- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] Bluetooth: Fix not cleanup led when bt_init fails
by Wang Liang 02 Nov '24

02 Nov '24

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v4.19.269 commit 8a66c3a94285552f6a8e45d73b34ebbad11d388b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIP CVE: CVE-2022-48971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2f3957c7eb4e07df944169a3e50a4d6790e1c744 ] bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0 Fixes: e64c97b53bc6 ("Bluetooth: Add combined LED trigger for controller power") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/af_bluetooth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index 0bd7ad4e72dc..4f839e4fb2c0 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -744,7 +744,7 @@ static int __init bt_init(void) err = bt_sysfs_init(); if (err < 0) - return err; + goto cleanup_led; err = sock_register(&bt_sock_family_ops); if (err) @@ -780,6 +780,8 @@ static int __init bt_init(void) sock_unregister(PF_BLUETOOTH); cleanup_sysfs: bt_sysfs_cleanup(); +cleanup_led: + bt_leds_cleanup(); return err; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] igb: Initialize mailbox message for VF reset
by Wang Liang 02 Nov '24

02 Nov '24

From: Tony Nguyen <anthony.l.nguyen(a)intel.com> stable inclusion from stable-v4.19.270 commit ef1d739dd1f362aec081278ff92f943c31eb177a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIW CVE: CVE-2022-48949 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit de5dc44370fbd6b46bd7f1a1e00369be54a041c8 upstream. When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case. Fixes: 6ddbc4cf1f4d ("igb: Indicate failure on vf reset for empty mac address") Reported-by: Akihiko Odaki <akihiko.odaki(a)daynix.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Reviewed-by: Akihiko Odaki <akihiko.odaki(a)daynix.com> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Link: https://lore.kernel.org/r/20221212190031.3983342-1-anthony.l.nguyen@intel.c… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index 6b7e4a718630..ef5d11723d56 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -7151,7 +7151,7 @@ static void igb_vf_reset_msg(struct igb_adapter *adapter, u32 vf) { struct e1000_hw *hw = &adapter->hw; unsigned char *vf_mac = adapter->vf_data[vf].vf_mac_addresses; - u32 reg, msgbuf[3]; + u32 reg, msgbuf[3] = {}; u8 *addr = (u8 *)(&msgbuf[1]); /* process all the same items cleared in a function level reset */ -- 2.34.1

2 1

[openeuler:OLK-6.6 1344/1344] drivers/crypto/ccp/hygon/tdm-kernel-guard.c:243:15: warning: no previous prototype for function 'kprobe_symbol_address_byname'
by kernel test robot 02 Nov '24

02 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4cd9ac5bb21892408b1fd5332f7fbea44a16b61e commit: 3ad98583441f7c8a2553e1e8d6340ed4397033e2 [1344/1344] crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM config: x86_64-buildonly-randconfig-003-20241102 (https://download.01.org/0day-ci/archive/20241102/202411020918.At8pfay4-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241102/202411020918.At8pfay4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411020918.At8pfay4-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/crypto/ccp/hygon/tdm-kernel-guard.c:15: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: warning: no previous prototype for function 'tdm_service_run' [-Wmissing-prototypes] 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^ | static drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:5: warning: no previous prototype for function 'tdm_service_exit' [-Wmissing-prototypes] 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^ | static >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:243:15: warning: no previous prototype for function 'kprobe_symbol_address_byname' [-Wmissing-prototypes] 243 | unsigned long kprobe_symbol_address_byname(const char *name) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:243:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 243 | unsigned long kprobe_symbol_address_byname(const char *name) | ^ | static 4 warnings generated. vim +/kprobe_symbol_address_byname +243 drivers/crypto/ccp/hygon/tdm-kernel-guard.c 211 > 212 int tdm_service_exit(struct tdm_security_enhance *data) 213 { 214 int ret = 0; 215 int task_status = 0; 216 217 task_status = psp_startstop_measure_task(data->task_id, data->authcode, false); 218 if (task_status < 0) { 219 ret = task_status; 220 pr_err("task_id %d stop failed with 0x%x\n", data->task_id, ret); 221 goto end; 222 } 223 224 // Waiting for the task to end 225 msleep(40); 226 227 psp_destroy_measure_task(data->task_id, data->authcode); 228 229 kfree(data->authcode); 230 data->authcode = NULL; 231 kfree(data->mem_range); 232 data->mem_range = NULL; 233 end: 234 return ret; 235 } 236 237 #if !IS_BUILTIN(CONFIG_TDM_KERNEL_GUARD) 238 static int p_tmp_kprobe_handler(struct kprobe *p_ri, struct pt_regs *p_regs) 239 { 240 return 0; 241 } 242 > 243 unsigned long kprobe_symbol_address_byname(const char *name) 244 { 245 int p_ret; 246 struct kprobe p_kprobe; 247 unsigned long addr = 0; 248 249 memset(&p_kprobe, 0, sizeof(p_kprobe)); 250 251 p_kprobe.pre_handler = p_tmp_kprobe_handler; 252 p_kprobe.symbol_name = name; 253 254 p_ret = register_kprobe(&p_kprobe); 255 if (p_ret < 0) { 256 pr_err("register_kprobe error [%d] :(\n", p_ret); 257 return 0; 258 } 259 260 addr = (unsigned long)p_kprobe.addr; 261 unregister_kprobe(&p_kprobe); 262 263 return addr; 264 } 265 #endif 266 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION fc269dcb986088196619510639266c08d10fc8b7
by kernel test robot 02 Nov '24

