- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 7037/10596] drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 08 Jul '24

08 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 3b421b6002e287e38790cbdad4a3e08baf7e1bc4 commit: f0db1bf5852542c46c16d0b305193069e265f769 [7037/10596] Huawei BMA: Adding Huawei BMA driver: host_edma_drv config: loongarch-randconfig-r132-20240707 (https://download.01.org/0day-ci/archive/20240708/202407081155.6fc6bMvH-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240708/202407081155.6fc6bMvH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407081155.6fc6bMvH-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:108:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:110:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:131:35: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:136:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:147:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:254:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:413:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:581:6: sparse: sparse: symbol 'host_dma_transfer_without_list' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:629:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:608:6: sparse: sparse: symbol 'host_dma_transfer_withlist' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:653:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:668:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:708:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:716:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:748:25: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:754:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:759:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:765:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:777:27: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:791:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:810:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:852:35: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:859:49: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:869:49: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:876:33: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:960:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:966:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:996:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1046:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1050:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1061:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1087:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1102:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1126:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1138:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1160:25: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1162:44: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1165:22: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1166:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got unsigned char * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1166:33: sparse: expected void const volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1166:33: sparse: got unsigned char * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1167:22: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1167:22: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got unsigned char * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1167:22: sparse: expected void const volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1167:22: sparse: got unsigned char * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1169:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1175:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1175:28: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1175:28: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1175:28: sparse: got void * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1181:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1186:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1196:33: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1200:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1201:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1203:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1217:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1218:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1219:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1227:36: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1227:36: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1227:36: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1227:36: sparse: got void * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1272:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1282:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1287:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1299:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1356:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1372:23: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1371:35: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *edma_send_addr @@ got void * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1371:35: sparse: expected void [noderef] __iomem *edma_send_addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1371:35: sparse: got void * >> drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got void [noderef] __iomem *edma_send_addr @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: expected void const * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: got void [noderef] __iomem *edma_send_addr >> drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got void [noderef] __iomem *edma_send_addr @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: expected void const * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: got void [noderef] __iomem *edma_send_addr >> drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got void [noderef] __iomem *edma_send_addr @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: expected void * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1374:9: sparse: got void [noderef] __iomem *edma_send_addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1377:23: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1376:35: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *edma_recv_addr @@ got void * @@ drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1376:35: sparse: expected void [noderef] __iomem *edma_recv_addr drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1376:35: sparse: got void * drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1380:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1406:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1413:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c:1442:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true vim +1374 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c 1268 1269 struct edma_user_inft_s *edma_host_get_user_inft(u32 type) 1270 { 1271 if (type >= TYPE_MAX) { > 1272 BMA_LOG(DLOG_ERROR, "type error %d\n", type); 1273 return NULL; 1274 } 1275 1276 return g_user_func[type]; 1277 } 1278 1279 int edma_host_user_register(u32 type, struct edma_user_inft_s *func) 1280 { 1281 if (type >= TYPE_MAX) { 1282 BMA_LOG(DLOG_ERROR, "type error %d\n", type); 1283 return -EFAULT; 1284 } 1285 1286 if (!func) { 1287 BMA_LOG(DLOG_ERROR, "func is NULL\n"); 1288 return -EFAULT; 1289 } 1290 1291 g_user_func[type] = func; 1292 1293 return 0; 1294 } 1295 1296 int edma_host_user_unregister(u32 type) 1297 { 1298 if (type >= TYPE_MAX) { 1299 BMA_LOG(DLOG_ERROR, "type error %d\n", type); 1300 return -EFAULT; 1301 } 1302 1303 g_user_func[type] = NULL; 1304 1305 return 0; 1306 } 1307 1308 int edma_host_init(struct edma_host_s *edma_host) 1309 { 1310 int ret = 0; 1311 struct bma_dev_s *bma_dev = NULL; 1312 struct notify_msg *pnm = NULL; 1313 1314 if (!edma_host) 1315 return -1; 1316 1317 bma_dev = list_entry(edma_host, struct bma_dev_s, edma_host); 1318 g_bma_dev = bma_dev; 1319 1320 edma_host->pdev = bma_dev->bma_pci_dev->pdev; 1321 1322 #ifdef EDMA_TIMER 1323 #ifdef HAVE_TIMER_SETUP 1324 timer_setup(&edma_host->timer, edma_host_timeout, 0); 1325 #else 1326 setup_timer(&edma_host->timer, edma_host_timeout, 1327 (unsigned long)edma_host); 1328 #endif 1329 (void)mod_timer(&edma_host->timer, jiffies_64 + TIMER_INTERVAL_CHECK); 1330 #ifdef USE_DMA 1331 #ifdef HAVE_TIMER_SETUP 1332 timer_setup(&edma_host->dma_timer, edma_host_dma_timeout, 0); 1333 1334 #else 1335 setup_timer(&edma_host->dma_timer, edma_host_dma_timeout, 1336 (unsigned long)edma_host); 1337 #endif 1338 (void)mod_timer(&edma_host->dma_timer, 1339 jiffies_64 + DMA_TIMER_INTERVAL_CHECK); 1340 #endif 1341 1342 #else 1343 init_completion(&edma_host->msg_ready); 1344 1345 edma_host->edma_thread = 1346 kthread_run(edma_host_thread, (void *)edma_host, "edma_host_msg"); 1347 1348 if (IS_ERR(edma_host->edma_thread)) { 1349 BMA_LOG(DLOG_ERROR, "kernel_run edma_host_msg failed\n"); 1350 return PTR_ERR(edma_host->edma_thread); 1351 } 1352 #endif 1353 1354 edma_host->msg_send_buf = kmalloc(HOST_MAX_SEND_MBX_LEN, GFP_KERNEL); 1355 if (!edma_host->msg_send_buf) { 1356 BMA_LOG(DLOG_ERROR, "malloc msg_send_buf failed!"); 1357 ret = -ENOMEM; 1358 goto failed1; 1359 } 1360 1361 edma_host->msg_send_write = 0; 1362 1363 spin_lock_init(&edma_host->send_msg_lock); 1364 1365 tasklet_init(&edma_host->tasklet, 1366 (void (*)(unsigned long))edma_host_isr_tasklet, 1367 (unsigned long)edma_host); 1368 1369 edma_host->edma_flag = bma_dev->bma_pci_dev->edma_swap_addr; 1370 > 1371 edma_host->edma_send_addr = 1372 (void *)((unsigned char *)bma_dev->bma_pci_dev->edma_swap_addr + 1373 HOST_DMA_FLAG_LEN); > 1374 memset(edma_host->edma_send_addr, 0, SIZE_OF_MBX_HDR); 1375 1376 edma_host->edma_recv_addr = 1377 (void *)((unsigned char *)edma_host->edma_send_addr + 1378 HOST_MAX_SEND_MBX_LEN); 1379 1380 BMA_LOG(DLOG_DEBUG, 1381 "edma_flag = %p, edma_send_addr = %p, edma_recv_addr = %p\n", 1382 edma_host->edma_flag, edma_host->edma_send_addr, 1383 edma_host->edma_recv_addr); 1384 1385 edma_host->hostrtc_viraddr = bma_dev->bma_pci_dev->hostrtc_viraddr; 1386 1387 init_waitqueue_head(&edma_host->wq_dmah2b); 1388 init_waitqueue_head(&edma_host->wq_dmab2h); 1389 1390 spin_lock_init(&edma_host->reg_lock); 1391 1392 edma_host->h2b_state = H2BSTATE_IDLE; 1393 edma_host->b2h_state = B2HSTATE_IDLE; 1394 1395 #ifdef HAVE_TIMER_SETUP 1396 timer_setup(&edma_host->heartbeat_timer, 1397 edma_host_heartbeat_timer, 0); 1398 #else 1399 setup_timer(&edma_host->heartbeat_timer, 1400 edma_host_heartbeat_timer, 1401 (unsigned long)edma_host); 1402 #endif 1403 (void)mod_timer(&edma_host->heartbeat_timer, 1404 jiffies_64 + HEARTBEAT_TIMER_INTERVAL_CHECK); 1405 1406 pnm = (struct notify_msg *)edma_host->edma_flag; 1407 if (pnm) 1408 pnm->host_registered = REGISTERED; 1409 1410 GET_SYS_SECONDS(edma_host->statistics.init_time); 1411 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
by Li Nan 08 Jul '24

