- Kernel - mailweb.openeuler.org

[PATCH v4 OLK-6.6 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 22 Apr '25

22 Apr '25

Compare to v3: Patch 09: Add comments for the enum resctrl_feat_type and make modifications based on community feedback. Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Zeng Heng (18): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value fs/resctrl: Support arch specific struct resctrl_arch_staged_config arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 23 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 138 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 146 ++++++--- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 36 ++- include/linux/resctrl_types.h | 30 ++ 11 files changed, 716 insertions(+), 188 deletions(-) -- 2.25.1

2 19

[PATCH OLK-6.6] erofs/cachefiles: Change the unmark inuse sequence in erofs ondemand mode
by Zizhi Wo 22 Apr '25

22 Apr '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC349R -------------------------------- In the current erofs ondemand loading mode, the close request is sent to userspace before calling the unmark inuse interface. This means userspace cannot reliably perform culling immediately upon receiving the close req. To address this, a new cookie flag is introduced to allow calling cachefiles_unmark_inode_in_use() before sending the close request. This enables userspace to safely perform culling after the notification. Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cachefiles/interface.c | 15 ++++++++++----- fs/erofs/fscache.c | 2 ++ include/linux/fscache-cache.h | 24 ++++++++++++++++++++++++ 3 files changed, 36 insertions(+), 5 deletions(-) diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c index 4d44e74c22fd..c384b6939a3e 100644 --- a/fs/cachefiles/interface.c +++ b/fs/cachefiles/interface.c @@ -338,6 +338,9 @@ static void cachefiles_clean_up_object(struct cachefiles_object *object, struct cachefiles_cache *cache) { struct file *file; + const struct cred *saved_cred; + + cachefiles_begin_secure(cache, &saved_cred); if (test_bit(FSCACHE_COOKIE_RETIRED, &object->cookie->flags)) { if (!test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags)) { @@ -362,6 +365,8 @@ static void cachefiles_clean_up_object(struct cachefiles_object *object, if (file) fput(file); + + cachefiles_end_secure(cache, saved_cred); } /* @@ -371,7 +376,7 @@ static void cachefiles_withdraw_cookie(struct fscache_cookie *cookie) { struct cachefiles_object *object = cookie->cache_priv; struct cachefiles_cache *cache = object->volume->cache; - const struct cred *saved_cred; + bool unmark_early = fscache_test_inode_unmark_early(cache->cache); _enter("o=%x", object->debug_id); cachefiles_see_object(object, cachefiles_obj_see_withdraw_cookie); @@ -383,13 +388,13 @@ static void cachefiles_withdraw_cookie(struct fscache_cookie *cookie) spin_unlock(&cache->object_list_lock); } + if (unmark_early && object->file) + cachefiles_clean_up_object(object, cache); + cachefiles_ondemand_clean_object(object); - if (object->file) { - cachefiles_begin_secure(cache, &saved_cred); + if (!unmark_early && object->file) cachefiles_clean_up_object(object, cache); - cachefiles_end_secure(cache, saved_cred); - } cookie->cache_priv = NULL; cachefiles_put_object(object, cachefiles_obj_put_detach); diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c index 7bcd1d261e7d..37289680888a 100644 --- a/fs/erofs/fscache.c +++ b/fs/erofs/fscache.c @@ -370,6 +370,8 @@ static int erofs_fscache_register_volume(struct super_block *sb) } else { /* enable synchronous unhashing for the associated volumes */ fscache_set_sync_volume_unhash(volume->cache); + /* enable to set inode unmark inuse early before send close req */ + fscache_set_inode_unmark_early(volume->cache); } sbi->volume = volume; diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h index 642fc1276c63..a1c5fa1a5214 100644 --- a/include/linux/fscache-cache.h +++ b/include/linux/fscache-cache.h @@ -46,6 +46,7 @@ struct fscache_cache { char *name; KABI_USE(1, unsigned long flags) #define FSCACHE_CACHE_SYNC_VOLUME_UNHASH 0 /* Mark to enable volume sync unhash */ +#define FSCACHE_CACHE_EARLY_UNMARK_INUSE 1 /* Need to unmark earlier */ KABI_RESERVE(2) KABI_RESERVE(3) @@ -225,6 +226,29 @@ static inline bool fscache_test_sync_volume_unhash(struct fscache_cache *cache) return test_bit(FSCACHE_CACHE_SYNC_VOLUME_UNHASH, &cache->flags); } +/** + * fscache_set_inode_unmark_early - Early unmark the inode inuse + * @cache: The cache to set + * + * Unmark the inode inuse before send close req. + */ +static inline void fscache_set_inode_unmark_early(struct fscache_cache *cache) +{ + set_bit(FSCACHE_CACHE_EARLY_UNMARK_INUSE, &cache->flags); +} + +/** + * fscache_test_inode_unmark_early - Check whether the inode need to + * unmark early + * @cache: The cache to query + * + * Indicates whether we need to unmark the inode inuse early. + */ +static inline bool fscache_test_inode_unmark_early(struct fscache_cache *cache) +{ + return test_bit(FSCACHE_CACHE_EARLY_UNMARK_INUSE, &cache->flags); +} + #ifdef CONFIG_FSCACHE_STATS extern atomic_t fscache_n_read; extern atomic_t fscache_n_write; -- 2.39.2