02 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: fc269dcb986088196619510639266c08d10fc8b7 !12815 media: venus: fix use after free bug in venus_remove due to race condition Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411012342.ooJtSVFz-lkp@intel.com drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:18:12: warning: 'sss_init_vf_hw' defined but not used [-Wunused-function] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:40:13: warning: 'sss_deinit_vf_hw' defined but not used [-Wunused-function] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:28: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'? [-Werror=implicit-function-declaration] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:51: error: invalid type argument of '->' (have 'int') include/linux/spinlock.h:316:23: warning: array subscript <unknown> is outside array bounds of 'struct smt_entry[0]' [-Warray-bounds=] include/linux/uaccess.h:112:17: warning: 'pid' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'pmas' may be used uninitialized [-Wmaybe-uninitialized] Unverified Error/Warning (likely false positive, kindly check if interested): arch/arm64/kernel/mpam/mpam_resctrl.c:757:5: warning: no previous prototype for 'cpus_ctrl_write' [-Wmissing-prototypes] arch/arm64/kernel/mpam/mpam_resctrl.c:845:5: warning: no previous prototype for 'cpus_mon_write' [-Wmissing-prototypes] arch/arm64/kernel/mpam/mpam_resctrl.c:989:9: warning: function 'rdt_last_cmd_printf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] drivers/acpi/ac.o: warning: objtool: missing symbol for section .exit.text drivers/gpu/drm/i2c/tda9950.o: warning: objtool: missing symbol for section .init.text drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.o: warning: objtool: missing symbol for section .text drivers/hid/.tmp_hid-steam.o: warning: objtool: missing symbol for section .init.text drivers/hid/hid-redragon.o: warning: objtool: missing symbol for section .init.text drivers/iio/dac/.tmp_ad5696-i2c.o: warning: objtool: missing symbol for section .init.text drivers/iio/dac/.tmp_ti-dac5571.o: warning: objtool: missing symbol for section .init.text drivers/iio/light/.tmp_tsl2772.o: warning: objtool: missing symbol for section .init.text drivers/iio/resolver/.tmp_ad2s1200.o: warning: objtool: missing symbol for section .init.text drivers/iio/resolver/ad2s1200.o: warning: objtool: missing symbol for section .init.text drivers/input/touchscreen/chipone_icn8505.o: warning: objtool: missing symbol for section .init.text drivers/leds/.tmp_leds-lm3601x.o: warning: objtool: missing symbol for section .init.text drivers/leds/leds-cr0014114.o: warning: objtool: missing symbol for section .init.text drivers/leds/leds-sc27xx-bltc.o: warning: objtool: missing symbol for section .init.text drivers/mailbox/.tmp_hi6220-mailbox.o: warning: objtool: missing symbol for section .init.text drivers/media/cec/cec-core.o: warning: objtool: missing symbol for section .init.text drivers/media/i2c/.tmp_video-i2c.o: warning: objtool: missing symbol for section .init.text drivers/media/rc/.tmp_ite-cir.o: warning: objtool: missing symbol for section .init.text drivers/media/rc/.tmp_winbond-cir.o: warning: objtool: missing symbol for section .init.text drivers/media/tuners/.tmp_qm1d1b0004.o: warning: objtool: missing symbol for section .init.text drivers/net/ethernet/marvell/mvpp2/.tmp_mvpp2_cls.o: warning: objtool: missing symbol for section .text drivers/net/ethernet/marvell/mvpp2/.tmp_mvpp2_main.o: warning: objtool: missing symbol for section .init.text drivers/net/ethernet/marvell/mvpp2/mvpp2_main.o: warning: objtool: missing symbol for section .init.text drivers/net/phy/.tmp_dp83tc811.o: warning: objtool: missing symbol for section .init.text drivers/net/phy/.tmp_mdio-mscc-miim.o: warning: objtool: missing symbol for section .init.text drivers/net/phy/.tmp_mdio-sun4i.o: warning: objtool: missing symbol for section .init.text drivers/net/phy/mdio-moxart.o: warning: objtool: missing symbol for section .init.text drivers/net/phy/mdio-sun4i.o: warning: objtool: missing symbol for section .init.text drivers/pci/controller/dwc/pci-exynos.o: warning: objtool: missing symbol for section .exit.text drivers/pci/controller/pci-hyperv.o: warning: objtool: missing symbol for section .init.text drivers/phy/qualcomm/.tmp_phy-ath79-usb.o: warning: objtool: missing symbol for section .init.text drivers/platform/chrome/chromeos_tbmc.o: warning: objtool: missing symbol for section .init.text drivers/regulator/.tmp_sy8106a-regulator.o: warning: objtool: missing symbol for section .init.text drivers/regulator/sy8106a-regulator.o: warning: objtool: missing symbol for section .init.text drivers/staging/media/omap4iss/.tmp_iss.o: warning: objtool: missing symbol for section .init.text drivers/staging/media/omap4iss/.tmp_iss_csiphy.o: warning: objtool: missing symbol for section .text drivers/staging/media/zoran/videocodec.o: warning: objtool: missing symbol for section .init.text drivers/staging/media/zoran/zoran_card.o: warning: objtool: missing symbol for section .init.text drivers/staging/media/zoran/zr36016.o: warning: objtool: missing symbol for section .init.text drivers/staging/media/zoran/zr36050.o: warning: objtool: missing symbol for section .init.text drivers/tty/serial/.tmp_qcom_geni_serial.o: warning: objtool: missing symbol for section .init.text drivers/usb/gadget/udc/aspeed-vhub/core.o: warning: objtool: missing symbol for section .init.text drivers/video/backlight/rave-sp-backlight.o: warning: objtool: missing symbol for section .init.text fs/autofs/.tmp_expire.o: warning: objtool: missing symbol for section .text fs/btrfs/print-tree.o: warning: objtool: missing symbol for section .text fs/xfs/libxfs/xfs_types.o: warning: objtool: missing symbol for section .text include/linux/uaccess.h:115:17: warning: 'port_pr' may be used uninitialized [-Wmaybe-uninitialized] lib/zstd/.tmp_decompress.o: warning: objtool: missing symbol for section .text lib/zstd/.tmp_fse_compress.o: warning: objtool: missing symbol for section .text lib/zstd/.tmp_huf_compress.o: warning: objtool: missing symbol for section .text lib/zstd/.tmp_huf_decompress.o: warning: objtool: missing symbol for section .text net/core/.tmp_failover.o: warning: objtool: missing symbol for section .init.text sound/soc/codecs/mt6351.o: warning: objtool: missing symbol for section .init.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-001-20241029 | |-- arch-arm64-kernel-mpam-mpam_resctrl.c:warning:function-rdt_last_cmd_printf-might-be-a-candidate-for-gnu_printf-format-attribute | |-- arch-arm64-kernel-mpam-mpam_resctrl.c:warning:no-previous-prototype-for-cpus_ctrl_write | `-- arch-arm64-kernel-mpam-mpam_resctrl.c:warning:no-previous-prototype-for-cpus_mon_write |-- arm64-randconfig-004-20241029 | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_sriov.c:warning:sss_deinit_vf_hw-defined-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_sriov.c:warning:sss_init_vf_hw-defined-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:implicit-declaration-of-function-vlan_dev_priv | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:invalid-type-argument-of-(have-int-) | |-- include-linux-spinlock.h:warning:array-subscript-unknown-is-outside-array-bounds-of-struct-smt_entry | |-- include-linux-uaccess.h:warning:pid-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:pmas-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:port_pr-may-be-used-uninitialized |-- x86_64-allyesconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-001-20241025 | |-- drivers-gpu-drm-i2c-tda9950.