } struct vidtv_psi_desc_registration @@ -362,8 +375,13 @@ struct vidtv_psi_desc_network_name desc->length = network_name_len; - if (network_name && network_name_len) + if (network_name && network_name_len) { desc->network_name = kstrdup(network_name, GFP_KERNEL); + if (!desc->network_name) { + kfree(desc); + return NULL; + } + } vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc); return desc; @@ -449,15 +467,32 @@ struct vidtv_psi_desc_short_event iso_language_code = "eng"; desc->iso_language_code = kstrdup(iso_language_code, GFP_KERNEL); + if (!desc->iso_language_code) + goto free_desc; - if (event_name && event_name_len) + if (event_name && event_name_len) { desc->event_name = kstrdup(event_name, GFP_KERNEL); + if (!desc->event_name) + goto free_desc_language_code; + } - if (text && text_len) + if (text && text_len) { desc->text = kstrdup(text, GFP_KERNEL); + if (!desc->text) + goto free_desc_event_name; + } vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc); return desc; + +free_desc_event_name: + if (event_name && event_name_len) + kfree(desc->event_name); +free_desc_language_code: + kfree(desc->iso_language_code); +free_desc: + kfree(desc); + return NULL; } struct vidtv_psi_desc *vidtv_psi_desc_clone(struct vidtv_psi_desc *desc) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] media: vidtv: psi: Add check for kstrdup
by Cai Xinchen 24 May '24

24 May '24

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v5.10.201 commit 3387490c89b10aeb4e71d78b65dbc9ba4b2385b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFIR CVE: CVE-2023-52844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76a2c5df6ca8bd8ada45e953b8c72b746f42918d ] Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: 7a7899f6f58e ("media: vidtv: psi: Implement an Event Information Table (EIT)") Fixes: c2f78f0cb294 ("media: vidtv: psi: add a Network Information Table (NIT)") Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/media/test-drivers/vidtv/vidtv_psi.c | 45 +++++++++++++++++--- 1 file changed, 40 insertions(+), 5 deletions(-) diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.c b/drivers/media/test-drivers/vidtv/vidtv_psi.c index 1724bb485e67..1726e76f0106 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_psi.c +++ b/drivers/media/test-drivers/vidtv/vidtv_psi.c @@ -308,16 +308,29 @@ struct vidtv_psi_desc_service *vidtv_psi_service_desc_init(struct vidtv_psi_desc desc->service_name_len = service_name_len; - if (service_name && service_name_len) + if (service_name && service_name_len) { desc->service_name = kstrdup(service_name, GFP_KERNEL); + if (!desc->service_name) + goto free_desc; + } desc->provider_name_len = provider_name_len; - if (provider_name && provider_name_len) + if (provider_name && provider_name_len) { desc->provider_name = kstrdup(provider_name, GFP_KERNEL); + if (!desc->provider_name) + goto free_desc_service_name; + } vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc); return desc; + +free_desc_service_name: + if (service_name && service_name_len) + kfree(desc->service_name); +free_desc: + kfree(desc); + return NULL; } struct vidtv_psi_desc_registration @@ -362,8 +375,13 @@ struct vidtv_psi_desc_network_name desc->length = network_name_len; - if (network_name && network_name_len) + if (network_name && network_name_len) { desc->network_name = kstrdup(network_name, GFP_KERNEL); + if (!desc->network_name) { + kfree(desc); + return NULL; + } + } vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc); return desc; @@ -449,15 +467,32 @@ struct vidtv_psi_desc_short_event iso_language_code = "eng"; desc->iso_language_code = kstrdup(iso_language_code, GFP_KERNEL); + if (!desc->iso_language_code) + goto free_desc; - if (event_name && event_name_len) + if (event_name && event_name_len) { desc->event_name = kstrdup(event_name, GFP_KERNEL); + if (!desc->event_name) + goto free_desc_language_code; + } - if (text && text_len) + if (text && text_len) { desc->text = kstrdup(text, GFP_KERNEL); + if (!desc->text) + goto free_desc_event_name; + } vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc); return desc; + +free_desc_event_name: + if (event_name && event_name_len) + kfree(desc->event_name); +free_desc_language_code: + kfree(desc->iso_language_code); +free_desc: + kfree(desc); + return NULL; } struct vidtv_psi_desc *vidtv_psi_desc_clone(struct vidtv_psi_desc *desc) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] media: vidtv: psi: Add check for kstrdup
by Cai Xinchen 24 May '24

