- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS v5 0/6] CVE-2023-52595
by Pu Lehui 19 Mar '24

19 Mar '24

Pu Lehui (1): rt2x00: Fix kabi breakage in struct rt2x00lib_ops Shiji Yang (1): wifi: rt2x00: restart beacon queue when hardware reset Stanislaw Gruszka (4): rt2800: do not nullify initialization vector data rt2800: add pre_reset_hw callback rt2x00: clear IV's on start to fix AP mode regression rt2x00: clear up IV's on key removal .../net/wireless/ralink/rt2x00/rt2800lib.c | 52 +++++++++++++++---- .../net/wireless/ralink/rt2x00/rt2800lib.h | 1 + .../net/wireless/ralink/rt2x00/rt2800pci.c | 5 ++ .../net/wireless/ralink/rt2x00/rt2800soc.c | 5 ++ .../net/wireless/ralink/rt2x00/rt2800usb.c | 5 ++ drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 + .../net/wireless/ralink/rt2x00/rt2x00dev.c | 30 ++++++++--- .../net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++++ 8 files changed, 94 insertions(+), 17 deletions(-) -- 2.34.1

2 7

[PATCH openEuler-1.0-LTS] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Yi Yang 19 Mar '24

19 Mar '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v4.19.307 commit eafd83b92f6c044007a3591cbd476bcf90455990 category: bugfix bugzilla: 189694 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 0ef7cb0448e8..e33b71659215 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -23,10 +23,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -58,7 +61,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -201,6 +204,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -228,34 +232,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -266,6 +273,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.25.1

2 1

[PATCH OLK-6.6 000/470] Backport 6.6.9~6.6.13 LTS patches
by Peng Zhang 19 Mar '24