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-cec-cec-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-ethernet-marvell-mvpp2-mvpp2_main.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-phy-mdio-moxart.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-phy-mdio-sun4i.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-usb-gadget-udc-aspeed-vhub-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-video-backlight-rave-sp-backlight.o:warning:objtool:missing-symbol-for-section-.init.text | `-- fs-xfs-libxfs-xfs_types.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-001-20241102 | |-- drivers-hid-.tmp_hid-steam.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-.tmp_ad5696-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_tsl2772.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-resolver-.tmp_ad2s1200.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-leds-.tmp_leds-lm3601x.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-buildonly-randconfig-002-20241028 | |-- drivers-acpi-ac.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-gpu-drm-nouveau-nvkm-subdev-bios-dp.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-input-touchscreen-chipone_icn8505.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-leds-leds-cr0014114.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-leds-leds-sc27xx-bltc.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pci-controller-dwc-pci-exynos.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-pci-controller-pci-hyperv.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-platform-chrome-chromeos_tbmc.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20241102 | |-- drivers-hid-.tmp_hid-steam.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-.tmp_video-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-phy-.tmp_dp83tc811.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-autofs-.tmp_expire.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | |-- lib-zstd-.tmp_decompress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_fse_compress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_huf_compress.o:warning:objtool:missing-symbol-for-section-.text | `-- lib-zstd-.tmp_huf_decompress.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20241029 | |-- drivers-hid-.tmp_hid-steam.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-.tmp_ad5696-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-.tmp_ti-dac5571.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_tsl2772.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-mailbox-.tmp_hi6220-mailbox.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-.tmp_video-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-rc-.tmp_ite-cir.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-rc-.tmp_winbond-cir.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-tuners-.tmp_qm1d1b0004.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-ethernet-marvell-mvpp2-.tmp_mvpp2_cls.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-net-ethernet-marvell-mvpp2-.tmp_mvpp2_main.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-phy-.tmp_dp83tc811.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-phy-.tmp_mdio-mscc-miim.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-net-phy-.tmp_mdio-sun4i.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-phy-qualcomm-.tmp_phy-ath79-usb.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-regulator-.tmp_sy8106a-regulator.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-media-omap4iss-.tmp_iss.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-media-omap4iss-.tmp_iss_csiphy.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-tty-serial-.tmp_qcom_geni_serial.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-autofs-.tmp_expire.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_decompress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_fse_compress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_huf_compress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_huf_decompress.o:warning:objtool:missing-symbol-for-section-.text | `-- net-core-.tmp_failover.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241031 | |-- drivers-iio-resolver-.tmp_ad2s1200.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-leds-.tmp_leds-lm3601x.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241102 | |-- arch-x86-kernel-cpu-mce-therm_throt.o:warning:objtool:missing-symbol-for-section-.irqentry.text | |-- drivers-char-ipmi-ipmi_si_intf.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-i2c-tda9950.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-leds-leds-cr0014114.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-leds-leds-sc27xx-bltc.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-cec-cec-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-regulator-sy8106a-regulator.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-usb-gadget-udc-aspeed-vhub-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- sound-soc-codecs-mt6351.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-004-20241102 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-005-20241031 | |-- drivers-staging-media-zoran-videocodec.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-media-zoran-zoran_card.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-media-zoran-zr36016.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-media-zoran-zr36050.o:warning:objtool:missing-symbol-for-section-.init.text | `-- sound-soc-codecs-mt6351.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20241027 | |-- drivers-hid-hid-redragon.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-resolver-ad2s1200.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-regulator-sy8106a-regulator.o:warning:objtool:missing-symbol-for-section-.init.text | `-- fs-btrfs-print-tree.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-8.3-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 914m configs tested: 11 configs skipped: 94 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241102 clang-19 x86_64 buildonly-randconfig-002-20241102 gcc-12 x86_64 buildonly-randconfig-003-20241102 clang-19 x86_64 buildonly-randconfig-004-20241102 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1231/1231] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:28: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'?
by kernel test robot 02 Nov '24