24 May '24

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v5.10.201 commit 3387490c89b10aeb4e71d78b65dbc9ba4b2385b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFIR CVE: CVE-2023-52844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76a2c5df6ca8bd8ada45e953b8c72b746f42918d ] Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: 7a7899f6f58e ("media: vidtv: psi: Implement an Event Information Table (EIT)") Fixes: c2f78f0cb294 ("media: vidtv: psi: add a Network Information Table (NIT)") Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/media/test-drivers/vidtv/vidtv_psi.c | 45 +++++++++++++++++--- 1 file changed, 40 insertions(+), 5 deletions(-) diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.c b/drivers/media/test-drivers/vidtv/vidtv_psi.c index 1724bb485e67..1726e76f0106 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_psi.c +++ b/drivers/media/test-drivers/vidtv/vidtv_psi.c @@ -308,16 +308,29 @@ struct vidtv_psi_desc_service *vidtv_psi_service_desc_init(struct vidtv_psi_desc desc->service_name_len = service_name_len; - if (service_name && service_name_len) + if (service_name && service_name_len) { desc->service_name = kstrdup(service_name, GFP_KERNEL); + if (!desc->service_name) + goto free_desc; + } desc->provider_name_len = provider_name_len; - if (provider_name && provider_name_len) + if (provider_name && provider_name_len) { desc->provider_name = kstrdup(provider_name, GFP_KERNEL); + if (!desc->provider_name) + goto free_desc_service_name; + } vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc); return desc; + +free_desc_service_name: + if (service_name && service_name_len) + kfree(desc->service_name); +free_desc: + kfree(desc); + return NULL; } struct vidtv_psi_desc_registration @@ -362,8 +375,13 @@ struct vidtv_psi_desc_network_name desc->length = network_name_len; - if (network_name && network_name_len) + if (network_name && network_name_len) { desc->network_name = kstrdup(network_name, GFP_KERNEL); + if (!desc->network_name) { + kfree(desc); + return NULL; + } + } vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc); return desc; @@ -449,15 +467,32 @@ struct vidtv_psi_desc_short_event iso_language_code = "eng"; desc->iso_language_code = kstrdup(iso_language_code, GFP_KERNEL); + if (!desc->iso_language_code) + goto free_desc; - if (event_name && event_name_len) + if (event_name && event_name_len) { desc->event_name = kstrdup(event_name, GFP_KERNEL); + if (!desc->event_name) + goto free_desc_language_code; + } - if (text && text_len) + if (text && text_len) { desc->text = kstrdup(text, GFP_KERNEL); + if (!desc->text) + goto free_desc_event_name; + } vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc); return desc; + +free_desc_event_name: + if (event_name && event_name_len) + kfree(desc->event_name); +free_desc_language_code: + kfree(desc->iso_language_code); +free_desc: + kfree(desc); + return NULL; } struct vidtv_psi_desc *vidtv_psi_desc_clone(struct vidtv_psi_desc *desc) -- 2.34.1

2 1

[PATCH OLK-5.10 v3 0/2] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
by Yipeng Zou 24 May '24

24 May '24

It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. Yipeng Zou (2): Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED" sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10 v3 0/2] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
by Yipeng Zou 24 May '24

24 May '24

It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. Yipeng Zou (2): Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED" sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] sched/rt: Fix rt_runtime leaks with cpu hotplug and RT_RUNTIME_SHARE
by Zhao Wenhui 24 May '24

