- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-38621
by Liao Chen 25 Jun '24

25 Jun '24

media: stk1160: fix bounds checking in stk1160_copy_video() Dan Carpenter (1): media: stk1160: fix bounds checking in stk1160_copy_video() drivers/media/usb/stk1160/stk1160-video.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] cvm: delete dead code and resolve macro definition holes
by Ju Fu 25 Jun '24

25 Jun '24

virtcca inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9TM0T -------------------------------- delete dead code and resolve macro definition holes Signed-off-by: Ju Fu <fuju1(a)huawei.com> --- arch/arm64/include/asm/kvm_tmi.h | 34 ++++++++++---------------------- arch/arm64/kvm/cvm.c | 1 - arch/arm64/kvm/tmi.c | 26 +----------------------- 3 files changed, 11 insertions(+), 50 deletions(-) diff --git a/arch/arm64/include/asm/kvm_tmi.h b/arch/arm64/include/asm/kvm_tmi.h index b89680f31..eef64936f 100644 --- a/arch/arm64/include/asm/kvm_tmi.h +++ b/arch/arm64/include/asm/kvm_tmi.h @@ -206,28 +206,24 @@ struct tmi_tec_run { * always invoked by the Normal world, forward by SPMD and handled by the * TMM. */ -#define TMI_FNUM_VERSION U(0x260) +#define TMI_FNUM_VERSION_REQ U(0x260) #define TMI_FNUM_MEM_INFO_SHOW U(0x261) #define TMI_FNUM_DATA_CREATE U(0x262) #define TMI_FNUM_DATA_DESTROY U(0x263) #define TMI_FNUM_CVM_ACTIVATE U(0x264) #define TMI_FNUM_CVM_CREATE U(0x265) #define TMI_FNUM_CVM_DESTROY U(0x266) -#define TMI_FNUM_TEC_CREATE U(0x27A) -#define TMI_FNUM_TEC_DESTROY U(0x27B) -#define TMI_FNUM_TEC_ENTER U(0x27C) -#define TMI_FNUM_TTT_CREATE U(0x27D) -#define TMI_FNUM_TTT_MAP_UNPROTECTED U(0x27F) -#define TMI_FNUM_TTT_MAP_PROTECTED U(0x280) -#define TMI_FNUM_TTT_UNMAP_UNPROTECTED U(0x282) -#define TMI_FNUM_TTT_UNMAP_PROTECTED U(0x283) -#define TMI_FNUM_PSCI_COMPLETE U(0x284) -#define TMI_FNUM_FEATURES U(0x285) -#define TMI_FNUM_TTT_MAP_RANGE U(0x286) -#define TMI_FNUM_TTT_UNMAP_RANGE U(0x287) +#define TMI_FNUM_TEC_CREATE U(0x267) +#define TMI_FNUM_TEC_DESTROY U(0x268) +#define TMI_FNUM_TEC_ENTER U(0x269) +#define TMI_FNUM_TTT_CREATE U(0x26A) +#define TMI_FNUM_PSCI_COMPLETE U(0x26B) +#define TMI_FNUM_FEATURES U(0x26C) +#define TMI_FNUM_TTT_MAP_RANGE U(0x26D) +#define TMI_FNUM_TTT_UNMAP_RANGE U(0x26E) /* TMI SMC64 PIDs handled by the SPMD */ -#define TMI_TMM_VESION TMI_FID(SMC_64, TMI_FNUM_VERSION) +#define TMI_TMM_VERSION_REQ TMI_FID(SMC_64, TMI_FNUM_VERSION_REQ) #define TMI_TMM_DATA_CREATE TMI_FID(SMC_64, TMI_FNUM_DATA_CREATE) #define TMI_TMM_DATA_DESTROY TMI_FID(SMC_64, TMI_FNUM_DATA_DESTROY) #define TMI_TMM_CVM_ACTIVATE TMI_FID(SMC_64, TMI_FNUM_CVM_ACTIVATE) @@ -237,10 +233,6 @@ struct tmi_tec_run { #define TMI_TMM_TEC_DESTROY TMI_FID(SMC_64, TMI_FNUM_TEC_DESTROY) #define TMI_TMM_TEC_ENTER TMI_FID(SMC_64, TMI_FNUM_TEC_ENTER) #define TMI_TMM_TTT_CREATE TMI_FID(SMC_64, TMI_FNUM_TTT_CREATE) -#define TMI_TMM_TTT_MAP_UNPROTECTED TMI_FID(SMC_64, TMI_FNUM_TTT_MAP_UNPROTECTED) -#define TMI_TMM_TTT_MAP_PROTECTED TMI_FID(SMC_64, TMI_FNUM_TTT_MAP_PROTECTED) -#define