02 Nov '24

Hi Steven, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: fc269dcb986088196619510639266c08d10fc8b7 commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [1231/1231] Net: ethernet: Support 3snic 3s9xx network card config: arm64-randconfig-004-20241029 (https://download.01.org/0day-ci/archive/20241101/202411012342.ooJtSVFz-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241101/202411012342.ooJtSVFz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411012342.ooJtSVFz-lkp@intel.com/ All error/warnings (new ones prefixed by >>): >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:40:13: warning: 'sss_deinit_vf_hw' defined but not used [-Wunused-function] 40 | static void sss_deinit_vf_hw(void *hwdev, u16 vf_num) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:18:12: warning: 'sss_init_vf_hw' defined but not used [-Wunused-function] 18 | static int sss_init_vf_hw(void *hwdev, u16 vf_num) | ^~~~~~~~~~~~~~ -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c: In function 'sss_nic_get_vlan_depth': >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:28: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'? [-Werror=implicit-function-declaration] 165 | vlan_dev = vlan_dev_priv(vlan_dev)->real_dev; | ^~~~~~~~~~~~~ | netdev_priv >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:51: error: invalid type argument of '->' (have 'int') 165 | vlan_dev = vlan_dev_priv(vlan_dev)->real_dev; | ^~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c: At top level: drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: warning: no previous prototype for 'sss_nic_port_module_cable_plug' [-Wmissing-prototypes] 878 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: warning: no previous prototype for 'sss_nic_port_module_cable_unplug' [-Wmissing-prototypes] 884 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: warning: no previous prototype for 'sss_nic_port_module_link_err' [-Wmissing-prototypes] 890 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:22: warning: no previous prototype for 'get_nic_uld_info' [-Wmissing-prototypes] 1029 | struct sss_uld_info *get_nic_uld_info(void) | ^~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +165 drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c 157 158 static u16 sss_nic_get_vlan_depth(struct net_device *dev) 159 { 160 u16 vlan_depth = 0; 161 struct net_device *vlan_dev = dev; 162 163 do { 164 vlan_depth++; > 165 vlan_dev = vlan_dev_priv(vlan_dev)->real_dev; 166 } while (is_vlan_dev(vlan_dev)); 167 168 return vlan_depth; 169 } 170 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] drm/stm: Avoid use-after-free issues with crtc and plane
by Zhang Kunbo 01 Nov '24

