- Linux-stable-mirror - lists.linaro.org

[PATCH v1 3/3] io_uring/rsrc: fix lost entries after cloned range

by Joanne Koong

When cloning with node replacements (IORING_REGISTER_DST_REPLACE), destination entries after the cloned range are not copied over. Add logic to copy them over to the new destination table. Fixes: c1329532d5aa ("io_uring/rsrc: allow cloning with node replacements") Cc: stable(a)vger.kernel.org Signed-off-by: Joanne Koong <joannelkoong(a)gmail.com> --- io_uring/rsrc.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 04f56212398a..a63474b331bf 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1205,7 +1205,7 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx if (ret) return ret; - /* Fill entries in data from dst that won't overlap with src */ + /* Copy original dst nodes from before the cloned range */ for (i = 0; i < min(arg->dst_off, ctx->buf_table.nr); i++) { struct io_rsrc_node *node = ctx->buf_table.nodes[i]; @@ -1238,6 +1238,16 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx i++; } + /* Copy original dst nodes from after the cloned range */ + for (i = nbufs; i < ctx->buf_table.nr; i++) { + struct io_rsrc_node *node = ctx->buf_table.nodes[i]; + + if (node) { + data.nodes[i] = node; + node->refs++; + } + } + /* * If asked for replace, put the old table. data->nodes[] holds both * old and new nodes at this point. -- 2.47.3

2 weeks, 1 day

1
0
0 0

[PATCH 5.15.y RESEND] KVM: arm64: sys_regs: disable -Wuninitialized-const-pointer warning

by Justin Stitt

A new warning in Clang 22 [1] complains that @clidr passed to get_clidr_el1() is an uninitialized const pointer. get_clidr_el1() doesn't really care since it casts away the const-ness anyways -- it is a false positive. | ../arch/arm64/kvm/sys_regs.c:2838:23: warning: variable 'clidr' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer] | 2838 | get_clidr_el1(NULL, &clidr); /* Ugly... */ | | ^~~~~ This patch isn't needed for anything past 6.1 as this code section was reworked in Commit 7af0c2534f4c ("KVM: arm64: Normalize cache configuration"). Since there is no upstream equivalent, this patch just needs to be applied to 5.15. Disable this warning for sys_regs.o with an iron fist as it doesn't make sense to waste maintainer's time or potentially break builds by backporting large changelists from 6.2+. Cc: stable(a)vger.kernel.org Fixes: 7c8c5e6a9101e ("arm64: KVM: system register handling") Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d44… [1] Reviewed-by: Nathan Chancellor <nathan(a)kernel.org> Signed-off-by: Justin Stitt <justinstitt(a)google.com> --- Resending this with Nathan's RB tag, an updated commit log and better recipients from checkpatch.pl. I'm also sending a similar patch resend for 6.1. --- arch/arm64/kvm/Makefile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/kvm/Makefile b/arch/arm64/kvm/Makefile index 989bb5dad2c8..109cca425d3e 100644 --- a/arch/arm64/kvm/Makefile +++ b/arch/arm64/kvm/Makefile @@ -25,3 +25,6 @@ kvm-y := $(KVM)/kvm_main.o $(KVM)/coalesced_mmio.o $(KVM)/eventfd.o \ vgic/vgic-its.o vgic/vgic-debug.o kvm-$(CONFIG_HW_PERF_EVENTS) += pmu-emul.o + +# Work around a false positive Clang 22 -Wuninitialized-const-pointer warning +CFLAGS_sys_regs.o := $(call cc-disable-warning, uninitialized-const-pointer) --- base-commit: 8bb7eca972ad531c9b149c0a51ab43a417385813 change-id: 20250728-b4-stable-disable-uninit-ptr-warn-5-15-c0c9db3df206 Best regards, -- Justin Stitt <justinstitt(a)google.com>

2 weeks, 1 day

1
0
0 0

Optimiza tu reclutamiento con PsicoSmart

by Valeria Pérez

Mejora tus contrataciones con PsicoSmart body { margin: 0; padding: 0; font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: #333; background-color: #ffffff; } table { border-spacing: 0; width: 100%; max-width: 600px; margin: auto; } td { padding: 12px 20px; } a { color: #1a73e8; text-decoration: none; } .footer { font-size: 12px; color: #888888; text-align: center; } Evalúa talento de forma objetiva y mejora tus contrataciones con PsicoSmart. Hola, , ¿Te ha pasado que un candidato luce perfecto en entrevista, pero en el trabajo no encaja como esperabas? En selección, confiar solo en la percepción puede llevar a decisiones costosas. Por eso quiero presentarte PsicoSmart, una herramienta creada para que los equipos de Recursos Humanos tomen decisiones más objetivas y acertadas. Con PsicoSmart puedes: Aplicar 31 pruebas psicométricas que evalúan liderazgo, honestidad, comunicación e inteligencia. Validar conocimientos técnicos con más de 2,500 exámenes especializados. Supervisar la identidad de quien responde mediante captura fotográfica automática durante la evaluación. Gestionar todo desde una sola plataforma, accesible desde cualquier dispositivo. Si estás buscando mejorar tus contrataciones, podría ser una muy buena opción. Si quieres conocer más puedes responder este correo o simplemente contactarme, mis datos están abajo. Saludos, -------------- Atte.: Valeria Pérez Ciudad de México: (55) 5018 0565 WhatsApp: +52 33 1607 2089 Si no deseas recibir más correos, haz clic aquí para darte de baja. Para remover su dirección de esta lista haga <a href="https://s1.arrobamail.com/unsuscribe.php?id=yiwtsrewiswqruseup">click aquí</a>

2 weeks, 1 day

1
0
0 0

[PATCH v4 2/4] tpm2-sessions: Fix tpm2_read_public range checks

by Jarkko Sakkinen

tpm2_read_public() has some rudimentary range checks but the function does not ensure that the response buffer has enough bytes for the full TPMT_HA payload. Re-implement the function with necessary checks and validation, and return name and name size for all handle types back to the caller. Cc: stable(a)vger.kernel.org # v6.10+ Fixes: d0a25bb961e6 ("tpm: Add HMAC session name/handle append") Reviewed-by: Jonathan McDowell <noodles(a)meta.com> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> --- v3: - Rename 'rc2' as 'name_size_alg'. - It makes a lot of sense to add additional robustness in name handling to tpm2_read_public. Thus also process handles whose handle name is the handle itself, and return name size back to the caller. v3: - No changes. v2: - Made the fix localized instead of spread all over the place. --- drivers/char/tpm/tpm2-cmd.c | 3 + drivers/char/tpm/tpm2-sessions.c | 94 +++++++++++++++++--------------- 2 files changed, 53 insertions(+), 44 deletions(-) diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index be4a9c7f2e1a..34e3599f094f 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -11,8 +11,11 @@ * used by the kernel internally. */ +#include "linux/dev_printk.h" +#include "linux/tpm.h" #include "tpm.h" #include <crypto/hash_info.h> +#include <linux/unaligned.h> static bool disable_pcr_integrity; module_param(disable_pcr_integrity, bool, 0444); diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c index 385014dbca39..3f389e2f6f58 100644 --- a/drivers/char/tpm/tpm2-sessions.c +++ b/drivers/char/tpm/tpm2-sessions.c @@ -163,53 +163,61 @@ static int name_size(const u8 *name) } } -static int tpm2_parse_read_public(char *name, struct tpm_buf *buf) +static int tpm2_read_public(struct tpm_chip *chip, u32 handle, void *name) { - struct tpm_header *head = (struct tpm_header *)buf->data; + u32 mso = tpm2_handle_mso(handle); off_t offset = TPM_HEADER_SIZE; - u32 tot_len = be32_to_cpu(head->length); - int ret; - u32 val; - - /* we're starting after the header so adjust the length */ - tot_len -= TPM_HEADER_SIZE; - - /* skip public */ - val = tpm_buf_read_u16(buf, &offset); - if (val > tot_len) - return -EINVAL; - offset += val; - /* name */ - val = tpm_buf_read_u16(buf, &offset); - ret = name_size(&buf->data[offset]); - if (ret < 0) - return ret; - - if (val != ret) - return -EINVAL; - - memcpy(name, &buf->data[offset], val); - /* forget the rest */ - return 0; -} - -static int tpm2_read_public(struct tpm_chip *chip, u32 handle, char *name) -{ + int rc, name_size_alg; struct tpm_buf buf; - int rc; + + if (mso != TPM2_MSO_PERSISTENT && mso != TPM2_MSO_VOLATILE && + mso != TPM2_MSO_NVRAM) { + memcpy(name, &handle, sizeof(u32)); + return sizeof(u32); + } rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_READ_PUBLIC); if (rc) return rc; tpm_buf_append_u32(&buf, handle); - rc = tpm_transmit_cmd(chip, &buf, 0, "read public"); - if (rc == TPM2_RC_SUCCESS) - rc = tpm2_parse_read_public(name, &buf); - tpm_buf_destroy(&buf); + rc = tpm_transmit_cmd(chip, &buf, 0, "TPM2_ReadPublic"); + if (rc) { + tpm_buf_destroy(&buf); + return tpm_ret_to_err(rc); + } - return rc; + /* Skip TPMT_PUBLIC: */ + offset += tpm_buf_read_u16(&buf, &offset); + + /* + * Ensure space for the length field of TPM2B_NAME and hashAlg field of + * TPMT_HA (the extra four bytes). + */ + if (offset + 4 > tpm_buf_length(&buf)) { + tpm_buf_destroy(&buf); + return -EIO; + } + + rc = tpm_buf_read_u16(&buf, &offset); + name_size_alg = name_size(&buf.data[offset]); + + if (name_size_alg < 0) + return name_size_alg; + + if (rc != name_size_alg) { + tpm_buf_destroy(&buf); + return -EIO; + } + + if (offset + rc > tpm_buf_length(&buf)) { + tpm_buf_destroy(&buf); + return -EIO; + } + + memcpy(name, &buf.data[offset], rc); + return name_size_alg; } #endif /* CONFIG_TCG_TPM2_HMAC */ @@ -243,6 +251,7 @@ int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, #ifdef CONFIG_TCG_TPM2_HMAC enum tpm2_mso_type mso = tpm2_handle_mso(handle); struct tpm2_auth *auth; + u16 name_size_alg; int slot; int ret; #endif @@ -273,8 +282,10 @@ int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, mso == TPM2_MSO_NVRAM) { if (!name) { ret = tpm2_read_public(chip, handle, auth->name[slot]); - if (ret) + if (ret < 0) goto err; + + name_size_alg = ret; } } else { if (name) { @@ -286,13 +297,8 @@ int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, } auth->name_h[slot] = handle; - if (name) { - ret = name_size(name); - if (ret < 0) - goto err; - - memcpy(auth->name[slot], name, ret); - } + if (name) + memcpy(auth->name[slot], name, name_size_alg); #endif return 0; -- 2.52.0

