- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-38570
by Zeng Heng 11 Jul '24

11 Jul '24

Andreas Gruenbacher (2): gfs2: Rename sd_{ glock => kill }_wait gfs2: Fix potential glock use-after-free on unmount fs/gfs2/glock.c | 45 ++++++++++++++++++++++++++++++++++++-------- fs/gfs2/glock.h | 1 + fs/gfs2/incore.h | 3 ++- fs/gfs2/lock_dlm.c | 14 ++++++++++++-- fs/gfs2/ops_fstype.c | 5 +++-- fs/gfs2/super.c | 3 --- 6 files changed, 55 insertions(+), 16 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] CVE-2024-38570
by Zeng Heng 11 Jul '24

11 Jul '24

Andreas Gruenbacher (2): gfs2: Rename sd_{ glock => kill }_wait gfs2: Fix potential glock use-after-free on unmount fs/gfs2/glock.c | 45 ++++++++++++++++++++++++++++++++++++-------- fs/gfs2/glock.h | 1 + fs/gfs2/incore.h | 3 ++- fs/gfs2/lock_dlm.c | 14 ++++++++++++-- fs/gfs2/ops_fstype.c | 5 +++-- fs/gfs2/super.c | 3 --- 6 files changed, 55 insertions(+), 16 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] cifs: Fix deadlock in cifs_writepages during reconnect
by Wang Zhaolong 11 Jul '24

11 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAASLU -------------------------------- When multiple processes or threads write to the same file concurrently, if a network disruption occurs during the write operation, it may lead to a deadlock situation as follow: Process 1 (dd) Process 2 (cifsd) Process 3 (cifsiod) cifs_writepages lock_page - [1] wait_on_page_writeback - [2] Waiting for writeback, blocked by [4] wait_on_page_bit cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket - If another process triggers reconnect at this point cifs_reconnect - mid->mid_state updated to MID_RETRY_NEEDED smb2_writev_callback mid_entry->callback() - mid_state leads to wdata->result = -EAGAIN wdata->result = -EAGAIN queue_work(cifsiod_wq, &wdata->work); cifs_writev_complete - work function - Condition satisfied - wdata->result == -EAGAIN cifs_writev_requeue lock_page - [3] Blocked by [1] end_page_writeback - [4] Won't execute, blocked by [3] unlock_page Mainline refactoring patch d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") unlock page while waiting for the writeback to complete, thus avoiding potential deadlocks caused by lock ordering issues during reconnection. Due to the large refactor of the mainline, the patch cannot be backport directly. Therefore, This patch only uses a part of the idea of the mainline patch to fix deadlock. Fixes: c28c89fc43e3 ("cifs: add cifs_async_writev") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/file.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 0b840555a175..e0c10fd93b64 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -2223,6 +2223,7 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, * back from swapper_space to tmpfs file mapping */ +relock_recheck: if (nr_pages == 0) lock_page(page); else if (!trylock_page(page)) @@ -2245,11 +2246,16 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, break; } - if (wbc->sync_mode != WB_SYNC_NONE) - wait_on_page_writeback(page); + if (PageWriteback(page)) { + unlock_page(page); + if (wbc->sync_mode != WB_SYNC_NONE) { + wait_on_page_writeback(page); + goto relock_recheck; + } + break; + } - if (PageWriteback(page) || - !clear_page_dirty_for_io(page)) { + if (!clear_page_dirty_for_io(page)) { unlock_page(page); break; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] cifs: Fix deadlock in cifs_writepages during reconnect
by Wang Zhaolong 11 Jul '24

11 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAASLU -------------------------------- When multiple processes or threads write to the same file concurrently, if a network disruption occurs during the write operation, it may lead to a deadlock situation as follow: Process 1 (dd) Process 2 (cifsd) Process 3 (cifsiod) cifs_writepages lock_page - [1] wait_on_page_writeback - [2] Waiting for writeback, blocked by [4] wait_on_page_bit cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket - If another process triggers reconnect at this point cifs_reconnect - mid->mid_state updated to MID_RETRY_NEEDED smb2_writev_callback mid_entry->callback() - mid_state leads to wdata->result = -EAGAIN wdata->result = -EAGAIN queue_work(cifsiod_wq, &wdata->work); cifs_writev_complete - work function - Condition satisfied - wdata->result == -EAGAIN cifs_writev_requeue lock_page - [3] Blocked by [1] end_page_writeback - [4] Won't execute, blocked by [3] unlock_page Mainline refactoring patch d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") unlock page while waiting for the writeback to complete, thus avoiding potential deadlocks caused by lock ordering issues during reconnection. Due to the large refactor of the mainline, the patch cannot be backport directly. Therefore, This patch only uses a part of the idea of the mainline patch to fix deadlock. Fixes: c28c89fc43e3 ("cifs: add cifs_async_writev") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/file.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 0b840555a175..e0c10fd93b64 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -2223,6 +2223,7 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, * back from swapper_space to tmpfs file mapping */ +relock_recheck: if (nr_pages == 0) lock_page(page); else if (!trylock_page(page)) @@ -2245,11 +2246,16 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, break; } - if (wbc->sync_mode != WB_SYNC_NONE) - wait_on_page_writeback(page); + if (PageWriteback(page)) { + unlock_page(page); + if (wbc->sync_mode != WB_SYNC_NONE) { + wait_on_page_writeback(page); + goto relock_recheck; + } + break; + } - if (PageWriteback(page) || - !clear_page_dirty_for_io(page)) { + if (!clear_page_dirty_for_io(page)) { unlock_page(page); break; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] cifs: Fix deadlock in cifs_writepages during reconnect
by Wang Zhaolong 11 Jul '24

11 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAASLU -------------------------------- When multiple processes or threads write to the same file concurrently, if a network disruption occurs during the write operation, it may lead to a deadlock situation as follow: Process 1 (dd) Process 2 (cifsd) Process 3 (cifsiod) cifs_writepages lock_page - [1] wait_on_page_writeback - [2] Waiting for writeback, blocked by [4] wait_on_page_bit cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket - If another process triggers reconnect at this point cifs_reconnect - mid->mid_state updated to MID_RETRY_NEEDED smb2_writev_callback mid_entry->callback() - mid_state leads to wdata->result = -EAGAIN wdata->result = -EAGAIN queue_work(cifsiod_wq, &wdata->work); cifs_writev_complete - work function - Condition satisfied - wdata->result == -EAGAIN cifs_writev_requeue lock_page - [3] Blocked by [1] end_page_writeback - [4] Won't execute, blocked by [3] unlock_page Mainline refactoring patch d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") unlock page while waiting for the writeback to complete, thus avoiding potential deadlocks caused by lock ordering issues during reconnection. Due to the large refactor of the mainline, the patch cannot be backport directly. Therefore, This patch only uses a part of the idea of the mainline patch to fix deadlock. Fixes: c28c89fc43e3 ("cifs: add cifs_async_writev") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/file.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 0b840555a175..e0c10fd93b64 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -2223,6 +2223,7 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, * back from swapper_space to tmpfs file mapping */ +relock_recheck: if (nr_pages == 0) lock_page(page); else if (!trylock_page(page)) @@ -2245,11 +2246,16 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, break; } - if (wbc->sync_mode != WB_SYNC_NONE) - wait_on_page_writeback(page); + if (PageWriteback(page)) { + unlock_page(page); + if (wbc->sync_mode != WB_SYNC_NONE) { + wait_on_page_writeback(page); + goto relock_recheck; + } + break; + } - if (PageWriteback(page) || - !clear_page_dirty_for_io(page)) { + if (!clear_page_dirty_for_io(page)) { unlock_page(page); break; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] usb: musb: tusb6010: check return value after calling platform_get_resource()
by Wang Zhaolong 11 Jul '24

11 Jul '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v5.16-rc1 commit 14651496a3de6807a17c310f63c894ea0c5d858e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNF2 CVE: CVE-2021-47181 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20210915034925.2399823-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/usb/musb/tusb6010.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c index 39453287b5c3..9629ddb943d5 100644 --- a/drivers/usb/musb/tusb6010.c +++ b/drivers/usb/musb/tusb6010.c @@ -1102,6 +1102,11 @@ static int tusb_musb_init(struct musb *musb) /* dma address for async dma */ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!mem) { + pr_debug("no async dma resource?\n"); + ret = -ENODEV; + goto done; + } musb->async = mem->start; /* dma address for sync dma */ -- 2.34.3

2 1

[PATCH OLK-6.6] x86: resctrl: Fix illegal access by the chips not having RDT
by Zeng Heng 11 Jul '24

11 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA7L2U --------------------------- If the chip not having RDT function, resctrl_arch_system_num_rmid_idx() would return 0. rmid_ptrs points to an illegal buffer after kcalloc() allocation, which would cause illegal access fault when accessing. Consequently, when we found resctrl_arch_system_num_rmid_idx() return 0, just return EOPNOTSUPP immediatly and skip initializing the resctrl file system. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrl/monitor.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/resctrl/monitor.c b/fs/resctrl/monitor.c index 6ef878f5afdd..a7bd84f9a440 100644 --- a/fs/resctrl/monitor.c +++ b/fs/resctrl/monitor.c @@ -728,6 +728,9 @@ static int dom_data_init(struct rdt_resource *r) int err = 0, i; u32 idx; + if (!idx_limit) + return -EOPNOTSUPP; + mutex_lock(&rdtgroup_mutex); if (IS_ENABLED(CONFIG_RESCTRL_RMID_DEPENDS_ON_CLOSID)) { u32 *tmp; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usb: musb: tusb6010: check return value after calling platform_get_resource()
by Wang Zhaolong 11 Jul '24

11 Jul '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v5.16-rc1v6.1 commit 14651496a3de6807a17c310f63c894ea0c5d858e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNF2 CVE: CVE-2021-47181 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20210915034925.2399823-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/usb/musb/tusb6010.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c index 39453287b5c3..9629ddb943d5 100644 --- a/drivers/usb/musb/tusb6010.c +++ b/drivers/usb/musb/tusb6010.c @@ -1102,6 +1102,11 @@ static int tusb_musb_init(struct musb *musb) /* dma address for async dma */ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!mem) { + pr_debug("no async dma resource?\n"); + ret = -ENODEV; + goto done; + } musb->async = mem->start; /* dma address for sync dma */ -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] cifs: Fix deadlock in cifs_writepages during reconnect
by Wang Zhaolong 11 Jul '24

11 Jul '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAASLU -------------------------------- When multiple processes or threads write to the same file concurrently, if a network disruption occurs during the write operation, it may lead to a deadlock situation as follow: Process 1 (dd) Process 2 (cifsd) Process 3 (cifsiod) cifs_writepages lock_page - [1] wait_on_page_writeback - [2] Waiting for writeback, blocked by [4] wait_on_page_bit cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket - If another process triggers reconnect at this point cifs_reconnect - mid->mid_state updated to MID_RETRY_NEEDED smb2_writev_callback mid_entry->callback() - mid_state leads to wdata->result = -EAGAIN wdata->result = -EAGAIN queue_work(cifsiod_wq, &wdata->work); cifs_writev_complete - work function - Condition satisfied - wdata->result == -EAGAIN cifs_writev_requeue lock_page - [3] Blocked by [1] end_page_writeback - [4] Won't execute, blocked by [3] unlock_page Mainline refactoring patch d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") unlock page while waiting for the writeback to complete, thus avoiding potential deadlocks caused by lock ordering issues during reconnection. Due to the large refactor of the mainline, the patch cannot be backport directly. Therefore, This patch only uses a part of the idea of the mainline patch to fix deadlock. Fixes: c28c89fc43e3 ("cifs: add cifs_async_writev") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/file.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 0b840555a175..e0c10fd93b64 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -2223,6 +2223,7 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, * back from swapper_space to tmpfs file mapping */ +relock_recheck: if (nr_pages == 0) lock_page(page); else if (!trylock_page(page)) @@ -2245,11 +2246,16 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, break; } - if (wbc->sync_mode != WB_SYNC_NONE) - wait_on_page_writeback(page); + if (PageWriteback(page)) { + unlock_page(page); + if (wbc->sync_mode != WB_SYNC_NONE) { + wait_on_page_writeback(page); + goto relock_recheck; + } + break; + } - if (PageWriteback(page) || - !clear_page_dirty_for_io(page)) { + if (!clear_page_dirty_for_io(page)) { unlock_page(page); break; } -- 2.39.2

2 1

[PATCH OLK-5.10] cifs: Fix deadlock in cifs_writepages during reconnect
by Wang Zhaolong 11 Jul '24

11 Jul '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAASLU -------------------------------- When multiple processes or threads write to the same file concurrently, if a network disruption occurs during the write operation, it may lead to a deadlock situation as follow: Process 1 (dd) Process 2 (cifsd) Process 3 (cifsiod) cifs_writepages lock_page - [1] wait_on_page_writeback - [2] Waiting for writeback, blocked by [4] wait_on_page_bit cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket - If another process triggers reconnect at this point cifs_reconnect - mid->mid_state updated to MID_RETRY_NEEDED smb2_writev_callback mid_entry->callback() - mid_state leads to wdata->result = -EAGAIN wdata->result = -EAGAIN queue_work(cifsiod_wq, &wdata->work); cifs_writev_complete - work function - Condition satisfied - wdata->result == -EAGAIN cifs_writev_requeue lock_page - [3] Blocked by [1] end_page_writeback - [4] Won't execute, blocked by [3] unlock_page Mainline refactoring patch d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") unlock page while waiting for the writeback to complete, thus avoiding potential deadlocks caused by lock ordering issues during reconnection. Due to the large refactor of the mainline, the patch cannot be backport directly. Therefore, This patch only uses a part of the idea of the mainline patch to fix deadlock. Fixes: c28c89fc43e3 ("cifs: add cifs_async_writev") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/file.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index e914f4f5cc83..dc7175b75c26 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -2226,6 +2226,7 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, * back from swapper_space to tmpfs file mapping */ +relock_recheck: if (nr_pages == 0) lock_page(page); else if (!trylock_page(page)) @@ -2248,11 +2249,16 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, break; } - if (wbc->sync_mode != WB_SYNC_NONE) - wait_on_page_writeback(page); + if (PageWriteback(page)) { + unlock_page(page); + if (wbc->sync_mode != WB_SYNC_NONE) { + wait_on_page_writeback(page); + goto relock_recheck; + } + break; + } - if (PageWriteback(page) || - !clear_page_dirty_for_io(page)) { + if (!clear_page_dirty_for_io(page)) { unlock_page(page); break; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] cifs: Fix deadlock in cifs_writepages during reconnect
by Wang Zhaolong 11 Jul '24