24 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RZC8 -------------------------------- When using cgroup rt_bandwidth with RT_RUNTIME_SHARE, if there are cpu hotplug and cpu.rt_runtime_us changing concurrently, the warning in __disable_runtime may occur: [ 991.697692] WARNING: CPU: 0 PID: 49573 at kernel/sched/rt.c:802 rq_offline_rt+0x24d/0x260 [ 991.697795] CPU: 0 PID: 49573 Comm: kworker/1:0 Kdump: loaded Not tainted 6.9.0-rc1+ #4 [ 991.697800] Workqueue: events cpuset_hotplug_workfn [ 991.697803] RIP: 0010:rq_offline_rt+0x24d/0x260 [ 991.697825] Call Trace: [ 991.697827] <TASK> [ 991.697858] set_rq_offline.part.125+0x2d/0x70 [ 991.697864] rq_attach_root+0xda/0x110 [ 991.697867] cpu_attach_domain+0x433/0x860 [ 991.697880] partition_sched_domains_locked+0x2a8/0x3a0 [ 991.697885] rebuild_sched_domains_locked+0x608/0x800 [ 991.697895] rebuild_sched_domains+0x1b/0x30 [ 991.697897] cpuset_hotplug_workfn+0x4b6/0x1160 [ 991.697909] process_scheduled_works+0xad/0x430 [ 991.697917] worker_thread+0x105/0x270 [ 991.697922] kthread+0xde/0x110 [ 991.697928] ret_from_fork+0x2d/0x50 [ 991.697935] ret_from_fork_asm+0x11/0x20 [ 991.697940] </TASK> [ 991.697941] ---[ end trace 0000000000000000 ]--- That's how it happens: CPU0 CPU1 ----- ----- set_rq_offline(rq) __disable_runtime(rq) (1) tg_set_rt_bandwidth (2) do_balance_runtime (3) set_rq_online(rq) __enable_runtime(rq) (4) In step(1) rt_rq->rt_runtime is set to RUNTIME_INF, and this rtrq's runtime is not supposed to change until its rq gets online. However, in step(2) tg_set_rt_bandwidth can set rt_rq->rt_runtime to rt_bandwidth.rt_runtime. Then, in step(3) rtrq's runtime is not RUNTIME_INF, so others can borrow rt_runtime from it. Finally, in step(4) the rq gets online, so its rtrq's runtime is set to rt_bandwidth.rt_runtime again, and Since then the total rt_runtime in the domain is increased by this way. After these steps, when offline cpu, rebuilding the sched_domain will offline all rq, and the last rq will find the rt_runtime is increased but nowhere to return. To fix this, we can add a state RUNTIME_DISABLED, which means the runtime is disabled and should not be used. When the rq is offline, we can set its rtrq's rt_runtime to RUNTIME_DISABLED, and when rq online, reset it. And in tg_set_rt_bandwidth and do_balance_runtime, never change a disabled rt_runtime. Fixes: 7def2be1dc67 ("sched: fix hotplug cpus on ia64") Closes: https://lore.kernel.org/all/47b4a790-9a27-2fc5-f2aa-f9981c6da015@huawei.com/ Co-developed-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- kernel/sched/rt.c | 15 +++++++++------ kernel/sched/sched.h | 5 +++++ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 58364f489529..9093fa9f8fdc 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -664,7 +664,8 @@ static void do_balance_runtime(struct rt_rq *rt_rq) * or __disable_runtime() below sets a specific rq to inf to * indicate its been disabled and disalow stealing. */ - if (iter->rt_runtime == RUNTIME_INF) + if (iter->rt_runtime == RUNTIME_INF || + iter->rt_runtime == RUNTIME_DISABLED) goto next; /* @@ -735,7 +736,9 @@ static void __disable_runtime(struct rq *rq) /* * Can't reclaim from ourselves or disabled runqueues. */ - if (iter == rt_rq || iter->rt_runtime == RUNTIME_INF) + if (iter == rt_rq || + iter->rt_runtime == RUNTIME_INF || + iter->rt_runtime == RUNTIME_DISABLED) continue; raw_spin_lock(&iter->rt_runtime_lock); @@ -761,10 +764,9 @@ static void __disable_runtime(struct rq *rq) WARN_ON_ONCE(want); balanced: /* - * Disable all the borrow logic by pretending we have inf - * runtime - in which case borrowing doesn't make sense. + * Disable all the borrow logic by marking runtime disabled. */ - rt_rq->rt_runtime = RUNTIME_INF; + rt_rq->rt_runtime = RUNTIME_DISABLED; rt_rq->rt_throttled = 0; raw_spin_unlock(&rt_rq->rt_runtime_lock); raw_spin_unlock(&rt_b->rt_runtime_lock); @@ -2555,7 +2557,8 @@ static int tg_set_rt_bandwidth(struct task_group *tg, struct rt_rq *rt_rq = tg->rt_rq[i]; raw_spin_lock(&rt_rq->rt_runtime_lock); - rt_rq->rt_runtime = rt_runtime; + if (rt_rq->rt_runtime != RUNTIME_DISABLED) + rt_rq->rt_runtime = rt_runtime; raw_spin_unlock(&rt_rq->rt_runtime_lock); } raw_spin_unlock_irq(&tg->rt_bandwidth.rt_runtime_lock); diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 4dd0e4de0aab..80e9d254ab7c 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -163,6 +163,11 @@ static inline void cpu_load_update_active(struct rq *this_rq) { } */ #define RUNTIME_INF ((u64)~0ULL) +/* + * Single value that denotes runtime is disabled, and it should not be used. + */ +#define RUNTIME_DISABLED (-2ULL) + static inline int idle_policy(int policy) { return policy == SCHED_IDLE; -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/2] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
by Yipeng Zou 24 May '24

