- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
by Guo Mengqi 19 Mar '25

19 Mar '25

From: James Smart <jsmart2021(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 577a942df3de2666f6947bdd3a5c9e8d30073424 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SH CVE: CVE-2022-49535 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 577a942df3de2666f6947bdd3a5c9e8d30073424 ] If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: James Smart <jsmart2021(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/lpfc/lpfc_els.c [Some contexts are not in this version] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index a6eae7c31bf3..fa1936ed3915 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -1408,10 +1408,12 @@ lpfc_initial_flogi(struct lpfc_vport *vport) } if (lpfc_issue_els_flogi(vport, ndlp, 0)) { - /* This decrement of reference count to node shall kick off - * the release of the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; @@ -1455,10 +1457,12 @@ lpfc_initial_fdisc(struct lpfc_vport *vport) } if (lpfc_issue_els_fdisc(vport, ndlp, 0)) { - /* decrement node reference count to trigger the release of - * the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; -- 2.22.0

2 1

[openEuler-1.0-LTS] scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
by Guo Mengqi 19 Mar '25

19 Mar '25

From: James Smart <jsmart2021(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 577a942df3de2666f6947bdd3a5c9e8d30073424 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SH CVE: CVE-2022-49535 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 577a942df3de2666f6947bdd3a5c9e8d30073424 ] If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: James Smart <jsmart2021(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/lpfc/lpfc_els.c [Some contexts are not in this version] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index a6eae7c31bf3..fa1936ed3915 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -1408,10 +1408,12 @@ lpfc_initial_flogi(struct lpfc_vport *vport) } if (lpfc_issue_els_flogi(vport, ndlp, 0)) { - /* This decrement of reference count to node shall kick off - * the release of the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; @@ -1455,10 +1457,12 @@ lpfc_initial_fdisc(struct lpfc_vport *vport) } if (lpfc_issue_els_fdisc(vport, ndlp, 0)) { - /* decrement node reference count to trigger the release of - * the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; -- 2.22.0

1 0

[openeuler:openEuler-1.0-LTS 1504/1504] drivers/tee/optee/core.c:618:10: warning: return makes integer from pointer without a cast
by kernel test robot 19 Mar '25