11 Jul '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAASLU -------------------------------- When multiple processes or threads write to the same file concurrently, if a network disruption occurs during the write operation, it may lead to a deadlock situation as follow: Process 1 (dd) Process 2 (cifsd) Process 3 (cifsiod) cifs_writepages lock_page - [1] wait_on_page_writeback - [2] Waiting for writeback, blocked by [4] wait_on_page_bit cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket - If another process triggers reconnect at this point cifs_reconnect - mid->mid_state updated to MID_RETRY_NEEDED smb2_writev_callback mid_entry->callback() - mid_state leads to wdata->result = -EAGAIN wdata->result = -EAGAIN queue_work(cifsiod_wq, &wdata->work); cifs_writev_complete - work function - Condition satisfied - wdata->result == -EAGAIN cifs_writev_requeue lock_page - [3] Blocked by [1] end_page_writeback - [4] Won't execute, blocked by [3] unlock_page Mainline refactoring patch d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") unlock page while waiting for the writeback to complete, thus avoiding potential deadlocks caused by lock ordering issues during reconnection. Due to the large refactor of the mainline, the patch cannot be backport directly. Therefore, This patch only uses a part of the idea of the mainline patch to fix deadlock. Fixes: c28c89fc43e3 ("cifs: add cifs_async_writev") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/file.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index 875cb44ba573..e346e6c2227a 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -2056,6 +2056,7 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, * back from swapper_space to tmpfs file mapping */ +relock_recheck: if (nr_pages == 0) lock_page(page); else if (!trylock_page(page)) @@ -2078,11 +2079,16 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages, break; } - if (wbc->sync_mode != WB_SYNC_NONE) - wait_on_page_writeback(page); + if (PageWriteback(page)) { + unlock_page(page); + if (wbc->sync_mode != WB_SYNC_NONE) { + wait_on_page_writeback(page); + goto relock_recheck; + } + break; + } - if (PageWriteback(page) || - !clear_page_dirty_for_io(page)) { + if (!clear_page_dirty_for_io(page)) { unlock_page(page); break; } -- 2.39.2

2 1

[PATCH OLK-6.6] ipvlan: Modify the value of ipvlan modes
by Zhengchao Shao 11 Jul '24

11 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAC95A CVE: NA -------------------------------- In order to make iproute compatible with other operation system like SUSE, rethad and etc, put IPVLAN_MODE_L2E last. Fixes: 53f51b3cd1e4 ("ipvlan: Introduce l2e mode") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ipvlan/ipvlan_main.c | 2 +- include/uapi/linux/if_link.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c index 67d03a17dd3f..3870d7b2b652 100644 --- a/drivers/net/ipvlan/ipvlan_main.c +++ b/drivers/net/ipvlan/ipvlan_main.c @@ -17,7 +17,7 @@ int sysctl_ipvlan_loop_qlen = 131072; int sysctl_ipvlan_loop_delay = 10; static int ipvlan_default_mode = IPVLAN_MODE_L3; module_param(ipvlan_default_mode, int, 0400); -MODULE_PARM_DESC(ipvlan_default_mode, "set ipvlan default mode: 0 for l2, 1 for l3, 2 for l2e, 3 for l3s, others invalid now"); +MODULE_PARM_DESC(ipvlan_default_mode, "set ipvlan default mode: 0 for l2, 1 for l3, 2 for l3s, 3 for l2e, others invalid now"); static struct ctl_table_header *ipvlan_table_hrd; static struct ctl_table ipvlan_table[] = { diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h index 96ecfe1709e0..e603ada6b5ea 100644 --- a/include/uapi/linux/if_link.h +++ b/include/uapi/linux/if_link.h @@ -741,8 +741,8 @@ enum { enum ipvlan_mode { IPVLAN_MODE_L2 = 0, IPVLAN_MODE_L3, - IPVLAN_MODE_L2E, IPVLAN_MODE_L3S, + IPVLAN_MODE_L2E, IPVLAN_MODE_MAX }; -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD SUCCESS 985826e1203e470bf196aab02c03859d95e4fc7f
by kernel test robot 11 Jul '24

11 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 985826e1203e470bf196aab02c03859d95e4fc7f !9829 fix CVE-2024-38620 Warning ids grouped by kconfigs: recent_errors `-- arm64-allmodconfig `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag elapsed time: 744m configs tested: 39 configs skipped: 122 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-13.2.0 arm64 randconfig-001-20240710 clang-19 arm64 randconfig-002-20240710 clang-19 arm64 randconfig-003-20240710 clang-17 arm64 randconfig-004-20240710 gcc-13.2.0 loongarch alldefconfig gcc-13.3.0 loongarch allmodconfig gcc-13.3.0 loongarch allnoconfig gcc-13.3.0 loongarch randconfig-001-20240710 gcc-13.3.0 loongarch randconfig-002-20240710 gcc-13.3.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240710 clang-18 x86_64 buildonly-randconfig-002-20240710 clang-18 x86_64 buildonly-randconfig-003-20240710 clang-18 x86_64 buildonly-randconfig-004-20240710 clang-18 x86_64 buildonly-randconfig-005-20240710 gcc-13 x86_64 buildonly-randconfig-006-20240710 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240710 gcc-13 x86_64 randconfig-002-20240710 clang-18 x86_64 randconfig-003-20240710 gcc-12 x86_64 randconfig-004-20240710 clang-18 x86_64 randconfig-005-20240710 clang-18 x86_64 randconfig-006-20240710 gcc-13 x86_64 randconfig-011-20240710 clang-18 x86_64 randconfig-012-20240710 clang-18 x86_64 randconfig-013-20240710 clang-18 x86_64 randconfig-014-20240710 clang-18 x86_64 randconfig-015-20240710 clang-18 x86_64 randconfig-016-20240710 gcc-13 x86_64 randconfig-071-20240710 gcc-13 x86_64 randconfig-072-20240710 clang-18 x86_64 randconfig-073-20240710 clang-18 x86_64 randconfig-074-20240710 gcc-7 x86_64 randconfig-075-20240710 clang-18 x86_64 randconfig-076-20240710 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS cf1d3c6a50d28b2cd5493204fe4e853383307ce4
by kernel test robot 11 Jul '24

11 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: cf1d3c6a50d28b2cd5493204fe4e853383307ce4 !9851 net/sched: act_skbmod: prevent kernel-infoleak elapsed time: 735m configs tested: 34 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-13.2.0 arm64 randconfig-001-20240710 clang-19 arm64 randconfig-002-20240710 clang-19 arm64 randconfig-003-20240710 clang-17 arm64 randconfig-004-20240710 gcc-13.2.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240710 clang-18 x86_64 buildonly-randconfig-002-20240710 clang-18 x86_64 buildonly-randconfig-003-20240710 clang-18 x86_64 buildonly-randconfig-004-20240710 clang-18 x86_64 buildonly-randconfig-005-20240710 gcc-13 x86_64 buildonly-randconfig-006-20240710 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240710 gcc-13 x86_64 randconfig-002-20240710 clang-18 x86_64 randconfig-003-20240710 gcc-12 x86_64 randconfig-004-20240710 clang-18 x86_64 randconfig-005-20240710 clang-18 x86_64 randconfig-006-20240710 gcc-13 x86_64 randconfig-011-20240710 clang-18 x86_64 randconfig-012-20240710 clang-18 x86_64 randconfig-013-20240710 clang-18 x86_64 randconfig-014-20240710 clang-18 x86_64 randconfig-015-20240710 clang-18 x86_64 randconfig-016-20240710 gcc-13 x86_64 randconfig-071-20240710 gcc-13 x86_64 randconfig-072-20240710 clang-18 x86_64 randconfig-073-20240710 clang-18 x86_64 randconfig-074-20240710 gcc-7 x86_64 randconfig-075-20240710 clang-18 x86_64 randconfig-076-20240710 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS dc5173acb0679d098a881e7e6b34ca61d8dc5d51
by kernel test robot 10 Jul '24

10 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: dc5173acb0679d098a881e7e6b34ca61d8dc5d51 !9842 net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove Warning ids grouped by kconfigs: recent_errors `-- x86_64-buildonly-randconfig-005-20240710 `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized elapsed time: 726m configs tested: 34 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-13.2.0 arm64 allnoconfig gcc-13.2.0 arm64 randconfig-001-20240710 gcc-13.2.0 arm64 randconfig-002-20240710 gcc-13.2.0 arm64 randconfig-003-20240710 gcc-13.2.0 arm64 randconfig-004-20240710 gcc-13.2.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240710 clang-18 x86_64 buildonly-randconfig-002-20240710 clang-18 x86_64 buildonly-randconfig-003-20240710 clang-18 x86_64 buildonly-randconfig-004-20240710 clang-18 x86_64 buildonly-randconfig-005-20240710 gcc-13 x86_64 buildonly-randconfig-006-20240710 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240710 gcc-13 x86_64 randconfig-002-20240710 clang-18 x86_64 randconfig-003-20240710 gcc-12 x86_64 randconfig-004-20240710 clang-18 x86_64 randconfig-005-20240710 clang-18 x86_64 randconfig-006-20240710 gcc-13 x86_64 randconfig-011-20240710 clang-18 x86_64 randconfig-012-20240710 clang-18 x86_64 randconfig-013-20240710 clang-18 x86_64 randconfig-014-20240710 clang-18 x86_64 randconfig-015-20240710 clang-18 x86_64 randconfig-016-20240710 gcc-13 x86_64 randconfig-071-20240710 gcc-13 x86_64 randconfig-072-20240710 clang-18 x86_64 randconfig-073-20240710 clang-18 x86_64 randconfig-074-20240710 gcc-7 x86_64 randconfig-075-20240710 clang-18 x86_64 randconfig-076-20240710 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] block: enable BLK_IO_HUNG_TASK_CHECK by default
by Li Lingfeng 10 Jul '24

10 Jul '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAC2T6 -------------------------------- Enable BLK_IO_HUNG_TASK_CHECK by default like 5.10. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 09e8452bba42..f4a8a774d53b 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -949,7 +949,7 @@ CONFIG_BLK_DEBUG_FS_ZONED=y # CONFIG_BLK_INLINE_ENCRYPTION is not set CONFIG_BLK_DEV_DETECT_WRITING_PART0=y CONFIG_BLK_DEV_WRITE_MOUNTED_DUMP=y -CONFIG_BLK_IO_HUNG_TASK_CHECK=n +CONFIG_BLK_IO_HUNG_TASK_CHECK=y # # Partition Types diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index e7859242cbbd..3d85395e74df 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -981,7 +981,7 @@ CONFIG_BLK_DEBUG_FS_ZONED=y # CONFIG_BLK_INLINE_ENCRYPTION is not set CONFIG_BLK_DEV_DETECT_WRITING_PART0=y CONFIG_BLK_DEV_WRITE_MOUNTED_DUMP=y -CONFIG_BLK_IO_HUNG_TASK_CHECK=n +CONFIG_BLK_IO_HUNG_TASK_CHECK=y # # Partition Types -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] khugepaged: fix null-pointer dereference due to race
by Liu Shixin 10 Jul '24

10 Jul '24

From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> mainline inclusion from mainline-v5.8-rc7 commit 594cced14ad3903166c8b091ff96adac7552f0b3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IABZNI CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- khugepaged has to drop mmap lock several times while collapsing a page. The situation can change while the lock is dropped and we need to re-validate that the VMA is still in place and the PMD is still subject for collapse. But we miss one corner case: while collapsing an anonymous pages the VMA could be replaced with file VMA. If the file VMA doesn't have any private pages we get NULL pointer dereference: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] anon_vma_lock_write include/linux/rmap.h:120 [inline] collapse_huge_page mm/khugepaged.c:1110 [inline] khugepaged_scan_pmd mm/khugepaged.c:1349 [inline] khugepaged_scan_mm_slot mm/khugepaged.c:2110 [inline] khugepaged_do_scan mm/khugepaged.c:2193 [inline] khugepaged+0x3bba/0x5a10 mm/khugepaged.c:2238 The fix is to make sure that the VMA is anonymous in hugepage_vma_revalidate(). The helper is only used for collapsing anonymous pages. Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") Reported-by: syzbot+ed318e8b790ca72c5ad0(a)syzkaller.appspotmail.com Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: David Hildenbrand <david(a)redhat.com> Acked-by: Yang Shi <yang.shi(a)linux.alibaba.com> Cc: <stable(a)vger.kernel.org> Link: http://lkml.kernel.org/r/20200722121439.44328-1-kirill.shutemov@linux.intel… Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> [ The Fixes tag is incorrect, the problem can triggered due to shmem_file. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/khugepaged.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 04d0a3ee006e..88badbed7f73 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -893,6 +893,9 @@ static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address, return SCAN_ADDRESS_RANGE; if (!hugepage_vma_check(vma, vma->vm_flags)) return SCAN_VMA_CHECK; + /* Anon VMA expected */ + if (!vma->anon_vma || vma->vm_ops) + return SCAN_VMA_CHECK; return 0; } -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amdgpu/mes: fix use-after-free issue
by Li Huafei 10 Jul '24

10 Jul '24

From: Jack Xiao <Jack.Xiao(a)amd.com> stable inclusion from stable-v6.6.33 commit 39cfce75168c11421d70b8c0c65f6133edccb82a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SIE CVE: CVE-2024-38581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 948255282074d9367e01908b3f5dcf8c10fc9c3d ] Delete fence fallback timer to fix the ramdom use-after-free issue. v2: move to amdgpu_mes.c Signed-off-by: Jack Xiao <Jack.Xiao(a)amd.com> Acked-by: Lijo Lazar <lijo.lazar(a)amd.com> Acked-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c index 15c67fa404ff..c5c55e132af2 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c @@ -1098,6 +1098,7 @@ void amdgpu_mes_remove_ring(struct amdgpu_device *adev, return; amdgpu_mes_remove_hw_queue(adev, ring->hw_queue_id); + del_timer_sync(&ring->fence_drv.fallback_timer); amdgpu_ring_fini(ring); kfree(ring); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] btrfs: fix memory ordering between normal and ordered work functions
by Yifan Qiao 10 Jul '24