01 Nov '24

From: Katya Orlova <e.orlova(a)ispras.ru> stable inclusion from stable-v6.6.55 commit 0a1741d10da29aa84955ef89ae9a03c4b6038657 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAF CVE: CVE-2024-49992 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 19dd9780b7ac673be95bf6fd6892a184c9db611f ] ltdc_load() calls functions drm_crtc_init_with_planes(), drm_universal_plane_init() and drm_encoder_init(). These functions should not be called with parameters allocated with devm_kzalloc() to avoid use-after-free issues [1]. Use allocations managed by the DRM framework. Found by Linux Verification Center (linuxtesting.org) [1] https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhu… Signed-off-by: Katya Orlova <e.orlova(a)ispras.ru> Acked-by: Raphaël Gallais-Pou <raphael.gallais-pou(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240216125040.8968-1-e.orlov… Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou(a)foss.st.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/stm/drv.c drivers/gpu/drm/stm/ltdc.c [ context conflicts in drv.c, keep operations after allocation of struct drm_encoder, drm_plane unchanged, only replace `devm_kzalloc`] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/gpu/drm/stm/drv.c | 3 ++- drivers/gpu/drm/stm/ltdc.c | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/stm/drv.c b/drivers/gpu/drm/stm/drv.c index 411103f013e2..76dbc5eeb7f7 100644 --- a/drivers/gpu/drm/stm/drv.c +++ b/drivers/gpu/drm/stm/drv.c @@ -23,6 +23,7 @@ #include <drm/drm_gem_framebuffer_helper.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> +#include <drm/drm_managed.h> #include "ltdc.h" @@ -73,7 +74,7 @@ static int drv_load(struct drm_device *ddev) DRM_DEBUG("%s\n", __func__); - ldev = devm_kzalloc(ddev->dev, sizeof(*ldev), GFP_KERNEL); + ldev = drmm_kzalloc(ddev, sizeof(*ldev), GFP_KERNEL); if (!ldev) return -ENOMEM; diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c index 089c00a8e7d4..3a4e51857a6c 100644 --- a/drivers/gpu/drm/stm/ltdc.c +++ b/drivers/gpu/drm/stm/ltdc.c @@ -32,6 +32,7 @@ #include <drm/drm_plane_helper.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> +#include <drm/drm_managed.h> #include <video/videomode.h> @@ -956,7 +957,6 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev, { unsigned long possible_crtcs = CRTC_MASK; struct ltdc_device *ldev = ddev->dev_private; - struct device *dev = ddev->dev; struct drm_plane *plane; unsigned int i, nb_fmt = 0; u32 formats[NB_PF * 2]; @@ -984,7 +984,7 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev, formats[nb_fmt++] = drm_fmt_no_alpha; } - plane = devm_kzalloc(dev, sizeof(*plane), GFP_KERNEL); + plane = drmm_kzalloc(ddev, sizeof(*plane), GFP_KERNEL); if (!plane) return NULL; @@ -1115,7 +1115,7 @@ static int ltdc_encoder_init(struct drm_device *ddev, struct drm_bridge *bridge) struct drm_encoder *encoder; int ret; - encoder = devm_kzalloc(ddev->dev, sizeof(*encoder), GFP_KERNEL); + encoder = drmm_kzalloc(ddev, sizeof(*encoder), GFP_KERNEL); if (!encoder) return -ENOMEM; @@ -1327,7 +1327,7 @@ int ltdc_load(struct drm_device *ddev) } - crtc = devm_kzalloc(dev, sizeof(*crtc), GFP_KERNEL); + crtc = drmm_kzalloc(ddev, sizeof(*crtc), GFP_KERNEL); if (!crtc) { DRM_ERROR("Failed to allocate crtc\n"); ret = -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-5.10] drm/stm: Avoid use-after-free issues with crtc and plane
by Zhang Kunbo 01 Nov '24