2 weeks, 1 day

1
0
0 0

[PATCH v4 1/4] tpm2-sessions: Fix out of range indexing in name_size

by Jarkko Sakkinen

'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at worst. Address the issue by only processing known values and returning -EINVAL for unrecognized values. Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so that errors are detected before causing any spurious TPM traffic. End also the authorization session on failure in both of the functions, as the session state would be then by definition corrupted. Cc: stable(a)vger.kernel.org # v6.10+ Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API") Reviewed-by: Jonathan McDowell <noodles(a)meta.com> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> --- v4: - Removed spurious empty line. v3: - Fix pr_warn() format string in name_size(). - Fix !CONFIG_TPM2_HMAC compilation. v2: - Wrote a better short summary. - Addressed remarks in https://lore.kernel.org/linux-integrity/aS8TIeviaippVAha@earth.li/ - Use -EIO consistently in tpm2_fill_hmac_session. These are not input value errors. They could only spun from malformed (kernel) state. - name_size did not have a proper default-case. Reorganize the fallback into that. --- drivers/char/tpm/tpm2-cmd.c | 23 +++- drivers/char/tpm/tpm2-sessions.c | 132 +++++++++++++++------- include/linux/tpm.h | 13 ++- security/keys/trusted-keys/trusted_tpm2.c | 29 ++++- 4 files changed, 142 insertions(+), 55 deletions(-) diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index dd502322f499..be4a9c7f2e1a 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -199,7 +199,11 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, } if (!disable_pcr_integrity) { - tpm_buf_append_name(chip, &buf, pcr_idx, NULL); + rc = tpm_buf_append_name(chip, &buf, pcr_idx, NULL); + if (rc) { + tpm_buf_destroy(&buf); + return rc; + } tpm_buf_append_hmac_session(chip, &buf, 0, NULL, 0); } else { tpm_buf_append_handle(chip, &buf, pcr_idx); @@ -214,8 +218,14 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, chip->allocated_banks[i].digest_size); } - if (!disable_pcr_integrity) - tpm_buf_fill_hmac_session(chip, &buf); + if (!disable_pcr_integrity) { + rc = tpm_buf_fill_hmac_session(chip, &buf); + if (rc) { + tpm_buf_destroy(&buf); + return rc; + } + } + rc = tpm_transmit_cmd(chip, &buf, 0, "attempting extend a PCR value"); if (!disable_pcr_integrity) rc = tpm_buf_check_hmac_response(chip, &buf, rc); @@ -273,7 +283,12 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) | TPM2_SA_CONTINUE_SESSION, NULL, 0); tpm_buf_append_u16(&buf, num_bytes); - tpm_buf_fill_hmac_session(chip, &buf); + err = tpm_buf_fill_hmac_session(chip, &buf); + if (err) { + tpm_buf_destroy(&buf); + return err; + } + err = tpm_transmit_cmd(chip, &buf, offsetof(struct tpm2_get_random_out, buffer), diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c index 6d03c224e6b2..385014dbca39 100644 --- a/drivers/char/tpm/tpm2-sessions.c +++ b/drivers/char/tpm/tpm2-sessions.c @@ -144,16 +144,23 @@ struct tpm2_auth { /* * Name Size based on TPM algorithm (assumes no hash bigger than 255) */ -static u8 name_size(const u8 *name) +static int name_size(const u8 *name) { - static u8 size_map[] = { - [TPM_ALG_SHA1] = SHA1_DIGEST_SIZE, - [TPM_ALG_SHA256] = SHA256_DIGEST_SIZE, - [TPM_ALG_SHA384] = SHA384_DIGEST_SIZE, - [TPM_ALG_SHA512] = SHA512_DIGEST_SIZE, - }; - u16 alg = get_unaligned_be16(name); - return size_map[alg] + 2; + u16 hash_alg = get_unaligned_be16(name); + + switch (hash_alg) { + case TPM_ALG_SHA1: + return SHA1_DIGEST_SIZE + 2; + case TPM_ALG_SHA256: + return SHA256_DIGEST_SIZE + 2; + case TPM_ALG_SHA384: + return SHA384_DIGEST_SIZE + 2; + case TPM_ALG_SHA512: + return SHA512_DIGEST_SIZE + 2; + default: + pr_warn("tpm: unsupported name algorithm: 0x%04x\n", hash_alg); + return -EINVAL; + } } static int tpm2_parse_read_public(char *name, struct tpm_buf *buf) @@ -161,6 +168,7 @@ static int tpm2_parse_read_public(char *name, struct tpm_buf *buf) struct tpm_header *head = (struct tpm_header *)buf->data; off_t offset = TPM_HEADER_SIZE; u32 tot_len = be32_to_cpu(head->length); + int ret; u32 val; /* we're starting after the header so adjust the length */ @@ -173,8 +181,13 @@ static int tpm2_parse_read_public(char *name, struct tpm_buf *buf) offset += val; /* name */ val = tpm_buf_read_u16(buf, &offset); - if (val != name_size(&buf->data[offset])) + ret = name_size(&buf->data[offset]); + if (ret < 0) + return ret; + + if (val != ret) return -EINVAL; + memcpy(name, &buf->data[offset], val); /* forget the rest */ return 0; @@ -221,46 +234,72 @@ static int tpm2_read_public(struct tpm_chip *chip, u32 handle, char *name) * As with most tpm_buf operations, success is assumed because failure * will be caused by an incorrect programming model and indicated by a * kernel message. + * + * Ends the authorization session on failure. */ -void tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, - u32 handle, u8 *name) +int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, + u32 handle, u8 *name) { #ifdef CONFIG_TCG_TPM2_HMAC enum tpm2_mso_type mso = tpm2_handle_mso(handle); struct tpm2_auth *auth; int slot; + int ret; #endif if (!tpm2_chip_auth(chip)) { tpm_buf_append_handle(chip, buf, handle); - return; + return 0; } #ifdef CONFIG_TCG_TPM2_HMAC slot = (tpm_buf_length(buf) - TPM_HEADER_SIZE) / 4; if (slot >= AUTH_MAX_NAMES) { - dev_err(&chip->dev, "TPM: too many handles\n"); - return; + dev_err(&chip->dev, "too many handles\n"); + ret = -EIO; + goto err; } auth = chip->auth; - WARN(auth->session != tpm_buf_length(buf), - "name added in wrong place\n"); + if (auth->session != tpm_buf_length(buf)) { + dev_err(&chip->dev, "session state malformed"); + ret = -EIO; + goto err; + } tpm_buf_append_u32(buf, handle); auth->session += 4; if (mso == TPM2_MSO_PERSISTENT || mso == TPM2_MSO_VOLATILE || mso == TPM2_MSO_NVRAM) { - if (!name) - tpm2_read_public(chip, handle, auth->name[slot]); + if (!name) { + ret = tpm2_read_public(chip, handle, auth->name[slot]); + if (ret) + goto err; + } } else { - if (name) - dev_err(&chip->dev, "TPM: Handle does not require name but one is specified\n"); + if (name) { + dev_err(&chip->dev, "handle 0x%08x does not use a name\n", + handle); + ret = -EIO; + goto err; + } } auth->name_h[slot] = handle; - if (name) - memcpy(auth->name[slot], name, name_size(name)); + if (name) { + ret = name_size(name); + if (ret < 0) + goto err; + + memcpy(auth->name[slot], name, ret); + } +#endif + return 0; + +#ifdef CONFIG_TCG_TPM2_HMAC +err: + tpm2_end_auth_session(chip); + return tpm_ret_to_err(ret); #endif } EXPORT_SYMBOL_GPL(tpm_buf_append_name); @@ -533,11 +572,9 @@ static void tpm_buf_append_salt(struct tpm_buf *buf, struct tpm_chip *chip, * encryption key and encrypts the first parameter of the command * buffer with it. * - * As with most tpm_buf operations, success is assumed because failure - * will be caused by an incorrect programming model and indicated by a - * kernel message. + * Ends the authorization session on failure. */ -void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) +int tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) { u32 cc, handles, val; struct tpm2_auth *auth = chip->auth; @@ -549,9 +586,12 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) u8 cphash[SHA256_DIGEST_SIZE]; struct sha256_ctx sctx; struct hmac_sha256_ctx hctx; + int ret; - if (!auth) - return; + if (!auth) { + ret = -EIO; + goto err; + } /* save the command code in BE format */ auth->ordinal = head->ordinal; @@ -560,9 +600,11 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) i = tpm2_find_cc(chip, cc); if (i < 0) { - dev_err(&chip->dev, "Command 0x%x not found in TPM\n", cc); - return; + dev_err(&chip->dev, "command 0x%08x not found\n", cc); + ret = -EIO; + goto err; } + attrs = chip->cc_attrs_tbl[i]; handles = (attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0); @@ -576,9 +618,9 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) u32 handle = tpm_buf_read_u32(buf, &offset_s); if (auth->name_h[i] != handle) { - dev_err(&chip->dev, "TPM: handle %d wrong for name\n", - i); - return; + dev_err(&chip->dev, "invalid handle 0x%08x\n", handle); + ret = -EIO; + goto err; } } /* point offset_s to the start of the sessions */ @@ -609,12 +651,14 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) offset_s += len; } if (offset_s != offset_p) { - dev_err(&chip->dev, "TPM session length is incorrect\n"); - return; + dev_err(&chip->dev, "session length is incorrect\n"); + ret = -EIO; + goto err; } if (!hmac) { - dev_err(&chip->dev, "TPM could not find HMAC session\n"); - return; + dev_err(&chip->dev, "could not find HMAC session\n"); + ret = -EIO; + goto err; } /* encrypt before HMAC */ @@ -646,8 +690,11 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) if (mso == TPM2_MSO_PERSISTENT || mso == TPM2_MSO_VOLATILE || mso == TPM2_MSO_NVRAM) { - sha256_update(&sctx, auth->name[i], - name_size(auth->name[i])); + ret = name_size(auth->name[i]); + if (ret < 0) + goto err; + + sha256_update(&sctx, auth->name[i], ret); } else { __be32 h = cpu_to_be32(auth->name_h[i]); @@ -668,6 +715,11 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) hmac_sha256_update(&hctx, auth->tpm_nonce, sizeof(auth->tpm_nonce)); hmac_sha256_update(&hctx, &auth->attrs, 1); hmac_sha256_final(&hctx, hmac); + return 0; + +err: + tpm2_end_auth_session(chip); + return ret; } EXPORT_SYMBOL(tpm_buf_fill_hmac_session); diff --git a/include/linux/tpm.h b/include/linux/tpm.h index 3d8f7d1ce2b8..aa816b144ab3 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -529,8 +529,8 @@ static inline struct tpm2_auth *tpm2_chip_auth(struct tpm_chip *chip) #endif } -void tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, - u32 handle, u8 *name); +int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, + u32 handle, u8 *name); void tpm_buf_append_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf, u8 attributes, u8 *passphrase, int passphraselen); @@ -563,7 +563,7 @@ static inline void tpm_buf_append_hmac_session_opt(struct tpm_chip *chip, #ifdef CONFIG_TCG_TPM2_HMAC int tpm2_start_auth_session(struct tpm_chip *chip); -void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf); +int tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf); int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf, int rc); void tpm2_end_auth_session(struct tpm_chip *chip); @@ -577,10 +577,13 @@ static inline int tpm2_start_auth_session(struct tpm_chip *chip) static inline void tpm2_end_auth_session(struct tpm_chip *chip) { } -static inline void tpm_buf_fill_hmac_session(struct tpm_chip *chip, - struct tpm_buf *buf) + +static inline int tpm_buf_fill_hmac_session(struct tpm_chip *chip, + struct tpm_buf *buf) { + return 0; } + static inline int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf, int rc) diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c index 8bc6efa8accb..5b205279584b 100644 --- a/security/keys/trusted-keys/trusted_tpm2.c +++ b/security/keys/trusted-keys/trusted_tpm2.c @@ -268,7 +268,10 @@ int tpm2_seal_trusted(struct tpm_chip *chip, goto out_put; } - tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + rc = tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + if (rc) + goto out; + tpm_buf_append_hmac_session(chip, &buf, TPM2_SA_DECRYPT, options->keyauth, TPM_DIGEST_SIZE); @@ -316,7 +319,10 @@ int tpm2_seal_trusted(struct tpm_chip *chip, goto out; } - tpm_buf_fill_hmac_session(chip, &buf); + rc = tpm_buf_fill_hmac_session(chip, &buf); + if (rc) + goto out; + rc = tpm_transmit_cmd(chip, &buf, 4, "sealing data"); rc = tpm_buf_check_hmac_response(chip, &buf, rc); if (rc) @@ -427,7 +433,10 @@ static int tpm2_load_cmd(struct tpm_chip *chip, return rc; } - tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + rc = tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + if (rc) + goto out; + tpm_buf_append_hmac_session(chip, &buf, 0, options->keyauth, TPM_DIGEST_SIZE); @@ -439,7 +448,10 @@ static int tpm2_load_cmd(struct tpm_chip *chip, goto out; } - tpm_buf_fill_hmac_session(chip, &buf); + rc = tpm_buf_fill_hmac_session(chip, &buf); + if (rc) + goto out; + rc = tpm_transmit_cmd(chip, &buf, 4, "loading blob"); rc = tpm_buf_check_hmac_response(chip, &buf, rc); if (!rc) @@ -484,7 +496,9 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, return rc; } - tpm_buf_append_name(chip, &buf, blob_handle, NULL); + rc = tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + if (rc) + goto out; if (!options->policyhandle) { tpm_buf_append_hmac_session(chip, &buf, TPM2_SA_ENCRYPT, @@ -509,7 +523,10 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, NULL, 0); } - tpm_buf_fill_hmac_session(chip, &buf); + rc = tpm_buf_fill_hmac_session(chip, &buf); + if (rc) + goto out; + rc = tpm_transmit_cmd(chip, &buf, 6, "unsealing"); rc = tpm_buf_check_hmac_response(chip, &buf, rc); -- 2.52.0