2 1

[PATCH OLK-6.6] efi: Don't map the entire mokvar table to determine its size
by Kaixiong Yu 22 Apr '25

22 Apr '25

From: Peter Jones <pjones(a)redhat.com> stable inclusion from stable-v6.6.83 commit ea3f0b362dfe4ef885ef812bfaf4088176422c91 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVU7 CVE: CVE-2025-21872 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2b90e7ace79774a3540ce569e000388f8d22c9e0 upstream. Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of early_memmap(), and we get a failure and traceback: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139 __early_ioremap+0xef/0x220 ... Call Trace: <TASK> ? __early_ioremap+0xef/0x220 ? __warn.cold+0x93/0xfa ? __early_ioremap+0xef/0x220 ? report_bug+0xff/0x140 ? early_fixup_exception+0x5d/0xb0 ? early_idt_handler_common+0x2f/0x3a ? __early_ioremap+0xef/0x220 ? efi_mokvar_table_init+0xce/0x1d0 ? setup_arch+0x864/0xc10 ? start_kernel+0x6b/0xa10 ? x86_64_start_reservations+0x24/0x30 ? x86_64_start_kernel+0xed/0xf0 ? common_startup_64+0x13e/0x141 </TASK> ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187. Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once. Changes efi_mokvar_table_init() to only map each entry header, not the entire table, when determining the table size. Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place. Cc: <stable(a)vger.kernel.org> Signed-off-by: Peter Jones <pjones(a)redhat.com> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/firmware/efi/mokvar-table.c | 42 +++++++++-------------------- 1 file changed, 13 insertions(+), 29 deletions(-) diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 5ed0602c2f75..4eb0dff4dfaf 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -103,9 +103,7 @@ void __init efi_mokvar_table_init(void) void *va = NULL; unsigned long cur_offset = 0; unsigned long offset_limit; - unsigned long map_size = 0; unsigned long map_size_needed = 0; - unsigned long size; struct efi_mokvar_table_entry *mokvar_entry; int err; @@ -134,48 +132,34 @@ void __init efi_mokvar_table_init(void) */ err = -EINVAL; while (cur_offset + sizeof(*mokvar_entry) <= offset_limit) { - mokvar_entry = va + cur_offset; - map_size_needed = cur_offset + sizeof(*mokvar_entry); - if (map_size_needed > map_size) { - if (va) - early_memunmap(va, map_size); - /* - * Map a little more than the fixed size entry - * header, anticipating some data. It's safe to - * do so as long as we stay within current memory - * descriptor. - */ - map_size = min(map_size_needed + 2*EFI_PAGE_SIZE, - offset_limit); - va = early_memremap(efi.mokvar_table, map_size); - if (!va) { - pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%lu.\n", - efi.mokvar_table, map_size); - return; - } - mokvar_entry = va + cur_offset; + if (va) + early_memunmap(va, sizeof(*mokvar_entry)); + va = early_memremap(efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); + if (!va) { + pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%zu.\n", + efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); + return; } + mokvar_entry = va; /* Check for last sentinel entry */ if (mokvar_entry->name[0] == '\0') { if (mokvar_entry->data_size != 0) break; err = 0; + map_size_needed = cur_offset + sizeof(*mokvar_entry); break; } - /* Sanity check that the name is null terminated */ - size = strnlen(mokvar_entry->name, - sizeof(mokvar_entry->name)); - if (size >= sizeof(mokvar_entry->name)) - break; + /* Enforce that the name is NUL terminated */ + mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0'; /* Advance to the next entry */ - cur_offset = map_size_needed + mokvar_entry->data_size; + cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size; } if (va) - early_memunmap(va, map_size); + early_memunmap(va, sizeof(*mokvar_entry)); if (err) { pr_err("EFI MOKvar config table is not valid\n"); return; -- 2.34.1