01 Nov '24

From: Katya Orlova <e.orlova(a)ispras.ru> stable inclusion from stable-v6.6.55 commit 0a1741d10da29aa84955ef89ae9a03c4b6038657 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAF CVE: CVE-2024-49992 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 19dd9780b7ac673be95bf6fd6892a184c9db611f ] ltdc_load() calls functions drm_crtc_init_with_planes(), drm_universal_plane_init() and drm_encoder_init(). These functions should not be called with parameters allocated with devm_kzalloc() to avoid use-after-free issues [1]. Use allocations managed by the DRM framework. Found by Linux Verification Center (linuxtesting.org) [1] https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhu… Signed-off-by: Katya Orlova <e.orlova(a)ispras.ru> Acked-by: Raphaël Gallais-Pou <raphael.gallais-pou(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240216125040.8968-1-e.orlov… Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou(a)foss.st.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/stm/drv.c drivers/gpu/drm/stm/ltdc.c [ context conflicts in drv.c, keep operations after allocation of struct drm_encoder, drm_plane unchanged, only replace `devm_kzalloc`] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/gpu/drm/stm/drv.c | 3 ++- drivers/gpu/drm/stm/ltdc.c | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/stm/drv.c b/drivers/gpu/drm/stm/drv.c index 411103f013e2..76dbc5eeb7f7 100644 --- a/drivers/gpu/drm/stm/drv.c +++ b/drivers/gpu/drm/stm/drv.c @@ -23,6 +23,7 @@ #include <drm/drm_gem_framebuffer_helper.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> +#include <drm/drm_managed.h> #include "ltdc.h" @@ -73,7 +74,7 @@ static int drv_load(struct drm_device *ddev) DRM_DEBUG("%s\n", __func__); - ldev = devm_kzalloc(ddev->dev, sizeof(*ldev), GFP_KERNEL); + ldev = drmm_kzalloc(ddev, sizeof(*ldev), GFP_KERNEL); if (!ldev) return -ENOMEM; diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c index 089c00a8e7d4..3a4e51857a6c 100644 --- a/drivers/gpu/drm/stm/ltdc.c +++ b/drivers/gpu/drm/stm/ltdc.c @@ -32,6 +32,7 @@ #include <drm/drm_plane_helper.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> +#include <drm/drm_managed.h> #include <video/videomode.h> @@ -956,7 +957,6 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev, { unsigned long possible_crtcs = CRTC_MASK; struct ltdc_device *ldev = ddev->dev_private; - struct device *dev = ddev->dev; struct drm_plane *plane; unsigned int i, nb_fmt = 0; u32 formats[NB_PF * 2]; @@ -984,7 +984,7 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev, formats[nb_fmt++] = drm_fmt_no_alpha; } - plane = devm_kzalloc(dev, sizeof(*plane), GFP_KERNEL); + plane = drmm_kzalloc(ddev, sizeof(*plane), GFP_KERNEL); if (!plane) return NULL; @@ -1115,7 +1115,7 @@ static int ltdc_encoder_init(struct drm_device *ddev, struct drm_bridge *bridge) struct drm_encoder *encoder; int ret; - encoder = devm_kzalloc(ddev->dev, sizeof(*encoder), GFP_KERNEL); + encoder = drmm_kzalloc(ddev, sizeof(*encoder), GFP_KERNEL); if (!encoder) return -ENOMEM; @@ -1327,7 +1327,7 @@ int ltdc_load(struct drm_device *ddev) } - crtc = devm_kzalloc(dev, sizeof(*crtc), GFP_KERNEL); + crtc = drmm_kzalloc(ddev, sizeof(*crtc), GFP_KERNEL); if (!crtc) { DRM_ERROR("Failed to allocate crtc\n"); ret = -ENOMEM; -- 2.34.1

2 1

[openeuler:OLK-5.10 2341/2341] kernel/trace/trace_uprobe.o: warning: objtool: __uprobe_perf_func()+0x1e6: unreachable instruction
by kernel test robot 01 Nov '24

01 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: cc5e1415473b95a8a68887dbb9c459ed50de9f1e commit: c59687cc7631aea65c88ec0f1162492b8470adf3 [2341/2341] uprobe: avoid out-of-bounds memory access of fetching args config: x86_64-kexec (https://download.01.org/0day-ci/archive/20241101/202411012238.VsICkiep-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241101/202411012238.VsICkiep-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411012238.VsICkiep-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/trace/trace_uprobe.o: warning: objtool: __uprobe_perf_func()+0x1e6: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] Revert "LoongArch: Add workaround for 3C6000 about io wr/rd"
by Hongchen Zhang 01 Nov '24

