- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 29178/30000] arch/x86/kernel/paravirt.c:65:2: error: implicit declaration of function '__text_gen_insn'
by kernel test robot 01 Sep '24

01 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 02994a9b68a17040658e1a32a4438a31ae6f273b commit: 822da186955cbcd69b4715b8a307053e6c756f30 [29178/30000] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() config: x86_64-buildonly-randconfig-001-20240901 (https://download.01.org/0day-ci/archive/20240901/202409011810.7nvZJ2lQ-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240901/202409011810.7nvZJ2lQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409011810.7nvZJ2lQ-lkp@intel.com/ All errors (new ones prefixed by >>): >> arch/x86/kernel/paravirt.c:65:2: error: implicit declaration of function '__text_gen_insn' [-Werror,-Wimplicit-function-declaration] 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^ >> arch/x86/kernel/paravirt.c:65:29: error: use of undeclared identifier 'CALL_INSN_OPCODE' 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^ >> arch/x86/kernel/paravirt.c:66:26: error: use of undeclared identifier 'CALL_INSN_SIZE' 66 | (void *)addr, target, CALL_INSN_SIZE); | ^ arch/x86/kernel/paravirt.c:67:9: error: use of undeclared identifier 'CALL_INSN_SIZE' 67 | return CALL_INSN_SIZE; | ^ arch/x86/kernel/paravirt.c:327:4: warning: cast from 'void (*)(struct mmu_gather *, struct page *)' to 'void (*)(struct mmu_gather *, void *)' converts to incompatible function type [-Wcast-function-type-strict] 327 | (void (*)(struct mmu_gather *, void *))tlb_remove_page, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning and 4 errors generated. vim +/__text_gen_insn +65 arch/x86/kernel/paravirt.c 61 62 static unsigned paravirt_patch_call(void *insn_buff, const void *target, 63 unsigned long addr, unsigned len) 64 { > 65 __text_gen_insn(insn_buff, CALL_INSN_OPCODE, > 66 (void *)addr, target, CALL_INSN_SIZE); 67 return CALL_INSN_SIZE; 68 } 69 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 5ceb8241d25b2319a0e4b3ee50a4427988a1e6d3
by kernel test robot 01 Sep '24

01 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5ceb8241d25b2319a0e4b3ee50a4427988a1e6d3 !11234 efi: fix NULL-deref in init error path Warning ids grouped by kconfigs: recent_errors `-- arm64-randconfig-002-20240901 |-- drivers-net-ethernet-cisco-enic-vnic_dev.c:warning:a0-may-be-used-uninitialized `-- drivers-net-ethernet-cisco-enic-vnic_dev.c:warning:a1-may-be-used-uninitialized elapsed time: 1457m configs tested: 16 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240901 gcc-14.1.0 arm64 randconfig-002-20240901 gcc-14.1.0 arm64 randconfig-003-20240901 gcc-14.1.0 arm64 randconfig-004-20240901 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240901 clang-18 x86_64 buildonly-randconfig-002-20240901 gcc-12 x86_64 buildonly-randconfig-003-20240901 gcc-12 x86_64 buildonly-randconfig-004-20240901 clang-18 x86_64 buildonly-randconfig-005-20240901 gcc-12 x86_64 buildonly-randconfig-006-20240901 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240901 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 1398fff09547a2cd1093b0265a5ccd988e0a9ccb
by kernel test robot 01 Sep '24

01 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 1398fff09547a2cd1093b0265a5ccd988e0a9ccb !11270 nvme: apple: fix device reference counting Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kernel-virtcca_cvm_tsi.c:warning:variable-ver-is-uninitialized-when-used-here | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-002-20240901 | `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:NR_syscalls-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-004-20240901 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | `-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier `-- x86_64-randconfig-001-20240901 `-- vmlinux.o:warning:objtool:amd_set_spi_freq-falls-through-to-next-function-amd_spi_busy_wait() elapsed time: 1364m configs tested: 23 configs skipped: 117 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240901 gcc-14.1.0 arm64 randconfig-002-20240901 gcc-14.1.0 arm64 randconfig-003-20240901 gcc-14.1.0 arm64 randconfig-004-20240901 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240901 gcc-14.1.0 loongarch randconfig-002-20240901 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240901 clang-18 x86_64 buildonly-randconfig-002-20240901 gcc-12 x86_64 buildonly-randconfig-003-20240901 gcc-12 x86_64 buildonly-randconfig-004-20240901 clang-18 x86_64 buildonly-randconfig-005-20240901 gcc-12 x86_64 buildonly-randconfig-006-20240901 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240901 clang-18 x86_64 randconfig-002-20240901 gcc-12 x86_64 randconfig-003-20240901 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS V1] Add exception protection processing for vd in axi_chan_handle_err function
by Cheng Yu 31 Aug '24