19 Mar '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport linux-6.6.9 linux-6.6.13 LTS patches from upstream. git cherry-pick v6.6.8..v6.6.9~1 -s git cherry-pick v6.6.9..v6.6.10~1 -s git cherry-pick v6.6.10..v6.6.11~1 -s git cherry-pick v6.6.11..v6.6.12~1 -s git cherry-pick v6.6.12..v6.6.13~1 -s There are only 1 simple context conflicts: block: warn once for each partition in bio_check_ro() Build and boot test passed for arm64 & x86. Aabish Malik (1): ALSA: hda/realtek: enable SND_PCI_QUIRK for hp pavilion 14-ec1xxx series Adrian Cinal (1): net: bcmgenet: Fix FCS generation for fragmented skbuffs Alex Bee (1): clk: rockchip: rk3128: Fix SCLK_SDMMC's clock name Alex Deucher (3): drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml drm/amdgpu: skip gpu_info fw loading on navi12 drm/amd/display: add nv12 bounding box Alex Lu (1): Bluetooth: Add more enc key size check Alex Williamson (1): vfio/mtty: Overhaul mtty interrupt handling Alexander Atanasov (1): scsi: core: Always send batch on reset or error handling command Alexis Lothoré (1): pinctrl: at91-pio4: use dedicated lock class for IRQ Alison Schofield (3): cxl/core: Always hold region_rwsem while reading poison lists kernel/resource: Increment by align value in get_free_mem_region() cxl/memdev: Hold region_rwsem during inject and clear poison ops Alper Ak (1): USB: serial: option: add Quectel EG912Y module support Alvin Lee (1): drm/amd/display: Increase num voltage states to 40 Andrew Davis (2): ARM: dts: dra7: Fix DRA7 L3 NoC node register size phy: ti: gmii-sel: Fix register offset when parent is not a syscon node Andrii Staikov (1): i40e: Restore VF MSI-X state during PCI reset Andy Chi (1): ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook Andy Gospodarek (1): bnxt_en: do not map packet buffers twice Armin Wolf (1): hwmon: (corsair-psu) Fix probe when built-in Arnd Bergmann (4): Bluetooth: hci_event: shut up a false-positive warning x86/xen: add CPU dependencies for 32-bit build kexec: fix KEXEC_FILE dependencies kexec: select CRYPTO from KEXEC_FILE instead of depending on it Avraham Stern (1): wifi: iwlwifi: pcie: avoid a NULL pointer dereference Baokun Li (1): mm/filemap: avoid buffered read/write race to read inconsistent data Ben Greear (1): wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap Benjamin Bara (1): i2c: core: Fix atomic xfer check for non-preempt config Benjamin Bigler (1): spi: spi-imx: correctly configure burst length when using dma Bitao Hu (1): nvme: fix deadlock between reset and scan Bjorn Helgaas (1): Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()" Boris Burkov (1): btrfs: free qgroup pertrans reserve on transaction abort Brad Cowie (1): netfilter: nf_nat: fix action not being set for all ct states Bryan O'Donoghue (3): media: qcom: camss: Fix V4L2 async notifier error path media: qcom: camss: Fix genpd cleanup media: qcom: camss: Comment CSID dt_id field Cameron Williams (2): parport: parport_serial: Add Brainboxes BAR details parport: parport_serial: Add Brainboxes device IDs and geometry Can Guo (1): scsi: ufs: core: Let the sq_lock protect sq_tail_slot access Carlos Llamas (5): binder: use EPOLLERR from eventpoll.h binder: fix use-after-free in shinker's callback binder: fix trivial typo of binder_free_buf_locked() binder: fix comment on binder_alloc_new_buf() return value scripts/decode_stacktrace.sh: optionally use LLVM utilities Carolina Jubran (1): net/mlx5e: XDP, Drop fragmented packets larger than MTU size ChanWoo Lee (1): scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() Chancel Liu (1): ASoC: fsl_rpmsg: Fix error handler with pm_runtime_enable Chao Song (1): soundwire: intel_ace2x: fix AC timing setting for ACE2.x Charan Teja Kalla (1): mm: migrate high-order folios in swap cache correctly Charlene Liu (1): drm/amd/display: get dprefclk ss info from integration info table Charles Keepax (2): pinctrl: lochnagar: Don't build on MIPS ASoC: wm8974: Correct boost mixer inputs Chen Ni (1): asix: Add check for usbnet_get_endpoints Chen-Yu Tsai (1): wifi: cfg80211: Add my certificate Cheng-Han Wu (1): ksmbd: Remove unused field in ksmbd_user struct Chester Lin (1): pinctrl: s32cc: Avoid possible string truncation Chris Mi (1): net/mlx5e: Decrease num_block_tc when unblock tc offload Chris Morgan (1): clk: rockchip: rk3568: Add PLL rate for 292.5MHz Christoffer Sandberg (1): Input: soc_button_array - add mapping for airplane mode button Christoph Hellwig (1): block: renumber QUEUE_FLAG_HW_WC Chuck Lever (1): SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 Chukun Pan (1): arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 Claudio Imbrenda (1): KVM: s390: vsie: fix wrong VIR 37 when MSO is used Claudiu Beznea (1): net: ravb: Wait for operating mode to be applied Clément Villeret (1): ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA Dan Carpenter (4): net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() net/mlx5e: Fix error codes in alloc_branch_attr() usb: fotg210-hcd: delete an incorrect bounds test ACPI: thermal: Fix acpi_thermal_unregister_thermal_zone() cleanup Dan Williams (1): driver core: Add a guard() definition for the device_lock() Daniel Golle (1): net: phy: skip LED triggers on PHYs on SFP modules Dave Airlie (1): nouveau/tu102: flush all pdbs on vmm flush Dave Ertman (1): ice: alter feature support check for SRIOV and LAG Dave Jiang (3): cxl: Add cxl_decoders_committed() helper cxl: Add cxl_num_decoders_committed() usage to cxl_test cxl/hdm: Fix a benign lockdep splat David Ahern (1): net/ipv6: Revert remove expired routes with a separated list of routes David E. Box (3): platform/x86/intel/pmc: Add suspend callback platform/x86/intel/pmc: Allow reenabling LTRs platform/x86/intel/pmc: Move GBE LTR ignore to suspend callback David Howells (5): afs: Fix the dynamic root's d_delete to always delete unused dentries afs: Fix dynamic root lookup DNS check keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry afs: Fix overwriting of result of DNS query afs: Fix use-after-free due to get/remove race in volume tree David Lechner (1): iio: triggered-buffer: prevent possible freeing of wrong buffer David Lin (1): ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 David Rau (1): ASoC: da7219: Support low DC impedance headset David Thompson (1): mlxbf_gige: fix receive packet race condition Denys Zagorui (1): bpftool: Fix -Wcast-qual warning Dinghao Liu (2): net/mlx5e: fix a potential double-free in fs_udp_create_groups net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues Dmitry Antipov (1): smb: client, common: fix fortify warnings Dmytro Laktyushkin (1): drm/amd/display: update dcn315 lpddr pstate latency Douglas Anderson (3): drm/bridge: parade-ps8640: Never store more than msg->size bytes in AUX xfer drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer drm/bridge: ps8640: Fix size mismatch warning w/ len Edward Adam Davis (3): wifi: mac80211: check if the existing link config remains unchanged keys, dns: Fix missing size check of V1 server-list header mptcp: fix uninit-value in mptcp_incoming_options Eric Biggers (1): crypto: xts - use 'spawn' for underlying single-block cipher Eric Dumazet (7): net: sched: ife: fix potential use-after-free net/rose: fix races in rose_kill_by_device() net: check dev->gso_max_size in gso_features_check() virtio_net: avoid data-races on dev->stats fields tcp: derive delack_max from rto_min net: prevent mss overflow in skb_segment() net: constify sk_dst_get() and __sk_dst_get() argument Esther Shimanovich (1): Input: i8042 - add nomux quirk for Acer P459-G2-M Eugen Hristev (1): ASoC: mediatek: mt8186: fix AUD_PAD_TOP register and offset Fabio Estevam (1): dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp Fedor Pchelkin (2): net: 9p: avoid freeing uninit memory in p9pdu_vreadf ksmbd: free ppace array on error in parse_dacl Felix Fietkau (1): wifi: mt76: fix crash with WED rx support enabled Finley Xiao (1): clk: rockchip: rk3128: Fix aclk_peri_src's parent Florian Eckert (1): leds: ledtrig-tty: Free allocated ttyname buffer on deactivate Frederic Weisbecker (3): rcu: Introduce rcu_cpu_online() rcu/tasks: Handle new PF_IDLE semantics rcu/tasks-trace: Handle new PF_IDLE semantics Frédéric Danis (1): Bluetooth: L2CAP: Send reject on command corrupted request Geert Uytterhoeven (2): reset: Fix crash when freeing non-existent optional resets mmc: core: Cancel delayed work before releasing host Geliang Tang (1): selftests: mptcp: join: fix subflow_send_ack lookup George Stark (1): iio: adc: meson: add separate config for axg SoC family Gergo Koteles (5): ALSA: hda/tas2781: select program 0, conf 0 by default ASoC: tas2781: check the validity of prm_no/cfg_no ALSA: hda/tas2781: do not use regcache ALSA: hda/tas2781: move set_drv_data outside tasdevice_init ALSA: hda/tas2781: remove sound controls in unbind Ghanshyam Agrawal (1): kselftest: alsa: fixed a print formatting warning Guanghui Feng (1): uio: Fix use-after-free in uio_open Guanjun (1): dmaengine: idxd: Protect int_handle field in hw descriptor Guilherme G. Piccoli (1): HID: nintendo: Prevent divide-by-zero on code Haibo Chen (1): iio: adc: imx93: add four channels for imx93 adc Hamza Mahfooz (1): drm/amd/display: fix hw rotated modes when PSR-SU is enabled Hangbin Liu (1): selftests: bonding: do not set port down when adding to bond Hangyu Hua (1): net: sched: em_text: fix possible memory leak in em_text_destroy() Hans de Goede (5): platform/x86: intel-vbtn: Fix missing tablet-mode-switch events Input: atkbd - skip ATKBD_CMD_GETID in translated mode ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk ACPI: resource: Add another DMI match for the TongFang GMxXGxx Haoran Liu (1): Input: ipaq-micro-keys - add error handling for devm_kmemdup Haren Myneni (1): powerpc/pseries/vas: Migration suspend waits for no in-progress open windows Hawking Zhang (1): drm/amdgpu: Do not issue gpu reset from nbio v7_9 bif interrupt Heiko Carstens (1): s390/vx: fix save/restore of fpu kernel context Heiko Stuebner (1): arm64: dts: rockchip: fix rk356x pcie msg interrupt name Helge Deller (2): linux/export: Fix alignment for 64-bit ksymtab entries linux/export: Ensure natural alignment of kcrctab array Hengqi Chen (1): LoongArch: Preserve syscall nr across execve() Herve Codina (1): lib/vsprintf: Fix %pfwf when current node refcount == 0 Hyunwoo Kim (1): Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg Ian Rogers (1): bpftool: Align output skeleton ELF code Imre Deak (1): drm/i915/mtl: Fix HDMI/DP PLL clock selection Inki Dae (1): drm/exynos: fix a wrong error checking Ira Weiny (1): cxl/pmu: Ensure put_device on pmu devices Ivan Lipski (1): drm/amd/display: Add monitor patch for specific eDP Ivan Orlov (1): ALSA: pcmtest: stop timer before buffer is released JP Kobryn (1): 9p: prevent read overrun in protocol dump tracepoint Jacob Keller (1): ice: stop trashing VF VSI aggregator node ID information Jai Luthra (1): dmaengine: ti: k3-psil-am62a: Fix SPI PDMA data James Clark (1): coresight: etm4x: Fix width of CCITMIN field Jani Nikula (2): drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select drm/crtc: fix uninitialized variable use Javier Carrasco (2): iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table iio: tmag5273: fix temperature offset Jeff Layton (3): fs: new accessor methods for atime and mtime client: convert to new timestamp accessors nfsd: drop the nfsd_put helper Jeffrey Hugo (1): accel/qaic: Implement quirk for SOC_HW_VERSION Jens Axboe (1): io_uring: use fget/fput consistently Jensen Huang (1): i2c: rk3x: fix potential spinlock recursion on poll Jeremie Knuesel (1): ALSA: usb-audio: Increase delay in MOTU M quirk Jeremy Soller (1): ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 Jerome Brunet (1): ASoC: hdmi-codec: fix missing report for jack initial status Jiajun Xie (1): mm: fix unmap_mapping_range high bits shift bug Jianbo Liu (1): net/mlx5e: Fix overrun reported by coverity Jinghao Jia (1): x86/kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect Jinyang He (1): LoongArch: Set unwind stack type to unknown rather than set error flag Jiri Olsa (1): bpf: Fix prog_array_map_poke_run map poke update Jisheng Zhang (1): riscv: don't probe unaligned access speed if already done Jocelyn Falempe (1): drm/mgag200: Fix gamma lut not initialized for G200ER, G200EV, G200SE Johan Hovold (1): usb: typec: ucsi: fix gpio-based orientation detection Johannes Berg (11): wifi: ieee80211: don't require protected vendor action frames wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock wifi: mac80211: don't re-add debugfs during reconfig wifi: mac80211: check defragmentation succeeded wifi: mac80211: mesh: check element parsing succeeded wifi: mac80211: mesh_plink: fix matches_local logic wifi: cfg80211: fix certs build to not depend on file order wifi: cfg80211: fix CQM for non-range use wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ wifi: cfg80211: lock wiphy mutex for rfkill poll debugfs: fix automount d_fsdata usage John Fastabend (1): bpf: syzkaller found null ptr deref in unix_bpf proto add John Johansen (1): apparmor: Fix move_mount mediation by detecting if source is detached Jorge Ramirez-Ortiz (1): mmc: rpmb: fixes pause retune on all RPMB partitions. Jose Ignacio Tornos Martinez (1): net: usb: ax88179_178a: avoid failed operations when device is disconnected Joshua Ashton (1): drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR José Pekkarinen (1): Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 Judy Hsiao (1): neighbour: Don't let neigh_forced_gc() disable preemption for long Jörn-Thorben Hinz (1): net: Implement missing getsockopt(SO_TIMESTAMPING_NEW) Kai-Heng Feng (1): r8169: Fix PCI error on system resume Kamil Duljas (3): ASoC: Intel: Skylake: Fix mem leak in few functions ASoC: SOF: topology: Fix mem leak in sof_dai_load() ASoC: Intel: Skylake: mem leak in skl register function Kangjing Huang (1): ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev() Karthik Poosa (1): drm/i915/hwmon: Fix static analysis tool reported issues Katarzyna Wieczerzycka (1): ice: Fix link_down_on_close message Ke Xiao (1): i40e: fix use-after-free in i40e_aqc_add_filters() Keith Busch (5): Revert "nvme-fc: fix race between error recovery and creating association" nvme-core: check for too small lba shift nvme: introduce helper function to get ctrl state nvme: ensure reset state check ordering nvme-ioctl: move capable() admin check to the end Kent Gibson (1): gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() Khaled Almahallawy (1): drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern Konrad Dybcio (1): interconnect: qcom: sm8250: Enable sync_state Krzysztof Kozlowski (3): stmmac: dwmac-loongson: drop useless check for compatible fallback MIPS: dts: loongson: drop incorrect dwmac fallback compatible reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Kunwu Chan (1): ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init Kurt Kanzenbach (3): igc: Report VLAN EtherType matching back to user igc: Check VLAN TCI mask igc: Check VLAN EtherType mask Lai Peter Jun Ann (1): net: stmmac: fix incorrect flag check in timestamp interrupt Larysa Zaremba (1): ice: Fix PF with enabled XDP going no-carrier after reset LeoLiuoc (1): PCI: Add ACS quirk for more Zhaoxin Root Ports Lewis Huang (1): drm/amd/display: Pass pwrseq inst for backlight and ABM Lijo Lazar (2): drm/amdgpu: Use another offset for GC 9.4.3 remap drm/amdgpu: Add NULL checks for function pointers Lingkai Dong (1): drm: Fix FD ownership check in drm_master_check_perm() Linus Torvalds (2): posix-timers: Get rid of [COMPAT_]SYS_NI() uses x86/csum: clean up `csum_partial' further Liu Jian (1): net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() Lorenzo Bianconi (1): net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() Louis Chauvet (1): spi: atmel: Fix clock issue when using devices with different polarities Lu Yao (1): drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer Luca Weiss (1): Input: xpad - add Razer Wolverine V2 support Luiz Augusto von Dentz (3): Bluetooth: Fix not notifying when connection encryption changes Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent Léo Lam (1): wifi: nl80211: fix deadlock in nl80211_set_cqm_rssi (6.6.x) Maciej Strozek (2): ASoC: cs43130: Fix the position of const qualifier ASoC: cs43130: Fix incorrect frame delay configuration Marc Dionne (1): net: Save and restore msg_namelen in sock_sendmsg Marc Zyngier (3): KVM: arm64: vgic: Simplify kvm_vgic_destroy() KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy Marek Vasut (1): clk: si521xx: Increase stack based print buffer size in probe Mario Limonciello (5): pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend platform/x86/amd/pmc: Move platform defines to header platform/x86/amd/pmc: Only run IRQ1 firmware version check on Cezanne platform/x86/amd/pmc: Move keyboard wakeup disablement detection to pmc-quirks platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13 Mark Brown (4): ASoC: meson: g12a-toacodec: Validate written enum values ASoC: meson: g12a-tohdmitx: Validate written enum values ASoC: meson: g12a-toacodec: Fix event generation ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux Mark Glover (1): USB: serial: ftdi_sio: update Actisense PIDs constant names Martin K. Petersen (1): Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" Mathieu Desnoyers (1): ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() Matthew Wilcox (Oracle) (5): mm/memory-failure: cast index to loff_t before shifting it mm/memory-failure: check the mapcount of the precise page mm: convert DAX lock/unlock page to lock/unlock folio mm/memory-failure: pass the folio and the page to collect_procs() ida: Fix crash in ida_free when the bitmap is empty Matti Vaittinen (1): iio: kx022a: Fix acceleration value scaling Matus Malych (1): ASoC: amd: yc: Add HP 255 G10 into quirk table Maurizio Lombardi (2): nvme-pci: fix sleeping function called from interrupt context nvme-core: fix a memory leak in nvme_ns_info_from_identify() Maxime Ripard (1): kunit: Warn if tests are slow Michael Chan (1): bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() Michael Walle (1): phy: mediatek: mipi: mt8183: fix minimal supported frequency Michael-CY Lee (1): wifi: avoid offset calculation on NULL pointer Michal Schmidt (1): ice: fix theoretical out-of-bounds access in ethtool link modes Michal Wajdeczko (1): kunit: Reset suite counter right before running tests Mike Snitzer (1): dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM Mike Tipton (1): interconnect: Treat xlate() returning NULL node as an error Mikulas Patocka (1): dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() Ming Lei (1): blk-mq: don't count completed flush data request as inflight in case of quiesce Miquel Raynal (2): spi: atmel: Do not cancel a transfer upon any signal spi: atmel: Prevent spi transfers from being killed Moshe Shemesh (2): net/mlx5: Fix fw tracer first block check RDMA/mlx5: Fix mkey cache WQ flush Muhammad Usama Anjum (1): selftests: secretmem: floor the memory size to the multiple of page_size Mukul Joshi (1): drm/amdkfd: Use common function for IP version check Nam Cao (3): pinctrl: starfive: jh7110: ignore disabled device tree nodes pinctrl: starfive: jh7100: ignore disabled device tree nodes spi: cadence: revert "Add SPI transfer delays" Namjae Jeon (17): ksmbd: reorganize ksmbd_iov_pin_rsp() ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr() ksmbd: add support for surrogate pair conversion ksmbd: no need to wait for binded connection termination at logoff ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked() ksmbd: separately allocate ci per dentry ksmbd: move oplock handling after unlock parent dir ksmbd: release interim response after sending status pending response ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error ksmbd: set epoch in create context v2 lease ksmbd: set v2 lease capability ksmbd: downgrade RWH lease caching state to RH for directory ksmbd: send v2 lease break notification for directory ksmbd: lazy v2 lease break on smb2_write() ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack() ksmbd: don't allow O_TRUNC open on read-only share Naveen Mamindlapalli (2): octeontx2-af: Always configure NIX TX link credits based on max frame size octeontx2-af: Re-enable MAC TX in otx2_stop processing NeilBrown (1): nfsd: call nfsd_last_thread() before final nfsd_put() Ngai-Mint Kwan (1): ice: Shut down VSI with "link-down-on-close" enabled Nitesh Shetty (1): nvme: prevent potential spectre v1 gadget Noah Goldstein (1): x86/csum: Remove unnecessary odd handling Nuno Sa (2): iio: imu: adis16475: add spi_device_id table iio: imu: adis16475: use bit numbers in assign_bit() Pablo Neira Ayuso (3): netfilter: nf_tables: skip set commit for deleted/destroyed sets netfilter: nf_tables: set transport offset from mac header for netdev/egress netfilter: nft_immediate: drop chain reference counter on error Paolo Abeni (4): mptcp: refactor sndbuf auto-tuning mptcp: fix possible NULL pointer dereference on close mptcp: fix inconsistent state on fastopen race mptcp: prevent tcp diag from closing listener subflows Paolo Bonzini (1): KVM: x86/pmu: fix masking logic for MSR_CORE_PERF_GLOBAL_CTRL Patrick Rudolph (3): pinctrl: cy8c95x0: Fix typo pinctrl: cy8c95x0: Fix regression pinctrl: cy8c95x0: Fix get_pincfg Paulo Alcantara (5): smb: client: fix OOB in cifsd when receiving compounded resps smb: client: fix potential OOB in cifs_dump_detail() smb: client: fix OOB in SMB2_query_info_init() smb: client: fix OOB in smbCalcSize() smb: client: fix potential OOB in smb2_dump_detail() Peter Ujfalusi (6): ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available ASoC: hdac_hda: Conditionally register dais for HDMI and Analog ASoC: SOF: ipc4-topology: Correct data structures for the SRC module ASoC: SOF: ipc4-topology: Correct data structures for the GAIN module ASoC: SOF: Intel: hda-codec: Delay the codec device registration Peter Zijlstra (1): rcu: Break rcu_node_0 --> &rq->__lock order Philip Yang (1): drm/amdkfd: svm range always mapped flag not working on APU Pranjal Ramajor Asha Kanojiya (1): accel/qaic: Fix GEM import path code Qu Wenruo (2): btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve() btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta() Quan Nguyen (1): i2c: aspeed: Handle the coalesced stop conditions with the start conditions. Rafał Miłecki (1): nvmem: brcm_nvram: store a copy of NVRAM content Rahul Rameshbabu (2): net/mlx5e: Correct snprintf truncation handling for fw_version buffer net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors Rajvi Jingar (1): platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() Ranjani Sridharan (2): ASoC: SOF: ipc4-topology: Add core_mask in struct snd_sof_pipeline ASoC: SOF: sof-audio: Modify logic for enabling/disabling topology cores Reinhard Speyerer (1): USB: serial: option: add Quectel RM500Q R13 firmware support Ricardo Rivera-Matos (3): ASoC: cs35l45: Use modern pm_ops ASoC: cs35l45: Prevent IRQ handling when suspending/resuming ASoC: cs35l45: Prevents spinning during runtime suspend Rob Herring (1): arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru Rodrigo Cataldo (1): igc: Fix hicredit calculation Ronald Wahl (2): net: ks8851: Fix TX stall caused by TX buffer overrun dmaengine: ti: k3-psil-am62: Fix SPI PDMA data Rouven Czerwinski (1): net: rfkill: gpio: set GPIO direction Ryan McClelland (1): HID: nintendo: fix initializer element is not constant error Sarannya S (1): net: qrtr: ns: Return 0 if server port is not present SeongJae Park (2): mm/damon/core: use number of passed access sampling as a timer mm/damon/core: make damon_start() waits until kdamond_fn() starts Shannon Nelson (3): pds_vdpa: fix up format-truncation complaint pds_vdpa: clear config callback when status goes to 0 pds_vdpa: set features order Shengjiu Wang (3): ASoC: fsl_sai: Fix channel swap issue on i.MX8MP ASoC: fsl_xcvr: Enable 2 * TX bit clock for spdif only case ASoC: fsl_xcvr: refine the requested phy clock frequency Shifeng Li (2): net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() net/mlx5e: Fix a race in command alloc flow Shigeru Yoshida (1): net: Return error from sk_stream_wait_connect() if sk_wait_event() fails Shin'ichiro Kawasaki (2): platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe Revert "platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe" Shuming Fan (1): ASoC: rt5650: add mutex to avoid the jack detection failure Shyam Prasad N (2): cifs: cifs_chan_is_iface_active should be called with chan_lock held cifs: do not depend on release_iface for maintaining iface_list Siddh