2 weeks, 1 day

1
0
0 0

[PATCH v3 2/4] tpm2-sessions: Fix tpm2_read_public range checks

by Jarkko Sakkinen

'tpm2_read_public' has some rudimentary range checks but the function does not ensure that the response buffer has enough bytes for the full TPMT_HA payload. Re-implement the function with necessary checks and validation. Cc: stable(a)vger.kernel.org # v6.10+ Fixes: d0a25bb961e6 ("tpm: Add HMAC session name/handle append") Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> v2: - Made the fix localized instead of spread all over the place. --- drivers/char/tpm/tpm2-cmd.c | 3 ++ drivers/char/tpm/tpm2-sessions.c | 77 +++++++++++++++++--------------- 2 files changed, 44 insertions(+), 36 deletions(-) diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index be4a9c7f2e1a..34e3599f094f 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -11,8 +11,11 @@ * used by the kernel internally. */ +#include "linux/dev_printk.h" +#include "linux/tpm.h" #include "tpm.h" #include <crypto/hash_info.h> +#include <linux/unaligned.h> static bool disable_pcr_integrity; module_param(disable_pcr_integrity, bool, 0444); diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c index a265e9752a5e..e9f439be3916 100644 --- a/drivers/char/tpm/tpm2-sessions.c +++ b/drivers/char/tpm/tpm2-sessions.c @@ -163,54 +163,59 @@ static int name_size(const u8 *name) } } -static int tpm2_parse_read_public(char *name, struct tpm_buf *buf) +static int tpm2_read_public(struct tpm_chip *chip, u32 handle, void *name) { - struct tpm_header *head = (struct tpm_header *)buf->data; + u32 mso = tpm2_handle_mso(handle); off_t offset = TPM_HEADER_SIZE; - u32 tot_len = be32_to_cpu(head->length); - int ret; - u32 val; - - /* we're starting after the header so adjust the length */ - tot_len -= TPM_HEADER_SIZE; - - /* skip public */ - val = tpm_buf_read_u16(buf, &offset); - if (val > tot_len) - return -EINVAL; - offset += val; - /* name */ - - val = tpm_buf_read_u16(buf, &offset); - ret = name_size(&buf->data[offset]); - if (ret < 0) - return ret; + struct tpm_buf buf; + int rc, rc2; - if (val != ret) + if (mso != TPM2_MSO_PERSISTENT && mso != TPM2_MSO_VOLATILE && + mso != TPM2_MSO_NVRAM) return -EINVAL; - memcpy(name, &buf->data[offset], val); - /* forget the rest */ - return 0; -} - -static int tpm2_read_public(struct tpm_chip *chip, u32 handle, char *name) -{ - struct tpm_buf buf; - int rc; - rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_READ_PUBLIC); if (rc) return rc; tpm_buf_append_u32(&buf, handle); - rc = tpm_transmit_cmd(chip, &buf, 0, "read public"); - if (rc == TPM2_RC_SUCCESS) - rc = tpm2_parse_read_public(name, &buf); - tpm_buf_destroy(&buf); + rc = tpm_transmit_cmd(chip, &buf, 0, "TPM2_ReadPublic"); + if (rc) { + tpm_buf_destroy(&buf); + return tpm_ret_to_err(rc); + } - return rc; + /* Skip TPMT_PUBLIC: */ + offset += tpm_buf_read_u16(&buf, &offset); + + /* + * Ensure space for the length field of TPM2B_NAME and hashAlg field of + * TPMT_HA (the extra four bytes). + */ + if (offset + 4 > tpm_buf_length(&buf)) { + tpm_buf_destroy(&buf); + return -EIO; + } + + rc = tpm_buf_read_u16(&buf, &offset); + rc2 = name_size(&buf.data[offset]); + + if (rc2 < 0) + return rc2; + + if (rc != rc2) { + tpm_buf_destroy(&buf); + return -EIO; + } + + if (offset + rc > tpm_buf_length(&buf)) { + tpm_buf_destroy(&buf); + return -EIO; + } + + memcpy(name, &buf.data[offset], rc); + return 0; } #endif /* CONFIG_TCG_TPM2_HMAC */ -- 2.52.0

2 weeks, 1 day

2
2
0 0

[PATCH v3 1/4] tpm2-sessions: fix out of range indexing in name_size

by Jarkko Sakkinen

'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at worst. Address the issue by only processing known values and returning -EINVAL for unrecognized values. Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so that errors are detected before causing any spurious TPM traffic. End also the authorization session on failure in both of the functions, as the session state would be then by definition corrupted. Cc: stable(a)vger.kernel.org # v6.10+ Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API") Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> v3: - Fix pr_warn() format string in name_size(). - Fix !CONFIG_TPM2_HMAC compilation. v2: - Wrote a better short summary. - Addressed remarks in https://lore.kernel.org/linux-integrity/aS8TIeviaippVAha@earth.li/ - Use -EIO consistently in tpm2_fill_hmac_session. These are not input value errors. They could only spun from malformed (kernel) state. - name_size did not have a proper default-case. Reorganize the fallback into that. --- drivers/char/tpm/tpm2-cmd.c | 23 +++- drivers/char/tpm/tpm2-sessions.c | 133 +++++++++++++++------- include/linux/tpm.h | 13 ++- security/keys/trusted-keys/trusted_tpm2.c | 29 ++++- 4 files changed, 143 insertions(+), 55 deletions(-) diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index dd502322f499..be4a9c7f2e1a 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -199,7 +199,11 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, } if (!disable_pcr_integrity) { - tpm_buf_append_name(chip, &buf, pcr_idx, NULL); + rc = tpm_buf_append_name(chip, &buf, pcr_idx, NULL); + if (rc) { + tpm_buf_destroy(&buf); + return rc; + } tpm_buf_append_hmac_session(chip, &buf, 0, NULL, 0); } else { tpm_buf_append_handle(chip, &buf, pcr_idx); @@ -214,8 +218,14 @@ int tpm2_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, chip->allocated_banks[i].digest_size); } - if (!disable_pcr_integrity) - tpm_buf_fill_hmac_session(chip, &buf); + if (!disable_pcr_integrity) { + rc = tpm_buf_fill_hmac_session(chip, &buf); + if (rc) { + tpm_buf_destroy(&buf); + return rc; + } + } + rc = tpm_transmit_cmd(chip, &buf, 0, "attempting extend a PCR value"); if (!disable_pcr_integrity) rc = tpm_buf_check_hmac_response(chip, &buf, rc); @@ -273,7 +283,12 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) | TPM2_SA_CONTINUE_SESSION, NULL, 0); tpm_buf_append_u16(&buf, num_bytes); - tpm_buf_fill_hmac_session(chip, &buf); + err = tpm_buf_fill_hmac_session(chip, &buf); + if (err) { + tpm_buf_destroy(&buf); + return err; + } + err = tpm_transmit_cmd(chip, &buf, offsetof(struct tpm2_get_random_out, buffer), diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c index 6d03c224e6b2..a265e9752a5e 100644 --- a/drivers/char/tpm/tpm2-sessions.c +++ b/drivers/char/tpm/tpm2-sessions.c @@ -144,16 +144,23 @@ struct tpm2_auth { /* * Name Size based on TPM algorithm (assumes no hash bigger than 255) */ -static u8 name_size(const u8 *name) +static int name_size(const u8 *name) { - static u8 size_map[] = { - [TPM_ALG_SHA1] = SHA1_DIGEST_SIZE, - [TPM_ALG_SHA256] = SHA256_DIGEST_SIZE, - [TPM_ALG_SHA384] = SHA384_DIGEST_SIZE, - [TPM_ALG_SHA512] = SHA512_DIGEST_SIZE, - }; - u16 alg = get_unaligned_be16(name); - return size_map[alg] + 2; + u16 hash_alg = get_unaligned_be16(name); + + switch (hash_alg) { + case TPM_ALG_SHA1: + return SHA1_DIGEST_SIZE + 2; + case TPM_ALG_SHA256: + return SHA256_DIGEST_SIZE + 2; + case TPM_ALG_SHA384: + return SHA384_DIGEST_SIZE + 2; + case TPM_ALG_SHA512: + return SHA512_DIGEST_SIZE + 2; + default: + pr_warn("tpm: unsupported name algorithm: 0x%04x\n", hash_alg); + return -EINVAL; + } } static int tpm2_parse_read_public(char *name, struct tpm_buf *buf) @@ -161,6 +168,7 @@ static int tpm2_parse_read_public(char *name, struct tpm_buf *buf) struct tpm_header *head = (struct tpm_header *)buf->data; off_t offset = TPM_HEADER_SIZE; u32 tot_len = be32_to_cpu(head->length); + int ret; u32 val; /* we're starting after the header so adjust the length */ @@ -172,9 +180,15 @@ static int tpm2_parse_read_public(char *name, struct tpm_buf *buf) return -EINVAL; offset += val; /* name */ + val = tpm_buf_read_u16(buf, &offset); - if (val != name_size(&buf->data[offset])) + ret = name_size(&buf->data[offset]); + if (ret < 0) + return ret; + + if (val != ret) return -EINVAL; + memcpy(name, &buf->data[offset], val); /* forget the rest */ return 0; @@ -221,46 +235,72 @@ static int tpm2_read_public(struct tpm_chip *chip, u32 handle, char *name) * As with most tpm_buf operations, success is assumed because failure * will be caused by an incorrect programming model and indicated by a * kernel message. + * + * Ends the authorization session on failure. */ -void tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, - u32 handle, u8 *name) +int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, + u32 handle, u8 *name) { #ifdef CONFIG_TCG_TPM2_HMAC enum tpm2_mso_type mso = tpm2_handle_mso(handle); struct tpm2_auth *auth; int slot; + int ret; #endif if (!tpm2_chip_auth(chip)) { tpm_buf_append_handle(chip, buf, handle); - return; + return 0; } #ifdef CONFIG_TCG_TPM2_HMAC slot = (tpm_buf_length(buf) - TPM_HEADER_SIZE) / 4; if (slot >= AUTH_MAX_NAMES) { - dev_err(&chip->dev, "TPM: too many handles\n"); - return; + dev_err(&chip->dev, "too many handles\n"); + ret = -EIO; + goto err; } auth = chip->auth; - WARN(auth->session != tpm_buf_length(buf), - "name added in wrong place\n"); + if (auth->session != tpm_buf_length(buf)) { + dev_err(&chip->dev, "session state malformed"); + ret = -EIO; + goto err; + } tpm_buf_append_u32(buf, handle); auth->session += 4; if (mso == TPM2_MSO_PERSISTENT || mso == TPM2_MSO_VOLATILE || mso == TPM2_MSO_NVRAM) { - if (!name) - tpm2_read_public(chip, handle, auth->name[slot]); + if (!name) { + ret = tpm2_read_public(chip, handle, auth->name[slot]); + if (ret) + goto err; + } } else { - if (name) - dev_err(&chip->dev, "TPM: Handle does not require name but one is specified\n"); + if (name) { + dev_err(&chip->dev, "handle 0x%08x does not use a name\n", + handle); + ret = -EIO; + goto err; + } } auth->name_h[slot] = handle; - if (name) - memcpy(auth->name[slot], name, name_size(name)); + if (name) { + ret = name_size(name); + if (ret < 0) + goto err; + + memcpy(auth->name[slot], name, ret); + } +#endif + return 0; + +#ifdef CONFIG_TCG_TPM2_HMAC +err: + tpm2_end_auth_session(chip); + return tpm_ret_to_err(ret); #endif } EXPORT_SYMBOL_GPL(tpm_buf_append_name); @@ -533,11 +573,9 @@ static void tpm_buf_append_salt(struct tpm_buf *buf, struct tpm_chip *chip, * encryption key and encrypts the first parameter of the command * buffer with it. * - * As with most tpm_buf operations, success is assumed because failure - * will be caused by an incorrect programming model and indicated by a - * kernel message. + * Ends the authorization session on failure. */ -void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) +int tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) { u32 cc, handles, val; struct tpm2_auth *auth = chip->auth; @@ -549,9 +587,12 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) u8 cphash[SHA256_DIGEST_SIZE]; struct sha256_ctx sctx; struct hmac_sha256_ctx hctx; + int ret; - if (!auth) - return; + if (!auth) { + ret = -EIO; + goto err; + } /* save the command code in BE format */ auth->ordinal = head->ordinal; @@ -560,9 +601,11 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) i = tpm2_find_cc(chip, cc); if (i < 0) { - dev_err(&chip->dev, "Command 0x%x not found in TPM\n", cc); - return; + dev_err(&chip->dev, "command 0x%08x not found\n", cc); + ret = -EIO; + goto err; } + attrs = chip->cc_attrs_tbl[i]; handles = (attrs >> TPM2_CC_ATTR_CHANDLES) & GENMASK(2, 0); @@ -576,9 +619,9 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) u32 handle = tpm_buf_read_u32(buf, &offset_s); if (auth->name_h[i] != handle) { - dev_err(&chip->dev, "TPM: handle %d wrong for name\n", - i); - return; + dev_err(&chip->dev, "invalid handle 0x%08x\n", handle); + ret = -EIO; + goto err; } } /* point offset_s to the start of the sessions */ @@ -609,12 +652,14 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) offset_s += len; } if (offset_s != offset_p) { - dev_err(&chip->dev, "TPM session length is incorrect\n"); - return; + dev_err(&chip->dev, "session length is incorrect\n"); + ret = -EIO; + goto err; } if (!hmac) { - dev_err(&chip->dev, "TPM could not find HMAC session\n"); - return; + dev_err(&chip->dev, "could not find HMAC session\n"); + ret = -EIO; + goto err; } /* encrypt before HMAC */ @@ -646,8 +691,11 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) if (mso == TPM2_MSO_PERSISTENT || mso == TPM2_MSO_VOLATILE || mso == TPM2_MSO_NVRAM) { - sha256_update(&sctx, auth->name[i], - name_size(auth->name[i])); + ret = name_size(auth->name[i]); + if (ret < 0) + goto err; + + sha256_update(&sctx, auth->name[i], ret); } else { __be32 h = cpu_to_be32(auth->name_h[i]); @@ -668,6 +716,11 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf) hmac_sha256_update(&hctx, auth->tpm_nonce, sizeof(auth->tpm_nonce)); hmac_sha256_update(&hctx, &auth->attrs, 1); hmac_sha256_final(&hctx, hmac); + return 0; + +err: + tpm2_end_auth_session(chip); + return ret; } EXPORT_SYMBOL(tpm_buf_fill_hmac_session); diff --git a/include/linux/tpm.h b/include/linux/tpm.h index 3d8f7d1ce2b8..aa816b144ab3 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -529,8 +529,8 @@ static inline struct tpm2_auth *tpm2_chip_auth(struct tpm_chip *chip) #endif } -void tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, - u32 handle, u8 *name); +int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, + u32 handle, u8 *name); void tpm_buf_append_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf, u8 attributes, u8 *passphrase, int passphraselen); @@ -563,7 +563,7 @@ static inline void tpm_buf_append_hmac_session_opt(struct tpm_chip *chip, #ifdef CONFIG_TCG_TPM2_HMAC int tpm2_start_auth_session(struct tpm_chip *chip); -void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf); +int tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf); int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf, int rc); void tpm2_end_auth_session(struct tpm_chip *chip); @@ -577,10 +577,13 @@ static inline int tpm2_start_auth_session(struct tpm_chip *chip) static inline void tpm2_end_auth_session(struct tpm_chip *chip) { } -static inline void tpm_buf_fill_hmac_session(struct tpm_chip *chip, - struct tpm_buf *buf) + +static inline int tpm_buf_fill_hmac_session(struct tpm_chip *chip, + struct tpm_buf *buf) { + return 0; } + static inline int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf, int rc) diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c index 8bc6efa8accb..5b205279584b 100644 --- a/security/keys/trusted-keys/trusted_tpm2.c +++ b/security/keys/trusted-keys/trusted_tpm2.c @@ -268,7 +268,10 @@ int tpm2_seal_trusted(struct tpm_chip *chip, goto out_put; } - tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + rc = tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + if (rc) + goto out; + tpm_buf_append_hmac_session(chip, &buf, TPM2_SA_DECRYPT, options->keyauth, TPM_DIGEST_SIZE); @@ -316,7 +319,10 @@ int tpm2_seal_trusted(struct tpm_chip *chip, goto out; } - tpm_buf_fill_hmac_session(chip, &buf); + rc = tpm_buf_fill_hmac_session(chip, &buf); + if (rc) + goto out; + rc = tpm_transmit_cmd(chip, &buf, 4, "sealing data"); rc = tpm_buf_check_hmac_response(chip, &buf, rc); if (rc) @@ -427,7 +433,10 @@ static int tpm2_load_cmd(struct tpm_chip *chip, return rc; } - tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + rc = tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + if (rc) + goto out; + tpm_buf_append_hmac_session(chip, &buf, 0, options->keyauth, TPM_DIGEST_SIZE); @@ -439,7 +448,10 @@ static int tpm2_load_cmd(struct tpm_chip *chip, goto out; } - tpm_buf_fill_hmac_session(chip, &buf); + rc = tpm_buf_fill_hmac_session(chip, &buf); + if (rc) + goto out; + rc = tpm_transmit_cmd(chip, &buf, 4, "loading blob"); rc = tpm_buf_check_hmac_response(chip, &buf, rc); if (!rc) @@ -484,7 +496,9 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, return rc; } - tpm_buf_append_name(chip, &buf, blob_handle, NULL); + rc = tpm_buf_append_name(chip, &buf, options->keyhandle, NULL); + if (rc) + goto out; if (!options->policyhandle) { tpm_buf_append_hmac_session(chip, &buf, TPM2_SA_ENCRYPT, @@ -509,7 +523,10 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, NULL, 0); } - tpm_buf_fill_hmac_session(chip, &buf); + rc = tpm_buf_fill_hmac_session(chip, &buf); + if (rc) + goto out; + rc = tpm_transmit_cmd(chip, &buf, 6, "unsealing"); rc = tpm_buf_check_hmac_response(chip, &buf, rc); -- 2.52.0