08 Jul '24

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit a2db328b0839312c169eb42746ec46fc1ab53ed2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D6H CVE: CVE-2024-36478 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Writing 'power' and 'submit_queues' concurrently will trigger kernel panic: Test script: modprobe null_blk nr_devices=0 mkdir -p /sys/kernel/config/nullb/nullb0 while true; do echo 1 > submit_queues; echo 4 > submit_queues; done & while true; do echo 1 > power; echo 0 > power; done Test result: BUG: kernel NULL pointer dereference, address: 0000000000000148 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:__lock_acquire+0x41d/0x28f0 Call Trace: <TASK> lock_acquire+0x121/0x450 down_write+0x5f/0x1d0 simple_recursive_removal+0x12f/0x5c0 blk_mq_debugfs_unregister_hctxs+0x7c/0x100 blk_mq_update_nr_hw_queues+0x4a3/0x720 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x79/0xf0 [null_blk] configfs_write_iter+0x119/0x1e0 vfs_write+0x326/0x730 ksys_write+0x74/0x150 This is because del_gendisk() can concurrent with blk_mq_update_nr_hw_queues(): nullb_device_power_store nullb_apply_submit_queues null_del_dev del_gendisk nullb_update_nr_hw_queues if (!dev->nullb) // still set while gendisk is deleted return 0 blk_mq_update_nr_hw_queues dev->nullb = NULL Fix this problem by resuing the global mutex to protect nullb_device_power_store() and nullb_update_nr_hw_queues() from configfs. Fixes: 45919fbfe1c4 ("null_blk: Enable modifying 'submit_queues' after an instance has been configured") Reported-and-tested-by: Yi Zhang <yi.zhang(a)redhat.com> Closes: https://lore.kernel.org/all/CAHj4cs9LgsHLnjg8z06LQ3Pr5cax-+Ps+xT7AP7TPnEjSt… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Link: https://lore.kernel.org/r/20240523153934.1937851-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/block/null_blk/main.c [ A lot of conflict, this patch just expand the protection range of mutex, ignore conflict. ] Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/null_blk/main.c | 43 +++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 17 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index 35b390a785dd..91c8412442d0 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -323,11 +323,9 @@ CONFIGFS_ATTR(nullb_device_, NAME); static int nullb_apply_submit_queues(struct nullb_device *dev, unsigned int submit_queues) { - struct nullb *nullb = dev->nullb; + struct nullb *nullb; struct blk_mq_tag_set *set; - - if (!nullb) - return 0; + int ret = 0; /* * Make sure that null_init_hctx() does not access nullb->queues[] past @@ -335,9 +333,20 @@ static int nullb_apply_submit_queues(struct nullb_device *dev, */ if (submit_queues > nr_cpu_ids) return -EINVAL; + + mutex_lock(&lock); + + nullb = dev->nullb; + if (!nullb) + goto out; + set = nullb->tag_set; blk_mq_update_nr_hw_queues(set, submit_queues); - return set->nr_hw_queues == submit_queues ? 0 : -ENOMEM; + ret = set->nr_hw_queues == submit_queues ? 0 : -ENOMEM; + +out: + mutex_unlock(&lock); + return ret; } NULLB_DEVICE_ATTR(size, ulong, NULL); @@ -378,27 +387,31 @@ static ssize_t nullb_device_power_store(struct config_item *item, if (ret < 0) return ret; + ret = count; + mutex_lock(&lock); if (!dev->power && newp) { if (test_and_set_bit(NULLB_DEV_FL_UP, &dev->flags)) - return count; + goto out; + if (null_add_dev(dev)) { clear_bit(NULLB_DEV_FL_UP, &dev->flags); - return -ENOMEM; + ret = -ENOMEM; + goto out; } set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags); dev->power = newp; } else if (dev->power && !newp) { if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) { - mutex_lock(&lock); dev->power = newp; null_del_dev(dev->nullb); - mutex_unlock(&lock); } clear_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags); } - return count; +out: + mutex_unlock(&lock); + return ret; } CONFIGFS_ATTR(nullb_device_, power); @@ -1880,15 +1893,11 @@ static int null_add_dev(struct nullb_device *dev) blk_queue_flag_set(QUEUE_FLAG_NONROT, nullb->q); blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, nullb->q); - mutex_lock(&lock); rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL); - if (rv < 0) { - mutex_unlock(&lock); + if (rv < 0) goto out_cleanup_zone; - } nullb->index = rv; dev->index = rv; - mutex_unlock(&lock); blk_queue_logical_block_size(nullb->q, dev->blocksize); blk_queue_physical_block_size(nullb->q, dev->blocksize); @@ -1901,9 +1910,7 @@ static int null_add_dev(struct nullb_device *dev) if (rv) goto out_ida_free; - mutex_lock(&lock); list_add_tail(&nullb->list, &nullb_list); - mutex_unlock(&lock); return 0; @@ -1985,7 +1992,9 @@ static int __init null_init(void) ret = -ENOMEM; goto err_dev; } + mutex_lock(&lock); ret = null_add_dev(dev); + mutex_unlock(&lock); if (ret) { null_free_dev(dev); goto err_dev; -- 2.39.2

2 1

[openeuler:OLK-6.6 3342/10596] include/linux/pgplib.h:26:15: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function
by kernel test robot 08 Jul '24