Raman Pant (2): nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local nfc: Do not send datagram if socket state isn't LLCP_BOUND Siddhesh Dharme (1): ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6 Sidhartha Kumar (1): maple_tree: do not preallocate nodes for slot stores Sjoerd Simons (2): bus: moxtet: Mark the irq as shared bus: moxtet: Add spi device table Slark Xiao (1): USB: serial: option: add Foxconn T99W265 with new baseline Stefan Binding (1): ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models Stefan Hajnoczi (1): virtio_blk: fix snprintf truncation compiler warning Stefan Wahren (2): ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init ARM: sun9i: smp: fix return code check of of_property_match_string Steven Rostedt (Google) (9): ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() ring-buffer: Fix slowpath of interrupted event tracing / synthetic: Disable events after testing in synth_event_gen_test_init() ring-buffer: Fix wake ups when buffer_percent is set to 100 ftrace: Fix modification of direct_function hash while in use tracing: Fix blocked reader of snapshot buffer tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing tracing: Add size check when printing trace_marker output ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI Su Hui (2): iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw phy: sunplus: return negative error code in sp_usb_phy_probe Sudheer Mogilappagari (1): i40e: Fix filter input checks to prevent config with invalid values Suman Ghosh (2): octeontx2-pf: Fix graceful exit during PFC configuration failure octeontx2-af: Fix marking couple of structure as __packed Sumanth Korikkar (1): mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval Svyatoslav Pankratov (1): crypto: qat - fix double free during reset Takashi Sakamoto (1): firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards Tasos Sahanidis (1): usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 Thinh Tran (1): net/tg3: fix race condition in tg3_reset_task() Thomas Gleixner (3): x86/alternatives: Sync core before enabling interrupts x86/alternatives: Disable interrupts and sync when optimizing NOPs in place x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully Thomas Lange (1): net: Implement missing SO_TIMESTAMPING_NEW cmsg support Thomas Weißschuh (1): net: avoid build bug in skb extension length calculation Tirthendu Sarkar (1): xsk: add multi-buffer support for sockets sharing umem Tom Jason Schwanke (1): ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 13-ay0xxx Tony Lindgren (2): ARM: dts: Fix occasional boot hang for am3 usb bus: ti-sysc: Flush posted write only after srst_udelay Tvrtko Ursulin (1): drm: Update file owner during use Umesh Nerlige Ramappa (1): drm/i915/perf: Update handling of MMIO triggered reports Vasiliy Kovalev (1): ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro Ville Syrjälä (5): drm/i915: Fix FEC state dump drm/i915: Introduce crtc_state->enhanced_framing drm/i915: Reject async flips with bigjoiner drm/i915/dmc: Don't enable any pipe DMC events drm/i915: Call intel_pre_plane_updates() also for pipes getting enabled Vineet Gupta (2): ARC: fix spare error ARC: fix smatch warning Vineeth Vijayan (1): s390/scm: fix virtual vs physical address confusion Vishnu Sankar (1): platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some ThinkPad systems Vlad Buslov (3): Revert "net/mlx5e: fix double free of encap_header in update funcs" Revert "net/mlx5e: fix double free of encap_header" net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num Vladimir Oltean (2): net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and above WANG Rui (1): LoongArch: Apply dynamic relocations for LLD Wadim Egorov (1): iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() Wang Yao (1): efi/loongarch: Use load address to calculate kernel entry address Wayne Lin (2): drm/amd/display: pbn_div need be updated for hotplug event drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event Wei Yongjun (1): scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() Weihao Li (1): clk: rockchip: rk3128: Fix HCLK_OTG gate register Wen Gu (1): net/smc: fix invalid link access in dumping SMC-R connections Wenchao Chen (1): mmc: sdhci-sprd: Fix eMMC init failure after hw reset Xiang Yang (1): drm/exynos: fix a potential error pointer dereference Xiao Yao (1): Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE Xiaolei Wang (2): dmaengine: fsl-edma: Do not suspend and resume the masked dma channel when the system is sleeping dmaengine: fsl-edma: Add judgment on enabling round robin arbitration Xuan Zhuo (2): virtio_ring: fix syncs DMA memory with different direction virtio_net: fix missing dma unmap for resize Yang Yingliang (2): i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() dmaengine: fsl-edma: fix wrong pointer check in fsl_edma3_attach_pd() Yaxiong Tian (1): thunderbolt: Fix memory leak in margining_port_remove() Ye Bin (1): jbd2: fix soft lockup in journal_finish_inode_data_buffers() Ying Hsu (1): Bluetooth: Fix deadlock in vhci_send_frame Yong-Xuan Wang (1): RISCV: KVM: update external interrupt atomically for IMSIC swfile Yu Kuai (1): block: warn once for each partition in bio_check_ro() Yu Zhao (1): mm/mglru: skip special VMAs in lru_gen_look_around() Yury Norov (1): net: mana: select PAGE_POOL Zhang Yi (2): jbd2: correct the printing of write_flags in jbd2_write_superblock() jbd2: increase the journal IO's priority ZhenGuo Yin (2): drm/amdgpu: re-create idle bo's PTE during VM state machine reset drm/amdkfd: Free gang_ctx_bo and wptr_bo in pqm_uninit Zheng Yejian (1): tracing: Fix uaf issue when open the hist or hist_debug file Zhipeng Lu (2): ethernet: atheros: fix a memleak in atl1e_setup_ring_resources sfc: fix a double-free bug in efx_probe_filters Ziqi Zhao (1): drm/crtc: Fix uninit-value bug in drm_mode_setcrtc Ziyang Huang (1): mmc: meson-mx-sdhc: Fix initialization frozen issue Zizhi Wo (1): fs: cifs: Fix atime update check Zongmin Zhou (1): ksmbd: prevent memory leak on error return wangkeqi (1): connector: Fix proc_event_num_listeners count not cleared xiongxin (1): gpio: dwapb: mask/unmask IRQ when disable/enale it .../devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 +- arch/arc/kernel/setup.c | 4 +- arch/arc/kernel/signal.c | 6 +- arch/arm/boot/dts/ti/omap/am33xx.dtsi | 1 + arch/arm/boot/dts/ti/omap/dra7.dtsi | 2 +- arch/arm/mach-omap2/id.c | 5 + arch/arm/mach-sunxi/mc_smp.c | 8 +- .../allwinner/sun50i-h616-orangepi-zero.dtsi | 3 - .../allwinner/sun50i-h616-orangepi-zero2.dts | 3 + .../allwinner/sun50i-h618-orangepi-zero3.dts | 2 + .../dts/rockchip/rk3399-gru-chromebook.dtsi | 3 +- .../dts/rockchip/rk3399-gru-scarlet-dumo.dts | 4 +- arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 1 + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +- arch/arm64/include/asm/syscall_wrapper.h | 4 - arch/arm64/kvm/arm.c | 2 +- arch/arm64/kvm/vgic/vgic-init.c | 47 ++-- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/kvm/vgic/vgic.h | 1 + arch/loongarch/Makefile | 2 +- arch/loongarch/include/asm/efi.h | 2 +- arch/loongarch/include/asm/elf.h | 2 +- arch/loongarch/kernel/stacktrace.c | 2 +- arch/loongarch/kernel/unwind.c | 1 - arch/loongarch/kernel/unwind_prologue.c | 2 +- .../boot/dts/loongson/loongson64-2k1000.dtsi | 3 +- arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +- arch/powerpc/Kconfig | 4 +- arch/powerpc/platforms/pseries/vas.c | 51 +++- arch/powerpc/platforms/pseries/vas.h | 2 + arch/riscv/Kconfig | 4 +- arch/riscv/include/asm/syscall_wrapper.h | 5 - arch/riscv/kernel/cpufeature.c | 4 + arch/riscv/kvm/aia_imsic.c | 13 + arch/s390/Kconfig | 4 +- arch/s390/include/asm/fpu/api.h | 2 +- arch/s390/include/asm/syscall_wrapper.h | 13 +- arch/s390/kvm/vsie.c | 4 - arch/x86/Kconfig | 4 +- arch/x86/events/intel/core.c | 7 +- arch/x86/include/asm/syscall_wrapper.h | 34 +-- arch/x86/kernel/alternative.c | 14 +- arch/x86/kernel/head_64.S | 16 ++ arch/x86/kernel/kprobes/core.c | 3 +- arch/x86/lib/csum-partial_64.c | 105 +++----- arch/x86/net/bpf_jit_comp.c | 46 ++++ arch/x86/xen/Kconfig | 1 + block/blk-core.c | 14 +- block/blk-mq.c | 14 +- crypto/xts.c | 23 +- drivers/accel/qaic/mhi_controller.c | 15 +- drivers/accel/qaic/qaic_data.c | 6 +- drivers/acpi/resource.c | 7 + drivers/acpi/thermal.c | 4 +- drivers/android/binder.c | 2 +- drivers/android/binder_alloc.c | 10 +- drivers/block/virtio_blk.c | 8 +- drivers/bluetooth/hci_vhci.c | 10 +- drivers/bus/moxtet.c | 9 +- drivers/bus/ti-sysc.c | 18 +- drivers/clk/clk-si521xx.c | 4 +- drivers/clk/rockchip/clk-rk3128.c | 24 +- drivers/clk/rockchip/clk-rk3568.c | 1 + drivers/connector/cn_proc.c | 5 +- drivers/crypto/intel/qat/qat_common/adf_aer.c | 3 +- drivers/cxl/core/hdm.c | 9 +- drivers/cxl/core/mbox.c | 2 +- drivers/cxl/core/memdev.c | 31 ++- drivers/cxl/core/pmu.c | 2 +- drivers/cxl/core/port.c | 7 + drivers/cxl/core/region.c | 5 - drivers/cxl/cxl.h | 1 + drivers/dma/fsl-edma-main.c | 12 +- drivers/dma/idxd/submit.c | 14 +- drivers/dma/ti/k3-psil-am62.c | 12 +- drivers/dma/ti/k3-psil-am62a.c | 12 +- drivers/firewire/ohci.c | 51 ++++ drivers/firmware/efi/libstub/loongarch-stub.c | 4 +- drivers/firmware/efi/libstub/loongarch.c | 6 +- drivers/gpio/gpio-dwapb.c | 12 +- drivers/gpio/gpiolib-cdev.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 5 - drivers/gpu/drm/amd/amdgpu/soc15.c | 17 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 2 +- .../amd/amdkfd/kfd_process_queue_manager.c | 54 ++-- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 18 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +- .../amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 6 + .../drm/amd/display/dc/bios/bios_parser2.c | 23 +- .../drm/amd/display/dc/bios/command_table2.c | 12 +- .../drm/amd/display/dc/bios/command_table2.h | 2 +- .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 26 +- .../gpu/drm/amd/display/dc/dc_bios_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 1 + drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c | 8 +- .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c | 7 +- .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h | 2 +- .../display/dc/dce110/dce110_hw_sequencer.c | 16 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 12 +- .../drm/amd/display/dc/dcn21/dcn21_hwseq.c | 36 ++- .../amd/display/dc/dcn31/dcn31_panel_cntl.c | 5 +- drivers/gpu/drm/amd/display/dc/dml/Makefile | 4 + .../gpu/drm/amd/display/dc/dml/dc_features.h | 2 +- .../drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 110 +++++++- drivers/gpu/drm/amd/display/dc/inc/hw/abm.h | 3 +- .../drm/amd/display/dc/inc/hw/panel_cntl.h | 2 + .../drm/amd/display/dc/link/link_factory.c | 56 ++-- .../gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 14 +- .../display/include/grph_object_ctrl_defs.h | 2 + .../display/modules/info_packet/info_packet.c | 13 +- drivers/gpu/drm/bridge/parade-ps8640.c | 7 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 4 +- drivers/gpu/drm/drm_auth.c | 3 +- drivers/gpu/drm/drm_crtc.c | 8 +- drivers/gpu/drm/drm_debugfs.c | 10 +- drivers/gpu/drm/drm_file.c | 40 ++- drivers/gpu/drm/drm_ioctl.c | 3 + drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +- drivers/gpu/drm/exynos/exynos_hdmi.c | 2 + drivers/gpu/drm/i915/display/g4x_dp.c | 10 +- drivers/gpu/drm/i915/display/intel_crt.c | 2 + .../drm/i915/display/intel_crtc_state_dump.c | 3 + drivers/gpu/drm/i915/display/intel_cx0_phy.c | 3 +- drivers/gpu/drm/i915/display/intel_ddi.c | 22 +- drivers/gpu/drm/i915/display/intel_display.c | 15 +- .../drm/i915/display/intel_display_types.h | 2 + drivers/gpu/drm/i915/display/intel_dmc.c | 43 ++- drivers/gpu/drm/i915/display/intel_dp.c | 5 +- .../drm/i915/display/intel_dp_link_training.c | 35 ++- drivers/gpu/drm/i915/i915_hwmon.c | 4 +- drivers/gpu/drm/i915/i915_perf.c | 39 ++- drivers/gpu/drm/mgag200/mgag200_drv.h | 5 + drivers/gpu/drm/mgag200/mgag200_g200er.c | 5 + drivers/gpu/drm/mgag200/mgag200_g200ev.c | 5 + drivers/gpu/drm/mgag200/mgag200_g200se.c | 5 + drivers/gpu/drm/mgag200/mgag200_mode.c | 10 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +- .../drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 6 +- drivers/hid/hid-nintendo.c | 71 ++--- drivers/hwmon/corsair-psu.c | 18 +- drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- drivers/i2c/busses/i2c-aspeed.c | 48 ++-- drivers/i2c/busses/i2c-qcom-geni.c | 8 +- drivers/i2c/busses/i2c-rk3x.c | 13 +- drivers/i2c/i2c-core.h | 4 +- drivers/iio/accel/kionix-kx022a.c | 37 ++- drivers/iio/adc/imx93_adc.c | 4 + drivers/iio/adc/meson_saradc.c | 16 +- drivers/iio/adc/ti_am335x_adc.c | 4 +- .../buffer/industrialio-triggered-buffer.c | 10 + .../iio/common/ms_sensors/ms_sensors_i2c.c | 4 +- drivers/iio/imu/adis16475.c | 121 +++++---- drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 +- drivers/iio/magnetometer/tmag5273.c | 2 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/input/joystick/xpad.c | 1 + drivers/input/keyboard/atkbd.c | 46 +++- drivers/input/keyboard/ipaq-micro-keys.c | 3 + drivers/input/misc/soc_button_array.