2 weeks, 1 day

2
2
0 0

[PATCH v1 0/2] mm: skip wait in wait_sb_inodes() for hangable-writeback mappings

by Joanne Koong

As reported by Athul upstream in [1], there is a userspace regression caused by commit 0c58a97f919c ("fuse: remove tmp folio for writebacks and internal rb tree") where if there is a bug in a fuse server that causes the server to never complete writeback, it will make wait_sb_inodes() wait forever, causing sync paths to hang. This is a resubmission of this patch [2] that was dropped from the original series due to a buggy/malicious server still being able to hold up sync() / the system in other ways if they wanted to, but the wait_sb_inodes() path is particularly common and easier to hit for malfunctioning servers. Thanks, Joanne [1] https://lore.kernel.org/regressions/CAJnrk1ZjQ8W8NzojsvJPRXiv9TuYPNdj8Ye7=C… [2] https://lore.kernel.org/linux-fsdevel/20241122232359.429647-4-joannelkoong@… Joanne Koong (2): mm: rename AS_WRITEBACK_MAY_DEADLOCK_ON_RECLAIM to AS_WRITEBACK_MAY_HANG fs/writeback: skip inodes with potential writeback hang in wait_sb_inodes() fs/fs-writeback.c | 3 +++ fs/fuse/file.c | 2 +- include/linux/pagemap.h | 10 +++++----- mm/vmscan.c | 3 +-- 4 files changed, 10 insertions(+), 8 deletions(-) -- 2.47.3

2 weeks, 1 day

4
16
0 0

Mini GPS Tracker with SOS & Voice Call

by GPS Tracker

2 weeks, 2 days

1
0
0 0

[PATCH 5.15.y] KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS

by Rajani Kantha

From: Sean Christopherson <seanjc(a)google.com> commit 4bcdd831d9d01e0fb64faea50732b59b2ee88da1 upstream. Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory. Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs(), which already holds SRCU. I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems. Acquiring SRCU isn't all that expensive, so for simplicity, grab it unconditionally for KVM_SET_VCPU_EVENTS. ============================= WARNING: suspicious RCU usage 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted ----------------------------- include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by repro/1071: #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm] stack backtrace: CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x13f/0x1a0 kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel] load_vmcs12_host_state+0x432/0xb40 [kvm_intel] vmx_leave_nested+0x30/0x40 [kvm_intel] kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] ? mark_held_locks+0x49/0x70 ? kvm_vcpu_ioctl+0x7d/0x970 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+0x497/0x970 [kvm] ? lock_acquire+0xba/0x2d0 ? find_held_lock+0x2b/0x80 ? do_user_addr_fault+0x40c/0x6f0 ? lock_release+0xb7/0x270 __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7ff11eb1b539 </TASK> Fixes: f7e570780efc ("KVM: x86: Forcibly leave nested virt when SMM state is toggled") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240723232055.3643811-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> [ Based on kernel 5.15 available functions, using srcu_read_lock/srcu_read_unlock instead of kvm_vcpu_srcu_read_lock/kvm_vcpu_srcu_read_unlock ] Signed-off-by: Rajani Kantha <681739313(a)139.com> --- arch/x86/kvm/x86.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 648f80f73e66..785cd9b4283a 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -5294,7 +5294,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, if (copy_from_user(&events, argp, sizeof(struct kvm_vcpu_events))) break; + vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu); r = kvm_vcpu_ioctl_x86_set_vcpu_events(vcpu, &events); + srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx); break; } case KVM_GET_DEBUGREGS: { -- 2.17.1

2 weeks, 2 days

2
1
0 0

+ mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Jiayuan Chen <jiayuan.chen(a)linux.dev> Subject: mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN Date: Fri, 28 Nov 2025 19:15:14 +0800 Syzkaller reported a memory out-of-bounds bug [1]. This patch fixes two issues: 1. In vrealloc, we were missing the KASAN_VMALLOC_VM_ALLOC flag when unpoisoning the extended region. This flag is required to correctly associate the allocation with KASAN's vmalloc tracking. Note: In contrast, vzalloc (via __vmalloc_node_range_noprof) explicitly sets KASAN_VMALLOC_VM_ALLOC and calls kasan_unpoison_vmalloc() with it. vrealloc must behave consistently �� especially when reusing existing vmalloc regions �� to ensure KASAN can track allocations correctly. 2. When vrealloc reuses an existing vmalloc region (without allocating new pages), KASAN previously generated a new tag, which broke tag-based memory access tracking. We now add a 'reuse_tag' parameter to __kasan_unpoison_vmalloc() to preserve the original tag in such cases. A new helper kasan_unpoison_vralloc() is introduced to handle this reuse scenario, ensuring consistent tag behavior during reallocation. Link: https://lkml.kernel.org/r/20251128111516.244497-1-jiayuan.chen@linux.dev Link: https://syzkaller.appspot.com/bug?extid=997752115a851cb0cf36 [1] Fixes: a0309faf1cb0 ("mm: vmalloc: support more granular vrealloc() sizing") Signed-off-by: Jiayuan Chen <jiayuan.chen(a)linux.dev> Reported-by: syzbot+997752115a851cb0cf36(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e243a2.050a0220.1696c6.007d.GAE@google.com/T/ Cc: Alexander Potapenko <glider(a)google.com> Cc: Andrey Konovalov <andreyknvl(a)gmail.com> Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> Cc: Danilo Krummrich <dakr(a)kernel.org> Cc: Dmitriy Vyukov <dvyukov(a)google.com> Cc: Kees Cook <kees(a)kernel.org> Cc: "Uladzislau Rezki (Sony)" <urezki(a)gmail.com> Cc: Vincenzo Frascino <vincenzo.frascino(a)arm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/kasan.h | 21 +++++++++++++++++++-- mm/kasan/hw_tags.c | 4 ++-- mm/kasan/shadow.c | 6 ++++-- mm/vmalloc.c | 4 ++-- 4 files changed, 27 insertions(+), 8 deletions(-) --- a/include/linux/kasan.h~mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan +++ a/include/linux/kasan.h @@ -596,13 +596,23 @@ static inline void kasan_release_vmalloc #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ void *__kasan_unpoison_vmalloc(const void *start, unsigned long size, - kasan_vmalloc_flags_t flags); + kasan_vmalloc_flags_t flags, bool reuse_tag); + +static __always_inline void *kasan_unpoison_vrealloc(const void *start, + unsigned long size, + kasan_vmalloc_flags_t flags) +{ + if (kasan_enabled()) + return __kasan_unpoison_vmalloc(start, size, flags, true); + return (void *)start; +} + static __always_inline void *kasan_unpoison_vmalloc(const void *start, unsigned long size, kasan_vmalloc_flags_t flags) { if (kasan_enabled()) - return __kasan_unpoison_vmalloc(start, size, flags); + return __kasan_unpoison_vmalloc(start, size, flags, false); return (void *)start; } @@ -629,6 +639,13 @@ static inline void kasan_release_vmalloc unsigned long free_region_end, unsigned long flags) { } +static inline void *kasan_unpoison_vrealloc(const void *start, + unsigned long size, + kasan_vmalloc_flags_t flags) +{ + return (void *)start; +} + static inline void *kasan_unpoison_vmalloc(const void *start, unsigned long size, kasan_vmalloc_flags_t flags) --- a/mm/kasan/hw_tags.c~mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan +++ a/mm/kasan/hw_tags.c @@ -317,7 +317,7 @@ static void init_vmalloc_pages(const voi } void *__kasan_unpoison_vmalloc(const void *start, unsigned long size, - kasan_vmalloc_flags_t flags) + kasan_vmalloc_flags_t flags, bool reuse_tag) { u8 tag; unsigned long redzone_start, redzone_size; @@ -361,7 +361,7 @@ void *__kasan_unpoison_vmalloc(const voi return (void *)start; } - tag = kasan_random_tag(); + tag = reuse_tag ? get_tag(start) : kasan_random_tag(); start = set_tag(start, tag); /* Unpoison and initialize memory up to size. */ --- a/mm/kasan/shadow.c~mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan +++ a/mm/kasan/shadow.c @@ -625,7 +625,7 @@ void kasan_release_vmalloc(unsigned long } void *__kasan_unpoison_vmalloc(const void *start, unsigned long size, - kasan_vmalloc_flags_t flags) + kasan_vmalloc_flags_t flags, bool reuse_tag) { /* * Software KASAN modes unpoison both VM_ALLOC and non-VM_ALLOC @@ -648,7 +648,9 @@ void *__kasan_unpoison_vmalloc(const voi !(flags & KASAN_VMALLOC_PROT_NORMAL)) return (void *)start; - start = set_tag(start, kasan_random_tag()); + if (!reuse_tag) + start = set_tag(start, kasan_random_tag()); + kasan_unpoison(start, size, false); return (void *)start; } --- a/mm/vmalloc.c~mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan +++ a/mm/vmalloc.c @@ -4175,8 +4175,8 @@ void *vrealloc_node_align_noprof(const v * We already have the bytes available in the allocation; use them. */ if (size <= alloced_size) { - kasan_unpoison_vmalloc(p + old_size, size - old_size, - KASAN_VMALLOC_PROT_NORMAL); + kasan_unpoison_vrealloc(p, size, + KASAN_VMALLOC_PROT_NORMAL | KASAN_VMALLOC_VM_ALLOC); /* * No need to zero memory here, as unused memory will have * already been zeroed at initial allocation time or during _ Patches currently in -mm which might be from jiayuan.chen(a)linux.dev are mm-kasan-fix-incorrect-unpoisoning-in-vrealloc-for-kasan.patch mm-vmscan-skip-increasing-kswapd_failures-when-reclaim-was-boosted.patch