TMI_TMM_TTT_UNMAP_UNPROTECTED TMI_FID(SMC_64, TMI_FNUM_TTT_UNMAP_UNPROTECTED) -#define TMI_TMM_TTT_UNMAP_PROTECTED TMI_FID(SMC_64, TMI_FNUM_TTT_UNMAP_PROTECTED) #define TMI_TMM_PSCI_COMPLETE TMI_FID(SMC_64, TMI_FNUM_PSCI_COMPLETE) #define TMI_TMM_FEATURES TMI_FID(SMC_64, TMI_FNUM_FEATURES) #define TMI_TMM_MEM_INFO_SHOW TMI_FID(SMC_64, TMI_FNUM_MEM_INFO_SHOW) @@ -331,8 +323,6 @@ static inline bool is_armv8_4_sel2_present(void) ID_AA64PFR0_SEL2_MASK) == 1UL; } -u64 phys_to_cvm_phys(u64 phys); - u64 tmi_version(void); u64 tmi_data_create(u64 data, u64 rd, u64 map_addr, u64 src, u64 level); u64 tmi_data_destroy(u64 rd, u64 map_addr, u64 level); @@ -343,14 +333,10 @@ u64 tmi_tec_create(u64 numa_set, u64 rd, u64 mpidr, u64 params_ptr); u64 tmi_tec_destroy(u64 tec); u64 tmi_tec_enter(u64 tec, u64 run_ptr); u64 tmi_ttt_create(u64 numa_set, u64 rd, u64 map_addr, u64 level); -u64 tmi_ttt_map_unprotected(u64 rd, u64 map_addr, u64 level, u64 ttte); -u64 tmi_ttt_unmap_unprotected(u64 rd, u64 map_addr, u64 level, u64 ns); -u64 tmi_ttt_unmap_protected(u64 rd, u64 map_addr, u64 level); u64 tmi_psci_complete(u64 calling_tec, u64 target_tec); u64 tmi_features(u64 index); u64 tmi_ttt_map_range(u64 rd, u64 map_addr, u64 size, u64 cur_node, u64 target_node); u64 tmi_ttt_unmap_range(u64 rd, u64 map_addr, u64 size, u64 node_id); - u64 tmi_mem_info_show(u64 mem_info_addr); void kvm_cvm_vcpu_put(struct kvm_vcpu *vcpu); diff --git a/arch/arm64/kvm/cvm.c b/arch/arm64/kvm/cvm.c index 73b8daede..08fad30d1 100644 --- a/arch/arm64/kvm/cvm.c +++ b/arch/arm64/kvm/cvm.c @@ -171,7 +171,6 @@ int kvm_arm_create_cvm(struct kvm *kvm) pgd_sz = kvm_pgd_pages(pgt->ia_bits, pgt->start_level); - cvm->params->measurement_algo = 0; cvm->params->ttt_level_start = kvm->arch.mmu.pgt->start_level; cvm->params->ttt_num_start = pgd_sz; cvm->params->s2sz = VTCR_EL2_IPA(kvm->arch.vtcr); diff --git a/arch/arm64/kvm/tmi.c b/arch/arm64/kvm/tmi.c index 1fcf1a8cc..888f1a4a2 100644 --- a/arch/arm64/kvm/tmi.c +++ b/arch/arm64/kvm/tmi.c @@ -10,7 +10,7 @@ u64 tmi_version(void) { struct arm_smccc_res res; - arm_smccc_1_1_smc(TMI_TMM_VESION, &res); + arm_smccc_1_1_smc(TMI_TMM_VERSION_REQ, &res); return res.a1; } @@ -86,30 +86,6 @@ u64 tmi_ttt_create(u64 numa_set, u64 rd, u64 map_addr, u64 level) return res.a1; } -u64 tmi_ttt_map_unprotected(u64 rd, u64 map_addr, u64 level, u64 ttte) -{ - struct arm_smccc_res res; - - arm_smccc_1_1_smc(TMI_TMM_TTT_MAP_UNPROTECTED, rd, map_addr, level, ttte, &res); - return res.a1; -} - -u64 tmi_ttt_unmap_unprotected(u64 rd, u64 map_addr, u64 level, u64 ns) -{ - struct arm_smccc_res res; - - arm_smccc_1_1_smc(TMI_TMM_TTT_UNMAP_UNPROTECTED, rd, map_addr, level, ns, &res); - return res.a1; -} - -u64 tmi_ttt_unmap_protected(u64 rd, u64 map_addr, u64 level) -{ - struct arm_smccc_res res; - - arm_smccc_1_1_smc(TMI_TMM_TTT_UNMAP_PROTECTED, rd, map_addr, level, &res); - return res.a1; -} - u64 tmi_psci_complete(u64 calling_tec, u64 target_tec) { struct arm_smccc_res res; -- 2.25.1.windows.1

