- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1] [Backport] drm/qxl: Add check for drm_cvt_mode
by Wang Hai 10 Sep '24

10 Sep '24

From: Chen Ni <nichen(a)iscas.ac.cn> stable inclusion from stable-v5.10.224 commit 4e87f592a46bb804d8f833da6ce702ae4b55053f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5J CVE: CVE-2024-43829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7bd09a2db0f617377027a2bb0b9179e6959edff3 ] Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference. Fixes: 1b043677d4be ("drm/qxl: add qxl_add_mode helper function") Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> Reviewed-by: Heng Qi <hengqi(a)linux.alibaba.com> Signed-off-by: Maxime Ripard <mripard(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240621071031.1987974-1-nich… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/gpu/drm/qxl/qxl_display.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index f22a1b776f4b..3ffa721d777b 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -232,6 +232,9 @@ static int qxl_add_mode(struct drm_connector *connector, return 0; mode = drm_cvt_mode(dev, width, height, 60, false, false, false); + if (!mode) + return 0; + if (preferred) mode->type |= DRM_MODE_TYPE_PREFERRED; mode->hdisplay = width; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] Fix CVE-2022-48887
by Huang Xiaojia 10 Sep '24

10 Sep '24

*** BLURB HERE *** Huang Xiaojia (2): drm/vmwgfx: Introduce ttm reference object find function drm/vmwgfx: Remove vmw_user_bo_noref_release Zack Rusin (1): drm/vmwgfx: Remove rcu locks from user resources drivers/gpu/drm/drm_hashtab.c | 5 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 55 +++---- drivers/gpu/drm/vmwgfx/ttm_object.h | 14 -- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 42 ------ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 27 +--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 176 +++++++++++------------ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 35 ----- include/drm/drm_hashtab.h | 2 + 8 files changed, 105 insertions(+), 251 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1 1/3] drm/vmwgfx: Introduce ttm reference object find function
by Huang Xiaojia 10 Sep '24

10 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIFE -------------------------------- For CVE-2022-48887, ttm_base_object_lookup requires a non-RCU lookup function to solve buggy RCU paths. But there is none, hence introduce it to handle this CVE. Fixes: e14c02e6b699 ("drm/vmwgfx: Look up objects without taking a reference") Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/drm_hashtab.c | 5 +++-- drivers/gpu/drm/vmwgfx/ttm_object.c | 14 ++++++++++++++ include/drm/drm_hashtab.h | 2 ++ 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_hashtab.c b/drivers/gpu/drm/drm_hashtab.c index c50fa6f0709f..a61642835542 100644 --- a/drivers/gpu/drm/drm_hashtab.c +++ b/drivers/gpu/drm/drm_hashtab.c @@ -74,8 +74,8 @@ void drm_ht_verbose_list(struct drm_open_hash *ht, unsigned long key) DRM_DEBUG("count %d, key: 0x%08lx\n", count++, entry->key); } -static struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, - unsigned long key) +struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, + unsigned long key) { struct drm_hash_item *entry; struct hlist_head *h_list; @@ -91,6 +91,7 @@ static struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, } return NULL; } +EXPORT_SYMBOL(drm_ht_find_key); static struct hlist_node *drm_ht_find_key_rcu(struct drm_open_hash *ht, unsigned long key) diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c index 16077785ad47..03bf50e87d97 100644 --- a/drivers/gpu/drm/vmwgfx/ttm_object.c +++ b/drivers/gpu/drm/vmwgfx/ttm_object.c @@ -137,6 +137,20 @@ ttm_object_file_ref(struct ttm_object_file *tfile) return tfile; } +static int ttm_tfile_find_ref(struct drm_open_hash *ht, + uint32_t key, + struct drm_hash_item **item) +{ + struct hlist_node *h_node; + + h_node = drm_ht_find_key(ht, key); + if (!h_node) + return -EINVAL; + + *item = hlist_entry(h_node, struct drm_hash_item, head); + return 0; +} + static void ttm_object_file_destroy(struct kref *kref) { struct ttm_object_file *tfile = diff --git a/include/drm/drm_hashtab.h b/include/drm/drm_hashtab.h index bb95ff011baf..fe5ad4793a15 100644 --- a/include/drm/drm_hashtab.h +++ b/include/drm/drm_hashtab.h @@ -49,6 +49,8 @@ struct drm_open_hash { u8 order; }; +struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, unsigned long key); + int drm_ht_create(struct drm_open_hash *ht, unsigned int order); int drm_ht_insert_item(struct drm_open_hash *ht, struct drm_hash_item *item); int drm_ht_just_insert_please(struct drm_open_hash *ht, struct drm_hash_item *item, -- 2.34.1