2 weeks, 2 days

3
3
0 0

[PATCH] usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()

by Haoxiang Li

usbhsp_get_pipe() set pipe's flags to IS_USED. In error paths, usbhsp_put_pipe() is required to clear pipe's flags to prevent pipe exhaustion. Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> --- drivers/usb/renesas_usbhs/pipe.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/renesas_usbhs/pipe.c b/drivers/usb/renesas_usbhs/pipe.c index 75fff2e4cbc6..56fc3ff5016f 100644 --- a/drivers/usb/renesas_usbhs/pipe.c +++ b/drivers/usb/renesas_usbhs/pipe.c @@ -713,11 +713,13 @@ struct usbhs_pipe *usbhs_pipe_malloc(struct usbhs_priv *priv, /* make sure pipe is not busy */ ret = usbhsp_pipe_barrier(pipe); if (ret < 0) { + usbhsp_put_pipe(pipe); dev_err(dev, "pipe setup failed %d\n", usbhs_pipe_number(pipe)); return NULL; } if (usbhsp_setup_pipecfg(pipe, is_host, dir_in, &pipecfg)) { + usbhsp_put_pipe(pipe); dev_err(dev, "can't setup pipe\n"); return NULL; } -- 2.25.1

2 weeks, 2 days

1
0
0 0

[PATCH 0/2] PCI: dwc: Fix missing iATU setup when ECAM is enabled

by Krishna Chaitanya Chundru

When ECAM is enabled, the driver skipped calling dw_pcie_iatu_setup() before configuring ECAM iATU entries. This left IO and MEM outbound windows unprogrammed, resulting in broken IO transactions. Additionally, dw_pcie_config_ecam_iatu() was only called during host initialization, so ECAM-related iATU entries were not restored after suspend/resume, leading to failures in configuration space access. To resolve these issues, the ECAM iATU configuration is moved into dw_pcie_setup_rc(). At the same time, dw_pcie_iatu_setup() is invoked when ECAM is enabled. Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru(a)oss.qualcomm.com> --- Krishna Chaitanya Chundru (2): PCI: dwc: Correct iATU index increment for MSG TLP region PCI: dwc: Fix missing iATU setup when ECAM is enabled drivers/pci/controller/dwc/pcie-designware-host.c | 37 ++++++++++++++--------- drivers/pci/controller/dwc/pcie-designware.c | 3 ++ drivers/pci/controller/dwc/pcie-designware.h | 2 +- 3 files changed, 26 insertions(+), 16 deletions(-) --- base-commit: 3f9f0252130e7dd60d41be0802bf58f6471c691d change-id: 20251203-ecam_io_fix-6e060fecd3b8 Best regards, -- Krishna Chaitanya Chundru <krishna.chundru(a)oss.qualcomm.com>

2 weeks, 2 days

3
3
0 0

[PATCH] drm/i915/dmc: fix an unlikely NULL pointer deference at probe

by Jani Nikula

intel_dmc_update_dc6_allowed_count() oopses when DMC hasn't been initialized, and dmc is thus NULL. That would be the case when the call path is intel_power_domains_init_hw() -> {skl,bxt,icl}_display_core_init() -> gen9_set_dc_state() -> intel_dmc_update_dc6_allowed_count(), as intel_power_domains_init_hw() is called *before* intel_dmc_init(). However, gen9_set_dc_state() calls intel_dmc_update_dc6_allowed_count() conditionally, depending on the current and target DC states. At probe, the target is disabled, but if DC6 is enabled, the function is called, and an oops follows. Apparently it's quite unlikely that DC6 is enabled at probe, as we haven't seen this failure mode before. Add NULL checks and switch the dmc->display references to just display. Fixes: 88c1f9a4d36d ("drm/i915/dmc: Create debugfs entry for dc6 counter") Cc: Mohammed Thasleem <mohammed.thasleem(a)intel.com> Cc: Imre Deak <imre.deak(a)intel.com> Cc: <stable(a)vger.kernel.org> # v6.16+ Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> --- Rare case, but this may also throw off the rc6 counting in debugfs when it does happen. --- drivers/gpu/drm/i915/display/intel_dmc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/display/intel_dmc.c b/drivers/gpu/drm/i915/display/intel_dmc.c index 2fb6fec6dc99..169bbbc91f6d 100644 --- a/drivers/gpu/drm/i915/display/intel_dmc.c +++ b/drivers/gpu/drm/i915/display/intel_dmc.c @@ -1570,10 +1570,10 @@ void intel_dmc_update_dc6_allowed_count(struct intel_display *display, struct intel_dmc *dmc = display_to_dmc(display); u32 dc5_cur_count; - if (DISPLAY_VER(dmc->display) < 14) + if (!dmc || DISPLAY_VER(display) < 14) return; - dc5_cur_count = intel_de_read(dmc->display, DG1_DMC_DEBUG_DC5_COUNT); + dc5_cur_count = intel_de_read(display, DG1_DMC_DEBUG_DC5_COUNT); if (!start_tracking) dmc->dc6_allowed.count += dc5_cur_count - dmc->dc6_allowed.dc5_start; @@ -1587,7 +1587,7 @@ static bool intel_dmc_get_dc6_allowed_count(struct intel_display *display, u32 * struct intel_dmc *dmc = display_to_dmc(display); bool dc6_enabled; - if (DISPLAY_VER(display) < 14) + if (!dmc || DISPLAY_VER(display) < 14) return false; mutex_lock(&power_domains->lock); -- 2.47.3

2 weeks, 2 days

2
6
0 0

[PATCH 5.10.y] HID: core: Harden s32ton() against conversion to 0 bits

by jetlan9＠163.com

From: Alan Stern <stern(a)rowland.harvard.edu> [ Upstream commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd ] Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does. Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-by: syzbot+b63d677d63bcac06cf90(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/68753a08.050a0220.33d347.0008.GAE@google.… Tested-by: syzbot+b63d677d63bcac06cf90(a)syzkaller.appspotmail.com Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/613a66cd-4309-4bce-a4f7-2905f9bce0c9@rowland.harva… Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> [ s32ton() was moved by c653ffc28340 ("HID: stop exporting hid_snto32()"). Minor context change fixed. ] Signed-off-by: Wenshan Lan <jetlan9(a)163.com> --- drivers/hid/hid-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 89aa7a0e51de..e789452181fe 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1349,7 +1349,12 @@ EXPORT_SYMBOL_GPL(hid_snto32); static u32 s32ton(__s32 value, unsigned n) { - s32 a = value >> (n - 1); + s32 a; + + if (!value || !n) + return 0; + + a = value >> (n - 1); if (a && a != -1) return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1; return value & ((1 << n) - 1); -- 2.43.0

2 weeks, 2 days

1
0
0 0

[PATCH 5.15.y] HID: core: Harden s32ton() against conversion to 0 bits

by jetlan9＠163.com

From: Alan Stern <stern(a)rowland.harvard.edu> [ Upstream commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd ] Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does. Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-by: syzbot+b63d677d63bcac06cf90(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/68753a08.050a0220.33d347.0008.GAE@google.… Tested-by: syzbot+b63d677d63bcac06cf90(a)syzkaller.appspotmail.com Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/613a66cd-4309-4bce-a4f7-2905f9bce0c9@rowland.harva… Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> [ s32ton() was moved by c653ffc28340 ("HID: stop exporting hid_snto32()"). Minor context change fixed. ] Signed-off-by: Wenshan Lan <jetlan9(a)163.com> --- drivers/hid/hid-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index a6c2c55daebb..d49a8c458206 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1349,7 +1349,12 @@ EXPORT_SYMBOL_GPL(hid_snto32); static u32 s32ton(__s32 value, unsigned n) { - s32 a = value >> (n - 1); + s32 a; + + if (!value || !n) + return 0; + + a = value >> (n - 1); if (a && a != -1) return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1; return value & ((1 << n) - 1); -- 2.43.0

2 weeks, 2 days

1
0
0 0

[PATCH v3 1/2] hfs: ensure sb->s_fs_info is always cleaned up

by Mehdi Ben Hadj Khelifa

When hfs was converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info. If setup_bdev_super() fails after a new superblock has been allocated by sget_fc(), but before hfs_fill_super() takes ownership of the filesystem-specific s_fs_info data it was leaked. Fix this by freeing sb->s_fs_info in hfs_kill_super(). Cc: stable(a)vger.kernel.org Fixes: ffcd06b6d13b ("hfs: convert hfs to use the new mount api") Reported-by: syzbot+ad45f827c88778ff7df6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6 Tested-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Mehdi Ben Hadj Khelifa <mehdi.benhadjkhelifa(a)gmail.com> --- fs/hfs/mdb.c | 35 ++++++++++++++--------------------- fs/hfs/super.c | 10 +++++++++- 2 files changed, 23 insertions(+), 22 deletions(-) diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c index 53f3fae60217..f28cd24dee84 100644 --- a/fs/hfs/mdb.c +++ b/fs/hfs/mdb.c @@ -92,7 +92,7 @@ int hfs_mdb_get(struct super_block *sb) /* See if this is an HFS filesystem */ bh = sb_bread512(sb, part_start + HFS_MDB_BLK, mdb); if (!bh) - goto out; + return -EIO; if (mdb->drSigWord == cpu_to_be16(HFS_SUPER_MAGIC)) break; @@ -102,13 +102,14 @@ int hfs_mdb_get(struct super_block *sb) * (should do this only for cdrom/loop though) */ if (hfs_part_find(sb, &part_start, &part_size)) - goto out; + return -EIO; } HFS_SB(sb)->alloc_blksz = size = be32_to_cpu(mdb->drAlBlkSiz); if (!size || (size & (HFS_SECTOR_SIZE - 1))) { pr_err("bad allocation block size %d\n", size); - goto out_bh; + brelse(bh); + return -EIO; } size = min(HFS_SB(sb)->alloc_blksz, (u32)PAGE_SIZE); @@ -125,14 +126,16 @@ int hfs_mdb_get(struct super_block *sb) brelse(bh); if (!sb_set_blocksize(sb, size)) { pr_err("unable to set blocksize to %u\n", size); - goto out; + return -EIO; } bh = sb_bread512(sb, part_start + HFS_MDB_BLK, mdb); if (!bh) - goto out; - if (mdb->drSigWord != cpu_to_be16(HFS_SUPER_MAGIC)) - goto out_bh; + return -EIO; + if (mdb->drSigWord != cpu_to_be16(HFS_SUPER_MAGIC)) { + brelse(bh); + return -EIO; + } HFS_SB(sb)->mdb_bh = bh; HFS_SB(sb)->mdb = mdb; @@ -174,7 +177,7 @@ int hfs_mdb_get(struct super_block *sb) HFS_SB(sb)->bitmap = kzalloc(8192, GFP_KERNEL); if (!HFS_SB(sb)->bitmap) - goto out; + return -EIO; /* read in the bitmap */ block = be16_to_cpu(mdb->drVBMSt) + part_start; @@ -185,7 +188,7 @@ int hfs_mdb_get(struct super_block *sb) bh = sb_bread(sb, off >> sb->s_blocksize_bits); if (!bh) { pr_err("unable to read volume bitmap\n"); - goto out; + return -EIO; } off2 = off & (sb->s_blocksize - 1); len = min((int)sb->s_blocksize - off2, size); @@ -199,12 +202,12 @@ int hfs_mdb_get(struct super_block *sb) HFS_SB(sb)->ext_tree = hfs_btree_open(sb, HFS_EXT_CNID, hfs_ext_keycmp); if (!HFS_SB(sb)->ext_tree) { pr_err("unable to open extent tree\n"); - goto out; + return -EIO; } HFS_SB(sb)->cat_tree = hfs_btree_open(sb, HFS_CAT_CNID, hfs_cat_keycmp); if (!HFS_SB(sb)->cat_tree) { pr_err("unable to open catalog tree\n"); - goto out; + return -EIO; } attrib = mdb->drAtrb; @@ -229,12 +232,6 @@ int hfs_mdb_get(struct super_block *sb) } return 0; - -out_bh: - brelse(bh); -out: - hfs_mdb_put(sb); - return -EIO; } /* @@ -359,8 +356,6 @@ void hfs_mdb_close(struct super_block *sb) * Release the resources associated with the in-core MDB. */ void hfs_mdb_put(struct super_block *sb) { - if (!HFS_SB(sb)) - return; /* free the B-trees */ hfs_btree_close(HFS_SB(sb)->ext_tree); hfs_btree_close(HFS_SB(sb)->cat_tree); @@ -373,6 +368,4 @@ void hfs_mdb_put(struct super_block *sb) unload_nls(HFS_SB(sb)->nls_disk); kfree(HFS_SB(sb)->bitmap); - kfree(HFS_SB(sb)); - sb->s_fs_info = NULL; } diff --git a/fs/hfs/super.c b/fs/hfs/super.c index 47f50fa555a4..df289cbdd4e8 100644 --- a/fs/hfs/super.c +++ b/fs/hfs/super.c @@ -431,10 +431,18 @@ static int hfs_init_fs_context(struct fs_context *fc) return 0; } +static void hfs_kill_super(struct super_block *sb) +{ + struct hfs_sb_info *hsb = HFS_SB(sb); + + kill_block_super(sb); + kfree(hsb); +} + static struct file_system_type hfs_fs_type = { .owner = THIS_MODULE, .name = "hfs", - .kill_sb = kill_block_super, + .kill_sb = hfs_kill_super, .fs_flags = FS_REQUIRES_DEV, .init_fs_context = hfs_init_fs_context, }; -- 2.52.0