08 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 3b421b6002e287e38790cbdad4a3e08baf7e1bc4 commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [3342/10596] KEYS: Provide a function to load keys from a PGP keyring blob config: arm64-randconfig-r131-20240707 (https://download.01.org/0day-ci/archive/20240708/202407081159.yhVjEfsw-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project a0c6b8aef853eedaa0980f07c0a502a5a8a9740e) reproduce: (https://download.01.org/0day-ci/archive/20240708/202407081159.yhVjEfsw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407081159.yhVjEfsw-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from crypto/asymmetric_keys/pgp_preload.c:19: >> include/linux/pgplib.h:26:15: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 26 | enum pgp_packet_tag type, | ^ include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:36:7: note: forward declaration of 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:37:23: error: field has incomplete type 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ include/linux/pgplib.h:37:7: note: forward declaration of 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ crypto/asymmetric_keys/pgp_preload.c:63:10: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:63:25: error: variable has incomplete type 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:63:10: note: forward declaration of 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:107:36: error: use of undeclared identifier 'PGP_PKT_PUBLIC_KEY' 107 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); | ^ crypto/asymmetric_keys/pgp_preload.c:108:25: error: incompatible function pointer types assigning to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' (aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, unsigned long)') from 'int (struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' (aka 'int (struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, unsigned long)') [-Wincompatible-function-pointer-types] 108 | ctx.pgp.process_packet = found_pgp_key; | ^ ~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c:101:12: warning: no previous prototype for function 'preload_pgp_keys' [-Wmissing-prototypes] 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ crypto/asymmetric_keys/pgp_preload.c:101:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ | static 3 warnings and 5 errors generated. -- In file included from crypto/asymmetric_keys/pgp_public_key.c:19: In file included from include/linux/mpi.h:21: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from crypto/asymmetric_keys/pgp_public_key.c:20: >> include/linux/pgplib.h:26:15: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 26 | enum pgp_packet_tag type, | ^ include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:36:7: note: forward declaration of 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:37:23: error: field has incomplete type 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ include/linux/pgplib.h:37:7: note: forward declaration of 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ crypto/asymmetric_keys/pgp_public_key.c:63:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 63 | kenter(""); | ^ crypto/asymmetric_keys/pgp_public_key.c:65:22: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^ crypto/asymmetric_keys/pgp_public_key.c:67:9: error: call to undeclared function 'mpi_key_length'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 67 | ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); | ^ crypto/asymmetric_keys/pgp_public_key.c:95:21: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 95 | if (pgp->version < PGP_KEY_VERSION_4) { | ^ crypto/asymmetric_keys/pgp_public_key.c:115:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 115 | kleave(" = %d", ret); | ^ crypto/asymmetric_keys/pgp_public_key.c:134:42: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^ crypto/asymmetric_keys/pgp_public_key.c:191:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 191 | kleave(" = %d", ret); | ^ crypto/asymmetric_keys/pgp_public_key.c:199:12: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:199:27: error: variable has incomplete type 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:199:12: note: forward declaration of 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:211:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 211 | kenter(",%u,%u,,%zu", type, headerlen, datalen); | ^ crypto/asymmetric_keys/pgp_public_key.c:213:14: error: use of undeclared identifier 'PGP_PKT_USER_ID' 213 | if (type == PGP_PKT_USER_ID) { | ^ crypto/asymmetric_keys/pgp_public_key.c:216:3: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 216 | kleave(" = 0 [user ID]"); | ^ crypto/asymmetric_keys/pgp_public_key.c:221:3: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 221 | kleave(" = -ENOKEY [already]"); | ^ crypto/asymmetric_keys/pgp_public_key.c:234:25: error: use of undeclared identifier 'PGP_PUBKEY__LAST' 234 | if (pgp.pubkey_algo >= PGP_PUBKEY__LAST) | ^ crypto/asymmetric_keys/pgp_public_key.c:236:9: error: use of undeclared identifier 'pgp_to_public_key_algo' 236 | algo = pgp_to_public_key_algo[pgp.pubkey_algo]; | ^ crypto/asymmetric_keys/pgp_public_key.c:252:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 252 | kleave(" = 0 [use]"); | ^ crypto/asymmetric_keys/pgp_public_key.c:310:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 310 | kenter(""); | ^ crypto/asymmetric_keys/pgp_public_key.c:313:36: error: use of undeclared identifier 'PGP_PKT_PUBLIC_KEY' 313 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY) | | ^ fatal error: too many errors emitted, stopping now [-ferror-limit=] 3 warnings and 20 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +26 include/linux/pgplib.h b78af6579e15dc David Howells 2023-09-12 19 b78af6579e15dc David Howells 2023-09-12 20 /* b78af6579e15dc David Howells 2023-09-12 21 * PGP library packet parser b78af6579e15dc David Howells 2023-09-12 22 */ b78af6579e15dc David Howells 2023-09-12 23 struct pgp_parse_context { b78af6579e15dc David Howells 2023-09-12 24 u64 types_of_interest; b78af6579e15dc David Howells 2023-09-12 25 int (*process_packet)(struct pgp_parse_context *context, b78af6579e15dc David Howells 2023-09-12 @26 enum pgp_packet_tag type, b78af6579e15dc David Howells 2023-09-12 27 u8 headerlen, b78af6579e15dc David Howells 2023-09-12 28 const u8 *data, b78af6579e15dc David Howells 2023-09-12 29 size_t datalen); b78af6579e15dc David Howells 2023-09-12 30 }; b78af6579e15dc David Howells 2023-09-12 31 :::::: The code at line 26 was first introduced by commit :::::: b78af6579e15dcdff86504da90af77f3e890270e PGPLIB: Basic packet parser :::::: TO: David Howells <dhowells(a)redhat.com> :::::: CC: zgzxx <zhangguangzhi3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] md: fix resync softlockup when bitmap size is less than array size
by Li Nan 08 Jul '24