19 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5624ca70f4eb787c54115bc1e1eb09ea582fd9a4 commit: 595311cf7e49c781dd26782e4b45fd54bbfb3e40 [1504/1504] optee: model OP-TEE as a platform device/driver config: arm64-randconfig-002-20250319 (https://download.01.org/0day-ci/archive/20250319/202503191516.fZeE5He3-lkp@…) compiler: aarch64-linux-gcc (GCC) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250319/202503191516.fZeE5He3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503191516.fZeE5He3-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/tee/optee/core.c: In function 'optee_probe': >> drivers/tee/optee/core.c:618:10: warning: return makes integer from pointer without a cast [-Wint-conversion] return ERR_PTR(-EINVAL); ^~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for UACCE Depends on [n]: IOMMU_API [=n] Selected by [m]: - CRYPTO_DEV_HISI_QM [=m] && CRYPTO [=y] && CRYPTO_HW [=y] && ARM64 [=y] && PCI [=y] vim +618 drivers/tee/optee/core.c 595311cf7e49c7 Ard Biesheuvel 2019-12-09 581 595311cf7e49c7 Ard Biesheuvel 2019-12-09 582 static int optee_probe(struct platform_device *pdev) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 583 { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 584 optee_invoke_fn *invoke_fn; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 585 struct tee_shm_pool *pool; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 586 struct optee *optee = NULL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 587 void *memremaped_shm = NULL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 588 struct tee_device *teedev; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 589 u32 sec_caps; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 590 int rc; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 591 595311cf7e49c7 Ard Biesheuvel 2019-12-09 592 invoke_fn = get_invoke_func(&pdev->dev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 593 if (IS_ERR(invoke_fn)) 595311cf7e49c7 Ard Biesheuvel 2019-12-09 594 return PTR_ERR(invoke_fn); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 595 4fb0a5eb364d23 Jens Wiklander 2015-04-14 596 if (!optee_msg_api_uid_is_optee_api(invoke_fn)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 597 pr_warn("api uid mismatch\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 598 return -EINVAL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 599 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 600 5c5f80307ab27c Jérôme Forissier 2017-11-24 601 optee_msg_get_os_revision(invoke_fn); 5c5f80307ab27c Jérôme Forissier 2017-11-24 602 4fb0a5eb364d23 Jens Wiklander 2015-04-14 603 if (!optee_msg_api_revision_is_compatible(invoke_fn)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 604 pr_warn("api revision mismatch\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 605 return -EINVAL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 606 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 607 4fb0a5eb364d23 Jens Wiklander 2015-04-14 608 if (!optee_msg_exchange_capabilities(invoke_fn, &sec_caps)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 609 pr_warn("capabilities mismatch\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 610 return -EINVAL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 611 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 612 4fb0a5eb364d23 Jens Wiklander 2015-04-14 613 /* 4fb0a5eb364d23 Jens Wiklander 2015-04-14 614 * We have no other option for shared memory, if secure world 4fb0a5eb364d23 Jens Wiklander 2015-04-14 615 * doesn't have any reserved memory we can use we can't continue. 4fb0a5eb364d23 Jens Wiklander 2015-04-14 616 */ 4fb0a5eb364d23 Jens Wiklander 2015-04-14 617 if (!(sec_caps & OPTEE_SMC_SEC_CAP_HAVE_RESERVED_SHM)) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 @618 return ERR_PTR(-EINVAL); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 619 f58e236c9d665a Volodymyr Babchuk 2017-11-29 620 pool = optee_config_shm_memremap(invoke_fn, &memremaped_shm, sec_caps); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 621 if (IS_ERR(pool)) 595311cf7e49c7 Ard Biesheuvel 2019-12-09 622 return PTR_ERR(pool); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 623 4fb0a5eb364d23 Jens Wiklander 2015-04-14 624 optee = kzalloc(sizeof(*optee), GFP_KERNEL); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 625 if (!optee) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 626 rc = -ENOMEM; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 627 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 628 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 629 4fb0a5eb364d23 Jens Wiklander 2015-04-14 630 optee->invoke_fn = invoke_fn; d885cc5e0759fc Volodymyr Babchuk 2017-11-29 631 optee->sec_caps = sec_caps; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 632 4fb0a5eb364d23 Jens Wiklander 2015-04-14 633 teedev = tee_device_alloc(&optee_desc, NULL, pool, optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 634 if (IS_ERR(teedev)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 635 rc = PTR_ERR(teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 636 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 637 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 638 optee->teedev = teedev; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 639 4fb0a5eb364d23 Jens Wiklander 2015-04-14 640 teedev = tee_device_alloc(&optee_supp_desc, NULL, pool, optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 641 if (IS_ERR(teedev)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 642 rc = PTR_ERR(teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 643 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 644 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 645 optee->supp_teedev = teedev; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 646 4fb0a5eb364d23 Jens Wiklander 2015-04-14 647 rc = tee_device_register(optee->teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 648 if (rc) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 649 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 650 4fb0a5eb364d23 Jens Wiklander 2015-04-14 651 rc = tee_device_register(optee->supp_teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 652 if (rc) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 653 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 654 4fb0a5eb364d23 Jens Wiklander 2015-04-14 655 mutex_init(&optee->call_queue.mutex); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 656 INIT_LIST_HEAD(&optee->call_queue.waiters); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 657 optee_wait_queue_init(&optee->wait_queue); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 658 optee_supp_init(&optee->supp); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 659 optee->memremaped_shm = memremaped_shm; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 660 optee->pool = pool; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 661 4fb0a5eb364d23 Jens Wiklander 2015-04-14 662 optee_enable_shm_cache(optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 663 595311cf7e49c7 Ard Biesheuvel 2019-12-09 664 platform_set_drvdata(pdev, optee); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 665 4fb0a5eb364d23 Jens Wiklander 2015-04-14 666 pr_info("initialized driver\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 667 return 0; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 668 err: 4fb0a5eb364d23 Jens Wiklander 2015-04-14 669 if (optee) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 670 /* 4fb0a5eb364d23 Jens Wiklander 2015-04-14 671 * tee_device_unregister() is safe to call even if the 4fb0a5eb364d23 Jens Wiklander 2015-04-14 672 * devices hasn't been registered with 4fb0a5eb364d23 Jens Wiklander 2015-04-14 673 * tee_device_register() yet. 4fb0a5eb364d23 Jens Wiklander 2015-04-14 674 */ 4fb0a5eb364d23 Jens Wiklander 2015-04-14 675 tee_device_unregister(optee->supp_teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 676 tee_device_unregister(optee->teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 677 kfree(optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 678 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 679 if (pool) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 680 tee_shm_pool_free(pool); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 681 if (memremaped_shm) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 682 memunmap(memremaped_shm); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 683 return rc; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 684 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 685 :::::: The code at line 618 was first introduced by commit :::::: 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 tee: add OP-TEE driver :::::: TO: Jens Wiklander <jens.wiklander(a)linaro.org> :::::: CC: Jens Wiklander <jens.wiklander(a)linaro.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 1/2] bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
by Pu Lehui 19 Mar '25