31 Aug '24

From: "Shawn.Shao" <shawn.shao(a)jaguarmicro.com> stable inclusion from stable-v4.19.271 commit f534dc438828cc3f1f8c6895b8bdfbef079521fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALLDN CVE: CVE-2023-52899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 57054fe516d59d03a7bcf1888e82479ccc244f87 upstream. Since there is no protection for vd, a kernel panic will be triggered here in exceptional cases. You can refer to the processing of axi_chan_block_xfer_complete function The triggered kernel panic is as follows: [ 67.848444] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 [ 67.848447] Mem abort info: [ 67.848449] ESR = 0x96000004 [ 67.848451] EC = 0x25: DABT (current EL), IL = 32 bits [ 67.848454] SET = 0, FnV = 0 [ 67.848456] EA = 0, S1PTW = 0 [ 67.848458] Data abort info: [ 67.848460] ISV = 0, ISS = 0x00000004 [ 67.848462] CM = 0, WnR = 0 [ 67.848465] user pgtable: 4k pages, 48-bit VAs, pgdp=00000800c4c0b000 [ 67.848468] [0000000000000060] pgd=0000000000000000, p4d=0000000000000000 [ 67.848472] Internal error: Oops: 96000004 [#1] SMP [ 67.848475] Modules linked in: dmatest [ 67.848479] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.100-emu_x2rc+ #11 [ 67.848483] pstate: 62000085 (nZCv daIf -PAN -UAO +TCO BTYPE=--) [ 67.848487] pc : axi_chan_handle_err+0xc4/0x230 [ 67.848491] lr : axi_chan_handle_err+0x30/0x230 [ 67.848493] sp : ffff0803fe55ae50 [ 67.848495] x29: ffff0803fe55ae50 x28: ffff800011212200 [ 67.848500] x27: ffff0800c42c0080 x26: ffff0800c097c080 [ 67.848504] x25: ffff800010d33880 x24: ffff80001139d850 [ 67.848508] x23: ffff0800c097c168 x22: 0000000000000000 [ 67.848512] x21: 0000000000000080 x20: 0000000000002000 [ 67.848517] x19: ffff0800c097c080 x18: 0000000000000000 [ 67.848521] x17: 0000000000000000 x16: 0000000000000000 [ 67.848525] x15: 0000000000000000 x14: 0000000000000000 [ 67.848529] x13: 0000000000000000 x12: 0000000000000040 [ 67.848533] x11: ffff0800c0400248 x10: ffff0800c040024a [ 67.848538] x9 : ffff800010576cd4 x8 : ffff0800c0400270 [ 67.848542] x7 : 0000000000000000 x6 : ffff0800c04003e0 [ 67.848546] x5 : ffff0800c0400248 x4 : ffff0800c4294480 [ 67.848550] x3 : dead000000000100 x2 : dead000000000122 [ 67.848555] x1 : 0000000000000100 x0 : ffff0800c097c168 [ 67.848559] Call trace: [ 67.848562] axi_chan_handle_err+0xc4/0x230 [ 67.848566] dw_axi_dma_interrupt+0xf4/0x590 [ 67.848569] __handle_irq_event_percpu+0x60/0x220 [ 67.848573] handle_irq_event+0x64/0x120 [ 67.848576] handle_fasteoi_irq+0xc4/0x220 [ 67.848580] __handle_domain_irq+0x80/0xe0 [ 67.848583] gic_handle_irq+0xc0/0x138 [ 67.848585] el1_irq+0xc8/0x180 [ 67.848588] arch_cpu_idle+0x14/0x2c [ 67.848591] default_idle_call+0x40/0x16c [ 67.848594] do_idle+0x1f0/0x250 [ 67.848597] cpu_startup_entry+0x2c/0x60 [ 67.848600] rest_init+0xc0/0xcc [ 67.848603] arch_call_rest_init+0x14/0x1c [ 67.848606] start_kernel+0x4cc/0x500 [ 67.848610] Code: eb0002ff 9a9f12d6 f2fbd5a2 f2fbd5a3 (a94602c1) [ 67.848613] ---[ end trace 585a97036f88203a ]--- Signed-off-by: Shawn.Shao <shawn.shao(a)jaguarmicro.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20230112055802.1764-1-shawn.shao@jaguarmicro.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c index c05ef7f1d7b6..99a40385267c 100644 --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c @@ -551,6 +551,11 @@ static noinline void axi_chan_handle_err(struct axi_dma_chan *chan, u32 status) /* The bad descriptor currently is in the head of vc list */ vd = vchan_next_desc(&chan->vc); + if (!vd) { + dev_err(chan2dev(chan), "BUG: %s, IRQ with no descriptors\n", + axi_chan_name(chan)); + goto out; + } /* Remove the completed descriptor from issued list */ list_del(&vd->node); @@ -565,6 +570,7 @@ static noinline void axi_chan_handle_err(struct axi_dma_chan *chan, u32 status) /* Try to restart the controller */ axi_chan_start_first_queued(chan); +out: spin_unlock_irqrestore(&chan->vc.lock, flags); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ext4: remove the redundant folio_wait_stable()
by Yifan Qiao 31 Aug '24