08 Jul '24

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit f0e729af2eb6bee9eb58c4df1087f14ebaefe26b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SH1 CVE: CVE-2024-38598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Is is reported that for dm-raid10, lvextend + lvchange --syncaction will trigger following softlockup: kernel:watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [mdX_resync:6976] CPU: 7 PID: 3588 Comm: mdX_resync Kdump: loaded Not tainted 6.9.0-rc4-next-20240419 #1 RIP: 0010:_raw_spin_unlock_irq+0x13/0x30 Call Trace: <TASK> md_bitmap_start_sync+0x6b/0xf0 raid10_sync_request+0x25c/0x1b40 [raid10] md_do_sync+0x64b/0x1020 md_thread+0xa7/0x170 kthread+0xcf/0x100 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1a/0x30 And the detailed process is as follows: md_do_sync j = mddev->resync_min while (j < max_sectors) sectors = raid10_sync_request(mddev, j, &skipped) if (!md_bitmap_start_sync(..., &sync_blocks)) // md_bitmap_start_sync set sync_blocks to 0 return sync_blocks + sectors_skippe; // sectors = 0; j += sectors; // j never change Root cause is that commit 301867b1c168 ("md/raid10: check slab-out-of-bounds in md_bitmap_get_counter") return early from md_bitmap_get_counter(), without setting returned blocks. Fix this problem by always set returned blocks from md_bitmap_get_counter"(), as it used to be. Noted that this patch just fix the softlockup problem in kernel, the case that bitmap size doesn't match array size still need to be fixed. Fixes: 301867b1c168 ("md/raid10: check slab-out-of-bounds in md_bitmap_get_counter") Reported-and-tested-by: Nigel Croxon <ncroxon(a)redhat.com> Closes: https://lore.kernel.org/all/71ba5272-ab07-43ba-8232-d2da642acb4e@redhat.com/ Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Link: https://lore.kernel.org/r/20240422065824.2516-1-yukuai1@huaweicloud.com Signed-off-by: Song Liu <song(a)kernel.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md-bitmap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c index a4976ceae868..ee67da44641b 100644 --- a/drivers/md/md-bitmap.c +++ b/drivers/md/md-bitmap.c @@ -1427,7 +1427,7 @@ __acquires(bitmap->lock) sector_t chunk = offset >> bitmap->chunkshift; unsigned long page = chunk >> PAGE_COUNTER_SHIFT; unsigned long pageoff = (chunk & PAGE_COUNTER_MASK) << COUNTER_BYTE_SHIFT; - sector_t csize; + sector_t csize = ((sector_t)1) << bitmap->chunkshift; int err; if (page >= bitmap->pages) { @@ -1436,6 +1436,7 @@ __acquires(bitmap->lock) * End-of-device while looking for a whole page or * user set a huge number to sysfs bitmap_set_bits. */ + *blocks = csize - (offset & (csize - 1)); return NULL; } err = md_bitmap_checkpage(bitmap, page, create, 0); @@ -1444,8 +1445,7 @@ __acquires(bitmap->lock) bitmap->bp[page].map == NULL) csize = ((sector_t)1) << (bitmap->chunkshift + PAGE_COUNTER_SHIFT); - else - csize = ((sector_t)1) << bitmap->chunkshift; + *blocks = csize - (offset & (csize - 1)); if (err < 0) -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
by Li Nan 08 Jul '24