10 Jul '24

From: Nikolay Borisov <nborisov(a)suse.com> stable inclusion from stable-v4.19.218 commit ed058d735a70f4b063323f1a7bb33cda0f987513 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFN CVE: CVE-2021-47189 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 45da9c1767ac31857df572f0a909fbe88fd5a7e9 upstream. Ordered work functions aren't guaranteed to be handled by the same thread which executed the normal work functions. The only way execution between normal/ordered functions is synchronized is via the WORK_DONE_BIT, unfortunately the used bitops don't guarantee any ordering whatsoever. This manifested as seemingly inexplicable crashes on ARM64, where async_chunk::inode is seen as non-null in async_cow_submit which causes submit_compressed_extents to be called and crash occurs because async_chunk::inode suddenly became NULL. The call trace was similar to: pc : submit_compressed_extents+0x38/0x3d0 lr : async_cow_submit+0x50/0xd0 sp : ffff800015d4bc20 <registers omitted for brevity> Call trace: submit_compressed_extents+0x38/0x3d0 async_cow_submit+0x50/0xd0 run_ordered_work+0xc8/0x280 btrfs_work_helper+0x98/0x250 process_one_work+0x1f0/0x4ac worker_thread+0x188/0x504 kthread+0x110/0x114 ret_from_fork+0x10/0x18 Fix this by adding respective barrier calls which ensure that all accesses preceding setting of WORK_DONE_BIT are strictly ordered before setting the flag. At the same time add a read barrier after reading of WORK_DONE_BIT in run_ordered_work which ensures all subsequent loads would be strictly ordered after reading the bit. This in turn ensures are all accesses before WORK_DONE_BIT are going to be strictly ordered before any access that can occur in ordered_func. Reported-by: Chris Murphy <lists(a)colorremedies.com> Fixes: 08a9ff326418 ("btrfs: Added btrfs_workqueue_struct implemented ordered execution based on kernel workqueue") CC: stable(a)vger.kernel.org # 4.4+ Link: https://bugzilla.redhat.com/show_bug.cgi?id=2011928 Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Tested-by: Chris Murphy <chris(a)colorremedies.com> Signed-off-by: Nikolay Borisov <nborisov(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/async-thread.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c index f79c0cb7697a..21f8f475c894 100644 --- a/fs/btrfs/async-thread.c +++ b/fs/btrfs/async-thread.c @@ -270,6 +270,13 @@ static void run_ordered_work(struct __btrfs_workqueue *wq, ordered_list); if (!test_bit(WORK_DONE_BIT, &work->flags)) break; + /* + * Orders all subsequent loads after reading WORK_DONE_BIT, + * paired with the smp_mb__before_atomic in btrfs_work_helper + * this guarantees that the ordered function will see all + * updates from ordinary work function. + */ + smp_rmb(); /* * we are going to call the ordered done function, but @@ -355,6 +362,13 @@ static void normal_work_helper(struct btrfs_work *work) thresh_exec_hook(wq); work->func(work); if (need_order) { + /* + * Ensures all memory accesses done in the work function are + * ordered before setting the WORK_DONE_BIT. Ensuring the thread + * which is going to executed the ordered work sees them. + * Pairs with the smp_rmb in run_ordered_work. + */ + smp_mb__before_atomic(); set_bit(WORK_DONE_BIT, &work->flags); run_ordered_work(wq, work); } -- 2.39.2

2 1

[openeuler:OLK-6.6] BUILD REGRESSION b752420db6600f7d154e7b1d9ccbf448a9cc3170
by kernel test robot 10 Jul '24

10 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b752420db6600f7d154e7b1d9ccbf448a9cc3170 !9779 CVE-2024-39461 Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- clang:warning:no-such-include-directory:drivers-infiniband-hw-hiroce3-include-mag |-- arm64-randconfig-002-20240709 | `-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:error:called-object-type-int-is-not-a-function-or-function-pointer `-- loongarch-randconfig-002-20240709 `-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and elapsed time: 816m configs tested: 39 configs skipped: 133 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-13.2.0 arm64 defconfig gcc-13.2.0 arm64 randconfig-001-20240709 clang-19 arm64 randconfig-002-20240709 clang-17 arm64 randconfig-003-20240709 clang-19 arm64 randconfig-004-20240709 clang-19 loongarch allnoconfig gcc-13.2.0 loongarch defconfig gcc-13.2.0 loongarch randconfig-001-20240709 gcc-13.2.0 loongarch randconfig-002-20240709 gcc-13.2.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240710 clang-18 x86_64 buildonly-randconfig-002-20240710 clang-18 x86_64 buildonly-randconfig-003-20240710 clang-18 x86_64 buildonly-randconfig-004-20240710 clang-18 x86_64 buildonly-randconfig-005-20240710 gcc-13 x86_64 buildonly-randconfig-006-20240710 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240710 gcc-13 x86_64 randconfig-002-20240710 clang-18 x86_64 randconfig-003-20240710 gcc-12 x86_64 randconfig-004-20240710 clang-18 x86_64 randconfig-005-20240710 clang-18 x86_64 randconfig-006-20240710 gcc-13 x86_64 randconfig-011-20240710 clang-18 x86_64 randconfig-012-20240710 clang-18 x86_64 randconfig-013-20240710 clang-18 x86_64 randconfig-014-20240710 clang-18 x86_64 randconfig-015-20240710 clang-18 x86_64 randconfig-016-20240710 gcc-13 x86_64 randconfig-071-20240710 gcc-13 x86_64 randconfig-072-20240710 clang-18 x86_64 randconfig-073-20240710 clang-18 x86_64 randconfig-074-20240710 gcc-7 x86_64 randconfig-075-20240710 clang-18 x86_64 randconfig-076-20240710 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 223a7beb53529b66601db229f1cd1a5e6d278982
by kernel test robot 10 Jul '24

10 Jul '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 223a7beb53529b66601db229f1cd1a5e6d278982 !9643 f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() elapsed time: 729m configs tested: 34 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-13.2.0 arm64 randconfig-001-20240709 clang-19 arm64 randconfig-002-20240709 clang-17 arm64 randconfig-003-20240709 clang-19 arm64 randconfig-004-20240709 clang-19 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240709 gcc-11 x86_64 buildonly-randconfig-002-20240709 clang-18 x86_64 buildonly-randconfig-003-20240709 clang-18 x86_64 buildonly-randconfig-004-20240709 gcc-9 x86_64 buildonly-randconfig-005-20240709 gcc-13 x86_64 buildonly-randconfig-006-20240709 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240709 clang-18 x86_64 randconfig-002-20240709 gcc-10 x86_64 randconfig-003-20240709 clang-18 x86_64 randconfig-004-20240709 gcc-12 x86_64 randconfig-005-20240709 gcc-13 x86_64 randconfig-006-20240709 gcc-8 x86_64 randconfig-011-20240709 clang-18 x86_64 randconfig-012-20240709 clang-18 x86_64 randconfig-013-20240709 clang-18 x86_64 randconfig-014-20240709 clang-18 x86_64 randconfig-015-20240709 clang-18 x86_64 randconfig-016-20240709 clang-18 x86_64 randconfig-071-20240709 gcc-7 x86_64 randconfig-072-20240709 clang-18 x86_64 randconfig-073-20240709 gcc-13 x86_64 randconfig-074-20240709 gcc-13 x86_64 randconfig-075-20240709 gcc-11 x86_64 randconfig-076-20240709 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix use-after-free of timer for log writer thread
by Guo Mengqi 09 Jul '24

09 Jul '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.219 commit 67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S5D CVE: CVE-2024-38583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 upstream. Patch series "nilfs2: fix log writer related issues". This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze issue in event synchronization found during their analysis. Details are described in each commit log. This patch (of 3): A use-after-free issue has been reported regarding the timer sc_timer on the nilfs_sc_info structure. The problem is that even though it is used to wake up a sleeping log writer thread, sc_timer is not shut down until the nilfs_sc_info structure is about to be freed, and is used regardless of the thread's lifetime. Fix this issue by limiting the use of sc_timer only while the log writer thread is alive. Link: https://lkml.kernel.org/r/20240520132621.4054-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20240520132621.4054-2-konishi.ryusuke@gmail.com Fixes: fdce895ea5dd ("nilfs2: change sc_timer from a pointer to an embedded one in struct nilfs_sc_info") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: "Bai, Shuangpeng" <sjb7183(a)psu.edu> Closes: https://groups.google.com/g/syzkaller/c/MK_LYqtt8ko/m/8rgdWeseAwAJ Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- fs/nilfs2/segment.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 931f87d657fc..d4e518a31131 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -2129,8 +2129,10 @@ static void nilfs_segctor_start_timer(struct nilfs_sc_info *sci) { spin_lock(&sci->sc_state_lock); if (!(sci->sc_state & NILFS_SEGCTOR_COMMIT)) { - sci->sc_timer.expires = jiffies + sci->sc_interval; - add_timer(&sci->sc_timer); + if (sci->sc_task) { + sci->sc_timer.expires = jiffies + sci->sc_interval; + add_timer(&sci->sc_timer); + } sci->sc_state |= NILFS_SEGCTOR_COMMIT; } spin_unlock(&sci->sc_state_lock); @@ -2350,10 +2352,21 @@ int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode, */ static void nilfs_segctor_accept(struct nilfs_sc_info *sci) { + bool thread_is_alive; + spin_lock(&sci->sc_state_lock); sci->sc_seq_accepted = sci->sc_seq_request; + thread_is_alive = (bool)sci->sc_task; spin_unlock(&sci->sc_state_lock); - del_timer_sync(&sci->sc_timer); + + /* + * This function does not race with the log writer thread's + * termination. Therefore, deleting sc_timer, which should not be + * done after the log writer thread exits, can be done safely outside + * the area protected by sc_state_lock. + */ + if (thread_is_alive) + del_timer_sync(&sci->sc_timer); } /** @@ -2379,7 +2392,7 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci, int mode, int err) sci->sc_flush_request &= ~FLUSH_DAT_BIT; /* re-enable timer if checkpoint creation was not done */ - if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) && + if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) && sci->sc_task && time_before(jiffies, sci->sc_timer.expires)) add_timer(&sci->sc_timer); } @@ -2569,6 +2582,7 @@ static int nilfs_segctor_thread(void *arg) int timeout = 0; sci->sc_timer_task = current; + timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0); /* start sync. */ sci->sc_task = current; @@ -2637,6 +2651,7 @@ static int nilfs_segctor_thread(void *arg) /* end sync. */ sci->sc_task = NULL; + del_timer_sync(&sci->sc_timer); wake_up(&sci->sc_wait_task); /* for nilfs_segctor_kill_thread() */ return 0; } @@ -2699,7 +2714,6 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb, INIT_LIST_HEAD(&sci->sc_gc_inodes); INIT_LIST_HEAD(&sci->sc_iput_queue); INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func); - timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0); sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT; sci->sc_mjcp_freq = HZ * NILFS_SC_DEFAULT_SR_FREQ; @@ -2785,7 +2799,6 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) down_write(&nilfs->ns_segctor_sem); - del_timer_sync(&sci->sc_timer); kfree(sci); } -- 2.17.1

2 1

[PATCH OLK-5.10] nilfs2: fix use-after-free of timer for log writer thread
by Guo Mengqi 09 Jul '24

09 Jul '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.219 commit 67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S5D CVE: CVE-2024-38583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 upstream. Patch series "nilfs2: fix log writer related issues". This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze issue in event synchronization found during their analysis. Details are described in each commit log. This patch (of 3): A use-after-free issue has been reported regarding the timer sc_timer on the nilfs_sc_info structure. The problem is that even though it is used to wake up a sleeping log writer thread, sc_timer is not shut down until the nilfs_sc_info structure is about to be freed, and is used regardless of the thread's lifetime. Fix this issue by limiting the use of sc_timer only while the log writer thread is alive. Link: https://lkml.kernel.org/r/20240520132621.4054-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20240520132621.4054-2-konishi.ryusuke@gmail.com Fixes: fdce895ea5dd ("nilfs2: change sc_timer from a pointer to an embedded one in struct nilfs_sc_info") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: "Bai, Shuangpeng" <sjb7183(a)psu.edu> Closes: https://groups.google.com/g/syzkaller/c/MK_LYqtt8ko/m/8rgdWeseAwAJ Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- fs/nilfs2/segment.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 3997f377f0e3..2eeae67ad298 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -2164,8 +2164,10 @@ static void nilfs_segctor_start_timer(struct nilfs_sc_info *sci) { spin_lock(&sci->sc_state_lock); if (!(sci->sc_state & NILFS_SEGCTOR_COMMIT)) { - sci->sc_timer.expires = jiffies + sci->sc_interval; - add_timer(&sci->sc_timer); + if (sci->sc_task) { + sci->sc_timer.expires = jiffies + sci->sc_interval; + add_timer(&sci->sc_timer); + } sci->sc_state |= NILFS_SEGCTOR_COMMIT; } spin_unlock(&sci->sc_state_lock); @@ -2385,10 +2387,21 @@ int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode, */ static void nilfs_segctor_accept(struct nilfs_sc_info *sci) { + bool thread_is_alive; + spin_lock(&sci->sc_state_lock); sci->sc_seq_accepted = sci->sc_seq_request; + thread_is_alive = (bool)sci->sc_task; spin_unlock(&sci->sc_state_lock); - del_timer_sync(&sci->sc_timer); + + /* + * This function does not race with the log writer thread's + * termination. Therefore, deleting sc_timer, which should not be + * done after the log writer thread exits, can be done safely outside + * the area protected by sc_state_lock. + */ + if (thread_is_alive) + del_timer_sync(&sci->sc_timer); } /** @@ -2414,7 +2427,7 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci, int mode, int err) sci->sc_flush_request &= ~FLUSH_DAT_BIT; /* re-enable timer if checkpoint creation was not done */ - if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) && + if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) && sci->sc_task && time_before(jiffies, sci->sc_timer.expires)) add_timer(&sci->sc_timer); } @@ -2604,6 +2617,7 @@ static int nilfs_segctor_thread(void *arg) int timeout = 0; sci->sc_timer_task = current; + timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0); /* start sync. */ sci->sc_task = current; @@ -2670,6 +2684,7 @@ static int nilfs_segctor_thread(void *arg) end_thread: /* end sync. */ sci->sc_task = NULL; + del_timer_sync(&sci->sc_timer); wake_up(&sci->sc_wait_task); /* for nilfs_segctor_kill_thread() */ spin_unlock(&sci->sc_state_lock); return 0; @@ -2733,7 +2748,6 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb, INIT_LIST_HEAD(&sci->sc_gc_inodes); INIT_LIST_HEAD(&sci->sc_iput_queue); INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func); - timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0); sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT; sci->sc_mjcp_freq = HZ * NILFS_SC_DEFAULT_SR_FREQ; @@ -2819,7 +2833,6 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) down_write(&nilfs->ns_segctor_sem); - del_timer_sync(&sci->sc_timer); kfree(sci); } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net/sched: act_skbmod: prevent kernel-infoleak
by Guo Mengqi 09 Jul '24