31 Aug '24

From: Zhang Yi <yi.zhang(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit df0b5afc62f3368d657a8fe4a8d393ac481474c2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IANSAC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- __filemap_get_folio() with FGP_WRITEBEGIN parameter has already wait for stable folio, so remove the redundant folio_wait_stable() in ext4_da_write_begin(), it was left over from the commit cc883236b792 ("ext4: drop unnecessary journal handle in delalloc write") that removed the retry getting page logic. Fixes: cc883236b792 ("ext4: drop unnecessary journal handle in delalloc write") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240419023005.2719050-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/inode.c [Since in 4.19, ext4 has not adapted to folio yet, and grab_cache_page_write_begin also has already wait for stable page. So remove the redundant wait_for_stable_page as removing folio_wait_stable in folio version.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ext4/inode.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 35033bb43149..994c1e51262c 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3078,9 +3078,6 @@ static int ext4_da_write_begin(struct file *file, struct address_space *mapping, if (!page) return -ENOMEM; - /* In case writeback began while the page was unlocked */ - wait_for_stable_page(page); - #ifdef CONFIG_EXT4_FS_ENCRYPTION ret = ext4_block_write_begin(page, pos, len, ext4_da_get_block_prep); -- 2.39.2

2 1

[PATCH OLK-6.6 v3 00/27] mm/shmem: mTHP support for anon shmem
by Liu Shixin 31 Aug '24