08 Jul '24

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit a2db328b0839312c169eb42746ec46fc1ab53ed2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D6H CVE: CVE-2024-36478 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Writing 'power' and 'submit_queues' concurrently will trigger kernel panic: Test script: modprobe null_blk nr_devices=0 mkdir -p /sys/kernel/config/nullb/nullb0 while true; do echo 1 > submit_queues; echo 4 > submit_queues; done & while true; do echo 1 > power; echo 0 > power; done Test result: BUG: kernel NULL pointer dereference, address: 0000000000000148 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:__lock_acquire+0x41d/0x28f0 Call Trace: <TASK> lock_acquire+0x121/0x450 down_write+0x5f/0x1d0 simple_recursive_removal+0x12f/0x5c0 blk_mq_debugfs_unregister_hctxs+0x7c/0x100 blk_mq_update_nr_hw_queues+0x4a3/0x720 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x79/0xf0 [null_blk] configfs_write_iter+0x119/0x1e0 vfs_write+0x326/0x730 ksys_write+0x74/0x150 This is because del_gendisk() can concurrent with blk_mq_update_nr_hw_queues(): nullb_device_power_store nullb_apply_submit_queues null_del_dev del_gendisk nullb_update_nr_hw_queues if (!dev->nullb) // still set while gendisk is deleted return 0 blk_mq_update_nr_hw_queues dev->nullb = NULL Fix this problem by resuing the global mutex to protect nullb_device_power_store() and nullb_update_nr_hw_queues() from configfs. Fixes: 45919fbfe1c4 ("null_blk: Enable modifying 'submit_queues' after an instance has been configured") Reported-and-tested-by: Yi Zhang <yi.zhang(a)redhat.com> Closes: https://lore.kernel.org/all/CAHj4cs9LgsHLnjg8z06LQ3Pr5cax-+Ps+xT7AP7TPnEjSt… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Link: https://lore.kernel.org/r/20240523153934.1937851-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/block/null_blk/main.c [ A lot of conflict, this patch just expand the protection range of mutex, ignore conflict. ] Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/null_blk/main.c | 43 +++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 17 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index 35b390a785dd..91c8412442d0 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -323,11 +323,9 @@ CONFIGFS_ATTR(nullb_device_, NAME); static int nullb_apply_submit_queues(struct nullb_device *dev, unsigned int submit_queues) { - struct nullb *nullb = dev->nullb; + struct nullb *nullb; struct blk_mq_tag_set *set; - - if (!nullb) - return 0; + int ret = 0; /* * Make sure that null_init_hctx() does not access nullb->queues[] past @@ -335,9 +333,20 @@ static int nullb_apply_submit_queues(struct nullb_device *dev, */ if (submit_queues > nr_cpu_ids) return -EINVAL; + + mutex_lock(&lock); + + nullb = dev->nullb; + if (!nullb) + goto out; + set = nullb->tag_set; blk_mq_update_nr_hw_queues(set, submit_queues); - return set->nr_hw_queues == submit_queues ? 0 : -ENOMEM; + ret = set->nr_hw_queues == submit_queues ? 0 : -ENOMEM; + +out: + mutex_unlock(&lock); + return ret; } NULLB_DEVICE_ATTR(size, ulong, NULL); @@ -378,27 +387,31 @@ static ssize_t nullb_device_power_store(struct config_item *item, if (ret < 0) return ret; + ret = count; + mutex_lock(&lock); if (!dev->power && newp) { if (test_and_set_bit(NULLB_DEV_FL_UP, &dev->flags)) - return count; + goto out; + if (null_add_dev(dev)) { clear_bit(NULLB_DEV_FL_UP, &dev->flags); - return -ENOMEM; + ret = -ENOMEM; + goto out; } set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags); dev->power = newp; } else if (dev->power && !newp) { if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) { - mutex_lock(&lock); dev->power = newp; null_del_dev(dev->nullb); - mutex_unlock(&lock); } clear_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags); } - return count; +out: + mutex_unlock(&lock); + return ret; } CONFIGFS_ATTR(nullb_device_, power); @@ -1880,15 +1893,11 @@ static int null_add_dev(struct nullb_device *dev) blk_queue_flag_set(QUEUE_FLAG_NONROT, nullb->q); blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, nullb->q); - mutex_lock(&lock); rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL); - if (rv < 0) { - mutex_unlock(&lock); + if (rv < 0) goto out_cleanup_zone; - } nullb->index = rv; dev->index = rv; - mutex_unlock(&lock); blk_queue_logical_block_size(nullb->q, dev->blocksize); blk_queue_physical_block_size(nullb->q, dev->blocksize); @@ -1901,9 +1910,7 @@ static int null_add_dev(struct nullb_device *dev) if (rv) goto out_ida_free; - mutex_lock(&lock); list_add_tail(&nullb->list, &nullb_list); - mutex_unlock(&lock); return 0; @@ -1985,7 +1992,9 @@ static int __init null_init(void) ret = -ENOMEM; goto err_dev; } + mutex_lock(&lock); ret = null_add_dev(dev); + mutex_unlock(&lock); if (ret) { null_free_dev(dev); goto err_dev; -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] CVE-2024-36478
by Li Nan 08 Jul '24

