- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] Fix CVE-2024-44958 for 6.6
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): [Backport] sched/smt: Introduce sched_smt_present_inc/dec() helper [Backport] sched/smt: Fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 18534/23801] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3a5093f2913b14c22e19e60b6bf7a4d8ec2e5c69 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [18534/23801] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-104-20240929 (https://download.01.org/0day-ci/archive/20240929/202409291416.g51wPHKv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291416.g51wPHKv-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net: phy: Fix missing of_node_put() for leds
by Zhang Changzhong 29 Sep '24

29 Sep '24

From: Jinjie Ruan <ruanjinjie(a)huawei.com> stable inclusion from stable-v6.6.51 commit 26928c8f00f6bb0e194f3957fe51c69d36838eb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYBT CVE: CVE-2024-46767 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2560db6ede1aaf162a73b2df43e0b6c5ed8819f7 ] The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it. Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Reviewed-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20240830022025.610844-1-ruanjinjie@huawei.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/phy_device.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index c895cd1..2e4bff6 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3164,11 +3164,13 @@ static int of_phy_leds(struct phy_device *phydev) err = of_phy_led(phydev, led); if (err) { of_node_put(led); + of_node_put(leds); phy_leds_unregister(phydev); return err; } } + of_node_put(leds); return 0; } -- 2.9.5

2 1

[PATCH OLK-6.6] mptcp: pm: only decrement add_addr_accepted for MPJ req
by Wang Liang 29 Sep '24

29 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> stable inclusion from stable-v6.6.48 commit d20bf2c96d7ffd171299b32f562f70e5bf5dc608 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJM CVE: CVE-2024-45009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1c1f721375989579e46741f59523e39ec9b2a9bd upstream. Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest. Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon the reception of the RM_ADDR, the other peer will then try to decrement this add_addr_accepted. That's not correct because the attached subflows have not been created upon the reception of an ADD_ADDR. A way to solve that is to decrement the counter only if the attached subflow was an MP_JOIN to a remote id that was not 0, and initiated by the host receiving the RM_ADDR. Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-9-38035d40de5b… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mptcp/pm_netlink.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index aa56696cdc78..7fc4d7063c82 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -841,7 +841,7 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk, mptcp_close_ssk(sk, ssk, subflow); spin_lock_bh(&msk->pm.lock); - removed = true; + removed |= subflow->request_join; if (rm_type == MPTCP_MIB_RMSUBFLOW) __MPTCP_INC_STATS(sock_net(sk), rm_type); } @@ -855,7 +855,11 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk, if (!mptcp_pm_is_kernel(msk)) continue; - if (rm_type == MPTCP_MIB_RMADDR) { + if (rm_type == MPTCP_MIB_RMADDR && rm_id && + !WARN_ON_ONCE(msk->pm.add_addr_accepted == 0)) { + /* Note: if the subflow has been closed before, this + * add_addr_accepted counter will not be decremented. + */ msk->pm.add_addr_accepted--; WRITE_ONCE(msk->pm.accept_addr, true); } else if (rm_type == MPTCP_MIB_RMSUBFLOW) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2024-44958
by Zheng Zucheng 29 Sep '24

29 Sep '24

Yang Yingliang (2): sched/smt: Introduce sched_smt_present_inc/dec() helper sched/smt: Fix unbalance sched_smt_present dec/inc Zheng Zucheng (1): sched: Revert fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 4049405548ac..d53a4a3a9f8a 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4860,7 +4860,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index ae6625aa2c4a..854c7fa0fc06 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4872,7 +4872,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 39afb1c46907..c88907111d80 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5150,7 +5150,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-6.6] drm/amdgpu: Fix the warning division or modulo by zero
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit d116bb921e8b104f45d1f30a473ea99ef4262b9a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUA67 CVE: CVE-2024-46806 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c ] Checks the partition mode and returns an error for an invalid mode. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Suggested-by: Lijo Lazar <lijo.lazar(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c index 0284c9198a04..6c6f9d9b5d89 100644 --- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c @@ -500,6 +500,12 @@ static int aqua_vanjaram_switch_partition_mode(struct amdgpu_xcp_mgr *xcp_mgr, if (mode == AMDGPU_AUTO_COMPUTE_PARTITION_MODE) { mode = __aqua_vanjaram_get_auto_mode(xcp_mgr); + if (mode == AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE) { + dev_err(adev->dev, + "Invalid config, no compatible compute partition mode found, available memory partitions: %d", + adev->gmc.num_mem_partitions); + return -EINVAL; + } } else if (!__aqua_vanjaram_is_valid_mode(xcp_mgr, mode)) { dev_err(adev->dev, "Invalid compute partition mode requested, requested: %s, available memory partitions: %d", -- 2.39.2

2 1

[openeuler:OLK-5.10 22702/30000] drivers/irqchip/irq-mbigen.c:122:11: sparse: sparse: symbol 'vtimer_cpu_mask' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: dc55753ca59725e5130059dc4c520e8a91c655c0 commit: 212e82b2357f9103ddb3b759c37ae518831f701b [22702/30000] mbigen: vtimer mbigen driver support config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409291341.axFxcmaf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409291341.axFxcmaf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291341.axFxcmaf-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/irqchip/irq-mbigen.c:122:11: sparse: sparse: symbol 'vtimer_cpu_mask' was not declared. Should it be static? drivers/irqchip/irq-mbigen.c:318:34: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:318:34: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:318:34: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:330:34: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:330:34: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:330:34: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:362:31: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:362:31: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:362:31: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:435:65: sparse: sparse: incorrect type in argument 5 (different address spaces) @@ expected void *chip_data @@ got void [noderef] __iomem *base @@ drivers/irqchip/irq-mbigen.c:435:65: sparse: expected void *chip_data drivers/irqchip/irq-mbigen.c:435:65: sparse: got void [noderef] __iomem *base vim +/vtimer_cpu_mask +122 drivers/irqchip/irq-mbigen.c 121 > 122 cpumask_t vtimer_cpu_mask; 123 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0