2 weeks, 2 days

2
4
0 0

Loan and Investment offer/ Account Reprofilling

by Gerald Johnson

2 weeks, 2 days

1
0
0 0

[PATCH] soc: mediatek: SVS: Fix a reference leak bug in svs_add_device_link()

by Haoxiang Li

svs_get_subsys_device() increases the reference count of the returned device, if error happens, put_device() is required to drop the device reference. Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> --- drivers/soc/mediatek/mtk-svs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c index f45537546553..c8f15bb139c6 100644 --- a/drivers/soc/mediatek/mtk-svs.c +++ b/drivers/soc/mediatek/mtk-svs.c @@ -2155,12 +2155,15 @@ static struct device *svs_add_device_link(struct svs_platform *svsp, sup_link = device_link_add(svsp->dev, dev, DL_FLAG_AUTOREMOVE_CONSUMER); if (!sup_link) { + put_device(dev); dev_err(svsp->dev, "sup_link is NULL\n"); return ERR_PTR(-EINVAL); } - if (sup_link->supplier->links.status != DL_DEV_DRIVER_BOUND) + if (sup_link->supplier->links.status != DL_DEV_DRIVER_BOUND) { + put_device(dev); return ERR_PTR(-EPROBE_DEFER); + } return dev; } -- 2.25.1

2 weeks, 2 days

1
0
0 0

[PATCH v2] drm/xe/exec: Validate num_syncs to prevent oversized allocations

by Shuicheng Lin

The exec ioctl allows userspace to specify an arbitrary num_syncs value. Without bounds checking, a very large num_syncs can force an excessively large allocation, leading to kernel warnings from the page allocator as below. Introduce XE_EXEC_MAX_SYNCS (set to 64) and reject any request exceeding this limit. " ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124 ... Call Trace: <TASK> alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416 ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317 __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348 __do_kmalloc_node mm/slub.c:4364 [inline] __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388 kmalloc_noprof include/linux/slab.h:909 [inline] kmalloc_array_noprof include/linux/slab.h:948 [inline] xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158 drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797 drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894 xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... " v2: Add "Reported-by" and Cc stable kernels. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6450 Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reported-by: Koen Koning <koen.koning(a)intel.com> Reported-by: Peter Senna Tschudin <peter.senna(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> Cc: Matthew Brost <matthew.brost(a)intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin(a)intel.com> --- drivers/gpu/drm/xe/xe_exec.c | 5 +++++ include/uapi/drm/xe_drm.h | 1 + 2 files changed, 6 insertions(+) diff --git a/drivers/gpu/drm/xe/xe_exec.c b/drivers/gpu/drm/xe/xe_exec.c index 4d81210e41f5..01c56fd95d5b 100644 --- a/drivers/gpu/drm/xe/xe_exec.c +++ b/drivers/gpu/drm/xe/xe_exec.c @@ -162,6 +162,11 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file) } if (args->num_syncs) { + if (XE_IOCTL_DBG(xe, args->num_syncs > XE_EXEC_MAX_SYNCS)) { + err = -EINVAL; + goto err_exec_queue; + } + syncs = kcalloc(args->num_syncs, sizeof(*syncs), GFP_KERNEL); if (!syncs) { err = -ENOMEM; diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h index 47853659a705..1901ca26621a 100644 --- a/include/uapi/drm/xe_drm.h +++ b/include/uapi/drm/xe_drm.h @@ -1463,6 +1463,7 @@ struct drm_xe_exec { /** @exec_queue_id: Exec queue ID for the batch buffer */ __u32 exec_queue_id; +#define XE_EXEC_MAX_SYNCS 64 /** @num_syncs: Amount of struct drm_xe_sync in array. */ __u32 num_syncs; -- 2.49.0

2 weeks, 2 days

3
2
0 0

[PATCH] powerpc: cell: Fix a reference leak bug in create_spu()

by Haoxiang Li

spu_create_dev() calls device_register(), if it fails, put_device() is required to drop the device reference. Fixes: 8a25a2fd126c ("cpu: convert 'cpu' and 'machinecheck' sysdev_class to a regular subsystem") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> --- arch/powerpc/platforms/cell/spu_base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c index 2c07387201d0..18145142d3ac 100644 --- a/arch/powerpc/platforms/cell/spu_base.c +++ b/arch/powerpc/platforms/cell/spu_base.c @@ -581,8 +581,10 @@ static int __init create_spu(void *data) goto out_destroy; ret = spu_create_dev(spu); - if (ret) + if (ret) { + put_device(&spu->dev); goto out_free_irqs; + } mutex_lock(&cbe_spu_info[spu->node].list_mutex); list_add(&spu->cbe_list, &cbe_spu_info[spu->node].spus); -- 2.25.1

2 weeks, 2 days

1
0
0 0

[PATCH net v3] net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()

by Shaurya Rane

prp_get_untagged_frame() calls __pskb_copy() to create frame->skb_std but doesn't check if the allocation failed. If __pskb_copy() returns NULL, skb_clone() is called with a NULL pointer, causing a crash: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] CPU: 0 UID: 0 PID: 5625 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041 Code: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 23 29 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 <43> 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c RSP: 0018:ffffc9000d00f200 EFLAGS: 00010207 RAX: ffffffff892235a1 RBX: 0000000000000000 RCX: ffff88803372a480 RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000 RBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee R10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000 R13: 0000000000000820 R14: 000000000000000f R15: ffff88805144cc00 FS: 0000555557f6d500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555581d35808 CR3: 000000005040e000 CR4: 0000000000352ef0 Call Trace: <TASK> hsr_forward_do net/hsr/hsr_forward.c:-1 [inline] hsr_forward_skb+0x1013/0x2860 net/hsr/hsr_forward.c:741 hsr_handle_frame+0x6ce/0xa70 net/hsr/hsr_slave.c:84 __netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966 __netif_receive_skb_one_core net/core/dev.c:6077 [inline] __netif_receive_skb+0x72/0x380 net/core/dev.c:6192 netif_receive_skb_internal net/core/dev.c:6278 [inline] netif_receive_skb+0x1cb/0x790 net/core/dev.c:6337 tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485 tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0449f8e1ff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 RSP: 002b:00007ffd7ad94c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f044a1e5fa0 RCX: 00007f0449f8e1ff RDX: 000000000000003e RSI: 0000200000000500 RDI: 00000000000000c8 RBP: 00007ffd7ad94d20 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000003e R11: 0000000000000293 R12: 0000000000000001 R13: 00007f044a1e5fa0 R14: 00007f044a1e5fa0 R15: 0000000000000003 </TASK> Add a NULL check immediately after __pskb_copy() to handle allocation failures gracefully. Reported-by: syzbot+2fa344348a579b779e05(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2fa344348a579b779e05 Fixes: f266a683a480 ("net/hsr: Better frame dispatch") Cc: stable(a)vger.kernel.org Signed-off-by: Shaurya Rane <ssrane_b23(a)ee.vjti.ac.in> --- v3: - Keep only prp_get_untagged_frame() fix as the other two NETIF_F_HW_HSR_TAG_INS checks are not needed for this bug - Move NULL check immediately after __pskb_copy() call v2: - Add stack trace to commit message - Target net tree with [PATCH net] - Add Cc: stable(a)vger.kernel.org --- net/hsr/hsr_forward.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c index 339f0d220212..aefc9b6936ba 100644 --- a/net/hsr/hsr_forward.c +++ b/net/hsr/hsr_forward.c @@ -205,6 +205,8 @@ struct sk_buff *prp_get_untagged_frame(struct hsr_frame_info *frame, __pskb_copy(frame->skb_prp, skb_headroom(frame->skb_prp), GFP_ATOMIC); + if (!frame->skb_std) + return NULL; } else { /* Unexpected */ WARN_ONCE(1, "%s:%d: Unexpected frame received (port_src %s)\n", -- 2.34.1

2 weeks, 2 days

4
3
0 0

kernel crash when use zstd compress 256gb qemu raw image file

by 罗勇刚(Yonggang Luo)