08 Jul '24

Damien Le Moal (1): null_blk: Fix return value of nullb_device_power_store() Yu Kuai (1): null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' drivers/block/null_blk/main.c | 41 +++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 14 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS v2] x86/ftrace: Disable lockdep check when execute ftrace_int3_handler()
by Zheng Yejian 08 Jul '24

08 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAA3U5 CVE: NA --------------------------- After commit 5e66a5bdad69 ("ftrace: Fix rcu warn in ftrace_location()"), lockdep still complain that: include/linux/rcupdate.h:646 rcu_read_lock() used illegally while idle! As Xu suggested, lockdep check can be disabled when exectue ftrace_int3_handler(), refer to mainline commit ba1f2b2eaa2a ("x86/entry: Fix NMI vs IRQ state tracking"). Fixes: 5e66a5bdad69 ("ftrace: Fix rcu warn in ftrace_location()") Suggested-by: Xu Kuohai <xukuohai(a)huawei.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- arch/x86/kernel/traps.c | 12 +++++++++--- kernel/trace/ftrace.c | 10 ++-------- 2 files changed, 11 insertions(+), 11 deletions(-) v1 -> v2: Fix check_format fail diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index e832a9becc19..343c21fa3fad 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -585,9 +585,15 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) * ftrace must be first, everything else may cause a recursive crash. * See note by declaration of modifying_ftrace_code in ftrace.c */ - if (unlikely(atomic_read(&modifying_ftrace_code)) && - ftrace_int3_handler(regs)) - return; + if (unlikely(atomic_read(&modifying_ftrace_code))) { + int ret; + + lockdep_off(); + ret = ftrace_int3_handler(regs); + lockdep_on(); + if (ret) + return; + } #endif if (poke_int3_handler(regs)) return; diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index ad4440da5b78..6704150cb655 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -1581,12 +1581,7 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) key.ip = start; key.flags = end; /* overload flags, as it is unsigned long */ - /* - * It is in atomic context when called from ftrace_int3_handler(), - * in this case rcu lock is not needed. - */ - if (!in_atomic()) - rcu_read_lock(); + rcu_read_lock(); for (pg = ftrace_pages_start; pg; pg = pg->next) { if (pg->index == 0 || end < pg->records[0].ip || @@ -1600,8 +1595,7 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) break; } } - if (!in_atomic()) - rcu_read_unlock(); + rcu_read_unlock(); return ip; } -- 2.25.1

2 1

[PATCH OLK-6.6] ax25: Fix reference count leak issue of net_device
by Zhengchao Shao 08 Jul '24

08 Jul '24

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v6.6.33 commit 965d940fb7414b310a22666503d2af69459c981b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SG4 CVE: CVE-2024-38554 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 36e56b1b002bb26440403053f19f9e1a8bc075b2 ] There is a reference count leak issue of the object "net_device" in ax25_dev_device_down(). When the ax25 device is shutting down, the ax25_dev_device_down() drops the reference count of net_device one or zero times depending on if we goto unlock_put or not, which will cause memory leak. In order to solve the above issue, decrease the reference count of net_device after dev->ax25_ptr is set to null. Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/7ce3b23a40d9084657ba1125432f0ecc380cbc80.17152470… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ax25/ax25_dev.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c index 52ccc37d5687..c9d55b99a7a5 100644 --- a/net/ax25/ax25_dev.c +++ b/net/ax25/ax25_dev.c @@ -118,15 +118,10 @@ void ax25_dev_device_down(struct net_device *dev) list_for_each_entry(s, &ax25_dev_list, list) { if (s == ax25_dev) { list_del(&s->list); - goto unlock_put; + break; } } - dev->ax25_ptr = NULL; - spin_unlock_bh(&ax25_dev_lock); - ax25_dev_put(ax25_dev); - return; -unlock_put: dev->ax25_ptr = NULL; spin_unlock_bh(&ax25_dev_lock); netdev_put(dev, &ax25_dev->dev_tracker); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] x86/ftrace: Disable lockdep check when execute ftrace_int3_handler()
by Zheng Yejian 08 Jul '24