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/serio/i8042-acpipnpio.h | 8 + drivers/interconnect/core.c | 3 + drivers/interconnect/qcom/sm8250.c | 1 + drivers/leds/trigger/ledtrig-tty.c | 4 + drivers/md/Kconfig | 1 + drivers/md/dm-integrity.c | 11 +- .../platform/qcom/camss/camss-csid-gen2.c | 14 +- drivers/media/platform/qcom/camss/camss.c | 45 ++-- drivers/mmc/core/block.c | 7 +- drivers/mmc/core/host.c | 1 + drivers/mmc/host/meson-mx-sdhc-mmc.c | 26 +- drivers/mmc/host/sdhci-sprd.c | 10 +- .../net/ethernet/atheros/atl1e/atl1e_main.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 11 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/broadcom/tg3.c | 11 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 11 +- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 ++- .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 4 +- drivers/net/ethernet/intel/ice/ice_lag.c | 2 + drivers/net/ethernet/intel/ice/ice_lib.c | 7 +- drivers/net/ethernet/intel/ice/ice_main.c | 12 +- drivers/net/ethernet/intel/igc/igc.h | 1 + drivers/net/ethernet/intel/igc/igc_ethtool.c | 42 ++- drivers/net/ethernet/intel/igc/igc_tsn.c | 2 +- .../net/ethernet/marvell/octeontx2/af/npc.h | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 17 ++ .../ethernet/marvell/octeontx2/af/rvu_nix.c | 118 +-------- .../marvell/octeontx2/nic/otx2_dcbnl.c | 17 +- drivers/net/ethernet/mediatek/mtk_wed_wo.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +- .../mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../mellanox/mlx5/core/en/fs_tt_redirect.c | 1 + .../mellanox/mlx5/core/en/tc/act/mirred.c | 5 +- .../ethernet/mellanox/mlx5/core/en/tc_tun.c | 30 ++- .../mellanox/mlx5/core/en/tc_tun_encap.c | 3 +- .../net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +- .../ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 10 +- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 3 +- .../mellanox/mlx5/core/eswitch_offloads.c | 31 ++- .../mlx5/core/eswitch_offloads_termtbl.c | 4 +- .../net/ethernet/mellanox/mlx5/core/vport.c | 2 +- .../mellanox/mlxbf_gige/mlxbf_gige_rx.c | 9 +- drivers/net/ethernet/micrel/ks8851.h | 3 + drivers/net/ethernet/micrel/ks8851_common.c | 20 +- drivers/net/ethernet/micrel/ks8851_spi.c | 42 +-- drivers/net/ethernet/microsoft/Kconfig | 1 + drivers/net/ethernet/mscc/ocelot_stats.c | 16 +- drivers/net/ethernet/qlogic/qla3xxx.c | 2 + drivers/net/ethernet/realtek/r8169_main.c | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 65 +++-- drivers/net/ethernet/sfc/rx_common.c | 4 +- .../ethernet/stmicro/stmmac/dwmac-loongson.c | 5 - .../ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/usb/ax88172a.c | 4 +- drivers/net/usb/ax88179_178a.c | 23 +- drivers/net/virtio_net.c | 90 +++---- .../wireless/intel/iwlwifi/pcie/internal.h | 4 +- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 10 +- .../net/wireless/intel/iwlwifi/pcie/trans.c | 21 +- drivers/net/wireless/mediatek/mt76/dma.c | 10 +- drivers/nvme/host/core.c | 67 +++-- drivers/nvme/host/fc.c | 27 +- drivers/nvme/host/ioctl.c | 21 +- drivers/nvme/host/nvme.h | 6 + drivers/nvme/host/pci.c | 14 +- drivers/nvme/host/rdma.c | 23 +- drivers/nvme/host/tcp.c | 27 +- drivers/nvme/target/configfs.c | 3 + drivers/nvmem/brcm_nvram.c | 134 +++++++--- drivers/parport/parport_serial.c | 64 +++++ drivers/pci/pci.c | 6 + drivers/pci/pci.h | 2 + drivers/pci/pcie/aspm.c | 19 ++ drivers/pci/quirks.c | 8 +- .../phy/mediatek/phy-mtk-mipi-dsi-mt8183.c | 2 +- drivers/phy/sunplus/phy-sunplus-usb2.c | 2 +- drivers/phy/ti/phy-gmii-sel.c | 5 +- drivers/pinctrl/cirrus/Kconfig | 3 +- drivers/pinctrl/nxp/pinctrl-s32cc.c | 4 +- drivers/pinctrl/pinctrl-amd.c | 9 + drivers/pinctrl/pinctrl-amd.h | 5 + drivers/pinctrl/pinctrl-at91-pio4.c | 8 + drivers/pinctrl/pinctrl-cy8c95x0.c | 14 +- .../starfive/pinctrl-starfive-jh7100.c | 4 +- .../starfive/pinctrl-starfive-jh7110.c | 4 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 20 ++ drivers/platform/x86/amd/pmc/pmc.c | 33 +-- drivers/platform/x86/amd/pmc/pmc.h | 12 + drivers/platform/x86/intel/pmc/adl.c | 9 +- drivers/platform/x86/intel/pmc/cnp.c | 26 +- drivers/platform/x86/intel/pmc/core.c | 14 +- drivers/platform/x86/intel/pmc/core.h | 7 +- drivers/platform/x86/intel/pmc/mtl.c | 9 +- drivers/platform/x86/intel/pmc/tgl.c | 9 +- drivers/platform/x86/intel/vbtn.c | 19 +- drivers/platform/x86/thinkpad_acpi.c | 98 ++++++- drivers/reset/core.c | 8 +- drivers/reset/hisilicon/hi6220_reset.c | 2 +- drivers/s390/block/scm_blk.c | 7 +- drivers/scsi/aacraid/aacraid.h | 1 - drivers/scsi/aacraid/commsup.c | 6 +- drivers/scsi/aacraid/linit.c | 14 - drivers/scsi/aacraid/src.c | 25 +- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +- drivers/scsi/scsi_error.c | 2 + drivers/soundwire/intel_ace2x.c | 3 +- drivers/spi/spi-atmel.c | 92 ++++++- drivers/spi/spi-cadence.c | 1 - drivers/spi/spi-imx.c | 15 +- drivers/thunderbolt/debugfs.c | 2 +- drivers/ufs/core/ufshcd.c | 3 +- drivers/ufs/host/ufs-qcom.c | 6 +- drivers/uio/uio.c | 7 +- drivers/usb/fotg210/fotg210-hcd.c | 3 - drivers/usb/serial/ftdi_sio.c | 6 +- drivers/usb/serial/ftdi_sio_ids.h | 6 +- drivers/usb/serial/option.c | 5 + drivers/usb/storage/unusual_devs.h | 11 + drivers/usb/typec/ucsi/ucsi_glink.c | 2 +- drivers/vdpa/pds/debugfs.c | 2 +- drivers/vdpa/pds/vdpa_dev.c | 7 +- drivers/virtio/virtio_ring.c | 6 +- fs/afs/cell.c | 6 +- fs/afs/dynroot.c | 31 ++- fs/afs/internal.h | 2 + fs/afs/volume.c | 26 +- fs/btrfs/disk-io.c | 28 ++ fs/btrfs/qgroup.c | 96 +++---- fs/btrfs/qgroup.h | 9 + fs/btrfs/transaction.c | 2 - fs/btrfs/transaction.h | 3 + fs/dax.c | 24 +- fs/debugfs/file.c | 8 + fs/debugfs/inode.c | 27 +- fs/debugfs/internal.h | 10 +- fs/jbd2/commit.c | 10 +- fs/jbd2/journal.c | 24 +- fs/libfs.c | 41 ++- fs/nfsd/nfsctl.c | 32 ++- fs/nfsd/nfsd.h | 8 +- fs/nfsd/nfssvc.c | 2 +- fs/smb/client/cifs_debug.c | 12 +- fs/smb/client/cifsglob.h | 4 +- fs/smb/client/cifspdu.h | 24 +- fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 14 +- fs/smb/client/file.c | 18 +- fs/smb/client/fscache.h | 6 +- fs/smb/client/inode.c | 17 +- fs/smb/client/misc.c | 4 + fs/smb/client/smb2misc.c | 30 +-- fs/smb/client/smb2ops.c | 65 +++-- fs/smb/client/smb2pdu.c | 37 ++- fs/smb/client/smb2pdu.h | 16 +- fs/smb/common/smb2pdu.h | 18 +- fs/smb/server/connection.c | 16 -- fs/smb/server/ksmbd_work.c | 51 ++-- fs/smb/server/mgmt/user_config.h | 1 - fs/smb/server/oplock.c | 118 ++++++++- fs/smb/server/oplock.h | 8 +- fs/smb/server/smb2ops.c | 9 +- fs/smb/server/smb2pdu.c | 179 +++++++------ fs/smb/server/smbacl.c | 11 +- fs/smb/server/transport_rdma.c | 40 ++- fs/smb/server/unicode.c | 187 ++++++++++---- fs/smb/server/vfs.c | 14 +- fs/smb/server/vfs_cache.c | 30 ++- fs/smb/server/vfs_cache.h | 9 +- include/drm/drm_file.h | 13 +- include/linux/blk_types.h | 2 + include/linux/blkdev.h | 2 +- include/linux/bpf.h | 3 + include/linux/damon.h | 16 +- include/linux/dax.h | 10 +- include/linux/device.h | 2 + include/linux/export-internal.h | 6 +- include/linux/fs.h | 85 +++++- include/linux/ieee80211.h | 7 +- include/linux/jbd2.h | 3 + include/linux/key-type.h | 1 + include/net/bluetooth/hci_core.h | 9 +- include/net/ip6_fib.h | 64 +---- include/net/netfilter/nf_tables_ipv4.h | 2 +- include/net/sock.h | 9 +- include/net/tcp.h | 2 + include/net/xdp_sock.h | 2 + include/trace/events/9p.h | 11 +- io_uring/cancel.c | 11 +- io_uring/io_uring.c | 36 +-- kernel/Kconfig.kexec | 2 + kernel/bpf/arraymap.c | 58 +---- kernel/rcu/rcu.h | 2 + kernel/rcu/tasks.h | 32 ++- kernel/rcu/tree.c | 43 ++- kernel/resource.c | 4 +- kernel/sys_ni.c | 14 + kernel/time/posix-stubs.c | 45 ---- kernel/trace/ftrace.c | 100 ++++--- kernel/trace/ring_buffer.c | 148 ++++------- kernel/trace/synth_event_gen_test.c | 11 + kernel/trace/trace.c | 32 ++- kernel/trace/trace.h | 1 + kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_output.c | 6 +- lib/idr.c | 2 +- lib/kunit/test.c | 42 ++- lib/maple_tree.c | 11 + lib/test_ida.c | 40 +++ lib/vsprintf.c | 11 +- mm/damon/core.c | 102 ++++---- mm/filemap.c | 9 + mm/memory-failure.c | 60 ++--- mm/memory.c | 4 +- mm/memory_hotplug.c | 8 +- mm/migrate.c | 9 +- mm/vmscan.c | 13 +- net/8021q/vlan_core.c | 9 +- net/9p/protocol.c | 17 +- net/bluetooth/af_bluetooth.c | 7 +- net/bluetooth/hci_event.c | 30 ++- net/bluetooth/l2cap_core.c | 21 +- net/bluetooth/mgmt.c | 25 +- net/bluetooth/smp.c | 7 + net/core/dev.c | 3 + net/core/neighbour.c | 9 +- net/core/skbuff.c | 5 +- net/core/sock.c | 12 +- net/core/sock_map.c | 2 + net/core/stream.c | 2 +- net/dns_resolver/dns_key.c | 25 +- net/ife/ife.c | 1 + net/ipv4/tcp.c | 3 +- net/ipv4/tcp_output.c | 16 +- net/ipv6/ip6_fib.c | 55 +--- net/ipv6/route.c | 6 +- net/mac80211/cfg.c | 4 +- net/mac80211/driver-ops.c | 6 +- net/mac80211/ht.c | 1 + net/mac80211/mesh_plink.c | 16 +- net/mac80211/mlme.c | 4 +- net/mptcp/options.c | 1 + net/mptcp/protocol.c | 27 +- net/mptcp/protocol.h | 63 ++++- net/mptcp/sockopt.c | 5 +- net/mptcp/subflow.c | 42 ++- net/netfilter/nf_nat_ovs.c | 3 +- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nft_immediate.c | 2 +- net/nfc/llcp_core.c | 39 ++- net/nfc/llcp_sock.c | 5 + net/qrtr/ns.c | 4 +- net/rfkill/rfkill-gpio.c | 8 + net/rose/af_rose.c | 39 ++- net/sched/em_text.c | 4 +- net/smc/smc_diag.c | 3 +- net/socket.c | 2 + net/sunrpc/svc_xprt.c | 5 +- net/wireless/certs/wens.hex | 87 +++++++ net/wireless/core.c | 2 + net/wireless/core.h | 1 + net/wireless/nl80211.c | 56 ++-- net/xdp/xsk.c | 2 +- net/xdp/xsk_buff_pool.c | 3 + samples/vfio-mdev/mtty.c | 239 +++++++++++------ scripts/decode_stacktrace.sh | 19 +- security/apparmor/apparmorfs.c | 1 + security/apparmor/mount.c | 4 + security/keys/gc.c | 31 ++- security/keys/internal.h | 11 +- security/keys/key.c | 15 +- security/keys/proc.c | 2 +- sound/drivers/pcmtest.c | 13 +- sound/hda/intel-nhlt.c | 33 ++- sound/pci/hda/patch_realtek.c | 20 +- sound/pci/hda/tas2781_hda_i2c.c | 244 ++++++++++-------- sound/soc/amd/yc/acp6x-mach.c | 14 + sound/soc/codecs/cs35l45-i2c.c | 2 +- sound/soc/codecs/cs35l45-spi.c | 2 +- sound/soc/codecs/cs35l45.c | 56 +++- sound/soc/codecs/cs43130.c | 6 +- sound/soc/codecs/da7219-aad.c | 2 +- sound/soc/codecs/hdac_hda.c | 23 +- sound/soc/codecs/hdmi-codec.c | 12 +- sound/soc/codecs/nau8822.c | 9 +- sound/soc/codecs/rt5645.c | 10 +- sound/soc/codecs/tas2781-comlib.c | 4 +- sound/soc/codecs/tas2781-fmwlib.c | 14 +- sound/soc/codecs/tas2781-i2c.c | 2 + sound/soc/codecs/wm8974.c | 6 +- sound/soc/fsl/fsl_rpmsg.c | 10 +- sound/soc/fsl/fsl_sai.c | 3 + sound/soc/fsl/fsl_xcvr.c | 14 +- sound/soc/intel/boards/bytcr_rt5640.c | 31 ++- sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 + sound/soc/intel/skylake/skl-pcm.c | 9 +- sound/soc/intel/skylake/skl-sst-ipc.c | 4 +- sound/soc/mediatek/mt8186/mt8186-dai-adda.c | 2 +- sound/soc/meson/g12a-toacodec.c | 5 +- sound/soc/meson/g12a-tohdmitx.c | 8 +- sound/soc/sof/intel/hda-codec.c | 18 +- sound/soc/sof/ipc3-topology.c | 2 + sound/soc/sof/ipc4-control.c | 20 +- sound/soc/sof/ipc4-topology.c | 61 +++-- sound/soc/sof/ipc4-topology.h | 34 ++- sound/soc/sof/sof-audio.c | 65 +++-- sound/soc/sof/sof-audio.h | 2 + sound/soc/sof/topology.c | 4 +- sound/usb/quirks.c | 4 +- tools/bpf/bpftool/gen.c | 15 +- tools/testing/cxl/Kbuild | 1 + tools/testing/cxl/cxl_core_exports.c | 7 + tools/testing/cxl/test/cxl.c | 5 +- tools/testing/radix-tree/maple.c | 2 +- tools/testing/selftests/alsa/mixer-test.c | 2 +- .../bonding/bond-arp-interval-causes-panic.sh | 6 +- tools/testing/selftests/mm/memfd_secret.c | 3 + .../testing/selftests/net/mptcp/mptcp_join.sh | 8 +- 493 files changed, 5473 insertions(+), 2775 deletions(-) create mode 100644 net/wireless/certs/wens.hex create mode 100644 tools/testing/cxl/cxl_core_exports.c -- 2.25.1