2 4

[PATCH OLK-5.10 0/3] FIX CVE-2022-48887
by Huang Xiaojia 10 Sep '24

10 Sep '24

*** BLURB HERE *** Huang Xiaojia (2): drm/vmwgfx: Introduce ttm reference object find function drm/vmwgfx: Remove vmw_user_bo_noref_release Zack Rusin (1): drm/vmwgfx: Remove rcu locks from user resources drivers/gpu/drm/drm_hashtab.c | 5 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 55 +++---- drivers/gpu/drm/vmwgfx/ttm_object.h | 14 -- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 42 ------ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 27 +--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 176 +++++++++++------------ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 35 ----- include/drm/drm_hashtab.h | 2 + 8 files changed, 105 insertions(+), 251 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 1/3] drm/vmwgfx: Introduce ttm reference object find function
by Huang Xiaojia 10 Sep '24

10 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIFE -------------------------------- For CVE-2022-48887, ttm_base_object_lookup requires a non-RCU lookup function to solve buggy RCU paths. But there is none, hence introduce it to handle this CVE. Fixes: e14c02e6b699 ("drm/vmwgfx: Look up objects without taking a reference") Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/drm_hashtab.c | 5 +++-- drivers/gpu/drm/vmwgfx/ttm_object.c | 14 ++++++++++++++ include/drm/drm_hashtab.h | 2 ++ 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_hashtab.c b/drivers/gpu/drm/drm_hashtab.c index c50fa6f0709f..a61642835542 100644 --- a/drivers/gpu/drm/drm_hashtab.c +++ b/drivers/gpu/drm/drm_hashtab.c @@ -74,8 +74,8 @@ void drm_ht_verbose_list(struct drm_open_hash *ht, unsigned long key) DRM_DEBUG("count %d, key: 0x%08lx\n", count++, entry->key); } -static struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, - unsigned long key) +struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, + unsigned long key) { struct drm_hash_item *entry; struct hlist_head *h_list; @@ -91,6 +91,7 @@ static struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, } return NULL; } +EXPORT_SYMBOL(drm_ht_find_key); static struct hlist_node *drm_ht_find_key_rcu(struct drm_open_hash *ht, unsigned long key) diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c index 16077785ad47..03bf50e87d97 100644 --- a/drivers/gpu/drm/vmwgfx/ttm_object.c +++ b/drivers/gpu/drm/vmwgfx/ttm_object.c @@ -137,6 +137,20 @@ ttm_object_file_ref(struct ttm_object_file *tfile) return tfile; } +static int ttm_tfile_find_ref(struct drm_open_hash *ht, + uint32_t key, + struct drm_hash_item **item) +{ + struct hlist_node *h_node; + + h_node = drm_ht_find_key(ht, key); + if (!h_node) + return -EINVAL; + + *item = hlist_entry(h_node, struct drm_hash_item, head); + return 0; +} + static void ttm_object_file_destroy(struct kref *kref) { struct ttm_object_file *tfile = diff --git a/include/drm/drm_hashtab.h b/include/drm/drm_hashtab.h index bb95ff011baf..fe5ad4793a15 100644 --- a/include/drm/drm_hashtab.h +++ b/include/drm/drm_hashtab.h @@ -49,6 +49,8 @@ struct drm_open_hash { u8 order; }; +struct hlist_node *drm_ht_find_key(struct drm_open_hash *ht, unsigned long key); + int drm_ht_create(struct drm_open_hash *ht, unsigned int order); int drm_ht_insert_item(struct drm_open_hash *ht, struct drm_hash_item *item); int drm_ht_just_insert_please(struct drm_open_hash *ht, struct drm_hash_item *item, -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2023-52915
by Ye Bin 10 Sep '24

10 Sep '24

Hans Verkuil (1): media: dvb-usb-v2: af9035: fix missing unlock Zhang Shurong (1): media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer drivers/media/usb/dvb-usb-v2/af9035.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[openeuler:OLK-6.6] BUILD REGRESSION db19e0325ea842cbe7263402cdf73ee4e750b42b
by kernel test robot 10 Sep '24