24 May '24

It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. Yipeng Zou (2): Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED" sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] sched/rt: Fix rt_runtime leaks with cpu hotplug and RT_RUNTIME_SHARE
by Zhao Wenhui 24 May '24

24 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RZC8 -------------------------------- When using cgroup rt_bandwidth with RT_RUNTIME_SHARE, if there are cpu hotplug and cpu.rt_runtime_us changing concurrently, the warning in __disable_runtime may occur: [ 991.697692] WARNING: CPU: 0 PID: 49573 at kernel/sched/rt.c:802 rq_offline_rt+0x24d/0x260 [ 991.697795] CPU: 0 PID: 49573 Comm: kworker/1:0 Kdump: loaded Not tainted 6.9.0-rc1+ #4 [ 991.697800] Workqueue: events cpuset_hotplug_workfn [ 991.697803] RIP: 0010:rq_offline_rt+0x24d/0x260 [ 991.697825] Call Trace: [ 991.697827] <TASK> [ 991.697858] set_rq_offline.part.125+0x2d/0x70 [ 991.697864] rq_attach_root+0xda/0x110 [ 991.697867] cpu_attach_domain+0x433/0x860 [ 991.697880] partition_sched_domains_locked+0x2a8/0x3a0 [ 991.697885] rebuild_sched_domains_locked+0x608/0x800 [ 991.697895] rebuild_sched_domains+0x1b/0x30 [ 991.697897] cpuset_hotplug_workfn+0x4b6/0x1160 [ 991.697909] process_scheduled_works+0xad/0x430 [ 991.697917] worker_thread+0x105/0x270 [ 991.697922] kthread+0xde/0x110 [ 991.697928] ret_from_fork+0x2d/0x50 [ 991.697935] ret_from_fork_asm+0x11/0x20 [ 991.697940] </TASK> [ 991.697941] ---[ end trace 0000000000000000 ]--- That's how it happens: CPU0 CPU1 ----- ----- set_rq_offline(rq) __disable_runtime(rq) (1) tg_set_rt_bandwidth (2) do_balance_runtime (3) set_rq_online(rq) __enable_runtime(rq) (4) In step(1) rt_rq->rt_runtime is set to RUNTIME_INF, and this rtrq's runtime is not supposed to change until its rq gets online. However, in step(2) tg_set_rt_bandwidth can set rt_rq->rt_runtime to rt_bandwidth.rt_runtime. Then, in step(3) rtrq's runtime is not RUNTIME_INF, so others can borrow rt_runtime from it. Finally, in step(4) the rq gets online, so its rtrq's runtime is set to rt_bandwidth.rt_runtime again, and Since then the total rt_runtime in the domain is increased by this way. After these steps, when offline cpu, rebuilding the sched_domain will offline all rq, and the last rq will find the rt_runtime is increased but nowhere to return. To fix this, we can add a state RUNTIME_DISABLED, which means the runtime is disabled and should not be used. When the rq is offline, we can set its rtrq's rt_runtime to RUNTIME_DISABLED, and when rq online, reset it. And in tg_set_rt_bandwidth and do_balance_runtime, never change a disabled rt_runtime. Fixes: 7def2be1dc67 ("sched: fix hotplug cpus on ia64") Closes: https://lore.kernel.org/all/47b4a790-9a27-2fc5-f2aa-f9981c6da015@huawei.com/ Co-developed-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- kernel/sched/fair.c.rej | 52 +++++++++++++++++++++++++++++++++++++++++ kernel/sched/rt.c | 3 ++- kernel/sched/rt.c.rej | 11 +++++++++ 3 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 kernel/sched/fair.c.rej create mode 100644 kernel/sched/rt.c.rej diff --git a/kernel/sched/fair.c.rej b/kernel/sched/fair.c.rej new