19 Mar '25

From: Andrii Nakryiko <andrii(a)kernel.org> stable inclusion from stable-v6.6.80 commit fc01ba097319ae2033f118da3075bd783f4a08e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSW0M CVE: CVE-2025-21853 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 98671a0fd1f14e4a518ee06b19037c20014900eb ] For all BPF maps we ensure that VM_MAYWRITE is cleared when memory-mapping BPF map contents as initially read-only VMA. This is because in some cases BPF verifier relies on the underlying data to not be modified afterwards by user space, so once something is mapped read-only, it shouldn't be re-mmap'ed as read-write. As such, it's not necessary to check VM_MAYWRITE in bpf_map_mmap() and map->ops->map_mmap() callbacks: VM_WRITE should be consistently set for read-write mappings, and if VM_WRITE is not set, there is no way for user space to upgrade read-only mapping to read-write one. This patch cleans up this VM_WRITE vs VM_MAYWRITE handling within bpf_map_mmap(), which is an entry point for any BPF map mmap()-ing logic. We also drop unnecessary sanitization of VM_MAYWRITE in BPF ringbuf's map_mmap() callback implementation, as it is already performed by common code in bpf_map_mmap(). Note, though, that in bpf_map_mmap_{open,close}() callbacks we can't drop VM_MAYWRITE use, because it's possible (and is outside of subsystem's control) to have initially read-write memory mapping, which is subsequently dropped to read-only by user space through mprotect(). In such case, from BPF verifier POV it's read-write data throughout the lifetime of BPF map, and is counted as "active writer". But its VMAs will start out as VM_WRITE|VM_MAYWRITE, then mprotect() can change it to just VM_MAYWRITE (and no VM_WRITE), so when its finally munmap()'ed and bpf_map_mmap_close() is called, vm_flags will be just VM_MAYWRITE, but we still need to decrement active writer count with bpf_map_write_active_dec() as it's still considered to be a read-write mapping by the rest of BPF subsystem. Similar reasoning applies to bpf_map_mmap_open(), which is called whenever mmap(), munmap(), and/or mprotect() forces mm subsystem to split original VMA into multiple discontiguous VMAs. Memory-mapping handling is a bit tricky, yes. Cc: Jann Horn <jannh(a)google.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/r/20250129012246.1515826-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Stable-dep-of: bc27c52eea18 ("bpf: avoid holding freeze_mutex during mmap operation") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/ringbuf.c | 4 ---- kernel/bpf/syscall.c | 10 ++++++++-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 00688545742f..6aff5ee483b6 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -268,8 +268,6 @@ static int ringbuf_map_mmap_kern(struct bpf_map *map, struct vm_area_struct *vma /* allow writable mapping for the consumer_pos only */ if (vma->vm_pgoff != 0 || vma->vm_end - vma->vm_start != PAGE_SIZE) return -EPERM; - } else { - vm_flags_clear(vma, VM_MAYWRITE); } /* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range(vma, rb_map->rb, @@ -289,8 +287,6 @@ static int ringbuf_map_mmap_user(struct bpf_map *map, struct vm_area_struct *vma * position, and the ring buffer data itself. */ return -EPERM; - } else { - vm_flags_clear(vma, VM_MAYWRITE); } /* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range(vma, rb_map->rb, vma->vm_pgoff + RINGBUF_PGOFF); diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index f8edda3bf396..f79b8915d8c8 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -913,15 +913,21 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) vma->vm_ops = &bpf_map_default_vmops; vma->vm_private_data = map; vm_flags_clear(vma, VM_MAYEXEC); + /* If mapping is read-only, then disallow potentially re-mapping with + * PROT_WRITE by dropping VM_MAYWRITE flag. This VM_MAYWRITE clearing + * means that as far as BPF map's memory-mapped VMAs are concerned, + * VM_WRITE and VM_MAYWRITE and equivalent, if one of them is set, + * both should be set, so we can forget about VM_MAYWRITE and always + * check just VM_WRITE + */ if (!(vma->vm_flags & VM_WRITE)) - /* disallow re-mapping with PROT_WRITE */ vm_flags_clear(vma, VM_MAYWRITE); err = map->ops->map_mmap(map, vma); if (err) goto out; - if (vma->vm_flags & VM_MAYWRITE) + if (vma->vm_flags & VM_WRITE) bpf_map_write_active_inc(map); out: mutex_unlock(&map->freeze_mutex); -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] block: fix error unwinding in blk_register_queue
by Zheng Qixing 19 Mar '25