2 471

[PATCH openEuler-1.0-LTS v4 0/5] CVE-2023-52595
by Pu Lehui 19 Mar '24

19 Mar '24

Shiji Yang (1): wifi: rt2x00: restart beacon queue when hardware reset Stanislaw Gruszka (4): rt2800: do not nullify initialization vector data rt2800: add pre_reset_hw callback rt2x00: clear IV's on start to fix AP mode regression rt2x00: clear up IV's on key removal .../net/wireless/ralink/rt2x00/rt2800lib.c | 52 +++++++++++++++---- .../net/wireless/ralink/rt2x00/rt2800lib.h | 1 + .../net/wireless/ralink/rt2x00/rt2800pci.c | 1 + .../net/wireless/ralink/rt2x00/rt2800soc.c | 1 + .../net/wireless/ralink/rt2x00/rt2800usb.c | 1 + drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 + .../net/wireless/ralink/rt2x00/rt2x00dev.c | 26 +++++++--- .../net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++++ 8 files changed, 78 insertions(+), 17 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-22.03-LTS-SP1 6/6] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 19 Mar '24

19 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 5/6] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 4/6] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 3/6] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 2/6] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 19 Mar '24

19 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 1/6] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] mpt3sas bugfix
by Baogen Shang 19 Mar '24

19 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0

[PATCH OLK-5.10 0/1] CVE-2023-52593
by Chen Ridong 19 Mar '24

19 Mar '24

*** BLURB HERE *** Chen Ridong (1): wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() drivers/staging/wfx/sta.c | 42 ++++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] iommu/arm-smmu-v3: Disable ECMDQ before reset
by Wang Wensheng 19 Mar '24

19 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97CSY -------------------------------- In kdump kernel, the ECMDQ is enabled before and cannot be reset before it is disabled. This leads to "CMD_SYNC timeout" problem. Disable the ECMDQ before reset the ECMDQ to fix. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 3d3e0c935023..4b006590ae05 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3869,6 +3869,20 @@ static int arm_smmu_ecmdq_reset(struct arm_smmu_device *smmu) q->llq.prod = 0; q->llq.cons = 0; } + + reg = readl(q->prod_reg); + if (reg & ECMDQ_PROD_EN) { + /* disable ecmdq */ + writel(reg & ~ECMDQ_PROD_EN, q->prod_reg); + ret = readl_relaxed_poll_timeout(q->cons_reg, reg, + !(reg & ECMDQ_CONS_ENACK), 1, ARM_SMMU_POLL_TIMEOUT_US); + if (ret) { + dev_warn(smmu->dev, "ecmdq[%d] disable failed\n", i); + smmu->ecmdq_enabled = 0; + return ret; + } + } + writeq_relaxed(q->q_base, ecmdq->base + ARM_SMMU_ECMDQ_BASE); writel_relaxed(q->llq.prod, ecmdq->base + ARM_SMMU_ECMDQ_PROD); writel_relaxed(q->llq.cons, ecmdq->base + ARM_SMMU_ECMDQ_CONS); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS v2 0/3] jfs: fix two cve issue
by Long Li 19 Mar '24

19 Mar '24

This patch set fix two cve issue. Dongliang Mu (1): JFS: fix memleak in jfs_mount Edward Adam Davis (2): jfs: fix uaf in jfs_evict_inode jfs: fix array-index-out-of-bounds in diNewExt fs/jfs/jfs_imap.c | 3 +++ fs/jfs/jfs_mount.c | 57 ++++++++++++++++++++-------------------------- 2 files changed, 28 insertions(+), 32 deletions(-) -- 2.31.1

2 4

[PATCH openEuler-22.03-LTS-SP2 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 306 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 13 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 315 insertions(+), 310 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS-SP1 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 304 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 7 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 309 insertions(+), 308 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 304 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 7 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 10 files changed, 309 insertions(+), 304 deletions(-) -- 2.34.1

2 8

[PATCH OLK-5.10 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 306 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 13 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 315 insertions(+), 310 deletions(-) -- 2.34.1

2 8

[PATCH OLK-5.10] s390/ptrace: handle setting of fpc register correctly
by Zheng Zucheng 19 Mar '24

19 Mar '24

From: Heiko Carstens <hca(a)linux.ibm.com> mainline inclusion from mainline-v6.8-rc1 commit 8b13601d19c541158a6e18b278c00ba69ae37829 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G7Q CVE: CVE-2023-52598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ] If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the tracing process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space. In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process. Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl(). Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- arch/s390/kernel/ptrace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c index 3009bb527252..f381caddd905 100644 --- a/arch/s390/kernel/ptrace.c +++ b/arch/s390/kernel/ptrace.c @@ -411,6 +411,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if ((unsigned int) data != 0 || test_fp_ctl(data >> (BITS_PER_LONG - 32))) return -EINVAL; @@ -771,6 +772,7 @@ static int __poke_user_compat(struct task_struct *child, /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if (test_fp_ctl(tmp)) return -EINVAL; child->thread.fpu.fpc = data; @@ -1010,9 +1012,7 @@ static int s390_fpregs_set(struct task_struct *target, int rc = 0; freg_t fprs[__NUM_FPRS]; - if (target == current) - save_fpu_regs(); - + save_fpu_regs(); if (MACHINE_HAS_VX) convert_vx_to_fp(fprs, target->thread.fpu.vxrs); else -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] s390/ptrace: handle setting of fpc register correctly
by Zheng Zucheng 19 Mar '24

19 Mar '24

From: Heiko Carstens <hca(a)linux.ibm.com> mainline inclusion from mainline-v6.8-rc1 commit 8b13601d19c541158a6e18b278c00ba69ae37829 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G7Q CVE: CVE-2023-52598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ] If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the tracing process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space. In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process. Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl(). Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- arch/s390/kernel/ptrace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c index cd3df5514552..05e93dd5f67e 100644 --- a/arch/s390/kernel/ptrace.c +++ b/arch/s390/kernel/ptrace.c @@ -389,6 +389,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if ((unsigned int) data != 0 || test_fp_ctl(data >> (BITS_PER_LONG - 32))) return -EINVAL; @@ -747,6 +748,7 @@ static int __poke_user_compat(struct task_struct *child, /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if (test_fp_ctl(tmp)) return -EINVAL; child->thread.fpu.fpc = data; @@ -977,9 +979,7 @@ static int s390_fpregs_set(struct task_struct *target, int rc = 0; freg_t fprs[__NUM_FPRS]; - if (target == current) - save_fpu_regs(); - + save_fpu_regs(); if (MACHINE_HAS_VX) convert_vx_to_fp(fprs, target->thread.fpu.vxrs); else -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 6/6] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 19 Mar '24

19 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 5/6] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 4/6] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 3/6] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 2/6] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 19 Mar '24

19 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 1/6] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] mpt3sas bugfix
by Baogen Shang 19 Mar '24

19 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0

[PATCH OLK-6.6 v2] s390/vfio-ap: always filter entire AP matrix
by Xiang Yang 19 Mar '24

19 Mar '24

From: Tony Krowiak <akrowiak(a)linux.ibm.com> stable inclusion from stable-v6.6.15 commit c69d821197611678533fb3eb784fc823b921349a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NH7 CVE: CVE-2024-26620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 upstream. The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filtering the matrix of adapters and domains assigned to the mdev. When an adapter or domain is assigned, only the APQNs associated with the APID of the new adapter or APQI of the new domain are inspected. If an APQN does not reference a queue device bound to the vfio_ap device driver, then it's APID will be filtered from the mdev's matrix when updating the guest's AP configuration. Inspecting only the APID of the new adapter or APQI of the new domain will result in passing AP queues through to a guest that are not bound to the vfio_ap device driver under certain circumstances. Consider the following: guest's AP configuration (all also assigned to the mdev's matrix): 14.0004 14.0005 14.0006 16.0004 16.0005 16.0006 unassign domain 4 unbind queue 16.0005 assign domain 4 When domain 4 is re-assigned, since only domain 4 will be inspected, the APQNs that will be examined will be: 14.0004 16.0004 Since both of those APQNs reference queue devices that are bound to the vfio_ap device driver, nothing will get filtered from the mdev's matrix when updating the guest's AP configuration. Consequently, queue 16.0005 will get passed through despite not being bound to the driver. This violates the linux device model requirement that a guest shall only be given access to devices bound to the device driver facilitating their pass-through. To resolve this problem, every adapter and domain assigned to the mdev will be inspected when filtering the mdev's matrix. Signed-off-by: Tony Krowiak <akrowiak(a)linux.ibm.com> Acked-by: Halil Pasic <pasic(a)linux.ibm.com> Fixes: 48cae940c31d ("s390/vfio-ap: refresh guest's APCB by filtering AP resources assigned to mdev") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240115185441.31526-2-akrowiak@linux.ibm.com Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/s390/crypto/vfio_ap_ops.c | 57 +++++++++---------------------- 1 file changed, 17 insertions(+), 40 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c index 4db538a55192..9382b32e5bd1 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -670,8 +670,7 @@ static bool vfio_ap_mdev_filter_cdoms(struct ap_matrix_mdev *matrix_mdev) * Return: a boolean value indicating whether the KVM guest's APCB was changed * by the filtering or not. */ -static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, - struct ap_matrix_mdev *matrix_mdev) +static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev) { unsigned long apid, apqi, apqn; DECLARE_BITMAP(prev_shadow_apm, AP_DEVICES); @@ -692,8 +691,8 @@ static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, bitmap_and(matrix_mdev->shadow_apcb.aqm, matrix_mdev->matrix.aqm, (unsigned long *)matrix_dev->info.aqm, AP_DOMAINS); - for_each_set_bit_inv(apid, apm, AP_DEVICES) { - for_each_set_bit_inv(apqi, aqm, AP_DOMAINS) { + for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, AP_DEVICES) { + for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, AP_DOMAINS) { /* * If the APQN is not bound to the vfio_ap device * driver, then we can't assign it to the guest's @@ -958,7 +957,6 @@ static ssize_t assign_adapter_store(struct device *dev, { int ret; unsigned long apid; - DECLARE_BITMAP(apm_delta, AP_DEVICES); struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); mutex_lock(&ap_perms_mutex); @@ -987,11 +985,8 @@ static ssize_t assign_adapter_store(struct device *dev, } vfio_ap_mdev_link_adapter(matrix_mdev, apid); - memset(apm_delta, 0, sizeof(apm_delta)); - set_bit_inv(apid, apm_delta); - if (vfio_ap_mdev_filter_matrix(apm_delta, - matrix_mdev->matrix.aqm, matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); ret = count; @@ -1167,7 +1162,6 @@ static ssize_t assign_domain_store(struct device *dev, { int ret; unsigned long apqi; - DECLARE_BITMAP(aqm_delta, AP_DOMAINS); struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); mutex_lock(&ap_perms_mutex); @@ -1196,11 +1190,8 @@ static ssize_t assign_domain_store(struct device *dev, } vfio_ap_mdev_link_domain(matrix_mdev, apqi); - memset(aqm_delta, 0, sizeof(aqm_delta)); - set_bit_inv(apqi, aqm_delta); - if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, aqm_delta, - matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); ret = count; @@ -2091,9 +2082,7 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) if (matrix_mdev) { vfio_ap_mdev_link_queue(matrix_mdev, q); - if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, - matrix_mdev->matrix.aqm, - matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); } dev_set_drvdata(&apdev->device, q); @@ -2443,34 +2432,22 @@ void vfio_ap_on_cfg_changed(struct ap_config_info *cur_cfg_info, static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev) { - bool do_hotplug = false; - int filter_domains = 0; - int filter_adapters = 0; - DECLARE_BITMAP(apm, AP_DEVICES); - DECLARE_BITMAP(aqm, AP_DOMAINS); + bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false; mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); - filter_adapters = bitmap_and(apm, matrix_mdev->matrix.apm, - matrix_mdev->apm_add, AP_DEVICES); - filter_domains = bitmap_and(aqm, matrix_mdev->matrix.aqm, - matrix_mdev->aqm_add, AP_DOMAINS); - - if (filter_adapters && filter_domains) - do_hotplug |= vfio_ap_mdev_filter_matrix(apm, aqm, matrix_mdev); - else if (filter_adapters) - do_hotplug |= - vfio_ap_mdev_filter_matrix(apm, - matrix_mdev->shadow_apcb.aqm, - matrix_mdev); - else - do_hotplug |= - vfio_ap_mdev_filter_matrix(matrix_mdev->shadow_apcb.apm, - aqm, matrix_mdev); + filter_adapters = bitmap_intersects(matrix_mdev->matrix.apm, + matrix_mdev->apm_add, AP_DEVICES); + filter_domains = bitmap_intersects(matrix_mdev->matrix.aqm, + matrix_mdev->aqm_add, AP_DOMAINS); + filter_cdoms = bitmap_intersects(matrix_mdev->matrix.adm, + matrix_mdev->adm_add, AP_DOMAINS); + + if (filter_adapters || filter_domains) + do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev); - if (bitmap_intersects(matrix_mdev->matrix.adm, matrix_mdev->adm_add, - AP_DOMAINS)) + if (filter_cdoms) do_hotplug |= vfio_ap_mdev_filter_cdoms(matrix_mdev); if (do_hotplug) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/4] CVE-2023-52447
by Pu Lehui 19 Mar '24