09 Jul '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.215 commit 5e45dc4408857305f4685abfd7a528a1e58b51b5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG2F Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d313eb8b77557a6d5855f42d2234bd592c7b50dd upstream. syzbot found that tcf_skbmod_dump() was copying four bytes from kernel stack to user space [1]. The issue here is that 'struct tc_skbmod' has a four bytes hole. We need to clear the structure before filling fields. [1] BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 copy_to_iter include/linux/uio.h:196 [inline] simple_copy_to_iter net/core/datagram.c:532 [inline] __skb_datagram_iter+0x185/0x1000 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:4050 [inline] netlink_recvmsg+0x432/0x1610 net/netlink/af_netlink.c:1962 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x2c4/0x340 net/socket.c:1068 __sys_recvfrom+0x35a/0x5f0 net/socket.c:2242 __do_sys_recvfrom net/socket.c:2260 [inline] __se_sys_recvfrom net/socket.c:2256 [inline] __x64_sys_recvfrom+0x126/0x1d0 net/socket.c:2256 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was stored to memory at: pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253 netlink_trim+0x2c2/0x330 net/netlink/af_netlink.c:1317 netlink_unicast+0x9f/0x1260 net/netlink/af_netlink.c:1351 nlmsg_unicast include/net/netlink.h:1144 [inline] nlmsg_notify+0x21d/0x2f0 net/netlink/af_netlink.c:2610 rtnetlink_send+0x73/0x90 net/core/rtnetlink.c:741 rtnetlink_maybe_send include/linux/rtnetlink.h:17 [inline] tcf_add_notify net/sched/act_api.c:2048 [inline] tcf_action_add net/sched/act_api.c:2071 [inline] tc_ctl_action+0x146e/0x19d0 net/sched/act_api.c:2119 rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was stored to memory at: __nla_put lib/nlattr.c:1041 [inline] nla_put+0x1c6/0x230 lib/nlattr.c:1099 tcf_skbmod_dump+0x23f/0xc20 net/sched/act_skbmod.c:256 tcf_action_dump_old net/sched/act_api.c:1191 [inline] tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227 tcf_action_dump+0x1fd/0x460 net/sched/act_api.c:1251 tca_get_fill+0x519/0x7a0 net/sched/act_api.c:1628 tcf_add_notify_msg net/sched/act_api.c:2023 [inline] tcf_add_notify net/sched/act_api.c:2042 [inline] tcf_action_add net/sched/act_api.c:2071 [inline] tc_ctl_action+0x1365/0x19d0 net/sched/act_api.c:2119 rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Local variable opt created at: tcf_skbmod_dump+0x9d/0xc20 net/sched/act_skbmod.c:244 tcf_action_dump_old net/sched/act_api.c:1191 [inline] tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227 Bytes 188-191 of 248 are uninitialized Memory access of size 248 starts at ffff888117697680 Data copied to user address 00007ffe56d855f0 Fixes: 86da71b57383 ("net_sched: Introduce skbmod action") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://lore.kernel.org/r/20240403130908.93421-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/sched/act_skbmod.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c index 8d17a543cc9f..9a266fd33cfb 100644 --- a/net/sched/act_skbmod.c +++ b/net/sched/act_skbmod.c @@ -219,13 +219,13 @@ static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a, struct tcf_skbmod *d = to_skbmod(a); unsigned char *b = skb_tail_pointer(skb); struct tcf_skbmod_params *p; - struct tc_skbmod opt = { - .index = d->tcf_index, - .refcnt = refcount_read(&d->tcf_refcnt) - ref, - .bindcnt = atomic_read(&d->tcf_bindcnt) - bind, - }; + struct tc_skbmod opt; struct tcf_t t; + memset(&opt, 0, sizeof(opt)); + opt.index = d->tcf_index; + opt.refcnt = refcount_read(&d->tcf_refcnt) - ref, + opt.bindcnt = atomic_read(&d->tcf_bindcnt) - bind; spin_lock_bh(&d->tcf_lock); opt.action = d->tcf_action; p = rcu_dereference_protected(d->skbmod_p, -- 2.17.1

2 1

[PATCH OLK-5.10] net/sched: act_skbmod: prevent kernel-infoleak
by Guo Mengqi 09 Jul '24

09 Jul '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.215 commit 5e45dc4408857305f4685abfd7a528a1e58b51b5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG2F Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d313eb8b77557a6d5855f42d2234bd592c7b50dd upstream. syzbot found that tcf_skbmod_dump() was copying four bytes from kernel stack to user space [1]. The issue here is that 'struct tc_skbmod' has a four bytes hole. We need to clear the structure before filling fields. [1] BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 copy_to_iter include/linux/uio.h:196 [inline] simple_copy_to_iter net/core/datagram.c:532 [inline] __skb_datagram_iter+0x185/0x1000 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:4050 [inline] netlink_recvmsg+0x432/0x1610 net/netlink/af_netlink.c:1962 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x2c4/0x340 net/socket.c:1068 __sys_recvfrom+0x35a/0x5f0 net/socket.c:2242 __do_sys_recvfrom net/socket.c:2260 [inline] __se_sys_recvfrom net/socket.c:2256 [inline] __x64_sys_recvfrom+0x126/0x1d0 net/socket.c:2256 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was stored to memory at: pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253 netlink_trim+0x2c2/0x330 net/netlink/af_netlink.c:1317 netlink_unicast+0x9f/0x1260 net/netlink/af_netlink.c:1351 nlmsg_unicast include/net/netlink.h:1144 [inline] nlmsg_notify+0x21d/0x2f0 net/netlink/af_netlink.c:2610 rtnetlink_send+0x73/0x90 net/core/rtnetlink.c:741 rtnetlink_maybe_send include/linux/rtnetlink.h:17 [inline] tcf_add_notify net/sched/act_api.c:2048 [inline] tcf_action_add net/sched/act_api.c:2071 [inline] tc_ctl_action+0x146e/0x19d0 net/sched/act_api.c:2119 rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was stored to memory at: __nla_put lib/nlattr.c:1041 [inline] nla_put+0x1c6/0x230 lib/nlattr.c:1099 tcf_skbmod_dump+0x23f/0xc20 net/sched/act_skbmod.c:256 tcf_action_dump_old net/sched/act_api.c:1191 [inline] tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227 tcf_action_dump+0x1fd/0x460 net/sched/act_api.c:1251 tca_get_fill+0x519/0x7a0 net/sched/act_api.c:1628 tcf_add_notify_msg net/sched/act_api.c:2023 [inline] tcf_add_notify net/sched/act_api.c:2042 [inline] tcf_action_add net/sched/act_api.c:2071 [inline] tc_ctl_action+0x1365/0x19d0 net/sched/act_api.c:2119 rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Local variable opt created at: tcf_skbmod_dump+0x9d/0xc20 net/sched/act_skbmod.c:244 tcf_action_dump_old net/sched/act_api.c:1191 [inline] tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227 Bytes 188-191 of 248 are uninitialized Memory access of size 248 starts at ffff888117697680 Data copied to user address 00007ffe56d855f0 Fixes: 86da71b57383 ("net_sched: Introduce skbmod action") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://lore.kernel.org/r/20240403130908.93421-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/sched/act_skbmod.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c index aa98dcac94b9..934765a2edeb 100644 --- a/net/sched/act_skbmod.c +++ b/net/sched/act_skbmod.c @@ -219,13 +219,13 @@ static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a, struct tcf_skbmod *d = to_skbmod(a); unsigned char *b = skb_tail_pointer(skb); struct tcf_skbmod_params *p; - struct tc_skbmod opt = { - .index = d->tcf_index, - .refcnt = refcount_read(&d->tcf_refcnt) - ref, - .bindcnt = atomic_read(&d->tcf_bindcnt) - bind, - }; + struct tc_skbmod opt; struct tcf_t t; + memset(&opt, 0, sizeof(opt)); + opt.index = d->tcf_index; + opt.refcnt = refcount_read(&d->tcf_refcnt) - ref, + opt.bindcnt = atomic_read(&d->tcf_bindcnt) - bind; spin_lock_bh(&d->tcf_lock); opt.action = d->tcf_action; p = rcu_dereference_protected(d->skbmod_p, -- 2.17.1

2 1

[PATCH OLK-5.10] power: supply: bq27xxx-i2c: Do not free non existing IRQ
by Guo Mengqi 09 Jul '24

09 Jul '24

From: Hans de Goede <hdegoede(a)redhat.com> stable inclusion from stable-v5.10.212 commit d7acc4a569f5f4513120c85ea2b9f04909b7490f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8ME Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2df70149e73e79783bcbc7db4fa51ecef0e2022c ] The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client->irq) check wrapping the request_threaded_irq(). But bq27xxx_battery_i2c_remove() unconditionally calls free_irq(client->irq) leading to: [ 190.310742] ------------[ cut here ]------------ [ 190.310843] Trying to free already-free IRQ 0 [ 190.310861] WARNING: CPU: 2 PID: 1304 at kernel/irq/manage.c:1893 free_irq+0x1b8/0x310 Followed by a backtrace when unbinding the driver. Add an if (client->irq) to bq27xxx_battery_i2c_remove() mirroring probe() to fix this. Fixes: 444ff00734f3 ("power: supply: bq27xxx: Fix I2C IRQ race on remove") Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20240215155133.70537-1-hdegoede@redhat.com Signed-off-by: Sebastian Reichel <sebastian.reichel(a)collabora.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/power/supply/bq27xxx_battery_i2c.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c index 0e32efb10ee7..6fbae8fc2e50 100644 --- a/drivers/power/supply/bq27xxx_battery_i2c.c +++ b/drivers/power/supply/bq27xxx_battery_i2c.c @@ -209,7 +209,9 @@ static int bq27xxx_battery_i2c_remove(struct i2c_client *client) { struct bq27xxx_device_info *di = i2c_get_clientdata(client); - free_irq(client->irq, di); + if (client->irq) + free_irq(client->irq, di); + bq27xxx_battery_teardown(di); mutex_lock(&battery_mutex); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
by Guo Mengqi 09 Jul '24

09 Jul '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> stable inclusion from stable-v6.6.33 commit dcf53e6103b26e7458be71491d0641f49fbd5840 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SEW CVE: CVE-2024-38548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 935a92a1c400285545198ca2800a4c6c519c650a ] In cdns_mhdp_atomic_enable(), the return value of drm_mode_duplicate() is assigned to mhdp_state->current_mode, and there is a dereference of it in drm_mode_set_name(), which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Fix this bug add a check of mhdp_state->current_mode. Fixes: fb43aa0acdfd ("drm: bridge: Add support for Cadence MHDP8546 DPI/DP bridge") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Reviewed-by: Robert Foss <rfoss(a)kernel.org> Signed-off-by: Robert Foss <rfoss(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240408125810.21899-1-amishi… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c index f56ff97c9899..ae99d04f0045 100644 --- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c @@ -1978,6 +1978,9 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, mhdp_state = to_cdns_mhdp_bridge_state(new_state); mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); + if (!mhdp_state->current_mode) + return; + drm_mode_set_name(mhdp_state->current_mode); dev_dbg(mhdp->dev, "%s: Enabling mode %s\n", __func__, mode->name); -- 2.17.1

2 1

[PATCH OLK-5.10] power: supply: bq27xxx-i2c: Do not free non existing IRQ
by Guo Mengqi 09 Jul '24

09 Jul '24

From: Hans de Goede <hdegoede(a)redhat.com> stable inclusion from stable-v5.10.212 commit d7acc4a569f5f4513120c85ea2b9f04909b7490f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8ME Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2df70149e73e79783bcbc7db4fa51ecef0e2022c ] The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client->irq) check wrapping the request_threaded_irq(). But bq27xxx_battery_i2c_remove() unconditionally calls free_irq(client->irq) leading to: [ 190.310742] ------------[ cut here ]------------ [ 190.310843] Trying to free already-free IRQ 0 [ 190.310861] WARNING: CPU: 2 PID: 1304 at kernel/irq/manage.c:1893 free_irq+0x1b8/0x310 Followed by a backtrace when unbinding the driver. Add an if (client->irq) to bq27xxx_battery_i2c_remove() mirroring probe() to fix this. Fixes: 444ff00734f3 ("power: supply: bq27xxx: Fix I2C IRQ race on remove") Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20240215155133.70537-1-hdegoede@redhat.com Signed-off-by: Sebastian Reichel <sebastian.reichel(a)collabora.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/power/supply/bq27xxx_battery_i2c.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c index 0e32efb10ee7..6fbae8fc2e50 100644 --- a/drivers/power/supply/bq27xxx_battery_i2c.c +++ b/drivers/power/supply/bq27xxx_battery_i2c.c @@ -209,7 +209,9 @@ static int bq27xxx_battery_i2c_remove(struct i2c_client *client) { struct bq27xxx_device_info *di = i2c_get_clientdata(client); - free_irq(client->irq, di); + if (client->irq) + free_irq(client->irq, di); + bq27xxx_battery_teardown(di); mutex_lock(&battery_mutex); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] of: Fix double free in of_parse_phandle_with_args_map
by Guo Mengqi 09 Jul '24