19 Mar '25

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.2-rc1 commit 40602997be26887bdfa3d58659c3acb4579099e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSG04 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ blk_register_queue fails to handle errors from blk_mq_sysfs_register, leaks various resources on errors and accidentally sets queue refs percpu refcount to percpu mode on kobject_add failure. Fix all that by properly unwinding on errors. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20221114042637.1009333-4-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-sysfs.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-sysfs.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index b23d82fbe736..05d8a5b236f5 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -961,15 +961,21 @@ int blk_register_queue(struct gendisk *disk) return ret; mutex_lock(&queue_to_wrapper(q)->sysfs_dir_lock); - ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue"); if (ret < 0) { blk_trace_remove_sysfs(dev); goto unlock; } - if (q->mq_ops) - __blk_mq_register_dev(dev, q); + if (q->mq_ops) { + ret = __blk_mq_register_dev(dev, q); + if (ret) { + blk_trace_remove_sysfs(dev); + kobject_del(&q->kobj); + kobject_put(&dev->kobj); + goto unlock; + } + } mutex_lock(&q->sysfs_lock); mutex_lock(&q->debugfs_mutex); -- 2.39.2

2 1

[openeuler:OLK-6.6 2041/2041] arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used
by kernel test robot 18 Mar '25

18 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 010e974aad58e203f1e68707107db00593fcf851 commit: 7bd845b17aab36ac5d381557b797845404aaeb57 [2041/2041] LoongArch: Update the flush cache policy config: loongarch-randconfig-001-20250318 (https://download.01.org/0day-ci/archive/20250318/202503182233.88LCSaAj-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250318/202503182233.88LCSaAj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503182233.88LCSaAj-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/loongarch/mm/cache.c: In function 'flush_cache_last_level': >> arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used [-Wunused-but-set-variable] 69 | int i, j, nr_nodes, way_size; | ^~~~~~~~ vim +/way_size +69 arch/loongarch/mm/cache.c 65 66 static void flush_cache_last_level(unsigned int leaf) 67 { 68 u64 addr; > 69 int i, j, nr_nodes, way_size; 70 struct cache_desc *cdesc = current_cpu_data.cache_leaves + leaf; 71 72 nr_nodes = loongson_sysconf.nr_nodes; 73 74 addr = CSR_DMW1_BASE; 75 iocsr_write8(0x1, 0x280); 76 way_size = cdesc->sets * cdesc->linesz; 77 do { 78 for (i = 0; i < (cdesc->ways * 3); i++) { 79 for (j = 0; j < (cdesc->sets); j++) { 80 READ_ONCE(*(u32 *)addr); 81 addr += cdesc->linesz; 82 } 83 } 84 addr += 0x100000000000; 85 } while (--nr_nodes > 0); 86 } 87 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49508
by Chen Ridong 18 Mar '25

18 Mar '25

CVE-2022-49508 Dinghao Liu (1): HID: elan: Fix memleak in elan_input_configured Miaoqian Lin (1): HID: elan: Fix potential double free in elan_input_configured drivers/hid/hid-elan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6] smb: client: Add check for next_buffer in receive_encrypted_standard()
by Li Lingfeng 18 Mar '25

18 Mar '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.80 commit 9e5d99a4cf2e23c716b44862975548415fae5391 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZD CVE: CVE-2025-21844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 860ca5e50f73c2a1cef7eefc9d39d04e275417f7 upstream. Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent null pointer dereference. Fixes: eec04ea11969 ("smb: client: fix OOB in receive_encrypted_standard()") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index fc6d00344c50..55269d3a8278 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4904,6 +4904,10 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); + if (!next_buffer) { + cifs_server_dbg(VFS, "No memory for (large) SMB response\n"); + return -1; + } memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] two bugfixs
by Tong Tiangen 18 Mar '25

18 Mar '25

Brian Geffon (1): mm: fix finish_fault() handling for large folios Zi Yan (1): mm/migrate: fix shmem xarray update during migration mm/memory.c | 15 ++++++++++----- mm/migrate.c | 10 ++++------ 2 files changed, 14 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH olk-6.6 0/2] two bugfixs
by Tong Tiangen 18 Mar '25

18 Mar '25

Brian Geffon (1): mm: fix finish_fault() handling for large folios Zi Yan (1): mm/migrate: fix shmem xarray update during migration mm/memory.c | 15 ++++++++++----- mm/migrate.c | 10 ++++------ 2 files changed, 14 insertions(+), 11 deletions(-) -- 2.25.1

2 3