10 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: db19e0325ea842cbe7263402cdf73ee4e750b42b !11464 mm/ksm: fix ksm_zero_pages accounting Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kernel-virtcca_cvm_host.c:warning:no-previous-prototype-for-function-is_virtcca_cvm_enable | |-- arch-arm64-kvm-tmi.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_evtq_thread | `-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_gerror_handler |-- arm64-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-001-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-002-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-003-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- arm64-randconfig-004-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allmodconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-allnoconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- loongarch-randconfig-002-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-allyesconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-001-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-002-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-003-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-buildonly-randconfig-004-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-defconfig | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-001-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-002-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-004-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-006-20240910 | `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:use-of-undeclared-identifier-NR_syscalls |-- x86_64-randconfig-011-20240910 | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:NR_syscalls-undeclared-(first-use-in-this-function) |-- x86_64-randconfig-012-20240910 | |-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs | `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:use-of-undeclared-identifier-NR_syscalls |-- x86_64-randconfig-013-20240910 | `-- mm-shmem.c:error:call-to-__compiletime_assert_NNN-declared-with-error-attribute:BUILD_BUG-failed |-- x86_64-randconfig-071-20240910 | `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs |-- x86_64-randconfig-074-20240910 | `-- mm-shmem.c:error:call-to-__compiletime_assert_NNN-declared-with-error-attribute:BUILD_BUG-failed `-- x86_64-rhel-8.3-rust `-- drivers-base-platform-msi.c:warning:Function-parameter-or-member-write_msi_msg-not-described-in-platform_msi_domain_alloc_range_irqs elapsed time: 788m configs tested: 38 configs skipped: 107 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240910 gcc-14.1.0 arm64 randconfig-002-20240910 clang-20 arm64 randconfig-003-20240910 gcc-14.1.0 arm64 randconfig-004-20240910 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240910 gcc-14.1.0 loongarch randconfig-002-20240910 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240910 gcc-12 x86_64 buildonly-randconfig-002-20240910 gcc-12 x86_64 buildonly-randconfig-003-20240910 clang-18 x86_64 buildonly-randconfig-004-20240910 gcc-12 x86_64 buildonly-randconfig-005-20240910 gcc-11 x86_64 buildonly-randconfig-006-20240910 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240910 gcc-12 x86_64 randconfig-002-20240910 gcc-12 x86_64 randconfig-003-20240910 gcc-12 x86_64 randconfig-004-20240910 gcc-12 x86_64 randconfig-005-20240910 clang-18 x86_64 randconfig-006-20240910 clang-18 x86_64 randconfig-011-20240910 gcc-12 x86_64 randconfig-012-20240910 clang-18 x86_64 randconfig-013-20240910 clang-18 x86_64 randconfig-014-20240910 clang-18 x86_64 randconfig-015-20240910 gcc-12 x86_64 randconfig-016-20240910 clang-18 x86_64 randconfig-071-20240910 clang-18 x86_64 randconfig-072-20240910 gcc-12 x86_64 randconfig-073-20240910 clang-18 x86_64 randconfig-074-20240910 clang-18 x86_64 randconfig-075-20240910 clang-18 x86_64 randconfig-076-20240910 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/5] coresight: etm4x: Fix CPU idle PM support for ETE
by Junhao He 10 Sep '24

10 Sep '24

Our CPUidle state save restore has some bugs which are triggered for an ETM with system instructions (e.g. ETE). This is a series of fixes to address them. Add CPU hotplug support for probing. Suzuki K Poulose (4): coresight: etm4x: Do not hardcode IOMEM access for register restore coresight: etm4x: Do not save/restore Data trace control registers coresight: etm4x: Safe access for TRCQCLTR coresight: etm4x: Fix access to resource selector registers Tamas Zsoldos (1): coresight: etm4x: add CPU hotplug support for probing .../coresight/coresight-etm4x-core.c | 162 +++++++++++++----- drivers/hwtracing/coresight/coresight-etm4x.h | 29 +--- 2 files changed, 119 insertions(+), 72 deletions(-) -- 2.33.0

2 6

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2023-52916
by Ye Bin 10 Sep '24

10 Sep '24

Jammy Huang (2): media: aspeed: Fix no complete irq for non-64-aligned width media: aspeed: Fix memory overwrite if timing is 1600x900 drivers/media/platform/aspeed-video.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] RDMA/hns: Fix missing unlock of scc_mutex in error path
by Chengchang Tang 10 Sep '24

10 Sep '24

From: Junxian Huang <huangjunxian6(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAPZGZ ---------------------------------------------------------------------- Fix missing unlock of scc_mutex in error path. Fixes: 5ea5896ecced ("RDMA/hns: Fix concurrency between sysfs store and FW configuration of scc params") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index e2ba5a003567..8bff09f348f8 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -7611,6 +7611,7 @@ static int hns_roce_v2_config_scc_param(struct hns_roce_dev *hr_dev, ibdev_err_ratelimited(&hr_dev->ib_dev, "failed to configure scc param, opcode: 0x%x, ret = %d.\n", le16_to_cpu(desc.opcode), ret); + mutex_unlock(&scc_param->scc_mutex); return ret; } -- 2.33.0

2 1