09 Jul '24

From: "Christian A. Ehrhardt" <lk(a)c--e.de> stable inclusion from stable-v5.10.209 commit d5f490343c77e6708b6c4aa7dbbfbcbb9546adea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ----------------------------------------- [ Upstream commit 4dde83569832f9377362e50f7748463340c5db6b ] In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of "new" is NULL on the first iteration of the inner loop. Make sure that this is true in all iterations of the outer loop by setting "new" to NULL after its value is assigned to "cur". Extend the unittest to detect the double free and add an additional test case that actually triggers this path. Fixes: bd6f2fd5a1 ("of: Support parsing phandle argument lists through a nexus node") Cc: Stephen Boyd <stephen.boyd(a)linaro.org> Signed-off-by: "Christian A. Ehrhardt" <lk(a)c--e.de> Link: https://lore.kernel.org/r/20231229105411.1603434-1-lk@c--e.de Signed-off-by: Rob Herring <robh(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/of/base.c | 1 + drivers/of/unittest-data/tests-phandle.dtsi | 10 ++- drivers/of/unittest.c | 74 ++++++++++++--------- 3 files changed, 53 insertions(+), 32 deletions(-) diff --git a/drivers/of/base.c b/drivers/of/base.c index a44a0e7ba251..64600a9b18e8 100644 --- a/drivers/of/base.c +++ b/drivers/of/base.c @@ -1670,6 +1670,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np, out_args->np = new; of_node_put(cur); cur = new; + new = NULL; } put: of_node_put(cur); diff --git a/drivers/of/unittest-data/tests-phandle.dtsi b/drivers/of/unittest-data/tests-phandle.dtsi index 6b33be4c4416..aa0d7027ffa6 100644 --- a/drivers/of/unittest-data/tests-phandle.dtsi +++ b/drivers/of/unittest-data/tests-phandle.dtsi @@ -38,6 +38,13 @@ phandle-map-pass-thru = <0x0 0xf0>; }; + provider5: provider5 { + #phandle-cells = <2>; + phandle-map = <2 7 &provider4 2 3>; + phandle-map-mask = <0xff 0xf>; + phandle-map-pass-thru = <0x0 0xf0>; + }; + consumer-a { phandle-list = <&provider1 1>, <&provider2 2 0>, @@ -64,7 +71,8 @@ <&provider4 4 0x100>, <&provider4 0 0x61>, <&provider0>, - <&provider4 19 0x20>; + <&provider4 19 0x20>, + <&provider5 2 7>; phandle-list-bad-phandle = <12345678 0 0>; phandle-list-bad-args = <&provider2 1 0>, <&provider4 0>; diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c index 5407bbdb6439..19442d5e2bb0 100644 --- a/drivers/of/unittest.c +++ b/drivers/of/unittest.c @@ -447,6 +447,9 @@ static void __init of_unittest_parse_phandle_with_args(void) unittest(passed, "index %i - data error on node %pOF rc=%i\n", i, args.np, rc); + + if (rc == 0) + of_node_put(args.np); } /* Check for missing list property */ @@ -536,8 +539,9 @@ static void __init of_unittest_parse_phandle_with_args(void) static void __init of_unittest_parse_phandle_with_args_map(void) { - struct device_node *np, *p0, *p1, *p2, *p3; + struct device_node *np, *p[6] = {}; struct of_phandle_args args; + unsigned int prefs[6]; int i, rc; np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-b"); @@ -546,34 +550,24 @@ static void __init of_unittest_parse_phandle_with_args_map(void) return; } - p0 = of_find_node_by_path("/testcase-data/phandle-tests/provider0"); - if (!p0) { - pr_err("missing testcase data\n"); - return; - } - - p1 = of_find_node_by_path("/testcase-data/phandle-tests/provider1"); - if (!p1) { - pr_err("missing testcase data\n"); - return; - } - - p2 = of_find_node_by_path("/testcase-data/phandle-tests/provider2"); - if (!p2) { - pr_err("missing testcase data\n"); - return; - } - - p3 = of_find_node_by_path("/testcase-data/phandle-tests/provider3"); - if (!p3) { - pr_err("missing testcase data\n"); - return; + p[0] = of_find_node_by_path("/testcase-data/phandle-tests/provider0"); + p[1] = of_find_node_by_path("/testcase-data/phandle-tests/provider1"); + p[2] = of_find_node_by_path("/testcase-data/phandle-tests/provider2"); + p[3] = of_find_node_by_path("/testcase-data/phandle-tests/provider3"); + p[4] = of_find_node_by_path("/testcase-data/phandle-tests/provider4"); + p[5] = of_find_node_by_path("/testcase-data/phandle-tests/provider5"); + for (i = 0; i < ARRAY_SIZE(p); ++i) { + if (!p[i]) { + pr_err("missing testcase data\n"); + return; + } + prefs[i] = kref_read(&p[i]->kobj.kref); } rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells"); - unittest(rc == 7, "of_count_phandle_with_args() returned %i, expected 7\n", rc); + unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc); - for (i = 0; i < 8; i++) { + for (i = 0; i < 9; i++) { bool passed = true; memset(&args, 0, sizeof(args)); @@ -584,13 +578,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void) switch (i) { case 0: passed &= !rc; - passed &= (args.np == p1); + passed &= (args.np == p[1]); passed &= (args.args_count == 1); passed &= (args.args[0] == 1); break; case 1: passed &= !rc; - passed &= (args.np == p3); + passed &= (args.np == p[3]); passed &= (args.args_count == 3); passed &= (args.args[0] == 2); passed &= (args.args[1] == 5); @@ -601,28 +595,36 @@ static void __init of_unittest_parse_phandle_with_args_map(void) break; case 3: passed &= !rc; - passed &= (args.np == p0); + passed &= (args.np == p[0]); passed &= (args.args_count == 0); break; case 4: passed &= !rc; - passed &= (args.np == p1); + passed &= (args.np == p[1]); passed &= (args.args_count == 1); passed &= (args.args[0] == 3); break; case 5: passed &= !rc; - passed &= (args.np == p0); + passed &= (args.np == p[0]); passed &= (args.args_count == 0); break; case 6: passed &= !rc; - passed &= (args.np == p2); + passed &= (args.np == p[2]); passed &= (args.args_count == 2); passed &= (args.args[0] == 15); passed &= (args.args[1] == 0x20); break; case 7: + passed &= !rc; + passed &= (args.np == p[3]); + passed &= (args.args_count == 3); + passed &= (args.args[0] == 2); + passed &= (args.args[1] == 5); + passed &= (args.args[2] == 3); + break; + case 8: passed &= (rc == -ENOENT); break; default: @@ -631,6 +633,9 @@ static void __init of_unittest_parse_phandle_with_args_map(void) unittest(passed, "index %i - data error on node %s rc=%i\n", i, args.np->full_name, rc); + + if (rc == 0) + of_node_put(args.np); } /* Check for missing list property */ @@ -677,6 +682,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void) "OF: /testcase-data/phandle-tests/consumer-b: #phandle-cells = 2 found -1"); unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc); + + for (i = 0; i < ARRAY_SIZE(p); ++i) { + unittest(prefs[i] == kref_read(&p[i]->kobj.kref), + "provider%d: expected:%d got:%d\n", + i, prefs[i], kref_read(&p[i]->kobj.kref)); + of_node_put(p[i]); + } } static void __init of_unittest_property_string(void) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2 0/3] CVE-2024-38598
by Li Nan 09 Jul '24

09 Jul '24

Li Nan (2): Revert "md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter" md/raid10: check slab-out-of-bounds in md_bitmap_get_counter Yu Kuai (1): md: fix resync softlockup when bitmap size is less than array size drivers/md/md-bitmap.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) -- 2.39.2

2 4

[PATCH OLK-6.6] xfs: fix log recovery buffer allocation for the legacy h_size fixup
by Long Li 09 Jul '24

09 Jul '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.9-rc4 commit 45cf976008ddef4a9c9a30310c9b4fb2a9a6602a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0JY CVE: CVE-2024-39472 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values used for the initial umount record in old xfsprogs versions. Later commit 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks") cleaned up the log reover buffer calculation, but stoped using the fixed up h_size value to size the log recovery buffer, which can lead to an out of bounds access when the incorrect h_size does not come from the old mkfs tool, but a fuzzer. Fix this by open coding xlog_logrec_hblks and taking the fixed h_size into account for this calculation. Fixes: 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks") Reported-by: Sam Sun <samsun1006219(a)gmail.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Brian Foster <bfoster(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/xfs_log_recover.c [Conflicts due to mainline code use kvfree() in context] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_log_recover.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c index a875c7237e2d..28acda900f03 100644 --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c @@ -2985,7 +2985,7 @@ xlog_do_recovery_pass( int error = 0, h_size, h_len; int error2 = 0; int bblks, split_bblks; - int hblks, split_hblks, wrapped_hblks; + int hblks = 1, split_hblks, wrapped_hblks; int i; struct hlist_head rhash[XLOG_RHASH_SIZE]; LIST_HEAD (buffer_list); @@ -3041,14 +3041,22 @@ xlog_do_recovery_pass( if (error) goto bread_err1; - hblks = xlog_logrec_hblks(log, rhead); - if (hblks != 1) { - kmem_free(hbp); - hbp = xlog_alloc_buffer(log, hblks); + /* + * This open codes xlog_logrec_hblks so that we can reuse the + * fixed up h_size value calculated above. Without that we'd + * still allocate the buffer based on the incorrect on-disk + * size. + */ + if (h_size > XLOG_HEADER_CYCLE_SIZE && + (rhead->h_version & cpu_to_be32(XLOG_VERSION_2))) { + hblks = DIV_ROUND_UP(h_size, XLOG_HEADER_CYCLE_SIZE); + if (hblks > 1) { + kmem_free(hbp); + hbp = xlog_alloc_buffer(log, hblks); + } } } else { ASSERT(log->l_sectBBsize == 1); - hblks = 1; hbp = xlog_alloc_buffer(log, 1); h_size = XLOG_BIG_RECORD_BSIZE; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] xfs: fix log recovery buffer allocation for the legacy h_size fixup
by Long Li 09 Jul '24

09 Jul '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.9-rc4 commit 45cf976008ddef4a9c9a30310c9b4fb2a9a6602a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0JY CVE: CVE-2024-39472 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values used for the initial umount record in old xfsprogs versions. Later commit 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks") cleaned up the log reover buffer calculation, but stoped using the fixed up h_size value to size the log recovery buffer, which can lead to an out of bounds access when the incorrect h_size does not come from the old mkfs tool, but a fuzzer. Fix this by open coding xlog_logrec_hblks and taking the fixed h_size into account for this calculation. Fixes: 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks") Reported-by: Sam Sun <samsun1006219(a)gmail.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Brian Foster <bfoster(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/xfs_log_recover.c [Conflicts due to mainline code use kvfree() in context] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_log_recover.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c index 331f568834a1..898c65b77457 100644 --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c @@ -2952,7 +2952,7 @@ xlog_do_recovery_pass( int error = 0, h_size, h_len; int error2 = 0; int bblks, split_bblks; - int hblks, split_hblks, wrapped_hblks; + int hblks = 1, split_hblks, wrapped_hblks; int i; struct hlist_head rhash[XLOG_RHASH_SIZE]; LIST_HEAD (buffer_list); @@ -3008,14 +3008,22 @@ xlog_do_recovery_pass( if (error) goto bread_err1; - hblks = xlog_logrec_hblks(log, rhead); - if (hblks != 1) { - kmem_free(hbp); - hbp = xlog_alloc_buffer(log, hblks); + /* + * This open codes xlog_logrec_hblks so that we can reuse the + * fixed up h_size value calculated above. Without that we'd + * still allocate the buffer based on the incorrect on-disk + * size. + */ + if (h_size > XLOG_HEADER_CYCLE_SIZE && + (rhead->h_version & cpu_to_be32(XLOG_VERSION_2))) { + hblks = DIV_ROUND_UP(h_size, XLOG_HEADER_CYCLE_SIZE); + if (hblks > 1) { + kmem_free(hbp); + hbp = xlog_alloc_buffer(log, hblks); + } } } else { ASSERT(log->l_sectBBsize == 1); - hblks = 1; hbp = xlog_alloc_buffer(log, 1); h_size = XLOG_BIG_RECORD_BSIZE; } -- 2.39.2

2 1

[PATCH OLK-5.10] xfs: fix log recovery buffer allocation for the legacy h_size fixup
by Long Li 09 Jul '24

09 Jul '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.9-rc4 commit 45cf976008ddef4a9c9a30310c9b4fb2a9a6602a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0JY CVE: CVE-2024-39472 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values used for the initial umount record in old xfsprogs versions. Later commit 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks") cleaned up the log reover buffer calculation, but stoped using the fixed up h_size value to size the log recovery buffer, which can lead to an out of bounds access when the incorrect h_size does not come from the old mkfs tool, but a fuzzer. Fix this by open coding xlog_logrec_hblks and taking the fixed h_size into account for this calculation. Fixes: 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks") Reported-by: Sam Sun <samsun1006219(a)gmail.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Brian Foster <bfoster(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/xfs_log_recover.c [Conflicts due to mainline code use kvfree() in context] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_log_recover.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c index 331f568834a1..898c65b77457 100644 --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c @@ -2952,7 +2952,7 @@ xlog_do_recovery_pass( int error = 0, h_size, h_len; int error2 = 0; int bblks, split_bblks; - int hblks, split_hblks, wrapped_hblks; + int hblks = 1, split_hblks, wrapped_hblks; int i; struct hlist_head rhash[XLOG_RHASH_SIZE]; LIST_HEAD (buffer_list); @@ -3008,14 +3008,22 @@ xlog_do_recovery_pass( if (error) goto bread_err1; - hblks = xlog_logrec_hblks(log, rhead); - if (hblks != 1) { - kmem_free(hbp); - hbp = xlog_alloc_buffer(log, hblks); + /* + * This open codes xlog_logrec_hblks so that we can reuse the + * fixed up h_size value calculated above. Without that we'd + * still allocate the buffer based on the incorrect on-disk + * size. + */ + if (h_size > XLOG_HEADER_CYCLE_SIZE && + (rhead->h_version & cpu_to_be32(XLOG_VERSION_2))) { + hblks = DIV_ROUND_UP(h_size, XLOG_HEADER_CYCLE_SIZE); + if (hblks > 1) { + kmem_free(hbp); + hbp = xlog_alloc_buffer(log, hblks); + } } } else { ASSERT(log->l_sectBBsize == 1); - hblks = 1; hbp = xlog_alloc_buffer(log, 1); h_size = XLOG_BIG_RECORD_BSIZE; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
by Zhengchao Shao 09 Jul '24