2 1

[PATCH OLK-6.6] ASoC: mediatek: Assign dummy when codec not specified for a DAI link
by liwei 25 Jun '24

25 Jun '24

From: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> mainline inclusion from mainline-v6.10-rc1 commit 5f39231888c63f0a7708abc86b51b847476379d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SG2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- MediaTek sound card drivers are checking whether a DAI link is present and used on a board to assign the correct parameters and this is done by checking the codec DAI names at probe time. If no real codec is present, assign the dummy codec to the DAI link to avoid NULL pointer during string comparison. Fixes: 4302187d955f ("ASoC: mediatek: common: add soundcard driver common code") Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Link: https://msgid.link/r/20240313110147.1267793-5-angelogioacchino.delregno@col… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- sound/soc/mediatek/common/mtk-soundcard-driver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/mediatek/common/mtk-soundcard-driver.c b/sound/soc/mediatek/common/mtk-soundcard-driver.c index a58e1e3674de..000a086a8cf4 100644 --- a/sound/soc/mediatek/common/mtk-soundcard-driver.c +++ b/sound/soc/mediatek/common/mtk-soundcard-driver.c @@ -22,7 +22,11 @@ static int set_card_codec_info(struct snd_soc_card *card, codec_node = of_get_child_by_name(sub_node, "codec"); if (!codec_node) { - dev_dbg(dev, "%s no specified codec\n", dai_link->name); + dev_dbg(dev, "%s no specified codec: setting dummy.\n", dai_link->name); + + dai_link->codecs = &snd_soc_dummy_dlc; + dai_link->num_codecs = 1; + dai_link->dynamic = 1; return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] hid: cp2112: Fix duplicate workqueue initialization
by Yuan Can 25 Jun '24

25 Jun '24

From: Danny Kaehn <danny.kaehn(a)plexus.com> stable inclusion from stable-v5.15.139 commit df0daac2709473531d6a3472997cc65301ac06d6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFR6 CVE: CVE-2023-52853 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Previously the cp2112 driver called INIT_DELAYED_WORK within cp2112_gpio_irq_startup, resulting in duplicate initilizations of the workqueue on subsequent IRQ startups following an initial request. This resulted in a warning in set_work_data in workqueue.c, as well as a rare NULL dereference within process_one_work in workqueue.c. Initialize the workqueue within _probe instead. Fixes: 13de9cca514e ("HID: cp2112: add IRQ chip handling") Signed-off-by: Danny Kaehn <danny.kaehn(a)plexus.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Conflicts: drivers/hid/hid-cp2112.c [Fix context] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/hid/hid-cp2112.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c index 172f20e88c6c..966504eea1bc 100644 --- a/drivers/hid/hid-cp2112.c +++ b/drivers/hid/hid-cp2112.c @@ -1157,8 +1157,6 @@ static unsigned int cp2112_gpio_irq_startup(struct irq_data *d) struct gpio_chip *gc = irq_data_get_irq_chip_data(d); struct cp2112_device *dev = gpiochip_get_data(gc); - INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback); - if (!dev->gpio_poll) { dev->gpio_poll = true; schedule_delayed_work(&dev->gpio_poll_worker, 0); @@ -1353,6 +1351,8 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id) girq->default_type = IRQ_TYPE_NONE; girq->handler = handle_simple_irq; + INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback); + ret = gpiochip_add_data(&dev->gc, dev); if (ret < 0) { hid_err(hdev, "error registering gpio chip\n"); -- 2.17.1