2 1

[PATCH V3 OLK-6.6 0/4] Backport mainline patches to avoid crash caused by rsize being 0
by Wang Zhaolong 22 Apr '25

22 Apr '25

vi -> V2 Revert temporary solution V2 -> V3 commit message adjust for checkpatch warning Wang Zhaolong (4): Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0" smb:client: smb: client: Add reverse mapping from tcon to superblocks smb: client: Store original IO parameters and prevent zero IO sizes smb: client: Update IO sizes after reconnection fs/smb/client/cifs_fs_sb.h | 1 + fs/smb/client/cifsglob.h | 3 ++- fs/smb/client/connect.c | 20 +++++++++++++++----- fs/smb/client/fs_context.c | 2 ++ fs/smb/client/fs_context.h | 3 +++ fs/smb/client/misc.c | 2 ++ fs/smb/client/smb1ops.c | 6 +++--- fs/smb/client/smb2ops.c | 27 +++++++++++++++++++-------- fs/smb/client/smb2pdu.c | 24 ++++++++++++++++++++++-- fs/smb/common/smb2pdu.h | 3 +++ 10 files changed, 72 insertions(+), 19 deletions(-) -- 2.34.3

2 5

[PATCH OLK-5.10 0/8] arm64: Support xcall prefetch
by Jinjie Ruan 22 Apr '25

22 Apr '25

Support xcall prefetch. Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Liao Chen (1): revert kpti bypass Yipeng Zou (5): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall xcall: introduce xcall_select to implement a custom xcall function eventpoll: xcall: Support sync and async prefetch data in epoll xcall: eventpoll: add tracepoint arch/Kconfig | 64 ++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/exception.h | 6 + arch/arm64/include/asm/syscall.h | 14 ++ arch/arm64/include/asm/syscall_wrapper.h | 25 +++ arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 +++++ arch/arm64/kernel/entry-common.c | 22 ++ arch/arm64/kernel/entry.S | 183 ++++++++++++++- arch/arm64/kernel/sys.c | 20 ++ arch/arm64/kernel/syscall.c | 69 ++++++ drivers/irqchip/irq-gic-v3.c | 123 ++++++++++ fs/eventpoll.c | 275 ++++++++++++++++++++++- fs/open.c | 4 + fs/proc/base.c | 201 +++++++++++++++++ fs/read_write.c | 65 +++++- include/linux/fs.h | 30 +++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 8 + include/linux/sched/task.h | 8 + include/linux/syscalls.h | 19 ++ include/trace/events/fs.h | 91 ++++++++ include/uapi/asm-generic/unistd.h | 11 + kernel/fork.c | 45 ++++ kernel/irq/debugfs.c | 33 +++ kernel/irq/internals.h | 18 ++ kernel/irq/irqdesc.c | 19 ++ kernel/irq/proc.c | 10 + kernel/softirq.c | 73 ++++++ kernel/sysctl.c | 36 +++ 33 files changed, 1548 insertions(+), 7 deletions(-) -- 2.34.1