09 Jul '24

From: Pavel Skripkin <paskripkin(a)gmail.com> mainline inclusion from mainline-v5.16-rc2 commit 9b5a333272a48c2f8b30add7a874e46e8b26129c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNEY CVE: CVE-2021-47204 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Access to netdev after free_netdev() will cause use-after-free bug. Move debug log before free_netdev() call to avoid it. Fixes: 7472dd9f6499 ("staging: fsl-dpaa2/eth: Move print message") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c [The conflict occurs because the commit 34ff68465a17("dpaa2-eth: Move DPAA2 Ethernet driver from staging to drivers/net") is not merged] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c index 9329fcad95ac..2f8f1f3f1bcd 100644 --- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c +++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c @@ -2632,10 +2632,10 @@ static int dpaa2_eth_remove(struct fsl_mc_device *ls_dev) fsl_mc_portal_free(priv->mc_io); - free_netdev(net_dev); - dev_dbg(net_dev->dev.parent, "Removed interface %s\n", net_dev->name); + free_netdev(net_dev); + return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension
by Xiongfeng Wang 09 Jul '24

09 Jul '24

From: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> mainline inclusion from mainline-v6.10-rc2 commit ffa077b2f6ad124ec3d23fbddc5e4b0ff2647af8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB05U CVE: CVE-2024-39473 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a process module does not have base config extension then the same format applies to all of it's inputs and the process->base_config_ext is NULL, causing NULL dereference when specifically crafted topology and sequences used. Fixes: 648fea128476 ("ASoC: SOF: ipc4-topology: set copier output format for process module") Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo(a)linux.intel.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: stable(a)vger.kernel.org Link: https://msgid.link/r/20240529121201.14687-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- sound/soc/sof/ipc4-topology.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c index 2c075afd237c..78ff129be772 100644 --- a/sound/soc/sof/ipc4-topology.c +++ b/sound/soc/sof/ipc4-topology.c @@ -195,6 +195,14 @@ sof_ipc4_get_input_pin_audio_fmt(struct snd_sof_widget *swidget, int pin_index) } process = swidget->private; + + /* + * For process modules without base config extension, base module config + * format is used for all input pins + */ + if (process->init_config != SOF_IPC4_MODULE_INIT_CONFIG_TYPE_BASE_CFG_WITH_EXT) + return &process->base_config.audio_fmt; + base_cfg_ext = process->base_config_ext; /* -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] cgroup: Fix AA deadlock caused by cgroup_bpf_release
by Chen Ridong 09 Jul '24

09 Jul '24

*** BLURB HERE *** Chen Ridong (1): cgroup: Fix AA deadlock caused by cgroup_bpf_release kernel/bpf/cgroup.c | 2 +- kernel/cgroup/cgroup-internal.h | 1 + kernel/cgroup/cgroup.c | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] cgroup: Fix AA deadlock caused by cgroup_bpf_release
by Chen Ridong 09 Jul '24

09 Jul '24

*** BLURB HERE *** Chen Ridong (1): cgroup: Fix AA deadlock caused by cgroup_bpf_release kernel/bpf/cgroup.c | 2 +- kernel/cgroup/cgroup-internal.h | 1 + kernel/cgroup/cgroup.c | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] cgroup: Fix AA deadlock caused by cgroup_bpf_release
by Chen Ridong 09 Jul '24

09 Jul '24

*** BLURB HERE *** Chen Ridong (1): cgroup: Fix AA deadlock caused by cgroup_bpf_release kernel/bpf/cgroup.c | 2 +- kernel/cgroup/cgroup-internal.h | 1 + kernel/cgroup/cgroup.c | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
by Zhengchao Shao 09 Jul '24

09 Jul '24

From: Pavel Skripkin <paskripkin(a)gmail.com> mainline inclusion from mainline-v5.16-rc2 commit 9b5a333272a48c2f8b30add7a874e46e8b26129c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNEY CVE: CVE-2021-47204 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Access to netdev after free_netdev() will cause use-after-free bug. Move debug log before free_netdev() call to avoid it. Fixes: 7472dd9f6499 ("staging: fsl-dpaa2/eth: Move print message") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c [The conflict occurs because the commit 34ff68465a17("dpaa2-eth: Move DPAA2 Ethernet driver from staging to drivers/net") is not merged] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c index 9329fcad95ac..2f8f1f3f1bcd 100644 --- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c +++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c @@ -2632,10 +2632,10 @@ static int dpaa2_eth_remove(struct fsl_mc_device *ls_dev) fsl_mc_portal_free(priv->mc_io); - free_netdev(net_dev); - dev_dbg(net_dev->dev.parent, "Removed interface %s\n", net_dev->name); + free_netdev(net_dev); + return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10] fpga: manager: add owner module and take its refcount
by Liu Chuang 09 Jul '24

09 Jul '24

From: Marco Pagani <marpagan(a)redhat.com> mainline inclusion from mainline-v6.10-rc1 commit 4d4d2d4346857bf778fafaa97d6f76bb1663e3c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7YM1 CVE: CVE-2024-37021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The current implementation of the fpga manager assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer dereference while attempting to get the manager if the parent device does not have a driver. To address this problem, add a module owner pointer to the fpga_manager struct and use it to take the module's refcount. Modify the functions for registering the manager to take an additional owner module parameter and rename them to avoid conflicts. Use the old function names for helper macros that automatically set the module that registers the manager as the owner. This ensures compatibility with existing low-level control modules and reduces the chances of registering a manager without setting the owner. Also, update the documentation to keep it consistent with the new interface for registering an fpga manager. Other changes: opportunistically move put_device() from __fpga_mgr_get() to fpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the manager device is taken in these functions. Fixes: 654ba4cc0f3e ("fpga manager: ensure lifetime with of_fpga_mgr_get") Suggested-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Suggested-by: Xu Yilun <yilun.xu(a)intel.com> Signed-off-by: Marco Pagani <marpagan(a)redhat.com> Acked-by: Xu Yilun <yilun.xu(a)intel.com> Link: https://lore.kernel.org/r/20240305192926.84886-1-marpagan@redhat.com Signed-off-by: Xu Yilun <yilun.xu(a)linux.intel.com> Conflicts: drivers/fpga/fpga-mgr.c include/linux/fpga/fpga-mgr.h Documentation/driver-api/fpga/fpga-mgr.rst [Liu Chuang: add owner module.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/fpga/fpga-mgr.c | 62 ++++++++++++++++++++--------------- include/linux/fpga/fpga-mgr.h | 14 +++++--- 2 files changed, 46 insertions(+), 30 deletions(-) diff --git a/drivers/fpga/fpga-mgr.c b/drivers/fpga/fpga-mgr.c index f38bab01432e..f65ea09af2fb 100644 --- a/drivers/fpga/fpga-mgr.c +++ b/drivers/fpga/fpga-mgr.c @@ -444,20 +444,15 @@ static struct attribute *fpga_mgr_attrs[] = { }; ATTRIBUTE_GROUPS(fpga_mgr); -static struct fpga_manager *__fpga_mgr_get(struct device *dev) +static struct fpga_manager *__fpga_mgr_get(struct device *mgr_dev) { struct fpga_manager *mgr; - mgr = to_fpga_manager(dev); - - if (!try_module_get(dev->parent->driver->owner)) - goto err_dev; + mgr = to_fpga_manager(mgr_dev); + if (!try_module_get(mgr->mops_owner)) + mgr = ERR_PTR(-ENODEV); return mgr; - -err_dev: - put_device(dev); - return ERR_PTR(-ENODEV); } static int fpga_mgr_dev_match(struct device *dev, const void *data) @@ -473,12 +468,18 @@ static int fpga_mgr_dev_match(struct device *dev, const void *data) */ struct fpga_manager *fpga_mgr_get(struct device *dev) { - struct device *mgr_dev = class_find_device(fpga_mgr_class, NULL, dev, - fpga_mgr_dev_match); + struct fpga_manager *mgr; + struct device *mgr_dev; + + mgr_dev = class_find_device(fpga_mgr_class, NULL, dev, fpga_mgr_dev_match); if (!mgr_dev) return ERR_PTR(-ENODEV); - return __fpga_mgr_get(mgr_dev); + mgr = __fpga_mgr_get(mgr_dev); + if (IS_ERR(mgr)) + put_device(mgr_dev); + + return mgr; } EXPORT_SYMBOL_GPL(fpga_mgr_get); @@ -491,13 +492,18 @@ EXPORT_SYMBOL_GPL(fpga_mgr_get); */ struct fpga_manager *of_fpga_mgr_get(struct device_node *node) { - struct device *dev; + struct fpga_manager *mgr; + struct device *mgr_dev; - dev = class_find_device_by_of_node(fpga_mgr_class, node); - if (!dev) + mgr_dev = class_find_device_by_of_node(fpga_mgr_class, node); + if (!mgr_dev) return ERR_PTR(-ENODEV); - return __fpga_mgr_get(dev); + mgr = __fpga_mgr_get(mgr_dev); + if (IS_ERR(mgr)) + put_device(mgr_dev); + + return mgr; } EXPORT_SYMBOL_GPL(of_fpga_mgr_get); @@ -507,7 +513,7 @@ EXPORT_SYMBOL_GPL(of_fpga_mgr_get); */ void fpga_mgr_put(struct fpga_manager *mgr) { - module_put(mgr->dev.parent->driver->owner); + module_put(mgr->mops_owner); put_device(&mgr->dev); } EXPORT_SYMBOL_GPL(fpga_mgr_put); @@ -546,20 +552,21 @@ void fpga_mgr_unlock(struct fpga_manager *mgr) EXPORT_SYMBOL_GPL(fpga_mgr_unlock); /** - * fpga_mgr_create - create and initialize a FPGA manager struct + * __fpga_mgr_create - create and initialize a FPGA manager struct * @dev: fpga manager device from pdev * @name: fpga manager name * @mops: pointer to structure of fpga manager ops * @priv: fpga manager private data + * @owner: owner module containing the ops * * The caller of this function is responsible for freeing the struct with * fpga_mgr_free(). Using devm_fpga_mgr_create() instead is recommended. * * Return: pointer to struct fpga_manager or NULL */ -struct fpga_manager *fpga_mgr_create(struct device *dev, const char *name, +struct fpga_manager *__fpga_mgr_create(struct device *dev, const char *name, const struct fpga_manager_ops *mops, - void *priv) + void *priv, struct module *owner) { struct fpga_manager *mgr; int id, ret; @@ -586,6 +593,8 @@ struct fpga_manager *fpga_mgr_create(struct device *dev, const char *name, mutex_init(&mgr->ref_mutex); + mgr->mops_owner = owner; + mgr->name = name; mgr->mops = mops; mgr->priv = priv; @@ -610,7 +619,7 @@ struct fpga_manager *fpga_mgr_create(struct device *dev, const char *name, return NULL; } -EXPORT_SYMBOL_GPL(fpga_mgr_create); +EXPORT_SYMBOL_GPL(__fpga_mgr_create); /** * fpga_mgr_free - free a FPGA manager created with fpga_mgr_create() @@ -631,11 +640,12 @@ static void devm_fpga_mgr_release(struct device *dev, void *res) } /** - * devm_fpga_mgr_create - create and initialize a managed FPGA manager struct + * __devm_fpga_mgr_create - create and initialize a managed FPGA manager struct * @dev: fpga manager device from pdev * @name: fpga manager name * @mops: pointer to structure of fpga manager ops * @priv: fpga manager private data + * @owner: owner module containing the ops * * This function is intended for use in a FPGA manager driver's probe function. * After the manager driver creates the manager struct with @@ -647,9 +657,9 @@ static void devm_fpga_mgr_release(struct device *dev, void *res) * * Return: pointer to struct fpga_manager or NULL */ -struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name, +struct fpga_manager *__devm_fpga_mgr_create(struct device *dev, const char *name, const struct fpga_manager_ops *mops, - void *priv) + void *priv, struct module *owner) { struct fpga_manager **ptr, *mgr; @@ -657,7 +667,7 @@ struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name, if (!ptr) return NULL; - mgr = fpga_mgr_create(dev, name, mops, priv); + mgr = __fpga_mgr_create(dev, name, mops, priv, owner); if (!mgr) { devres_free(ptr); } else { @@ -667,7 +677,7 @@ struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name, return mgr; } -EXPORT_SYMBOL_GPL(devm_fpga_mgr_create); +EXPORT_SYMBOL_GPL(__devm_fpga_mgr_create); /** * fpga_mgr_register - register a FPGA manager diff --git a/include/linux/fpga/fpga-mgr.h b/include/linux/fpga/fpga-mgr.h index e8ca62b2cb5b..7c97e1c359b0 100644 --- a/include/linux/fpga/fpga-mgr.h +++ b/include/linux/fpga/fpga-mgr.h @@ -162,6 +162,7 @@ struct fpga_compat_id { * @state: state of fpga manager * @compat_id: FPGA manager id for compatibility check. * @mops: pointer to struct of fpga manager ops + * @mops_owner: module containing the mops * @priv: low level driver private date */ struct fpga_manager { @@ -171,6 +172,7 @@ struct fpga_manager { enum fpga_mgr_states state; struct fpga_compat_id *compat_id; const struct fpga_manager_ops *mops; + struct module *mops_owner; void *priv; }; @@ -191,15 +193,19 @@ struct fpga_manager *fpga_mgr_get(struct device *dev); void fpga_mgr_put(struct fpga_manager *mgr); -struct fpga_manager *fpga_mgr_create(struct device *dev, const char *name, +#define fpga_mgr_create(dev, name, mops, priv) \ + __fpga_mgr_create(dev, name, mops, priv, THIS_MODULE) +struct fpga_manager *__fpga_mgr_create(struct device *dev, const char *name, const struct fpga_manager_ops *mops, - void *priv); + void *priv, struct module *owner); void fpga_mgr_free(struct fpga_manager *mgr); int fpga_mgr_register(struct fpga_manager *mgr); void fpga_mgr_unregister(struct fpga_manager *mgr); -struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name, +#define devm_fpga_mgr_create(dev, name, mops, priv) \ + __devm_fpga_mgr_create(dev, name, mops, priv, THIS_MODULE) +struct fpga_manager *__devm_fpga_mgr_create(struct device *dev, const char *name, const struct fpga_manager_ops *mops, - void *priv); + void *priv, struct module *owner); #endif /*_LINUX_FPGA_MGR_H */ -- 2.34.1