2 1

[OLK-6.6] RDMA/hns: Fix some mutex UAF
by Chengchang Tang 25 Jun '24

25 Jun '24

From: wenglianfa <wenglianfa(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5Z6R ---------------------------------------------------------------------- umem_unfree_list_mutex and mtr_unfree_list_mutex may be used after being destroyed. To fix it, The mutex is destroyed after it is used for the last time. Fixes: a91843046b2a ("RDMA/hns: Fix sleeping in spin_lock critical section") Signed-off-by: wenglianfa <wenglianfa(a)huawei.com> Signed-off-by: Guofeng Yue <yueguofeng(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 424dcf69d3b8..3628dbb250ab 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -1503,9 +1503,9 @@ void hns_roce_exit(struct hns_roce_dev *hr_dev, bool bond_cleanup) if (hr_dev->hw->hw_exit) hr_dev->hw->hw_exit(hr_dev); - hns_roce_teardown_hca(hr_dev); hns_roce_free_unfree_umem(hr_dev); hns_roce_free_unfree_mtr(hr_dev); + hns_roce_teardown_hca(hr_dev); hns_roce_cleanup_hem(hr_dev); if (hr_dev->cmd_mod) -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2022-48703
by Pu Lehui 25 Jun '24

25 Jun '24

Lee, Chun-Yi (1): thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR Rafael J. Wysocki (1): thermal: int340x_thermal: Consolidate priv->data_vault checks drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2022-48703
by Pu Lehui 25 Jun '24

25 Jun '24

Lee, Chun-Yi (1): thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR Rafael J. Wysocki (1): thermal: int340x_thermal: Consolidate priv->data_vault checks drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
by Guo Mengqi 25 Jun '24

25 Jun '24

From: Krishna Kurapati <quic_kriskura(a)quicinc.com> stable inclusion from stable-v5.10.211 commit 57ca0e16f393bb21d69734e536e383a3a4c665fd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8M7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 76c51146820c5dac629f21deafab0a7039bc3ccd upstream. It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has one byte appended at the end of a proper NTB. When the NTB is parsed, unwrap call looks for any leftover bytes in SKB provided by u_ether and if there are any pending bytes, it treats them as a separate NTB and parses it. But in case the second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that were parsed properly in the first NTB and saved in rx_list are dropped. Adding a few custom traces showed the following: [002] d..1 7828.532866: dwc3_gadget_giveback: ep1out: req 000000003868811a length 1025/16384 zsI ==> 0 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10 [002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames In this case, the giveback is of 1025 bytes and block length is 1024. The rest 1 byte (which is 0x00) won't be parsed resulting in drop of all datagrams in rx_list. Same is case with packets of size 2048: [002] d..1 7828.557948: dwc3_gadget_giveback: ep1out: req 0000000011dfd96e length 2049/16384 zsI ==> 0 [002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800 Lecroy shows one byte coming in extra confirming that the byte is coming in from PC: Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590) - Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590) --- Packet 4063861 Data(1024 bytes) Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590) --- Packet 4063863 Data(1 byte) Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722) According to Windows driver, no ZLP is needed if wBlockLength is non-zero, because the non-zero wBlockLength has already told the function side the size of transfer to be expected. However, there are in-market NCM devices that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize. To deal with such devices, it pads an extra 0 at end so the transfer is no longer multiple of wMaxPacketSize. Cc: <stable(a)vger.kernel.org> Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added") Signed-off-by: Krishna Kurapati <quic_kriskura(a)quicinc.com> Reviewed-by: Maciej Żenczykowski <maze(a)google.com> Link: https://lore.kernel.org/r/20240205074650.200304-1-quic_kriskura@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/usb/gadget/function/f_ncm.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index d1e36941c924..e3b89b7c1d67 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -1349,7 +1349,15 @@ static int ncm_unwrap_ntb(struct gether *port, "Parsed NTB with %d frames\n", dgram_counter); to_process -= block_len; - if (to_process != 0) { + + /* + * Windows NCM driver avoids USB ZLPs by adding a 1-byte + * zero pad as needed. + */ + if (to_process == 1 && + (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) { + to_process--; + } else if (to_process > 0) { ntb_ptr = (unsigned char *)(ntb_ptr + block_len); goto parse_ntb; } -- 2.17.1

2 1

[PATCH OLK-5.10] fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
by Guo Mengqi 25 Jun '24