08 Jul '24

After commit 5e66a5bdad69 ("ftrace: Fix rcu warn in ftrace_location()"), lockdep still complain that: include/linux/rcupdate.h:646 rcu_read_lock() used illegally while idle! As Xu suggested, lockdep check can be disabled when exectue ftrace_int3_handler(), refer to mainline commit ba1f2b2eaa2a ("x86/entry: Fix NMI vs IRQ state tracking"). Fixes: 5e66a5bdad69 ("ftrace: Fix rcu warn in ftrace_location()") Suggested-by: Xu Kuohai <xukuohai(a)huawei.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- arch/x86/kernel/traps.c | 12 +++++++++--- kernel/trace/ftrace.c | 10 ++-------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index e832a9becc19..343c21fa3fad 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -585,9 +585,15 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) * ftrace must be first, everything else may cause a recursive crash. * See note by declaration of modifying_ftrace_code in ftrace.c */ - if (unlikely(atomic_read(&modifying_ftrace_code)) && - ftrace_int3_handler(regs)) - return; + if (unlikely(atomic_read(&modifying_ftrace_code))) { + int ret; + + lockdep_off(); + ret = ftrace_int3_handler(regs); + lockdep_on(); + if (ret) + return; + } #endif if (poke_int3_handler(regs)) return; diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index ad4440da5b78..6704150cb655 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -1581,12 +1581,7 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) key.ip = start; key.flags = end; /* overload flags, as it is unsigned long */ - /* - * It is in atomic context when called from ftrace_int3_handler(), - * in this case rcu lock is not needed. - */ - if (!in_atomic()) - rcu_read_lock(); + rcu_read_lock(); for (pg = ftrace_pages_start; pg; pg = pg->next) { if (pg->index == 0 || end < pg->records[0].ip || @@ -1600,8 +1595,7 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) break; } } - if (!in_atomic()) - rcu_read_unlock(); + rcu_read_unlock(); return ip; } -- 2.25.1

2 1

[openeuler:OLK-6.6 3272/10596] drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4087:21: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 08 Jul '24

08 Jul '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 3b421b6002e287e38790cbdad4a3e08baf7e1bc4 commit: 22129ea1b367d0101df8cc4a837b3f773021e556 [3272/10596] iommu/arm-smmu-v3: Add support for less than one ECMDQ per core config: arm64-randconfig-r131-20240707 (https://download.01.org/0day-ci/archive/20240708/202407080858.aAMctg7p-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project a0c6b8aef853eedaa0980f07c0a502a5a8a9740e) reproduce: (https://download.01.org/0day-ci/archive/20240708/202407080858.aAMctg7p-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202407080858.aAMctg7p-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4084:15: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct arm_smmu_ecmdq *ecmdq @@ got struct arm_smmu_ecmdq [noderef] __percpu * @@ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4084:15: sparse: expected struct arm_smmu_ecmdq *ecmdq drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4084:15: sparse: got struct arm_smmu_ecmdq [noderef] __percpu * >> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4087:21: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct arm_smmu_ecmdq [noderef] __percpu *ecmdq @@ got struct arm_smmu_ecmdq *ecmdq @@ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4087:21: sparse: expected struct arm_smmu_ecmdq [noderef] __percpu *ecmdq drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4087:21: sparse: got struct arm_smmu_ecmdq *ecmdq drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4124:45: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const *addr @@ got void [noderef] __iomem *base @@ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4124:45: sparse: expected void const *addr drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:4124:45: sparse: got void [noderef] __iomem *base drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c: note: in included file (through arch/arm64/include/asm/atomic.h, include/linux/atomic.h, include/asm-generic/bitops/atomic.h, ...): arch/arm64/include/asm/cmpxchg.h:168:1: sparse: sparse: cast truncates bits from constant value (ffffffff80000000 becomes 0) arch/arm64/include/asm/cmpxchg.h:168:1: sparse: sparse: cast truncates bits from constant value (ffffffff80000000 becomes 0) vim +4087 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c 4077 4078 #ifdef CONFIG_ARM_SMMU_V3_ECMDQ 4079 static int arm_smmu_ecmdq_layout(struct arm_smmu_device *smmu) 4080 { 4081 int cpu, host_cpu; 4082 struct arm_smmu_ecmdq *ecmdq; 4083 > 4084 ecmdq = devm_alloc_percpu(smmu->dev, *ecmdq); 4085 if (!ecmdq) 4086 return -ENOMEM; > 4087 smmu->ecmdq = ecmdq; 4088 4089 /* A core requires at most one ECMDQ */ 4090 if (num_possible_cpus() < smmu->nr_ecmdq) 4091 smmu->nr_ecmdq = num_possible_cpus(); 4092 4093 for_each_possible_cpu(cpu) { 4094 if (cpu < smmu->nr_ecmdq) { 4095 *per_cpu_ptr(smmu->ecmdqs, cpu) = per_cpu_ptr(smmu->ecmdq, cpu); 4096 } else { 4097 host_cpu = cpu % smmu->nr_ecmdq; 4098 ecmdq = per_cpu_ptr(smmu->ecmdq, host_cpu); 4099 ecmdq->cmdq.shared = 1; 4100 *per_cpu_ptr(smmu->ecmdqs, cpu) = ecmdq; 4101 } 4102 } 4103 4104 return 0; 4105 } 4106 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0