file mode 100644 index 000000000000..7275501f1bf3 --- /dev/null +++ b/kernel/sched/fair.c.rej @@ -0,0 +1,52 @@ +diff a/kernel/sched/fair.c b/kernel/sched/fair.c (rejected hunks) +@@ -161,9 +161,12 @@ int __weak arch_asym_cpu_priority(int cpu) + #endif + + #ifdef CONFIG_QOS_SCHED +- ++struct qos_overload_checker { ++ struct hrtimer qos_overload_timer; ++ unsigned int cpu; ++}; + static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, qos_throttled_cfs_rq); +-static DEFINE_PER_CPU_SHARED_ALIGNED(struct hrtimer, qos_overload_timer); ++static DEFINE_PER_CPU_SHARED_ALIGNED(struct qos_overload_checker, qos_overload_checker); + static DEFINE_PER_CPU(int, qos_cpu_overload); + unsigned int sysctl_overload_detect_period = 5000; /* in ms */ + unsigned int sysctl_offline_wait_interval = 100; /* in ms */ +@@ -7951,14 +7954,17 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ + } + + #ifdef CONFIG_QOS_SCHED ++static struct hrtimer *qos_timer(int cpu) { ++ return &(per_cpu_ptr(&qos_overload_checker, cpu)->qos_overload_timer); ++} + static inline bool qos_timer_is_activated(int cpu) + { +- return hrtimer_active(per_cpu_ptr(&qos_overload_timer, cpu)); ++ return hrtimer_active(qos_timer(cpu)); + } + + static inline void cancel_qos_timer(int cpu) + { +- hrtimer_cancel(per_cpu_ptr(&qos_overload_timer, cpu)); ++ hrtimer_cancel(qos_timer(cpu)); + } + + static inline bool is_offline_task(struct task_struct *p) +@@ -8183,10 +8189,13 @@ void sched_qos_offline_wait(void) + static enum hrtimer_restart qos_overload_timer_handler(struct hrtimer *timer) + { + struct rq_flags rf; +- struct rq *rq = this_rq(); ++ struct qos_overload_checker *checker = container_of(timer, ++ struct qos_overload_checker, qos_overload_timer); ++ int cpu = checker->cpu; ++ struct rq *rq = cpu_rq(cpu); + + rq_lock_irqsave(rq, &rf); +- __unthrottle_qos_cfs_rqs(smp_processor_id()); ++ __unthrottle_qos_cfs_rqs(cpu); + __this_cpu_write(qos_cpu_overload, 1); + + /* Determine whether we need to wake up potentially idle CPU. */ diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 58364f489529..bb1f76264686 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -664,7 +664,8 @@ static void do_balance_runtime(struct rt_rq *rt_rq) * or __disable_runtime() below sets a specific rq to inf to * indicate its been disabled and disalow stealing. */ - if (iter->rt_runtime == RUNTIME_INF) + if (iter->rt_runtime == RUNTIME_INF || + iter->rt_runtime == RUNTIME_DISABLED) goto next; /* diff --git a/kernel/sched/rt.c.rej b/kernel/sched/rt.c.rej new file mode 100644 index 000000000000..710818859059 --- /dev/null +++ b/kernel/sched/rt.c.rej @@ -0,0 +1,11 @@ +diff a/kernel/sched/rt.c b/kernel/sched/rt.c (rejected hunks) +@@ -704,7 +704,8 @@ static void do_balance_runtime(struct rt_rq *rt_rq) + * or __disable_runtime() below sets a specific rq to inf to + * indicate its been disabled and disallow stealing. + */ +- if (iter->rt_runtime == RUNTIME_INF) ++ if (iter->rt_runtime == RUNTIME_INF || ++ iter->rt_runtime == RUNTIME_DISABLED) + goto next; + + /* -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/2] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
by Yipeng Zou 24 May '24