2 9

[PATCH V2 OLK-6.6 0/4] Backport mainline patches to avoid crash caused by rsize being 0
by Wang Zhaolong 22 Apr '25

22 Apr '25

vi -> V2 Revert temporary solution Wang Zhaolong (4): Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0" smb:client: smb: client: Add reverse mapping from tcon to superblocks smb: client: Store original IO parameters and prevent zero IO sizes smb: client: Update IO sizes after reconnection fs/smb/client/cifs_fs_sb.h | 1 + fs/smb/client/cifsglob.h | 3 ++- fs/smb/client/connect.c | 20 +++++++++++++++----- fs/smb/client/fs_context.c | 2 ++ fs/smb/client/fs_context.h | 3 +++ fs/smb/client/misc.c | 2 ++ fs/smb/client/smb1ops.c | 6 +++--- fs/smb/client/smb2ops.c | 27 +++++++++++++++++++-------- fs/smb/client/smb2pdu.c | 24 ++++++++++++++++++++++-- fs/smb/common/smb2pdu.h | 3 +++ 10 files changed, 72 insertions(+), 19 deletions(-) -- 2.34.3

2 5

[PATCH V2 OLK-6.6 0/4] Backport mainline patches to avoid crash caused by rsize being 0
by Wang Zhaolong 22 Apr '25

22 Apr '25

vi -> V2 Revert temporary solution Wang Zhaolong (4): Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0" smb:client: smb: client: Add reverse mapping from tcon to superblocks smb: client: Store original IO parameters and prevent zero IO sizes smb: client: Update IO sizes after reconnection fs/smb/client/cifs_fs_sb.h | 1 + fs/smb/client/cifsglob.h | 3 ++- fs/smb/client/connect.c | 20 +++++++++++++++----- fs/smb/client/fs_context.c | 2 ++ fs/smb/client/fs_context.h | 3 +++ fs/smb/client/misc.c | 2 ++ fs/smb/client/smb1ops.c | 6 +++--- fs/smb/client/smb2ops.c | 27 +++++++++++++++++++-------- fs/smb/client/smb2pdu.c | 24 ++++++++++++++++++++++-- fs/smb/common/smb2pdu.h | 3 +++ 10 files changed, 72 insertions(+), 19 deletions(-) -- 2.34.3

2 5

[PATCH OLK-6.6] LoongArch: BPF: Don't override subprog's return value
by Ye Bin 22 Apr '25

22 Apr '25

From: Hengqi Chen <hengqi.chen(a)gmail.com> mainline inclusion from mainline-v6.15-rc1 commit 60f3caff1492e5b8616b9578c4bedb5c0a88ed14 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QR7 CVE: CVE-2025-22048 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The verifier test `calls: div by 0 in subprog` triggers a panic at the ld.bu instruction. The ld.bu insn is trying to load byte from memory address returned by the subprog. The subprog actually set the correct address at the a5 register (dedicated register for BPF return values). But at commit 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") we also sign extended a5 to the a0 register (return value in LoongArch). For function call insn, we later propagate the a0 register back to a5 register. This is right for native calls but wrong for bpf2bpf calls which expect zero-extended return value in a5 register. So only move a0 to a5 for native calls (i.e. non-BPF_PSEUDO_CALL). Cc: stable(a)vger.kernel.org Fixes: 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") Signed-off-by: Hengqi Chen <hengqi.chen(a)gmail.com> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- arch/loongarch/net/bpf_jit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 525fc03d7056..31063433a597 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -842,7 +842,10 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext move_addr(ctx, t1, func_addr); emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0); - move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); + + if (insn->src_reg != BPF_PSEUDO_CALL) + move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); + break; /* tail call */ -- 2.34.1