01 Nov '24

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB1JDN -------------------------------- This reverts commit fcf5d35be96ef2ca2cc76bff6623ca58c3ecd1eb. Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/include/asm/io.h | 149 -------------------------------- arch/loongarch/kernel/smp.c | 20 +---- 2 files changed, 1 insertion(+), 168 deletions(-) diff --git a/arch/loongarch/include/asm/io.h b/arch/loongarch/include/asm/io.h index d5d5b55cdc50..838db690b723 100644 --- a/arch/loongarch/include/asm/io.h +++ b/arch/loongarch/include/asm/io.h @@ -79,155 +79,6 @@ extern void __memcpy_fromio(void *to, const volatile void __iomem *from, size_t #define __io_aw() mmiowb() -#include <linux/spinlock.h> -extern spinlock_t lcl_node_lock[16]; -#define __raw_readb __raw_readb -static inline u8 __raw_readb(const volatile void __iomem *addr) -{ - unsigned long dst_node, node; - unsigned long irq_flag; - u8 val; - - dst_node = ((unsigned long)addr >> 44) & 0xf; - node = get_csr_cpuid() / 32; - if (node != dst_node) - spin_lock_irqsave(&lcl_node_lock[node + 8], irq_flag); - val = *(const volatile u8 __force *)addr; - if (node != dst_node) - spin_unlock_irqrestore(&lcl_node_lock[node + 8], irq_flag); - /* read barrier */ - rmb(); - return val; -} - -#define __raw_readw __raw_readw -static inline u16 __raw_readw(const volatile void __iomem *addr) -{ - unsigned long dst_node, node; - unsigned long irq_flag; - u16 val; - - dst_node = ((unsigned long)addr >> 44) & 0xf; - node = get_csr_cpuid() / 32; - if (node != dst_node) - spin_lock_irqsave(&lcl_node_lock[node + 8], irq_flag); - val = *(const volatile u16 __force *)addr; - if (node != dst_node) - spin_unlock_irqrestore(&lcl_node_lock[node + 8], irq_flag); - /* read barrier */ - rmb(); - return val; -} - -#define __raw_readl __raw_readl -static inline u32 __raw_readl(const volatile void __iomem *addr) -{ - unsigned long dst_node, node; - unsigned long irq_flag; - u32 val; - - dst_node = ((unsigned long)addr >> 44) & 0xf; - node = get_csr_cpuid() / 32; - if (node != dst_node) - spin_lock_irqsave(&lcl_node_lock[node + 8], irq_flag); - val = *(const volatile u32 __force *)addr; - if (node != dst_node) - spin_unlock_irqrestore(&lcl_node_lock[node + 8], irq_flag); - /* read barrier */ - rmb(); - return val; -} - -#ifdef CONFIG_64BIT -#define __raw_readq __raw_readq -static inline u64 __raw_readq(const volatile void __iomem *addr) -{ - unsigned long dst_node, node; - unsigned long irq_flag; - u64 val; - - dst_node = ((unsigned long)addr >> 44) & 0xf; - node = get_csr_cpuid() / 32; - if (node != dst_node) - spin_lock_irqsave(&lcl_node_lock[node + 8], irq_flag); - val = *(const volatile u64 __force *)addr; - if (node != dst_node) - spin_unlock_irqrestore(&lcl_node_lock[node + 8], irq_flag); - /* read barrier */ - rmb(); - return val; -} -#endif /* CONFIG_64BIT */ - -#define __raw_writeb __raw_writeb -static inline void __raw_writeb(u8 value, volatile void __iomem *addr) -{ - unsigned long dst_node, node; - unsigned long irq_flag; - - /* write barrier */ - wmb(); - dst_node = ((unsigned long)addr >> 44) & 0xf; - node = get_csr_cpuid() / 32; - if (node != dst_node) - spin_lock_irqsave(&lcl_node_lock[node], irq_flag); - *(volatile u8 __force *)addr = value; - if (node != dst_node) - spin_unlock_irqrestore(&lcl_node_lock[node], irq_flag); -} - -#define __raw_writew __raw_writew -static inline void __raw_writew(u16 value, volatile void __iomem *addr) -{ - unsigned long dst_node, node; - unsigned long irq_flag; - - /* write barrier */ - wmb(); - dst_node = ((unsigned long)addr >> 44) & 0xf; - node = get_csr_cpuid() / 32; - if (node != dst_node) - spin_lock_irqsave(&lcl_node_lock[node], irq_flag); - *(volatile u16 __force *)addr = value; - if (node != dst_node) - spin_unlock_irqrestore(&lcl_node_lock[node], irq_flag); -} - -#define __raw_writel __raw_writel -static inline void __raw_writel(u32 value, volatile void __iomem *addr) -{ - unsigned long dst_node, node; - unsigned long irq_flag; - - /* write barrier */ - wmb(); - dst_node = ((unsigned long)addr >> 44) & 0xf; - node = get_csr_cpuid() / 32; - if (node != dst_node) - spin_lock_irqsave(&lcl_node_lock[node], irq_flag); - *(volatile u32 __force *)addr = value; - if (node != dst_node) - spin_unlock_irqrestore(&lcl_node_lock[node], irq_flag); -} - -#ifdef CONFIG_64BIT -#define __raw_writeq __raw_writeq -static inline void __raw_writeq(u64 value, volatile void __iomem *addr) -{ - unsigned long dst_node, node; - unsigned long irq_flag; - - /* write barrier */ - wmb(); - dst_node = ((unsigned long)addr >> 44) & 0xf; - node = get_csr_cpuid() / 32; - if (node != dst_node) - spin_lock_irqsave(&lcl_node_lock[node], irq_flag); - *(volatile u64 __force *)addr = value; - if (node != dst_node) - spin_unlock_irqrestore(&lcl_node_lock[node], irq_flag); -} -#endif /* CONFIG_64BIT */ #include <asm-generic/io.h> #define ARCH_HAS_VALID_PHYS_ADDR_RANGE diff --git a/arch/loongarch/kernel/smp.c b/arch/loongarch/kernel/smp.c index 619e28117af2..bd0bd3decd32 100644 --- a/arch/loongarch/kernel/smp.c +++ b/arch/loongarch/kernel/smp.c @@ -35,8 +35,6 @@ #include <asm/time.h> #include "legacy_boot.h" -spinlock_t lcl_node_lock[16]; -EXPORT_SYMBOL(lcl_node_lock); int __cpu_number_map[NR_CPUS]; /* Map physical to logical */ EXPORT_SYMBOL(__cpu_number_map); @@ -199,19 +197,7 @@ static void ipi_write_action(int cpu, u32 action) static void loongson_send_ipi_single(int cpu, unsigned int action) { - unsigned int curr_cpu = cpu_logical_map(smp_processor_id()); - unsigned int t_cpu = cpu_logical_map(cpu); - int flag = -1; - unsigned long irq_flag; - - if ((curr_cpu / 32) != (t_cpu / 32)) { - flag = curr_cpu / 32; - spin_lock_irqsave(&lcl_node_lock[flag], irq_flag); - asm ("dbar 0x0"); - } ipi_write_action(cpu_logical_map(cpu), (u32)action); - if (flag >= 0) - spin_unlock_irqrestore(&lcl_node_lock[flag], irq_flag); } static void loongson_send_ipi_mask(const struct cpumask *mask, unsigned int action) @@ -219,7 +205,7 @@ static void loongson_send_ipi_mask(const struct cpumask *mask, unsigned int acti unsigned int i; for_each_cpu(i, mask) - loongson_send_ipi_single(i, (u32)action); + ipi_write_action(cpu_logical_map(i), (u32)action); } void arch_send_call_function_single_ipi(int cpu) @@ -325,10 +311,6 @@ static void __init fdt_smp_setup(void) void __init loongson_smp_setup(void) { - int i; - - for (i = 0; i < 16; i++) - spin_lock_init(&lcl_node_lock[i]); fdt_smp_setup(); cpu_data[0].core = cpu_logical_map(0) % loongson_sysconf.cores_per_package; -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] tipc: guard against string buffer overrun
by dinglongwei 01 Nov '24