31 Aug '24

v2->v3: Fix compile error "unused variable". v1->v2: No change. Resend this series after merging the series "mm: lazyfree THP support" since there are merge conflict. Bang Li (5): mm: add update_mmu_tlb_range() mm: implement update_mmu_tlb() using update_mmu_tlb_range() mm: use update_mmu_tlb_range() to simplify code mm/shmem: fix input and output inconsistencies mm: thp: support "THPeligible" semantics for mTHP with anonymous shmem Baolin Wang (8): mm: memory: extend finish_fault() to support large folio mm: shmem: add THP validation for PMD-mapped THP related statistics mm: shmem: add multi-size THP sysfs interface for anonymous shmem mm: shmem: add mTHP support for anonymous shmem mm: shmem: add mTHP size alignment in shmem_get_unmapped_area mm: shmem: add mTHP counters for anonymous shmem mm: shmem: avoid allocating huge pages larger than MAX_PAGECACHE_ORDER for shmem mm: shmem: fix incorrect aligned index when checking conflicts Christoph Hellwig (2): shmem: set a_ops earlier in shmem_symlink shmem: move the shmem_mapping assert into shmem_get_folio_gfp Hugh Dickins (8): shmem: shrink shmem_inode_info: dir_offsets in a union shmem: remove vma arg from shmem_get_folio_gfp() shmem: factor shmem_falloc_wait() out of shmem_fault() shmem: trivial tidyups, removing extra blank lines, etc shmem: shmem_acct_blocks() and shmem_inode_acct_blocks() shmem: move memcg charge out of shmem_add_to_page_cache() shmem: _add_to_page_cache() before shmem_inode_acct_blocks() shmem,percpu_counter: add _limited_add(fbc, limit, amount) Lance Yang (2): mm: add per-order mTHP split counters mm: add docs for per-order mTHP split counters Liu Shixin (1): mm: shmem: Merge shmem_alloc_hugefolio() with shmem_alloc_folio() Ryan Roberts (1): mm: shmem: rename mTHP shmem counters Documentation/admin-guide/mm/transhuge.rst | 74 +- arch/loongarch/include/asm/pgtable.h | 4 +- arch/mips/include/asm/pgtable.h | 4 +- arch/riscv/include/asm/pgtable.h | 4 +- arch/xtensa/include/asm/pgtable.h | 6 +- arch/xtensa/mm/tlb.c | 6 +- include/linux/huge_mm.h | 26 + include/linux/percpu_counter.h | 23 + include/linux/pgtable.h | 11 +- include/linux/shmem_fs.h | 25 +- lib/percpu_counter.c | 53 ++ mm/huge_memory.c | 43 +- mm/memory.c | 65 +- mm/shmem.c | 790 +++++++++++++-------- 14 files changed, 796 insertions(+), 338 deletions(-) -- 2.25.1

2 28

[PATCH OLK-5.10] gpio: prevent potential speculation leaks in gpio_device_get_desc()
by Guo Mengqi 31 Aug '24

31 Aug '24

From: Hagar Hemdan <hagarhem(a)amazon.com> stable inclusion from stable-v6.6.46 commit 1b955f786a4bcde8c0ccb2b7d519def2acb6f3cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMC8 CVE: CVE-2024-44931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d795848ecce24a75dfd46481aee066ae6fe39775 ] Userspace may trigger a speculative read of an address outside the gpio descriptor array. Users can do that by calling gpio_ioctl() with an offset out of range. Offset is copied from user and then used as an array index to get the gpio descriptor without sanitization in gpio_device_get_desc(). This change ensures that the offset is sanitized by using array_index_nospec() to mitigate any possibility of speculative information leaks. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Signed-off-by: Hagar Hemdan <hagarhem(a)amazon.com> Link: https://lore.kernel.org/r/20240523085332.1801-1-hagarhem@amazon.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpio/gpiolib.c [include header file context conflict] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpio/gpiolib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 374bb9f43266..a8e63d8f0e36 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -2,6 +2,7 @@ #include <linux/bitmap.h> #include <linux/kernel.h> #include <linux/module.h> +#include <linux/nospec.h> #include <linux/interrupt.h> #include <linux/irq.h> #include <linux/spinlock.h> @@ -143,7 +144,7 @@ struct gpio_desc *gpiochip_get_desc(struct gpio_chip *gc, if (hwnum >= gdev->ngpio) return ERR_PTR(-EINVAL); - return &gdev->descs[hwnum]; + return &gdev->descs[array_index_nospec(hwnum, gdev->ngpio)]; } EXPORT_SYMBOL_GPL(gpiochip_get_desc); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] gpio: prevent potential speculation leaks in gpio_device_get_desc()
by Guo Mengqi 31 Aug '24

31 Aug '24

From: Hagar Hemdan <hagarhem(a)amazon.com> stable inclusion from stable-v6.6.46 commit 1b955f786a4bcde8c0ccb2b7d519def2acb6f3cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMC8 CVE: CVE-2024-44931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d795848ecce24a75dfd46481aee066ae6fe39775 ] Userspace may trigger a speculative read of an address outside the gpio descriptor array. Users can do that by calling gpio_ioctl() with an offset out of range. Offset is copied from user and then used as an array index to get the gpio descriptor without sanitization in gpio_device_get_desc(). This change ensures that the offset is sanitized by using array_index_nospec() to mitigate any possibility of speculative information leaks. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Signed-off-by: Hagar Hemdan <hagarhem(a)amazon.com> Link: https://lore.kernel.org/r/20240523085332.1801-1-hagarhem@amazon.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpio/gpiolib.c [include header file context conflict] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpio/gpiolib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 59d8affad343..c4218d255392 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -2,6 +2,7 @@ #include <linux/bitmap.h> #include <linux/kernel.h> #include <linux/module.h> +#include <linux/nospec.h> #include <linux/interrupt.h> #include <linux/irq.h> #include <linux/spinlock.h> @@ -143,7 +144,7 @@ struct gpio_desc *gpiochip_get_desc(struct gpio_chip *gc, if (hwnum >= gdev->ngpio) return ERR_PTR(-EINVAL); - return &gdev->descs[hwnum]; + return &gdev->descs[array_index_nospec(hwnum, gdev->ngpio)]; } EXPORT_SYMBOL_GPL(gpiochip_get_desc); -- 2.17.1