24 May '24

It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. Yipeng Zou (2): Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED" sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
by Xiongfeng Wang 24 May '24

24 May '24

From: Guchun Chen <guchun.chen(a)amd.com> mainline inclusion from mainline-v5.15-rc5 commit 248b061689a40f4fed05252ee2c89f87cf26d7d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4NB CVE: CVE-2021-47421 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock. To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen. Fixes: c9a6b82f45e2 ("drm/amdgpu: Implement DPC recovery") Suggested-by: Andrey Grodzovsky <andrey.grodzovsky(a)amd.com> Signed-off-by: Guchun Chen <guchun.chen(a)amd.com> Reviewed-by: Andrey Grodzovsky <andrey.grodzovsky(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu.h [wangxiongfeng: fix context conflicts in struct amdgpu_device] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h index ff5555353eb4..683bbefc39c1 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h @@ -997,6 +997,7 @@ struct amdgpu_device { bool in_pci_err_recovery; struct pci_saved_state *pci_state; + pci_channel_state_t pci_channel_state; }; static inline struct amdgpu_device *drm_to_adev(struct drm_device *ddev) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index a093f1b27724..eab8909f0988 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -4932,6 +4932,8 @@ pci_ers_result_t amdgpu_pci_error_detected(struct pci_dev *pdev, pci_channel_sta return PCI_ERS_RESULT_DISCONNECT; } + adev->pci_channel_state = state; + switch (state) { case pci_channel_io_normal: return PCI_ERS_RESULT_CAN_RECOVER; @@ -5067,6 +5069,10 @@ void amdgpu_pci_resume(struct pci_dev *pdev) DRM_INFO("PCI error: resume callback!!\n"); + /* Only continue execution for the case of pci_channel_io_frozen */ + if (adev->pci_channel_state != pci_channel_io_frozen) + return; + for (i = 0; i < AMDGPU_MAX_RINGS; ++i) { struct amdgpu_ring *ring = adev->rings[i]; -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1] hwmon: (axi-fan-control) Fix possible NULL pointer dereference
by Wenyu Huang 24 May '24