01 Nov '24

From: Simon Horman <horms(a)kernel.org> stable inclusion from stable-v5.10.227 commit e2b2558971e02ca33eb637a8350d68a48b3e8e46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA6 CVE: CVE-2024-49995 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6555a2a9212be6983d2319d65276484f7c5f431a ] Smatch reports that copying media_name and if_name to name_parts may overwrite the destination. .../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16) .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16) This does seem to be the case so guard against this possibility by using strscpy() and failing if truncation occurs. Introduced by commit b97bf3fd8f6a ("[TIPC] Initial merge") Compile tested only. Reviewed-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20240801-tipic-overrun-v2-1-c5b869d1f074@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- net/tipc/bearer.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c index 72c31ef985eb..fe2a71971dd7 100644 --- a/net/tipc/bearer.c +++ b/net/tipc/bearer.c @@ -161,8 +161,12 @@ static int bearer_name_validate(const char *name, /* return bearer name components, if necessary */ if (name_parts) { - strcpy(name_parts->media_name, media_name); - strcpy(name_parts->if_name, if_name); + if (strscpy(name_parts->media_name, media_name, + TIPC_MAX_MEDIA_NAME) < 0) + return 0; + if (strscpy(name_parts->if_name, if_name, + TIPC_MAX_IF_NAME) < 0) + return 0; } return 1; } -- 2.17.1

2 1