2 1

[PATCH] Support selecting congestion control algorithms.
by Chengchang Tang 09 Jul '24

09 Jul '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Support configuring congestion control algorithms with hns direct verbs. New option: --congest_type Usage example: ./ib_send_bw -d hns_0 --congest_type=DCQCN ./ib_send_bw -d hns_0 --congest_type=DCQCN 192.168.100.100 update perftest.spec. Signed-off-by:Xinghai Cen <cenxinghai(a)partners.com> --- ...-selecting-congestion-control-algori.patch | 276 ++++++++++++++++++ perftest.spec | 9 +- 2 files changed, 284 insertions(+), 1 deletion(-) create mode 100644 0010-Perftest-Support-selecting-congestion-control-algori.patch diff --git a/0010-Perftest-Support-selecting-congestion-control-algori.patch b/0010-Perftest-Support-selecting-congestion-control-algori.patch new file mode 100644 index 0000000..ba539b2 --- /dev/null +++ b/0010-Perftest-Support-selecting-congestion-control-algori.patch @@ -0,0 +1,276 @@ +From d3d89123a650aa400be38d6ac939202a909783d4 Mon Sep 17 00:00:00 2001 +From: Guofeng Yue <yueguofeng(a)h-partners.com> +Date: Fri, 28 Jun 2024 10:56:09 +0800 +Subject: [PATCH] Perftest: Support selecting congestion control algorithms + +Support configuring congestion control algorithms with hns direct verbs. + + New option: --congest_type + + Usage example: + ./ib_send_bw -d hns_0 --congest_type=DCQCN + ./ib_send_bw -d hns_0 --congest_type=DCQCN 192.168.100.100 + +Signed-off-by: Guofeng Yue <yueguofeng(a)h-partners.com> +Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> +--- + Makefile.am | 24 ++++++++--------- + configure.ac | 7 +++++ + src/perftest_parameters.c | 57 +++++++++++++++++++++++++++++++++++++++ + src/perftest_parameters.h | 1 + + src/perftest_resources.c | 12 +++++++++ + src/perftest_resources.h | 3 +++ + 6 files changed, 92 insertions(+), 12 deletions(-) + +diff --git a/Makefile.am b/Makefile.am +index dc3ca41..807e169 100755 +--- a/Makefile.am ++++ b/Makefile.am +@@ -104,41 +104,41 @@ LIBMLX4= + endif + + ib_send_bw_SOURCES = src/send_bw.c src/multicast_resources.c src/multicast_resources.h +-ib_send_bw_LDADD = libperftest.a $(LIBUMAD) $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_send_bw_LDADD = libperftest.a $(LIBUMAD) $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_send_lat_SOURCES = src/send_lat.c src/multicast_resources.c src/multicast_resources.h +-ib_send_lat_LDADD = libperftest.a $(LIBUMAD) $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_send_lat_LDADD = libperftest.a $(LIBUMAD) $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_write_lat_SOURCES = src/write_lat.c +-ib_write_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_write_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_write_bw_SOURCES = src/write_bw.c +-ib_write_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_write_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_read_lat_SOURCES = src/read_lat.c +-ib_read_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_read_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_read_bw_SOURCES = src/read_bw.c +-ib_read_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_read_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_atomic_lat_SOURCES = src/atomic_lat.c +-ib_atomic_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_atomic_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + ib_atomic_bw_SOURCES = src/atomic_bw.c +-ib_atomic_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++ib_atomic_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + if HAVE_RAW_ETH + raw_ethernet_bw_SOURCES = src/raw_ethernet_send_bw.c +-raw_ethernet_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++raw_ethernet_bw_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + raw_ethernet_lat_SOURCES = src/raw_ethernet_send_lat.c +-raw_ethernet_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++raw_ethernet_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + raw_ethernet_burst_lat_SOURCES = src/raw_ethernet_send_burst_lat.c +-raw_ethernet_burst_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++raw_ethernet_burst_lat_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + raw_ethernet_fs_rate_SOURCES = src/raw_ethernet_fs_rate.c +-raw_ethernet_fs_rate_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) ++raw_ethernet_fs_rate_LDADD = libperftest.a $(LIBMATH) $(LIBMLX4) $(LIBMLX5) $(LIBEFA) $(LIBHNS) + + else + raw_ethernet_bw_SOURCES = +diff --git a/configure.ac b/configure.ac +index 71b8382..e59bf39 100755 +--- a/configure.ac ++++ b/configure.ac +@@ -382,6 +382,13 @@ if [test $HAVE_MLX5DV_LIB = yes] && [test $HAVE_MLX5DV = yes]; then + AC_SUBST([LIBMLX5]) + fi + ++AC_CHECK_LIB([hns], [hnsdv_query_device], [HAVE_HNSDV=yes LIBHNS=-lhns], [HAVE_HNSDV=no]) ++AM_CONDITIONAL([HAVE_HNSDV], [test "x$HAVE_HNSDV" = "xyes"]) ++if [test $HAVE_HNSDV = yes]; then ++ AC_DEFINE([HAVE_HNSDV], [1], [Have hns Direct Verbs support]) ++ AC_SUBST([LIBHNS]) ++fi ++ + CFLAGS="-g -Wall -D_GNU_SOURCE -O3 $CFLAGS" + LDFLAGS="$LDFLAGS" + LIBS=$LIBS" -lpthread" +diff --git a/src/perftest_parameters.c b/src/perftest_parameters.c +index dfa7241..cff1336 100755 +--- a/src/perftest_parameters.c ++++ b/src/perftest_parameters.c +@@ -34,6 +34,9 @@ static const char *portStates[] = {"Nop","Down","Init","Armed","","Active Defer" + static const char *qp_state[] = {"OFF","ON"}; + static const char *exchange_state[] = {"Ethernet","rdma_cm"}; + static const char *atomicTypesStr[] = {"CMP_AND_SWAP","FETCH_AND_ADD"}; ++#ifdef HAVE_HNSDV ++static const char *congestStr[] = {"DCQCN","LDCP","HC3","DIP"}; ++#endif + + /****************************************************************************** + * parse_mac_from_str. +@@ -438,6 +441,11 @@ static void usage(const char *argv0, VerbType verb, TestType tst, int connection + printf(" --cpu_util "); + printf(" Show CPU Utilization in report, valid only in Duration mode \n"); + ++ #ifdef HAVE_HNSDV ++ printf(" --congest_type=<DCQCN, LDCP, HC3, DIP> "); ++ printf(" Use the hnsdv interface to set congestion control algorithm.\n"); ++ #endif ++ + if (tst != FS_RATE) { + printf(" --dlid "); + printf(" Set a Destination LID instead of getting it from the other side.\n"); +@@ -863,6 +871,7 @@ static void init_perftest_params(struct perftest_parameters *user_param) + user_param->source_ip = NULL; + user_param->has_source_ip = 0; + user_param->use_write_with_imm = 0; ++ user_param->congest_type = OFF; + } + + static int open_file_write(const char* file_path) +@@ -961,6 +970,25 @@ static void change_conn_type(int *cptr, VerbType verb, const char *optarg) + exit(1); + } + } ++ ++#ifdef HAVE_HNSDV ++static void set_congest_type(int *cgtr, const char *optarg) ++{ ++ if (strcmp(congestStr[0], optarg) == 0) { ++ *cgtr = HNSDV_QP_CREATE_ENABLE_DCQCN; ++ } else if (strcmp(congestStr[1], optarg) == 0) { ++ *cgtr = HNSDV_QP_CREATE_ENABLE_LDCP; ++ } else if (strcmp(congestStr[2], optarg) == 0) { ++ *cgtr = HNSDV_QP_CREATE_ENABLE_HC3; ++ } else if (strcmp(congestStr[3], optarg) == 0) { ++ *cgtr = HNSDV_QP_CREATE_ENABLE_DIP; ++ } else { ++ fprintf(stderr, " Invalid congest type. Please choose from {DCQCN,LDCP,HC3,DIP}\n"); ++ exit(1); ++ } ++} ++#endif ++ + /****************************************************************************** + * + ******************************************************************************/ +@@ -1756,6 +1784,23 @@ static void force_dependecies(struct perftest_parameters *user_param) + } + } + ++ #ifdef HAVE_HNSDV ++ if (user_param->congest_type) { ++ if (user_param->work_rdma_cm == ON) ++ { ++ printf(RESULT_LINE); ++ fprintf(stderr, "rdma_cm does not support setting congest type.\n"); ++ exit(1); ++ } ++ ++ if (user_param->connection_type == XRC || user_param->connection_type == UD) { ++ printf(RESULT_LINE); ++ fprintf(stdout, "XRC/UD does not support setting congest type.\n"); ++ exit(1); ++ } ++ } ++ #endif ++ + return; + } + /****************************************************************************** +@@ -2273,6 +2318,9 @@ int parser(struct perftest_parameters *user_param,char *argv[], int argc) + static int credentials_path_flag = 0; + static int data_enc_key_app_path_flag = 0; + #endif ++ #ifdef HAVE_HNSDV ++ static int congest_type_flag = 0; ++ #endif + + char *server_ip = NULL; + char *client_ip = NULL; +@@ -2426,6 +2474,9 @@ int parser(struct perftest_parameters *user_param,char *argv[], int argc) + #if defined HAVE_OOO_ATTR + {.name = "use_ooo", .has_arg = 0, .flag = &use_ooo_flag, .val = 1}, + #endif ++ #ifdef HAVE_HNSDV ++ { .name = "congest_type", .has_arg = 1, .flag = &congest_type_flag, .val = 1}, ++ #endif + {.name = "bind_source_ip", .has_arg = 1, .flag = &source_ip_flag, .val = 1}, + {.name = "write_with_imm", .has_arg = 0, .flag = &use_write_with_imm_flag, .val = 1 }, + {0} +@@ -2720,6 +2771,12 @@ int parser(struct perftest_parameters *user_param,char *argv[], int argc) + free(duplicates_checker); + return FAILURE; + case 0: /* required for long options to work. */ ++ #ifdef HAVE_HNSDV ++ if (congest_type_flag) { ++ set_congest_type(&user_param->congest_type, optarg); ++ congest_type_flag = 0; ++ } ++ #endif + if (pkey_flag) { + CHECK_VALUE(user_param->pkey_index,int,"Pkey index",not_int_ptr); + pkey_flag = 0; +diff --git a/src/perftest_parameters.h b/src/perftest_parameters.h +index aa476f1..d26253d 100755 +--- a/src/perftest_parameters.h ++++ b/src/perftest_parameters.h +@@ -523,6 +523,7 @@ struct perftest_parameters { + int recv_post_list; + int duration; + int use_srq; ++ int congest_type; + int use_xrc; + int use_rss; + int srq_exists; +diff --git a/src/perftest_resources.c b/src/perftest_resources.c +index eeb679c..be3890c 100755 +--- a/src/perftest_resources.c ++++ b/src/perftest_resources.c +@@ -2219,6 +2219,9 @@ struct ibv_qp* ctx_qp_create(struct pingpong_context *ctx, + struct efadv_qp_init_attr efa_attr = {}; + #endif + #endif ++ #ifdef HAVE_HNSDV ++ struct hnsdv_qp_init_attr hns_attr = {}; ++ #endif + + attr.send_cq = ctx->send_cq; + attr.recv_cq = (user_param->verb == SEND || user_param->verb == WRITE_IMM) ? ctx->recv_cq : ctx->send_cq; +@@ -2382,6 +2385,15 @@ struct ibv_qp* ctx_qp_create(struct pingpong_context *ctx, + #endif // HAVE_AES_XTS + else + #endif // HAVE_MLX5DV ++ ++ #ifdef HAVE_HNSDV ++ if (user_param->congest_type) { ++ hns_attr.comp_mask = HNSDV_QP_INIT_ATTR_MASK_QP_CONGEST_TYPE; ++ hns_attr.congest_type = user_param->congest_type; ++ qp = hnsdv_create_qp(ctx->context, &attr_ex, &hns_attr); ++ } ++ else ++ #endif //HAVE_HNSDV + qp = ibv_create_qp_ex(ctx->context, &attr_ex); + } + else +diff --git a/src/perftest_resources.h b/src/perftest_resources.h +index 12386e2..565deda 100755 +--- a/src/perftest_resources.h ++++ b/src/perftest_resources.h +@@ -55,6 +55,9 @@ + #if defined(HAVE_MLX5DV) + #include <infiniband/mlx5dv.h> + #endif ++#if defined(HAVE_HNSDV) ++#include <infiniband/hnsdv.h> ++#endif + #include <rdma/rdma_cma.h> + #include <stdint.h> + #if defined(__FreeBSD__) +-- +2.33.0 + diff --git a/perftest.spec b/perftest.spec index c49d33d..c34a50b 100644 --- a/perftest.spec +++ b/perftest.spec @@ -1,6 +1,6 @@ Name: perftest Version: 4.5 -Release: 6 +Release: 7 License: GPLv2 or BSD Summary: RDMA Performance Testing Tools Url: https://github.com/linux-rdma/perftest @@ -15,6 +15,7 @@ Patch6: 0006-Perftest-Add-new-HNS-roce-device-ROH-to-support-new_.patch Patch7: 0007-add-loongarch-support-for-perftest.patch Patch8: 0008-Get-CPU-MHz-on-RISC-V.patch Patch9: 0009-Get-CPU-cycles-on-RISC-V.patch +Patch10: 0010-Perftest-Support-selecting-congestion-control-algori.patch BuildRequires: automake gcc libibverbs-devel >= 1.2.0 librdmacm-devel >= 1.0.21 libibumad-devel >= 1.3.10.2 BuildRequires: pciutils-devel libibverbs librdmacm libibumad @@ -41,6 +42,12 @@ done %_bindir/* %changelog +* Mon Jul 8 2024 Xinghai Cen <cenxinghai(a)h-partners.com> - 4.5-7 +- Type: feature +- ID: NA +- SUG: NA +- DESC: support selecting congestion control algorithms + * Fri Jan 19 2024 Chengchang Tang <tangchengchang(a)huawei.com> - 4.5-6 - Type: bugfix - ID: NA -- 2.33.0