24 May '24

From: Dragos Bogdan <dragos.bogdan(a)analog.com> stable inclusion from stable-v5.10.201 commit 7d870088db4863c514a7f8751cd593751983029a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RL31 CVE: CVE-2023-52863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a5b3370a1d9750eca325292e291c8c7cb8cf2e0 ] axi_fan_control_irq_handler(), dependent on the private axi_fan_control_data structure, might be called before the hwmon device is registered. That will cause an "Unable to handle kernel NULL pointer dereference" error. Fixes: 8412b410fa5e ("hwmon: Support ADI Fan Control IP") Signed-off-by: Dragos Bogdan <dragos.bogdan(a)analog.com> Signed-off-by: Nuno Sa <nuno.sa(a)analog.com> Link: https://lore.kernel.org/r/20231025132100.649499-1-nuno.sa@analog.com Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/hwmon/axi-fan-control.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/drivers/hwmon/axi-fan-control.c b/drivers/hwmon/axi-fan-control.c index e3f6b03e6764..0dba67c0054c 100644 --- a/drivers/hwmon/axi-fan-control.c +++ b/drivers/hwmon/axi-fan-control.c @@ -423,6 +423,21 @@ static int axi_fan_control_probe(struct platform_device *pdev) return -ENODEV; } + ret = axi_fan_control_init(ctl, pdev->dev.of_node); + if (ret) { + dev_err(&pdev->dev, "Failed to initialize device\n"); + return ret; + } + + ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev, + name, + ctl, + &axi_chip_info, + axi_fan_control_groups); + + if (IS_ERR(ctl->hdev)) + return PTR_ERR(ctl->hdev); + ctl->irq = platform_get_irq(pdev, 0); if (ctl->irq < 0) return ctl->irq; @@ -436,19 +451,7 @@ static int axi_fan_control_probe(struct platform_device *pdev) return ret; } - ret = axi_fan_control_init(ctl, pdev->dev.of_node); - if (ret) { - dev_err(&pdev->dev, "Failed to initialize device\n"); - return ret; - } - - ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev, - name, - ctl, - &axi_chip_info, - NULL); - - return PTR_ERR_OR_ZERO(ctl->hdev); + return 0; } static struct platform_driver axi_fan_control_driver = { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] crypto: engine - fix crypto_queue backlog handling
by Chen Ridong 24 May '24

24 May '24

*** BLURB HERE *** Olivier Bacon (1): crypto: engine - fix crypto_queue backlog handling crypto/algapi.c | 3 +++ crypto/crypto_engine.c | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS v2] netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
by Xiongfeng Wang 24 May '24

24 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 34a164d2448264b62af82bc0af3d2c83d12d38ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q94J CVE: CVE-2024-27426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e799299aafed417cc1f32adccb2a0e5268b3f6d5 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 82daed1296f5..5189ed68c709 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -460,7 +460,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = - msecs_to_jiffies(sysctl_netrom_transport_maximum_tries); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); nr->t4 = msecs_to_jiffies(sysctl_netrom_transport_busy_delay); nr->idle = -- 2.20.1

2 2

[PATCH OLK-5.10 v2] netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
by Xiongfeng Wang 24 May '24

24 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 34a164d2448264b62af82bc0af3d2c83d12d38ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q94J CVE: CVE-2024-27426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e799299aafed417cc1f32adccb2a0e5268b3f6d5 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 336abc5771fd..33fb5c1a5f49 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -457,7 +457,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = - msecs_to_jiffies(sysctl_netrom_transport_maximum_tries); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); nr->t4 = msecs_to_jiffies(sysctl_netrom_transport_busy_delay); nr->idle = -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
by Xiongfeng Wang 24 May '24

24 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 34a164d2448264b62af82bc0af3d2c83d12d38ac category: bugfix bugzilla: 189268 CVE: CVE-2024-27426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e799299aafed417cc1f32adccb2a0e5268b3f6d5 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 82daed1296f5..5189ed68c709 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -460,7 +460,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = - msecs_to_jiffies(sysctl_netrom_transport_maximum_tries); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); nr->t4 = msecs_to_jiffies(sysctl_netrom_transport_busy_delay); nr->idle = -- 2.20.1

2 1

[PATCH OLK-5.10] netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
by Xiongfeng Wang 24 May '24

24 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 34a164d2448264b62af82bc0af3d2c83d12d38ac category: bugfix bugzilla: 189268 CVE: CVE-2024-27426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e799299aafed417cc1f32adccb2a0e5268b3f6d5 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 336abc5771fd..33fb5c1a5f49 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -457,7 +457,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = - msecs_to_jiffies(sysctl_netrom_transport_maximum_tries); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_maximum_tries)); nr->t4 = msecs_to_jiffies(sysctl_netrom_transport_busy_delay); nr->idle = -- 2.20.1