2 1

[PATCH OLK-5.10 0/2] Patches merge from mainline
by Yifan Qiao 31 Aug '24

31 Aug '24

Martin Kaiser (1): nfs: keep server info for remounts Zhang Yi (1): ext4: remove the redundant folio_wait_stable() fs/ext4/inode.c | 3 --- fs/nfs/fs_context.c | 9 ++++++--- 2 files changed, 6 insertions(+), 6 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 V1] padata: Fix possible divide-by-0 panic in padata_mt_helper()
by Cheng Yu 31 Aug '24

31 Aug '24

From: Waiman Long <longman(a)redhat.com> stable inclusion from stable-v6.6.46 commit 924f788c906dccaca30acab86c7124371e1d6f2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMM8G CVE: CVE-2024-43889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6d45e1c948a8b7ed6ceddb14319af69424db730c upstream. We are hit with a not easily reproducible divide-by-0 panic in padata.c at bootup time. [ 10.017908] Oops: divide error: 0000 1 PREEMPT SMP NOPTI [ 10.017908] CPU: 26 PID: 2627 Comm: kworker/u1666:1 Not tainted 6.10.0-15.el10.x86_64 #1 [ 10.017908] Hardware name: Lenovo ThinkSystem SR950 [7X12CTO1WW]/[7X12CTO1WW], BIOS [PSE140J-2.30] 07/20/2021 [ 10.017908] Workqueue: events_unbound padata_mt_helper [ 10.017908] RIP: 0010:padata_mt_helper+0x39/0xb0 : [ 10.017963] Call Trace: [ 10.017968] <TASK> [ 10.018004] ? padata_mt_helper+0x39/0xb0 [ 10.018084] process_one_work+0x174/0x330 [ 10.018093] worker_thread+0x266/0x3a0 [ 10.018111] kthread+0xcf/0x100 [ 10.018124] ret_from_fork+0x31/0x50 [ 10.018138] ret_from_fork_asm+0x1a/0x30 [ 10.018147] </TASK> Looking at the padata_mt_helper() function, the only way a divide-by-0 panic can happen is when ps->chunk_size is 0. The way that chunk_size is initialized in padata_do_multithreaded(), chunk_size can be 0 when the min_chunk in the passed-in padata_mt_job structure is 0. Fix this divide-by-0 panic by making sure that chunk_size will be at least 1 no matter what the input parameters are. Link: https://lkml.kernel.org/r/20240806174647.1050398-1-longman@redhat.com Fixes: 004ed42638f4 ("padata: add basic support for multithreaded jobs") Signed-off-by: Waiman Long <longman(a)redhat.com> Cc: Daniel Jordan <daniel.m.jordan(a)oracle.com> Cc: Steffen Klassert <steffen.klassert(a)secunet.com> Cc: Waiman Long <longman(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/padata.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/padata.c b/kernel/padata.c index c974568f65f5..29545dd6dd53 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -516,6 +516,13 @@ void __init padata_do_multithreaded(struct padata_mt_job *job) ps.chunk_size = max(ps.chunk_size, job->min_chunk); ps.chunk_size = roundup(ps.chunk_size, job->align); + /* + * chunk_size can be 0 if the caller sets min_chunk to 0. So force it + * to at least 1 to prevent divide-by-0 panic in padata_mt_helper().` + */ + if (!ps.chunk_size) + ps.chunk_size = 1U; + list_for_each_entry(pw, &works, pw_list) queue_work(system_unbound_wq, &pw->pw_work); -- 2.25.1

2 1