19 Mar '24

Hou Tao (3): bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Set need_defer as false when clearing fd array during map free bpf: Defer the free of inner map when necessary Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops include/linux/bpf.h | 18 +++++++++++++++--- kernel/bpf/arraymap.c | 33 ++++++++++++++++++++------------- kernel/bpf/hashtab.c | 6 +++--- kernel/bpf/map_in_map.c | 13 +++++++++---- kernel/bpf/map_in_map.h | 2 +- kernel/bpf/syscall.c | 23 +++++++++++++++++++++-- 6 files changed, 69 insertions(+), 26 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/4] CVE-2023-52447
by Pu Lehui 19 Mar '24

19 Mar '24

Hou Tao (3): bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Set need_defer as false when clearing fd array during map free bpf: Defer the free of inner map when necessary Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops include/linux/bpf.h | 18 +++++++++++++++--- kernel/bpf/arraymap.c | 33 ++++++++++++++++++++------------- kernel/bpf/hashtab.c | 6 +++--- kernel/bpf/map_in_map.c | 13 +++++++++---- kernel/bpf/map_in_map.h | 2 +- kernel/bpf/syscall.c | 23 +++++++++++++++++++++-- 6 files changed, 69 insertions(+), 26 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS 0/4] CVE-2023-52447
by Pu Lehui 19 Mar '24

19 Mar '24

Hou Tao (3): bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Set need_defer as false when clearing fd array during map free bpf: Defer the free of inner map when necessary Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops include/linux/bpf.h | 18 +++++++++++++++--- kernel/bpf/arraymap.c | 33 ++++++++++++++++++++------------- kernel/bpf/hashtab.c | 6 +++--- kernel/bpf/map_in_map.c | 13 +++++++++---- kernel/bpf/map_in_map.h | 2 +- kernel/bpf/syscall.c | 23 +++++++++++++++++++++-- 6 files changed, 69 insertions(+), 26 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] CVE-2023-52447
by Pu Lehui 19 Mar '24

19 Mar '24

Hou Tao (3): bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Set need_defer as false when clearing fd array during map free bpf: Defer the free of inner map when necessary Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops include/linux/bpf.h | 18 +++++++++++++++--- kernel/bpf/arraymap.c | 33 ++++++++++++++++++++------------- kernel/bpf/hashtab.c | 6 +++--- kernel/bpf/map_in_map.c | 13 +++++++++---- kernel/bpf/map_in_map.h | 2 +- kernel/bpf/syscall.c | 23 +++++++++++++++++++++-- 6 files changed, 69 insertions(+), 26 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] powerpc/lib: Validate size for vector operations
by Zhu Wang 19 Mar '24

19 Mar '24

From: Naveen N Rao <naveen(a)kernel.org> mainline inclusion from mainline-v6.8-rc1 commit 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G83 CVE: CVE-2023-52606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyse_instr(). Add a check to validate the assumption on the maximum size of the operations, so as to prevent any unintended kernel stack corruption. Signed-off-by: Naveen N Rao <naveen(a)kernel.org> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Build-tested-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231123071705.397625-1-naveen@kernel.org Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- arch/powerpc/lib/sstep.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c index d81568f783e5..6c8531928274 100644 --- a/arch/powerpc/lib/sstep.c +++ b/arch/powerpc/lib/sstep.c @@ -473,6 +473,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea, } u; nb = GETSIZE(op->type); + if (nb > sizeof(u)) + return -EINVAL; if (!address_ok(regs, ea, nb)) return -EFAULT; rn = op->reg; @@ -523,6 +525,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea, } u; nb = GETSIZE(op->type); + if (nb > sizeof(u)) + return -EINVAL; if (!address_ok(regs, ea, nb)) return -EFAULT; rn = op->reg; @@ -567,6 +571,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea, u8 b[sizeof(__vector128)]; } u = {}; + if (size > sizeof(u)) + return -EINVAL; + if (!address_ok(regs, ea & ~0xfUL, 16)) return -EFAULT; /* align to multiple of size */ @@ -594,6 +601,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea, u8 b[sizeof(__vector128)]; } u; + if (size > sizeof(u)) + return -EINVAL; + if (!address_ok(regs, ea & ~0xfUL, 16)) return -EFAULT; /* align to multiple of size */ -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] CVE-2023-52593
by Chen Ridong 19 Mar '24

19 Mar '24

*** BLURB HERE *** Dmitry Antipov (1): wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() drivers/net/wireless/silabs/wfx/sta.c | 42 ++++++++++++++++----------- 1 file changed, 25 insertions(+), 17 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] binder: fix race between mmput() and do_exit()
by Zheng Yejian 19 Mar '24

19 Mar '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.209 commit 7e7a0d86542b0ea903006d3f42f33c4f7ead6918 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JWJ CVE: CVE-2023-52609 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)huawei.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/android/binder_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 61406bfa454b..7bd086ab74c5 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -271,7 +271,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, } if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return 0; @@ -304,7 +304,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, err_no_vma: if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return vma ? -ENOMEM : -ESRCH; } -- 2.25.1

2 1

[PATCH OLK-6.6] s390/vfio-ap: always filter entire AP matrix
by Xiang Yang 19 Mar '24