2 1

[PATCH OLK-6.6] drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
by Tengda Wu 21 Apr '25

21 Apr '25

From: Douglas Anderson <dianders(a)chromium.org> stable inclusion from stable-6.6.87 commit 13ec849fd2eab808ee8eba2625df7ebea3b85edf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC2CCA CVE: CVE-2025-38240 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 106a6de46cf4887d535018185ec528ce822d6d84 ] The function mtk_dp_wait_hpd_asserted() may be called before the `mtk_dp->drm_dev` pointer is assigned in mtk_dp_bridge_attach(). Specifically it can be called via this callpath: - mtk_edp_wait_hpd_asserted - [panel probe] - dp_aux_ep_probe Using "drm" level prints anywhere in this callpath causes a NULL pointer dereference. Change the error message directly in mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the error messages in mtk_dp_parse_capabilities(), which is called by mtk_dp_wait_hpd_asserted(). While touching these prints, also add the error code to them to make future debugging easier. Fixes: 7eacba9a083b ("drm/mediatek: dp: Add .wait_hpd_asserted() for AUX bus") Signed-off-by: Douglas Anderson <dianders(a)chromium.org> Reviewed-by: CK Hu <ck.hu(a)mediatek.com> Link: https://patchwork.kernel.org/project/dri-devel/patch/20250116094249.1.I29b0… Signed-off-by: Chun-Kuang Hu <chunkuang.hu(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c index be4de26c77f9..199527643093 100644 --- a/drivers/gpu/drm/mediatek/mtk_dp.c +++ b/drivers/gpu/drm/mediatek/mtk_dp.c @@ -1648,7 +1648,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) ret = drm_dp_dpcd_readb(&mtk_dp->aux, DP_MSTM_CAP, &val); if (ret < 1) { - drm_err(mtk_dp->drm_dev, "Read mstm cap failed\n"); + dev_err(mtk_dp->dev, "Read mstm cap failed: %zd\n", ret); return ret == 0 ? -EIO : ret; } @@ -1658,7 +1658,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) DP_DEVICE_SERVICE_IRQ_VECTOR_ESI0, &val); if (ret < 1) { - drm_err(mtk_dp->drm_dev, "Read irq vector failed\n"); + dev_err(mtk_dp->dev, "Read irq vector failed: %zd\n", ret); return ret == 0 ? -EIO : ret; } @@ -1941,7 +1941,7 @@ static int mtk_dp_wait_hpd_asserted(struct drm_dp_aux *mtk_aux, unsigned long wa ret = mtk_dp_parse_capabilities(mtk_dp); if (ret) { - drm_err(mtk_dp->drm_dev, "Can't parse capabilities\n"); + dev_err(mtk_dp->dev, "Can't parse capabilities: %d\n", ret); return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6] iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
by Wang Zhaolong 21 Apr '25

21 Apr '25

From: Chengen Du <chengen.du(a)canonical.com> mainline inclusion from mainline-v6.14-rc2 commit 07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYE6H CVE: CVE-2025-21993 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message. Signed-off-by: Chengen Du <chengen.du(a)canonical.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/firmware/iscsi_ibft.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c index 6e9788324fea..371f24569b3b 100644 --- a/drivers/firmware/iscsi_ibft.c +++ b/drivers/firmware/iscsi_ibft.c @@ -308,11 +308,14 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf) break; case ISCSI_BOOT_ETH_IP_ADDR: str += sprintf_ipaddr(str, nic->ip_addr); break; case ISCSI_BOOT_ETH_SUBNET_MASK: - val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); + if (nic->subnet_mask_prefix > 32) + val = cpu_to_be32(~0); + else + val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); str += sprintf(str, "%pI4", &val); break; case ISCSI_BOOT_ETH_PREFIX_LEN: str += sprintf(str, "%d\n", nic->subnet_mask_prefix); break; -- 2.34.3

2 1