2 1

[PATCH OLK-5.10 0/1] fix crypto_queue backlog handling
by Chen Ridong 24 May '24

24 May '24

*** BLURB HERE *** Olivier Bacon (1): crypto: engine - fix crypto_queue backlog handling crypto/algapi.c | 3 +++ crypto/crypto_engine.c | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 v2] pstore/platform: Add check for kstrdup
by Wei Li 24 May '24

24 May '24

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v5.10.201 commit bb166bdae1a7d7db30e9be7e6ccaba606debc05f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFKZ CVE: CVE-2023-52869 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a19d48f7c5d57c0f0405a7d4334d1d38fe9d3c1c ] Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: 563ca40ddf40 ("pstore/platform: Switch pstore_info::name to const") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Link: https://lore.kernel.org/r/20230623022706.32125-1-jiasheng@iscas.ac.cn Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wei Li <liwei391(a)huawei.com> --- fs/pstore/platform.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c index ce03c3dbb5c3..d59f13b1fb96 100644 --- a/fs/pstore/platform.c +++ b/fs/pstore/platform.c @@ -558,6 +558,8 @@ static int pstore_write_user_compat(struct pstore_record *record, */ int pstore_register(struct pstore_info *psi) { + char *new_backend; + if (backend && strcmp(backend, psi->name)) { pr_warn("ignoring unexpected backend '%s'\n", psi->name); return -EPERM; @@ -577,11 +579,16 @@ int pstore_register(struct pstore_info *psi) return -EINVAL; } + new_backend = kstrdup(psi->name, GFP_KERNEL); + if (!new_backend) + return -ENOMEM; + mutex_lock(&psinfo_lock); if (psinfo) { pr_warn("backend '%s' already loaded: ignoring '%s'\n", psinfo->name, psi->name); mutex_unlock(&psinfo_lock); + kfree(new_backend); return -EBUSY; } @@ -614,7 +621,7 @@ int pstore_register(struct pstore_info *psi) * Update the module parameter backend, so it is visible * through /sys/module/pstore/parameters/backend */ - backend = kstrdup(psi->name, GFP_KERNEL); + backend = new_backend; pr_info("Registered %s as persistent store backend\n", psi->name); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pstore/platform: Add check for kstrdup
by Wei Li 24 May '24

24 May '24

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v5.10.201 commit bb166bdae1a7d7db30e9be7e6ccaba606debc05f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9DFT4 CVE: CVE-2023-52869 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a19d48f7c5d57c0f0405a7d4334d1d38fe9d3c1c ] Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: 563ca40ddf40 ("pstore/platform: Switch pstore_info::name to const") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Link: https://lore.kernel.org/r/20230623022706.32125-1-jiasheng@iscas.ac.cn Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wei Li <liwei391(a)huawei.com> --- fs/pstore/platform.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c index ce03c3dbb5c3..d59f13b1fb96 100644 --- a/fs/pstore/platform.c +++ b/fs/pstore/platform.c @@ -558,6 +558,8 @@ static int pstore_write_user_compat(struct pstore_record *record, */ int pstore_register(struct pstore_info *psi) { + char *new_backend; + if (backend && strcmp(backend, psi->name)) { pr_warn("ignoring unexpected backend '%s'\n", psi->name); return -EPERM; @@ -577,11 +579,16 @@ int pstore_register(struct pstore_info *psi) return -EINVAL; } + new_backend = kstrdup(psi->name, GFP_KERNEL); + if (!new_backend) + return -ENOMEM; + mutex_lock(&psinfo_lock); if (psinfo) { pr_warn("backend '%s' already loaded: ignoring '%s'\n", psinfo->name, psi->name); mutex_unlock(&psinfo_lock); + kfree(new_backend); return -EBUSY; } @@ -614,7 +621,7 @@ int pstore_register(struct pstore_info *psi) * Update the module parameter backend, so it is visible * through /sys/module/pstore/parameters/backend */ - backend = kstrdup(psi->name, GFP_KERNEL); + backend = new_backend; pr_info("Registered %s as persistent store backend\n", psi->name); -- 2.25.1

2 2