19 Mar '24

From: Tony Krowiak <akrowiak(a)linux.ibm.com> mainline inclusion from mainline-v6.6.15 commit c69d821197611678533fb3eb784fc823b921349a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NH7 CVE: CVE-2024-26620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 upstream. The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filtering the matrix of adapters and domains assigned to the mdev. When an adapter or domain is assigned, only the APQNs associated with the APID of the new adapter or APQI of the new domain are inspected. If an APQN does not reference a queue device bound to the vfio_ap device driver, then it's APID will be filtered from the mdev's matrix when updating the guest's AP configuration. Inspecting only the APID of the new adapter or APQI of the new domain will result in passing AP queues through to a guest that are not bound to the vfio_ap device driver under certain circumstances. Consider the following: guest's AP configuration (all also assigned to the mdev's matrix): 14.0004 14.0005 14.0006 16.0004 16.0005 16.0006 unassign domain 4 unbind queue 16.0005 assign domain 4 When domain 4 is re-assigned, since only domain 4 will be inspected, the APQNs that will be examined will be: 14.0004 16.0004 Since both of those APQNs reference queue devices that are bound to the vfio_ap device driver, nothing will get filtered from the mdev's matrix when updating the guest's AP configuration. Consequently, queue 16.0005 will get passed through despite not being bound to the driver. This violates the linux device model requirement that a guest shall only be given access to devices bound to the device driver facilitating their pass-through. To resolve this problem, every adapter and domain assigned to the mdev will be inspected when filtering the mdev's matrix. Signed-off-by: Tony Krowiak <akrowiak(a)linux.ibm.com> Acked-by: Halil Pasic <pasic(a)linux.ibm.com> Fixes: 48cae940c31d ("s390/vfio-ap: refresh guest's APCB by filtering AP resources assigned to mdev") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240115185441.31526-2-akrowiak@linux.ibm.com Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/s390/crypto/vfio_ap_ops.c | 57 +++++++++---------------------- 1 file changed, 17 insertions(+), 40 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c index 4db538a55192..9382b32e5bd1 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -670,8 +670,7 @@ static bool vfio_ap_mdev_filter_cdoms(struct ap_matrix_mdev *matrix_mdev) * Return: a boolean value indicating whether the KVM guest's APCB was changed * by the filtering or not. */ -static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, - struct ap_matrix_mdev *matrix_mdev) +static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev) { unsigned long apid, apqi, apqn; DECLARE_BITMAP(prev_shadow_apm, AP_DEVICES); @@ -692,8 +691,8 @@ static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, bitmap_and(matrix_mdev->shadow_apcb.aqm, matrix_mdev->matrix.aqm, (unsigned long *)matrix_dev->info.aqm, AP_DOMAINS); - for_each_set_bit_inv(apid, apm, AP_DEVICES) { - for_each_set_bit_inv(apqi, aqm, AP_DOMAINS) { + for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, AP_DEVICES) { + for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, AP_DOMAINS) { /* * If the APQN is not bound to the vfio_ap device * driver, then we can't assign it to the guest's @@ -958,7 +957,6 @@ static ssize_t assign_adapter_store(struct device *dev, { int ret; unsigned long apid; - DECLARE_BITMAP(apm_delta, AP_DEVICES); struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); mutex_lock(&ap_perms_mutex); @@ -987,11 +985,8 @@ static ssize_t assign_adapter_store(struct device *dev, } vfio_ap_mdev_link_adapter(matrix_mdev, apid); - memset(apm_delta, 0, sizeof(apm_delta)); - set_bit_inv(apid, apm_delta); - if (vfio_ap_mdev_filter_matrix(apm_delta, - matrix_mdev->matrix.aqm, matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); ret = count; @@ -1167,7 +1162,6 @@ static ssize_t assign_domain_store(struct device *dev, { int ret; unsigned long apqi; - DECLARE_BITMAP(aqm_delta, AP_DOMAINS); struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); mutex_lock(&ap_perms_mutex); @@ -1196,11 +1190,8 @@ static ssize_t assign_domain_store(struct device *dev, } vfio_ap_mdev_link_domain(matrix_mdev, apqi); - memset(aqm_delta, 0, sizeof(aqm_delta)); - set_bit_inv(apqi, aqm_delta); - if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, aqm_delta, - matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); ret = count; @@ -2091,9 +2082,7 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) if (matrix_mdev) { vfio_ap_mdev_link_queue(matrix_mdev, q); - if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, - matrix_mdev->matrix.aqm, - matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); } dev_set_drvdata(&apdev->device, q); @@ -2443,34 +2432,22 @@ void vfio_ap_on_cfg_changed(struct ap_config_info *cur_cfg_info, static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev) { - bool do_hotplug = false; - int filter_domains = 0; - int filter_adapters = 0; - DECLARE_BITMAP(apm, AP_DEVICES); - DECLARE_BITMAP(aqm, AP_DOMAINS); + bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false; mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); - filter_adapters = bitmap_and(apm, matrix_mdev->matrix.apm, - matrix_mdev->apm_add, AP_DEVICES); - filter_domains = bitmap_and(aqm, matrix_mdev->matrix.aqm, - matrix_mdev->aqm_add, AP_DOMAINS); - - if (filter_adapters && filter_domains) - do_hotplug |= vfio_ap_mdev_filter_matrix(apm, aqm, matrix_mdev); - else if (filter_adapters) - do_hotplug |= - vfio_ap_mdev_filter_matrix(apm, - matrix_mdev->shadow_apcb.aqm, - matrix_mdev); - else - do_hotplug |= - vfio_ap_mdev_filter_matrix(matrix_mdev->shadow_apcb.apm, - aqm, matrix_mdev); + filter_adapters = bitmap_intersects(matrix_mdev->matrix.apm, + matrix_mdev->apm_add, AP_DEVICES); + filter_domains = bitmap_intersects(matrix_mdev->matrix.aqm, + matrix_mdev->aqm_add, AP_DOMAINS); + filter_cdoms = bitmap_intersects(matrix_mdev->matrix.adm, + matrix_mdev->adm_add, AP_DOMAINS); + + if (filter_adapters || filter_domains) + do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev); - if (bitmap_intersects(matrix_mdev->matrix.adm, matrix_mdev->adm_add, - AP_DOMAINS)) + if (filter_cdoms) do_hotplug |= vfio_ap_mdev_filter_cdoms(matrix_mdev); if (do_hotplug) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47114
by Yifan Qiao 19 Mar '24

19 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS] binder: fix race between mmput() and do_exit()
by Zheng Yejian 19 Mar '24

19 Mar '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v4.19.306 commit 95b1d336b0642198b56836b89908d07b9a0c9608 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JWJ CVE: CVE-2023-52609 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com [cmllamas: fix trivial conflict with missing d8ed45c5dcd4.] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/android/binder_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index d866a70cba7b..6f073d7fd7c6 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -281,7 +281,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, } if (mm) { up_read(&mm->mmap_sem); - mmput(mm); + mmput_async(mm); } return 0; @@ -314,7 +314,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, err_no_vma: if (mm) { up_read(&mm->mmap_sem); - mmput(mm); + mmput_async(mm); } return vma ? -ENOMEM : -ESRCH; } -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] CVE-2023-52593 wifi
by Chen Ridong 19 Mar '24

19 Mar '24

*** BLURB HERE *** Chen Ridong (1): wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() drivers/staging/wfx/sta.c | 42 ++++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH V4 OLK-6.6] iommu/iova: avoid softlockup in fq_flush_timeout
by Zhang Zekun 19 Mar '24

19 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZE0I CVE: NA -------------------------------- There is a softlockup undering cpu pressure test. ... pc : _raw_spin_unlock_irqrestore+0x14/0x78 lr : fq_flush_timeout+0x94/0x118 ... Call trace: _raw_spin_unlock_irqrestore+0x14/0x78 call_timer_fn+0x3c/0x1d0 expire_timers+0xcc/0x190 run_timer_softirq+0xfc/0x268 __do_softirq+0x128/0x3dc ____do_softirq+0x18/0x30 call_on_irq_stack+0x24/0x30 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0xc0/0xe8 el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x78/0x80 __schedule+0xf28/0x12a0 schedule+0x3c/0x108 schedule_timeout+0xa0/0x1d0 pktgen_thread_worker+0x1180/0x15d0 kthread+0x120/0x130 ret_from_fork+0x10/0x20 This is because the timer callback fq_flush_timeout may run more than 10ms, and timer may be processed continuously in the softirq so trigger softlockup. We can use work to deal with fq_ring_free for each cpu which may take long time, that to avoid triggering softlockup. Signed-off-by: Li Bin <huawei.libin(a)huawei.com> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- v4: - fix code check warnings. drivers/iommu/dma-iommu.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 037fcf826407..06ccdda6173b 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -85,6 +85,8 @@ struct iommu_dma_cookie { /* Options for dma-iommu use */ struct iommu_dma_options options; struct mutex mutex; + + struct work_struct free_iova_work; }; static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled); @@ -184,17 +186,11 @@ static void fq_flush_iotlb(struct iommu_dma_cookie *cookie) static void fq_flush_timeout(struct timer_list *t) { struct iommu_dma_cookie *cookie = from_timer(cookie, t, fq_timer); - int cpu; atomic_set(&cookie->fq_timer_on, 0); fq_flush_iotlb(cookie); - if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { - fq_ring_free(cookie, cookie->single_fq); - } else { - for_each_possible_cpu(cpu) - fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); - } + schedule_work(&cookie->free_iova_work); } static void queue_iova(struct iommu_dma_cookie *cookie, @@ -279,6 +275,7 @@ static void iommu_dma_free_fq(struct iommu_dma_cookie *cookie) return; del_timer_sync(&cookie->fq_timer); + flush_work(&cookie->free_iova_work); if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) iommu_dma_free_fq_single(cookie->single_fq); else @@ -330,6 +327,21 @@ static int iommu_dma_init_fq_percpu(struct iommu_dma_cookie *cookie) return 0; } +static void free_iova_work_func(struct work_struct *work) +{ + struct iommu_dma_cookie *cookie; + int cpu; + + cookie = container_of(work, struct iommu_dma_cookie, free_iova_work); + if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { + fq_ring_free(cookie, cookie->single_fq); + } else { + for_each_possible_cpu(cpu) + fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); + } + +} + /* sysfs updates are serialised by the mutex of the group owning @domain */ int iommu_dma_init_fq(struct iommu_domain *domain) { @@ -352,6 +364,7 @@ int iommu_dma_init_fq(struct iommu_domain *domain) return -ENOMEM; } + INIT_WORK(&cookie->free_iova_work, free_iova_work_func); timer_setup(&cookie->fq_timer, fq_flush_timeout, 0); atomic_set(&cookie->fq_timer_on, 0); /* -- 2.17.1

2 1

[PATCH OLK-6.6] iommu/arm-smmu-v3: Disable ECMDQ before reset
by Wang Wensheng 19 Mar '24

19 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97CSY -------------------------------- In kdump kernel, the ECMDQ is enabled before and cannot be reset before it is disabled. This leads to "CMD_SYNC timeout" problem. Disable the ECMDQ before reset the ECMDQ to fix. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 3d3e0c935023..4b006590ae05 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3869,6 +3869,20 @@ static int arm_smmu_ecmdq_reset(struct arm_smmu_device *smmu) q->llq.prod = 0; q->llq.cons = 0; } + + reg = readl(q->prod_reg); + if (reg & ECMDQ_PROD_EN) { + /* disable ecmdq */ + writel(reg & ~ECMDQ_PROD_EN, q->prod_reg); + ret = readl_relaxed_poll_timeout(q->cons_reg, reg, + !(reg & ECMDQ_CONS_ENACK), 1, ARM_SMMU_POLL_TIMEOUT_US); + if (ret) { + dev_warn(smmu->dev, "ecmdq[%d] disable failed\n", i); + smmu->ecmdq_enabled = 0; + return ret; + } + } + writeq_relaxed(q->q_base, ecmdq->base + ARM_SMMU_ECMDQ_BASE); writel_relaxed(q->llq.prod, ecmdq->base + ARM_SMMU_ECMDQ_PROD); writel_relaxed(q->llq.cons, ecmdq->base + ARM_SMMU_ECMDQ_CONS); -- 2.17.1

1 0

[PATCH OLK-5.10 0/1] CVE-2023-52593
by Chen Ridong 19 Mar '24

19 Mar '24

*** BLURB HERE *** Chen Ridong (1): wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() drivers/staging/wfx/sta.c | 42 ++++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47114
by Yifan Qiao 19 Mar '24

19 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS 0/3]
by Yifan Qiao 19 Mar '24

19 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 8

[PATCH openEuler-22.03-LTS-SP2] UBSAN: array-index-out-of-bounds in dtSplitRoot
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G93 CVE: CVE-2023-52603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ] Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..fafcb90219cf 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid, do { f = &rp->slot[fsi]; fsi = f->next; - } while (fsi != -1); + } while (fsi >= 0); f->next = n; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] UBSAN: array-index-out-of-bounds in dtSplitRoot
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G93 CVE: CVE-2023-52603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ] Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..fafcb90219cf 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid, do { f = &rp->slot[fsi]; fsi = f->next; - } while (fsi != -1); + } while (fsi >= 0); f->next = n; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] UBSAN: array-index-out-of-bounds in dtSplitRoot
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G93 CVE: CVE-2023-52603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ] Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..fafcb90219cf 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid, do { f = &rp->slot[fsi]; fsi = f->next; - } while (fsi != -1); + } while (fsi >= 0); f->next = n; } -- 2.39.2

2 1

[PATCH OLK-5.10] UBSAN: array-index-out-of-bounds in dtSplitRoot
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G93 CVE: CVE-2023-52603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ] Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..fafcb90219cf 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid, do { f = &rp->slot[fsi]; fsi = f->next; - } while (fsi != -1); + } while (fsi >= 0); f->next = n; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47114
by Yifan Qiao 19 Mar '24

19 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-22.03-LTS-SP2] jfs: fix slab-out-of-bounds Read in dtSearch
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 1c40ca3d39d769931b28295b3145c25f1decf5a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G8Y CVE: CVE-2023-52602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ] Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error. Dave: Set return code to -EIO Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202310241724.Ed02yUz9-lkp@intel.com/ Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..aaee08319214 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -633,6 +633,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data, for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) { index = base + (lim >> 1); + if (stbl[index] < 0) { + rc = -EIO; + goto out; + } + if (p->header.flag & BT_LEAF) { /* uppercase leaf name to compare */ cmp = -- 2.39.2

2 1