1 0

[PATCH OLK-6.6] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v6.6.34 commit 7590da4c04dd4aa9c262da0231e978263861c6eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 upstream. Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index ee3b1a4e0848..8fa6796787f4 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1344,7 +1344,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static void __exit davinci_mmcsd_remove(struct platform_device *pdev) +static void davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1399,7 +1399,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove_new = __exit_p(davinci_mmcsd_remove), + .remove_new = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v5.10.221 commit 6ff7cfa02baabec907f6f29ea76634e6256d2ec4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 647928ab00a3..77258948440f 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1347,7 +1347,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static int __exit davinci_mmcsd_remove(struct platform_device *pdev) +static int davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1404,7 +1404,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove = __exit_p(davinci_mmcsd_remove), + .remove = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS-SP1] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v5.10.221 commit 6ff7cfa02baabec907f6f29ea76634e6256d2ec4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 647928ab00a3..77258948440f 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1347,7 +1347,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static int __exit davinci_mmcsd_remove(struct platform_device *pdev) +static int davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1404,7 +1404,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove = __exit_p(davinci_mmcsd_remove), + .remove = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 1

[PATCH OLK-5.10] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v5.10.221 commit 6ff7cfa02baabec907f6f29ea76634e6256d2ec4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index 647928ab00a3..77258948440f 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1347,7 +1347,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static int __exit davinci_mmcsd_remove(struct platform_device *pdev) +static int davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1404,7 +1404,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove = __exit_p(davinci_mmcsd_remove), + .remove = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] mmc: davinci: Don't strip remove function when driver is builtin
by Yi Yang 09 Jul '24

09 Jul '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> stable inclusion from stable-v5.10.221 commit 6ff7cfa02baabec907f6f29ea76634e6256d2ec4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB0L1 CVE: CVE-2024-39484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55c421b364482b61c4c45313a535e61ed5ae4ea3 ] Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) -> davinci_mmcsd_remove (section: .exit.text) Fixes: b4cff4549b7a ("DaVinci: MMC: MMC/SD controller driver for DaVinci family") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240324114017.231936-2-u.kleine-koenig@pengutron… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c index e6f14257a7d0..591cef502b59 100644 --- a/drivers/mmc/host/davinci_mmc.c +++ b/drivers/mmc/host/davinci_mmc.c @@ -1361,7 +1361,7 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) return ret; } -static int __exit davinci_mmcsd_remove(struct platform_device *pdev) +static int davinci_mmcsd_remove(struct platform_device *pdev) { struct mmc_davinci_host *host = platform_get_drvdata(pdev); @@ -1413,7 +1413,7 @@ static struct platform_driver davinci_mmcsd_driver = { .of_match_table = davinci_mmc_dt_ids, }, .probe = davinci_mmcsd_probe, - .remove = __exit_p(davinci_mmcsd_remove), + .remove = davinci_mmcsd_remove, .id_table = davinci_mmc_devtype, }; -- 2.25.1

2 1

[PATCH OLK-6.6 0/5] fix CVE-2024-38620
by Jialin Zhang 09 Jul '24

09 Jul '24

Christophe JAILLET (1): Bluetooth: Remove usage of the deprecated ida_simple_xx() API Iulia Tanasescu (1): Bluetooth: ISO: Fix BIS cleanup Luiz Augusto von Dentz (1): Bluetooth: HCI: Remove HCI_AMP support Lukas Bulwahn (1): Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS Pauli Virtanen (1): Bluetooth: fix connection setup in l2cap_connect drivers/bluetooth/btmrvl_main.c | 9 - drivers/bluetooth/btrsi.c | 1 - drivers/bluetooth/btsdio.c | 8 - drivers/bluetooth/btusb.c | 5 - drivers/bluetooth/hci_bcm4377.c | 1 - drivers/bluetooth/hci_ldisc.c | 6 - drivers/bluetooth/hci_serdev.c | 5 - drivers/bluetooth/hci_uart.h | 1 - drivers/bluetooth/hci_vhci.c | 10 +- drivers/bluetooth/virtio_bt.c | 2 - include/net/bluetooth/hci.h | 114 ------------ include/net/bluetooth/hci_core.h | 46 +---- include/net/bluetooth/hci_sync.h | 2 + include/uapi/linux/virtio_bt.h | 1 - net/bluetooth/hci_conn.c | 10 +- net/bluetooth/hci_core.c | 135 ++------------ net/bluetooth/hci_event.c | 310 ------------------------------- net/bluetooth/hci_sock.c | 9 +- net/bluetooth/hci_sync.c | 138 ++------------ net/bluetooth/l2cap_core.c | 21 +-- net/bluetooth/mgmt.c | 84 +++------ 21 files changed, 73 insertions(+), 845 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-22.03-LTS-SP1] ksmbd: fix slab out of bounds write in smb_inherit_dacl()
by Wang Zhaolong 09 Jul '24

09 Jul '24

From: Yang Xiongwei <yangxiongwei6(a)huawei.com> mainline inclusion from mainline-v6.7-rc1 commit eebff19acaa35820cb09ce2ccb3d21bee2156ffb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LC CVE: CVE-2023-52755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-22271 Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c fs/ksmbd/smbacl.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6(a)huawei.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ksmbd/smbacl.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index d76cee773b82..e173717330ff 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -1098,6 +1098,7 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, struct smb_acl *pdacl; struct smb_sid *powner_sid = NULL, *pgroup_sid = NULL; int powner_sid_size = 0, pgroup_sid_size = 0, pntsd_size; + int pntsd_alloc_size; if (parent_pntsd->osidoffset) { powner_sid = (struct smb_sid *)((char *)parent_pntsd + @@ -1110,9 +1111,10 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, pgroup_sid_size = 1 + 1 + 6 + (pgroup_sid->num_subauth * 4); } - pntsd = kzalloc(sizeof(struct smb_ntsd) + powner_sid_size + - pgroup_sid_size + sizeof(struct smb_acl) + - nt_size, GFP_KERNEL); + pntsd_alloc_size = sizeof(struct smb_ntsd) + powner_sid_size + + pgroup_sid_size + sizeof(struct smb_acl) + nt_size; + + pntsd = kzalloc(pntsd_alloc_size, GFP_KERNEL); if (!pntsd) { rc = -ENOMEM; goto free_aces_base; @@ -1127,6 +1129,27 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, pntsd->gsidoffset = parent_pntsd->gsidoffset; pntsd->dacloffset = parent_pntsd->dacloffset; + if ((u64)le32_to_cpu(pntsd->osidoffset) + powner_sid_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + + if ((u64)le32_to_cpu(pntsd->gsidoffset) + pgroup_sid_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + + if ((u64)le32_to_cpu(pntsd->dacloffset) + sizeof(struct smb_acl) + nt_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + if (pntsd->osidoffset) { struct smb_sid *owner_sid = (struct smb_sid *)((char *)pntsd + le32_to_cpu(pntsd->osidoffset)); -- 2.34.3

2 1

[PATCH OLK-5.10] ksmbd: fix slab out of bounds write in smb_inherit_dacl()
by Wang Zhaolong 09 Jul '24

09 Jul '24

From: Yang Xiongwei <yangxiongwei6(a)huawei.com> mainline inclusion from mainline-v6.7-rc1 commit eebff19acaa35820cb09ce2ccb3d21bee2156ffb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LC CVE: CVE-2023-52755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-22271 Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c fs/ksmbd/smbacl.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6(a)huawei.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ksmbd/smbacl.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index d76cee773b82..e173717330ff 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -1098,6 +1098,7 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, struct smb_acl *pdacl; struct smb_sid *powner_sid = NULL, *pgroup_sid = NULL; int powner_sid_size = 0, pgroup_sid_size = 0, pntsd_size; + int pntsd_alloc_size; if (parent_pntsd->osidoffset) { powner_sid = (struct smb_sid *)((char *)parent_pntsd + @@ -1110,9 +1111,10 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, pgroup_sid_size = 1 + 1 + 6 + (pgroup_sid->num_subauth * 4); } - pntsd = kzalloc(sizeof(struct smb_ntsd) + powner_sid_size + - pgroup_sid_size + sizeof(struct smb_acl) + - nt_size, GFP_KERNEL); + pntsd_alloc_size = sizeof(struct smb_ntsd) + powner_sid_size + + pgroup_sid_size + sizeof(struct smb_acl) + nt_size; + + pntsd = kzalloc(pntsd_alloc_size, GFP_KERNEL); if (!pntsd) { rc = -ENOMEM; goto free_aces_base; @@ -1127,6 +1129,27 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, pntsd->gsidoffset = parent_pntsd->gsidoffset; pntsd->dacloffset = parent_pntsd->dacloffset; + if ((u64)le32_to_cpu(pntsd->osidoffset) + powner_sid_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + + if ((u64)le32_to_cpu(pntsd->gsidoffset) + pgroup_sid_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + + if ((u64)le32_to_cpu(pntsd->dacloffset) + sizeof(struct smb_acl) + nt_size > + pntsd_alloc_size) { + rc = -EINVAL; + kfree(pntsd); + goto free_aces_base; + } + if (pntsd->osidoffset) { struct smb_sid *owner_sid = (struct smb_sid *)((char *)pntsd + le32_to_cpu(pntsd->osidoffset)); -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] smb: client: fix potential deadlock when releasing mids
by Wang Zhaolong 09 Jul '24

09 Jul '24

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.7-rc1 commit e6322fd177c6885a21dd4609dc5e5c973d1a2eb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4KS CVE: CVE-2023-52757 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- All release_mid() callers seem to hold a reference of @mid so there is no need to call kref_put(&mid->refcount, __release_mid) under @server->mid_lock spinlock. If they don't, then an use-after-free bug would have occurred anyways. By getting rid of such spinlock also fixes a potential deadlock as shown below CPU 0 CPU 1 ------------------------------------------------------------------ cifs_demultiplex_thread() cifs_debug_data_proc_show() release_mid() spin_lock(&server->mid_lock); spin_lock(&cifs_tcp_ses_lock) spin_lock(&server->mid_lock) __release_mid() smb2_find_smb_tcon() spin_lock(&cifs_tcp_ses_lock) *deadlock* Cc: stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/cifsproto.h fs/smb/client/smb2misc.c fs/smb/client/transport.c fs/cifs/cifsproto.h fs/cifs/smb2misc.c fs/cifs/transport.c [Path is changed and related functions has been refactored for a long time] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsproto.h | 7 ++++++- fs/cifs/smb2misc.c | 2 +- fs/cifs/transport.c | 9 +-------- 3 files changed, 8 insertions(+), 10 deletions(-) diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h index a6ca4eda9a5a..5ff518be107e 100644 --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -85,7 +85,7 @@ extern struct mid_q_entry *AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server); extern void DeleteMidQEntry(struct mid_q_entry *midEntry); extern void cifs_delete_mid(struct mid_q_entry *mid); -extern void cifs_mid_q_entry_release(struct mid_q_entry *midEntry); +void _cifs_mid_q_entry_release(struct kref *refcount); extern void cifs_wake_up_task(struct mid_q_entry *mid); extern int cifs_handle_standard(struct TCP_Server_Info *server, struct mid_q_entry *mid); @@ -646,4 +646,9 @@ static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options) return options; } +static inline void cifs_mid_q_entry_release(struct mid_q_entry *midEntry) +{ + kref_put(&midEntry->refcount, _cifs_mid_q_entry_release); +} + #endif /* _CIFSPROTO_H */ diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c index 49686086a333..4652b681f5aa 100644 --- a/fs/cifs/smb2misc.c +++ b/fs/cifs/smb2misc.c @@ -786,7 +786,7 @@ __smb2_handle_cancelled_cmd(struct cifs_tcon *tcon, __u16 cmd, __u64 mid, { struct close_cancelled_open *cancelled; - cancelled = kzalloc(sizeof(*cancelled), GFP_ATOMIC); + cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL); if (!cancelled) return -ENOMEM; diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index d209f989bb70..231a86327316 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -88,7 +88,7 @@ AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server) return temp; } -static void _cifs_mid_q_entry_release(struct kref *refcount) +void _cifs_mid_q_entry_release(struct kref *refcount) { struct mid_q_entry *midEntry = container_of(refcount, struct mid_q_entry, refcount); @@ -168,13 +168,6 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) mempool_free(midEntry, cifs_mid_poolp); } -void cifs_mid_q_entry_release(struct mid_q_entry *midEntry) -{ - spin_lock(&GlobalMid_Lock); - kref_put(&midEntry->refcount, _cifs_mid_q_entry_release); - spin_unlock(&GlobalMid_Lock); -} - void DeleteMidQEntry(struct mid_q_entry *midEntry) { cifs_mid_q_entry_release(midEntry); -- 2.34.3

2 1