25 Jun '24

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.3-rc1 commit 47d586913f2abec4d240bae33417f537fda987ec category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/IA5PIS CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently, filp_close() and generic_shutdown_super() use printk() to log messages when bugs are detected. This is problematic because infrastructure like syzkaller has no idea that this message indicates a bug. In addition, some people explicitly want their kernels to BUG() when kernel data corruption has been detected (CONFIG_BUG_ON_DATA_CORRUPTION). And finally, when generic_shutdown_super() detects remaining inodes on a system without CONFIG_BUG_ON_DATA_CORRUPTION, it would be nice if later accesses to a busy inode would at least crash somewhat cleanly rather than walking through freed memory. To address all three, use CHECK_DATA_CORRUPTION() when kernel bugs are detected. Signed-off-by: Jann Horn <jannh(a)google.com> Reviewed-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Reviewed-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Conflicts: include/linux/poison.h Signed-off-by: liwei <liwei728(a)huawei.com> --- fs/open.c | 5 +++-- fs/super.c | 21 +++++++++++++++++---- include/linux/poison.h | 3 +++ 3 files changed, 23 insertions(+), 6 deletions(-) diff --git a/fs/open.c b/fs/open.c index 8092178ceab0..926fd0598935 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1285,8 +1285,9 @@ int filp_close(struct file *filp, fl_owner_t id) { int retval = 0; - if (!file_count(filp)) { - printk(KERN_ERR "VFS: Close: file count is 0\n"); + if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, + "VFS: Close: file count is 0 (f_op=%ps)", + filp->f_op)) { return 0; } diff --git a/fs/super.c b/fs/super.c index db6345634f8b..db46a20da0c8 100644 --- a/fs/super.c +++ b/fs/super.c @@ -465,10 +465,23 @@ void generic_shutdown_super(struct super_block *sb) if (sop->put_super) sop->put_super(sb); - if (!list_empty(&sb->s_inodes)) { - printk("VFS: Busy inodes after unmount of %s. " - "Self-destruct in 5 seconds. Have a nice day...\n", - sb->s_id); + if (CHECK_DATA_CORRUPTION(!list_empty(&sb->s_inodes), + "VFS: Busy inodes after unmount of %s (%s)", + sb->s_id, sb->s_type->name)) { + /* + * Adding a proper bailout path here would be hard, but + * we can at least make it more likely that a later + * iput_final() or such crashes cleanly. + */ + struct inode *inode; + + spin_lock(&sb->s_inode_list_lock); + list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { + inode->i_op = VFS_PTR_POISON; + inode->i_sb = VFS_PTR_POISON; + inode->i_mapping = VFS_PTR_POISON; + } + spin_unlock(&sb->s_inode_list_lock); } } spin_lock(&sb_lock); diff --git a/include/linux/poison.h b/include/linux/poison.h index 028133fb1405..a33190e56035 100644 --- a/include/linux/poison.h +++ b/include/linux/poison.h @@ -85,4 +85,7 @@ /********** net/core/page_pool.c **********/ #define PP_SIGNATURE (0x40 + POISON_POINTER_DELTA) +/********** VFS **********/ +#define VFS_PTR_POISON ((void *)(0xF5 + POISON_POINTER_DELTA)) + #endif -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] RDMA/hns: Fix deadlock on SRQ async events.
by Guo Mengqi 25 Jun '24

25 Jun '24

From: Chengchang Tang <tangchengchang(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit b46494b6f9c19f141114a57729e198698f40af37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SF1 CVE: CVE-2024-38591 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- xa_lock for SRQ table may be required in AEQ. Use xa_store_irq()/ xa_erase_irq() to avoid deadlock. Fixes: 81fce6291d99 ("RDMA/hns: Add SRQ asynchronous event support") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://lore.kernel.org/r/20240412091616.370789-5-huangjunxian6@hisilicon.c… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/hns/hns_roce_main.c [The conflict occurs because the commit e4df3a25f0fa("[Backport] RDMA/hns: support RoCE bonding") has been merged. It contains hnae3.h] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_srq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c index 727c7a134102..a3999fc69719 100644 --- a/drivers/infiniband/hw/hns/hns_roce_srq.c +++ b/drivers/infiniband/hw/hns/hns_roce_srq.c @@ -122,7 +122,7 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) return ret; } - ret = xa_err(xa_store(&srq_table->xa, srq->srqn, srq, GFP_KERNEL)); + ret = xa_err(xa_store_irq(&srq_table->xa, srq->srqn, srq, GFP_KERNEL)); if (ret) { ibdev_err(ibdev, "failed to store SRQC, ret = %d.\n", ret); goto err_put; @@ -135,7 +135,7 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) return 0; err_xa: - xa_erase(&srq_table->xa, srq->srqn); + xa_erase_irq(&srq_table->xa, srq->srqn); err_put: hns_roce_table_put(hr_dev, &srq_table->table, srq->srqn); @@ -153,7 +153,7 @@ static void free_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq) dev_err(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n", ret, srq->srqn); - xa_erase(&srq_table->xa, srq->srqn); + xa_erase_irq(&srq_table->xa, srq->srqn); if (refcount_dec_and_test(&srq->refcount)) complete(&srq->free); -- 2.17.1

2 1

2024

2023

2022

2021

2020

2019

Kernel