Dec 04 03:29:28 32core systemd-modules-load[916]: Failed to find module 'vendor-reset' Dec 04 03:29:28 32core systemd-udevd[938]: Using default interface naming scheme 'v257'. Dec 04 03:29:28 32core lvm[908]: 5 logical volume(s) in volume group "pve" monitored Dec 04 03:29:28 32core systemd-modules-load[916]: Inserted module 'vhost_net' Dec 04 03:29:28 32core systemd[1]: Starting systemd-journal-flush.service - Flush Journal to Persistent Storage... Dec 04 03:29:28 32core kernel: input: Generic USB Audio Consumer Control as /devices/pci0000:40/0000:40:01.1/0000:41:00.0/0000:42:08.0/0000:48:00.3/usb9/9-5/9-5:1.7/0003:26CE:0A01.0006/input/input10 Dec 04 03:29:28 32core kernel: input: Generic USB Audio as /devices/pci0000:40/0000:40:01.1/0000:41:00.0/0000:42:08.0/0000:48:00.3/usb9/9-5/9-5:1.7/0003:26CE:0A01.0006/input/input11 Dec 04 03:29:28 32core kernel: hid-generic 0003:26CE:0A01.0006: input,hiddev2,hidraw5: USB HID v1.11 Device [Generic USB Audio] on usb-0000:48:00.3-5/input7 Dec 04 03:29:28 32core (udev-worker)[954]: lo: Invalid network interface name, ignoring: Dec 04 03:29:28 32core systemd[1]: Found device dev-pve-swap.device - /dev/pve/swap. Dec 04 03:29:28 32core lvm[1079]: PV /dev/nvme2n1p3 online, VG pve is complete. Dec 04 03:29:28 32core lvm[1079]: VG pve finished Dec 04 03:29:29 32core kernel: mc: Linux media interface: v0.10 Dec 04 03:29:29 32core kernel: input: PC Speaker as /devices/platform/pcspkr/input/input12 Dec 04 03:29:29 32core kernel: RAPL PMU: API unit is 2^-32 Joules, 2 fixed counters, 163840 ms ovfl timer Dec 04 03:29:29 32core kernel: RAPL PMU: hw unit of domain package 2^-16 Joules Dec 04 03:29:29 32core kernel: RAPL PMU: hw unit of domain core 2^-16 Joules Dec 04 03:29:29 32core kernel: ee1004 1-0051: 512 byte EE1004-compliant SPD EEPROM, read-only Dec 04 03:29:29 32core kernel: ccp 0000:22:00.1: enabling device (0000 -> 0002) Dec 04 03:29:29 32core kernel: ccp 0000:22:00.1: ccp enabled Dec 04 03:29:29 32core kernel: ccp 0000:22:00.1: psp enabled Dec 04 03:29:29 32core kernel: ee1004 1-0053: 512 byte EE1004-compliant SPD EEPROM, read-only Dec 04 03:29:29 32core kernel: ee1004 1-0055: 512 byte EE1004-compliant SPD EEPROM, read-only Dec 04 03:29:29 32core kernel: ee1004 1-0057: 512 byte EE1004-compliant SPD EEPROM, read-only Dec 04 03:29:29 32core kernel: ee1004 3-0057: Failed to select page 0 (-6) Dec 04 03:29:29 32core kernel: ee1004 3-0057: 512 byte EE1004-compliant SPD EEPROM, read-only Dec 04 03:29:29 32core systemd[1]: Activating swap dev-pve-swap.swap - /dev/pve/swap... Dec 04 03:29:29 32core systemd[1]: Finished systemd-udev-trigger.service - Coldplug All udev Devices. Dec 04 03:29:29 32core systemd-journald[915]: Time spent on flushing to /var/log/journal/9b05606f693a449bb4ef49b502ff7c47 is 14.486ms for 1566 entries. Dec 04 03:29:29 32core systemd-journald[915]: System Journal (/var/log/journal/9b05606f693a449bb4ef49b502ff7c47) is 3.1G, max 4G, 907.3M free. Dec 04 03:29:29 32core systemd-journald[915]: Received client request to flush runtime journal. Dec 04 03:29:29 32core systemd-journald[915]: File /var/log/journal/9b05606f693a449bb4ef49b502ff7c47/system.journal corrupted or uncleanly shut down, renaming and replacing. Dec 04 03:29:29 32core kernel: Adding 8388604k swap on /dev/mapper/pve-swap. Priority:-2 extents:1 across:8388604k SS Dec 04 03:29:29 32core systemd[1]: Activated swap dev-pve-swap.swap - /dev/pve/swap. Dec 04 03:29:29 32core systemd[1]: Found device dev-disk-by\x2duuid-9EA6\x2dDCA3.device - THNSN51T02DU7 TOSHIBA 2. Dec 04 03:29:29 32core systemd[1]: Found device dev-disk-by\x2duuid-c1ab544a\x2d4190\x2d426a\x2d8cdd\x2d8d6af66f97fa.device - Asgard AN2TNVMe M.2/80 1. Dec 04 03:29:29 32core systemd[1]: Reached target swap.target - Swaps. Dec 04 03:29:29 32core systemd-fsck[1210]: fsck.fat 4.2 (2021-01-31) Dec 04 03:29:29 32core systemd-fsck[1210]: There are differences between boot sector and its backup. Dec 04 03:29:29 32core systemd-fsck[1210]: This is mostly harmless. Differences: (offset:original/backup) Dec 04 03:29:29 32core systemd-fsck[1210]: 65:01/00 Dec 04 03:29:29 32core systemd-fsck[1210]: Not automatically fixing this. Dec 04 03:29:29 32core systemd-fsck[1210]: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt. Dec 04 03:29:29 32core systemd-fsck[1210]: Automatically removing dirty bit. Dec 04 03:29:29 32core systemd-fsck[1210]: *** Filesystem was changed *** Dec 04 03:29:29 32core systemd-fsck[1210]: Writing changes. Dec 04 03:29:29 32core systemd-fsck[1210]: /dev/nvme2n1p2: 5 files, 88/130812 clusters Dec 04 03:29:29 32core systemd[1]: Reached target tpm2.target - Trusted Platform Module. Dec 04 03:29:29 32core systemd[1]: Listening on systemd-rfkill.socket - Load/Save RF Kill Switch Status /dev/rfkill Watch. Dec 04 03:29:29 32core systemd[1]: Starting ifupdown2-pre.service - Helper to synchronize boot up for ifupdown... Dec 04 03:29:29 32core systemd[1]: Starting systemd-fsck(a)dev-disk-by\x2duuid-9EA6\x2dDCA3.service - File System Check on /dev/disk/by-uuid/9EA6-DCA3... Dec 04 03:29:29 32core systemd[1]: Starting systemd-udev-settle.service - Wait for udev To Complete Device Initialization... Dec 04 03:29:29 32core udevadm[1208]: systemd-udev-settle.service is deprecated. Please fix zfs-import-scan.service, zfs-import-cache.service not to pull it in. Dec 04 03:29:29 32core systemd[1]: Finished systemd-fsck(a)dev-disk-by\x2duuid-9EA6\x2dDCA3.service - File System Check on /dev/disk/by-uuid/9EA6-DCA3. Dec 04 03:29:29 32core systemd[1]: Finished systemd-journal-flush.service - Flush Journal to Persistent Storage. Dec 04 03:29:29 32core kernel: kvm_amd: TSC scaling supported Dec 04 03:29:29 32core kernel: kvm_amd: Nested Virtualization enabled Dec 04 03:29:29 32core kernel: kvm_amd: Nested Paging enabled Dec 04 03:29:29 32core kernel: kvm_amd: LBR virtualization supported Dec 04 03:29:29 32core kernel: kvm_amd: SEV disabled (ASIDs 1 - 509) Dec 04 03:29:29 32core kernel: kvm_amd: SEV-ES disabled (ASIDs 0 - 0) Dec 04 03:29:29 32core kernel: kvm_amd: Virtual VMLOAD VMSAVE supported Dec 04 03:29:29 32core kernel: kvm_amd: Virtual GIF supported Dec 04 03:29:29 32core kernel: snd_hda_intel 0000:01:00.1: Force to non-snoop mode Dec 04 03:29:29 32core kernel: snd_hda_intel 0000:22:00.4: enabling device (0000 -> 0002) Dec 04 03:29:29 32core kernel: snd_hda_intel 0000:22:00.4: no codecs found! Dec 04 03:29:29 32core kernel: ZFS: Loaded module v2.3.4-pve1, ZFS pool version 5000, ZFS filesystem version 5 Dec 04 03:29:29 32core systemd-modules-load[916]: Inserted module 'zfs' Dec 04 03:29:29 32core systemd[1]: Finished systemd-modules-load.service - Load Kernel Modules. Dec 04 03:29:29 32core kernel: [drm] radeon kernel modesetting enabled. Dec 04 03:29:29 32core systemd[1]: Starting systemd-sysctl.service - Apply Kernel Variables... Dec 04 03:29:29 32core kernel: MCE: In-kernel MCE decoding enabled. Dec 04 03:29:29 32core systemd[1]: Reached target sound.target - Sound Card. Dec 04 03:29:29 32core kernel: input: HDA ATI HDMI HDMI/DP,pcm=3 as /devices/pci0000:00/0000:00:01.1/0000:01:00.1/sound/card1/input13 Dec 04 03:29:29 32core kernel: Console: switching to colour dummy device 80x25 Dec 04 03:29:29 32core systemd[1]: Finished systemd-sysctl.service - Apply Kernel Variables. Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: vgaarb: deactivate vga console Dec 04 03:29:29 32core kernel: [drm] initializing kernel modesetting (OLAND 0x1002:0x6613 0x1002:0x2B0A 0x81). Dec 04 03:29:29 32core kernel: ATOM BIOS: C57701 Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: VRAM: 1024M 0x0000000000000000 - 0x000000003FFFFFFF (1024M used) Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: GTT: 2048M 0x0000000040000000 - 0x00000000BFFFFFFF Dec 04 03:29:29 32core kernel: [drm] Detected VRAM RAM=1024M, BAR=256M Dec 04 03:29:29 32core kernel: [drm] RAM width 128bits DDR Dec 04 03:29:29 32core kernel: [drm] radeon: 1024M of VRAM memory ready Dec 04 03:29:29 32core kernel: [drm] radeon: 2048M of GTT memory ready. Dec 04 03:29:29 32core kernel: [drm] Loading oland Microcode Dec 04 03:29:29 32core kernel: [drm] Internal thermal controller with fan control Dec 04 03:29:29 32core kernel: [drm] radeon: dpm initialized Dec 04 03:29:29 32core kernel: [drm] GART: num cpu pages 524288, num gpu pages 524288 Dec 04 03:29:29 32core kernel: intel_rapl_common: Found RAPL domain package Dec 04 03:29:29 32core kernel: intel_rapl_common: Found RAPL domain core Dec 04 03:29:29 32core kernel: amd_atl: AMD Address Translation Library initialized Dec 04 03:29:29 32core kernel: [drm] PCIE GART of 2048M enabled (table at 0x0000000000165000). Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: WB enabled Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: fence driver on ring 0 uses gpu addr 0x0000000040000c00 Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: fence driver on ring 1 uses gpu addr 0x0000000040000c04 Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: fence driver on ring 2 uses gpu addr 0x0000000040000c08 Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: fence driver on ring 3 uses gpu addr 0x0000000040000c0c Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: fence driver on ring 4 uses gpu addr 0x0000000040000c10 Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: fence driver on ring 5 uses gpu addr 0x0000000000075a18 Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: radeon: MSI limited to 32-bit Dec 04 03:29:29 32core kernel: radeon 0000:01:00.0: radeon: using MSI. Dec 04 03:29:29 32core kernel: [drm] radeon: irq initialized. Dec 04 03:29:29 32core systemd[1]: Mounting boot-efi.mount - /boot/efi... Dec 04 03:29:29 32core systemd[1]: Mounting mnt-pve-asgard\x2d2tb.mount - Mount storage 'asgard-2tb' under /mnt/pve... Dec 04 03:29:29 32core systemd[1]: tmp.mount: Directory /tmp to mount over is not empty, mounting anyway. Dec 04 03:29:29 32core systemd[1]: Mounting tmp.mount - Temporary Directory /tmp... Dec 04 03:29:29 32core kernel: [drm] ring test on 0 succeeded in 1 usecs Dec 04 03:29:29 32core kernel: [drm] ring test on 1 succeeded in 1 usecs Dec 04 03:29:29 32core kernel: [drm] ring test on 2 succeeded in 1 usecs Dec 04 03:29:29 32core kernel: [drm] ring test on 3 succeeded in 3 usecs Dec 04 03:29:29 32core kernel: [drm] ring test on 4 succeeded in 3 usecs Dec 04 03:29:30 32core kernel: [drm] ring test on 5 succeeded in 1 usecs Dec 04 03:29:30 32core kernel: [drm] UVD initialized successfully. Dec 04 03:29:30 32core kernel: snd_hda_intel 0000:01:00.1: bound 0000:01:00.0 (ops radeon_audio_component_bind_ops [radeon]) Dec 04 03:29:30 32core kernel: [drm] ib test on ring 0 succeeded in 0 usecs Dec 04 03:29:30 32core kernel: [drm] ib test on ring 1 succeeded in 0 usecs Dec 04 03:29:30 32core kernel: [drm] ib test on ring 2 succeeded in 0 usecs Dec 04 03:29:30 32core kernel: [drm] ib test on ring 3 succeeded in 0 usecs Dec 04 03:29:30 32core kernel: [drm] ib test on ring 4 succeeded in 0 usecs Dec 04 03:29:30 32core kernel: [drm] ib test on ring 5 succeeded Dec 04 03:29:30 32core kernel: [drm] Radeon Display Connectors Dec 04 03:29:30 32core kernel: [drm] Connector 0: Dec 04 03:29:30 32core kernel: [drm] HDMI-A-1 Dec 04 03:29:30 32core kernel: [drm] HPD1 Dec 04 03:29:30 32core kernel: [drm] DDC: 0x6540 0x6540 0x6544 0x6544 0x6548 0x6548 0x654c 0x654c Dec 04 03:29:30 32core kernel: [drm] Encoders: Dec 04 03:29:30 32core kernel: [drm] DFP1: INTERNAL_UNIPHY Dec 04 03:29:30 32core kernel: [drm] Connector 1: Dec 04 03:29:30 32core kernel: [drm] DVI-D-1 Dec 04 03:29:30 32core kernel: [drm] HPD2 Dec 04 03:29:30 32core kernel: [drm] DDC: 0x6530 0x6530 0x6534 0x6534 0x6538 0x6538 0x653c 0x653c Dec 04 03:29:30 32core kernel: [drm] Encoders: Dec 04 03:29:30 32core kernel: [drm] DFP2: INTERNAL_UNIPHY Dec 04 03:29:30 32core kernel: [drm] Connector 2: Dec 04 03:29:30 32core kernel: [drm] VGA-1 Dec 04 03:29:30 32core kernel: [drm] DDC: 0x65c0 0x65c0 0x65c4 0x65c4 0x65c8 0x65c8 0x65cc 0x65cc Dec 04 03:29:30 32core kernel: [drm] Encoders: Dec 04 03:29:30 32core kernel: [drm] CRT1: INTERNAL_KLDSCP_DAC1 Dec 04 03:29:30 32core kernel: [drm] Initialized radeon 2.51.0 for 0000:01:00.0 on minor 0 Dec 04 03:29:30 32core kernel: [drm] fb mappable at 0xD0571000 Dec 04 03:29:30 32core kernel: [drm] vram apper at 0xD0000000 Dec 04 03:29:30 32core kernel: [drm] size 35389440 Dec 04 03:29:30 32core kernel: [drm] fb depth is 24 Dec 04 03:29:30 32core kernel: [drm] pitch is 16384 Dec 04 03:29:30 32core kernel: fbcon: radeondrmfb (fb0) is primary device Dec 04 03:29:30 32core kernel: Console: switching to colour frame buffer device 256x67 Dec 04 03:29:30 32core kernel: radeon 0000:01:00.0: [drm] fb0: radeondrmfb frame buffer device Dec 04 03:29:31 32core systemd[1]: Mounted tmp.mount - Temporary Directory /tmp. Dec 04 03:29:31 32core systemd[1]: Mounted boot-efi.mount - /boot/efi. Dec 04 03:29:31 32core kernel: EXT4-fs (nvme1n1p1): recovery complete Dec 04 03:29:31 32core kernel: EXT4-fs (nvme1n1p1): mounted filesystem c1ab544a-4190-426a-8cdd-8d6af66f97fa r/w with ordered data mode. Quota mode: none. Dec 04 03:29:31 32core systemd[1]: Mounted mnt-pve-asgard\x2d2tb.mount - Mount storage 'asgard-2tb' under /mnt/pve. Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: enabling device (0000 -> 0003) Dec 04 03:29:32 32core kernel: [drm] initializing kernel modesetting (RV380 0x1002:0x5B64 0x1002:0x0102 0x80). Dec 04 03:29:32 32core kernel: [drm] amdgpu kernel modesetting enabled. Dec 04 03:29:32 32core kernel: amdgpu: Virtual CRAT table created for CPU Dec 04 03:29:32 32core kernel: amdgpu: Topology: Add CPU node Dec 04 03:29:32 32core kernel: [drm] GPU not posted. posting now... Dec 04 03:29:32 32core kernel: [drm] Generation 2 PCI interface, using max accessible memory Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: VRAM: 128M 0x00000000B0000000 - 0x00000000B7FFFFFF (128M used) Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: GTT: 2048M 0x0000000030000000 - 0x00000000AFFFFFFF Dec 04 03:29:32 32core kernel: debugfs: 'radeon_gpu_reset' already exists in '/' Dec 04 03:29:32 32core kernel: debugfs: 'radeon_fence_info' already exists in '/' Dec 04 03:29:32 32core kernel: [drm] Detected VRAM RAM=128M, BAR=128M Dec 04 03:29:32 32core kernel: [drm] RAM width 128bits DDR Dec 04 03:29:32 32core kernel: [drm] radeon: 128M of VRAM memory ready Dec 04 03:29:32 32core kernel: [drm] radeon: 2048M of GTT memory ready. Dec 04 03:29:32 32core kernel: debugfs: 'radeon_vram' already exists in '/' Dec 04 03:29:32 32core kernel: debugfs: 'radeon_gtt' already exists in '/' Dec 04 03:29:32 32core kernel: debugfs: 'ttm_page_pool' already exists in '/' Dec 04 03:29:32 32core kernel: debugfs: 'radeon_vram_mm' already exists in '/' Dec 04 03:29:32 32core kernel: debugfs: 'radeon_gtt_mm' already exists in '/' Dec 04 03:29:32 32core kernel: [drm] GART: num cpu pages 524288, num gpu pages 524288 Dec 04 03:29:32 32core kernel: [drm] radeon: 1 quad pipes, 1 Z pipes initialized Dec 04 03:29:32 32core kernel: [drm] PCIE GART of 2048M enabled (table at 0x00000000B0040000). Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: WB enabled Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: fence driver on ring 0 uses gpu addr 0x0000000030000000 Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: radeon: MSI limited to 32-bit Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: radeon: using MSI. Dec 04 03:29:32 32core kernel: [drm] radeon: irq initialized. Dec 04 03:29:32 32core kernel: [drm] Loading R300 Microcode Dec 04 03:29:32 32core kernel: debugfs: 'radeon_ring_gfx' already exists in '/' Dec 04 03:29:32 32core kernel: [drm] radeon: ring at 0x0000000030001000 Dec 04 03:29:32 32core kernel: [drm] ring test succeeded in 1 usecs Dec 04 03:29:32 32core kernel: debugfs: 'radeon_sa_info' already exists in '/' Dec 04 03:29:32 32core kernel: debugfs: 'radeon_gem_info' already exists in '/' Dec 04 03:29:32 32core kernel: [drm] ib test succeeded in 0 usecs Dec 04 03:29:32 32core kernel: [drm] Radeon Display Connectors Dec 04 03:29:32 32core kernel: [drm] Connector 0: Dec 04 03:29:32 32core kernel: [drm] VGA-2 Dec 04 03:29:32 32core kernel: [drm] DDC: 0x60 0x60 0x60 0x60 0x60 0x60 0x60 0x60 Dec 04 03:29:32 32core kernel: [drm] Encoders: Dec 04 03:29:32 32core kernel: [drm] CRT1: INTERNAL_DAC1 Dec 04 03:29:32 32core kernel: [drm] Connector 1: Dec 04 03:29:32 32core kernel: [drm] DVI-I-1 Dec 04 03:29:32 32core kernel: [drm] HPD1 Dec 04 03:29:32 32core kernel: [drm] DDC: 0x64 0x64 0x64 0x64 0x64 0x64 0x64 0x64 Dec 04 03:29:32 32core kernel: [drm] Encoders: Dec 04 03:29:32 32core kernel: [drm] CRT2: INTERNAL_DAC2 Dec 04 03:29:32 32core kernel: [drm] DFP1: INTERNAL_TMDS1 Dec 04 03:29:32 32core kernel: [drm] Initialized radeon 2.51.0 for 0000:4d:00.0 on minor 1 Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: [drm] Cannot find any crtc or sizes Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: [drm] Cannot find any crtc or sizes Dec 04 03:29:32 32core kernel: radeon 0000:4d:00.0: [drm] Cannot find any crtc or sizes Dec 04 03:29:32 32core kernel: usbcore: registered new interface driver snd-usb-audio Dec 04 03:29:32 32core kernel: Bluetooth: Core ver 2.22 Dec 04 03:29:32 32core kernel: cfg80211: Loading compiled-in X.509 certificates for regulatory database Dec 04 03:29:32 32core kernel: Loaded X.509 cert 'benh(a)debian.org: 577e021cb980e0e820821ba7b54b4961b8b4fadf' Dec 04 03:29:32 32core kernel: Loaded X.509 cert 'romain.perier(a)gmail.com: 3abbc6ec146e09d1b6016ab9d6cf71dd233f0328' Dec 04 03:29:32 32core kernel: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7' Dec 04 03:29:32 32core kernel: Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600' Dec 04 03:29:32 32core kernel: faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2 Dec 04 03:29:32 32core kernel: cfg80211: failed to load regulatory.db Dec 04 03:29:32 32core kernel: NET: Registered PF_BLUETOOTH protocol family Dec 04 03:29:32 32core kernel: Bluetooth: HCI device and connection manager initialized Dec 04 03:29:32 32core kernel: Bluetooth: HCI socket layer initialized Dec 04 03:29:32 32core kernel: Bluetooth: L2CAP socket layer initialized Dec 04 03:29:32 32core kernel: Bluetooth: SCO socket layer initialized Dec 04 03:29:32 32core kernel: iwlwifi 0000:46:00.0: enabling device (0000 -> 0002) Dec 04 03:29:32 32core kernel: iwlwifi 0000:46:00.0: Detected crf-id 0x3617, cnv-id 0x100530 wfpm id 0x80000000 Dec 04 03:29:32 32core kernel: iwlwifi 0000:46:00.0: PCI dev 2723/0084, rev=0x340, rfid=0x10a100 Dec 04 03:29:32 32core kernel: iwlwifi 0000:46:00.0: Detected Intel(R) Wi-Fi 6 AX200 160MHz Dec 04 03:29:32 32core kernel: usbcore: registered new interface driver btusb Dec 04 03:29:32 32core systemd[1]: Starting systemd-rfkill.service - Load/Save RF Kill Switch Status... Dec 04 03:29:32 32core systemd[1]: Reached target bluetooth.target - Bluetooth Support. Dec 04 03:29:32 32core kernel: iwlwifi 0000:46:00.0: loaded firmware version 77.6eaf654b.0 cc-a0-77.ucode op_mode iwlmvm Dec 04 03:29:32 32core systemd[1]: Started systemd-rfkill.service - Load/Save RF Kill Switch Status. Dec 04 03:29:32 32core kernel: Bluetooth: hci0: Found device firmware: intel/ibt-20-1-3.sfi Dec 04 03:29:32 32core kernel: Bluetooth: hci0: Boot Address: 0x24800 Dec 04 03:29:32 32core kernel: Bluetooth: hci0: Firmware Version: 193-33.24 Dec 04 03:29:32 32core kernel: Bluetooth: hci0: Firmware already loaded Dec 04 03:29:32 32core kernel: Bluetooth: hci0: HCI LE Coded PHY feature bit is set, but its usage is not supported. Dec 04 03:29:32 32core systemd[1]: Finished systemd-udev-settle.service - Wait for udev To Complete Device Initialization. Dec 04 03:29:32 32core systemd[1]: zfs-import-cache.service - Import ZFS pools by cache file was skipped because of an unmet condition check (ConditionFileNotEmpty=/etc/zfs/zpool.cache). Dec 04 03:29:32 32core systemd[1]: Starting zfs-import-scan.service - Import ZFS pools by device scanning... Dec 04 03:29:32 32core systemd[1]: Finished ifupdown2-pre.service - Helper to synchronize boot up for ifupdown. Dec 04 03:29:33 32core zpool[1304]: no pools available to import Dec 04 03:29:33 32core systemd[1]: Finished zfs-import-scan.service - Import ZFS pools by device scanning. Dec 04 03:29:33 32core systemd[1]: Reached target zfs-import.target - ZFS pool import target. Dec 04 03:29:33 32core systemd[1]: Starting zfs-mount.service - Mount ZFS filesystems... Dec 04 03:29:33 32core systemd[1]: Starting zfs-volume-wait.service - Wait for ZFS Volume (zvol) links in /dev... Dec 04 03:29:33 32core zvol_wait[1370]: No zvols found, nothing to do. Dec 04 03:29:33 32core systemd[1]: Finished zfs-mount.service - Mount ZFS filesystems. Dec 04 03:29:33 32core systemd[1]: Finished zfs-volume-wait.service - Wait for ZFS Volume (zvol) links in /dev. Dec 04 03:29:33 32core systemd[1]: Reached target local-fs.target - Local File Systems. Dec 04 03:29:33 32core systemd[1]: Reached target zfs-volumes.target - ZFS volumes are ready. Dec 04 03:29:33 32core systemd[1]: Listening on systemd-sysext.socket - System Extension Image Management. Dec 04 03:29:33 32core kernel: iwlwifi 0000:46:00.0: Detected RF HR B3, rfid=0x10a100 Dec 04 03:29:33 32core systemd[1]: Starting apparmor.service - Load AppArmor profiles... Dec 04 03:29:33 32core systemd[1]: Starting console-setup.service - Set console font and keymap... Dec 04 03:29:33 32core systemd[1]: Starting networking.service - Network initialization... Dec 04 03:29:33 32core systemd[1]: Starting pvebanner.service - Proxmox VE Login Banner... Dec 04 03:29:33 32core systemd[1]: Starting pvefw-logger.service - Proxmox VE firewall logger... Dec 04 03:29:33 32core systemd[1]: Starting pvenetcommit.service - Commit Proxmox VE network changes... Dec 04 03:29:33 32core systemd[1]: Starting systemd-binfmt.service - Set Up Additional Binary Formats... Dec 04 03:29:33 32core systemd[1]: Starting systemd-tmpfiles-setup.service - Create System Files and Directories... Dec 04 03:29:33 32core systemd[1]: Finished console-setup.service - Set console font and keymap. Dec 04 03:29:33 32core apparmor.systemd[1377]: Restarting AppArmor Dec 04 03:29:33 32core apparmor.systemd[1377]: Reloading AppArmor profiles Dec 04 03:29:33 32core networking[1379]: networking: Configuring network interfaces Dec 04 03:29:33 32core systemd[1]: proc-sys-fs-binfmt_misc.automount: Got automount request for /proc/sys/fs/binfmt_misc, triggered by 1385 (systemd-binfmt) Dec 04 03:29:33 32core systemd[1]: Mounting proc-sys-fs-binfmt_misc.mount - Arbitrary Executable File Formats File System... Dec 04 03:29:33 32core systemd-tmpfiles[1387]: /usr/lib/tmpfiles.d/legacy.conf:14: Duplicate line for path "/run/lock", ignoring. Dec 04 03:29:33 32core pvefw-logger[1405]: starting pvefw logger Dec 04 03:29:33 32core systemd[1]: Finished pvenetcommit.service - Commit Proxmox VE network changes. Dec 04 03:29:33 32core systemd[1]: Started pvefw-logger.service - Proxmox VE firewall logger. Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.086:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="linux-sandbox" pid=1440 comm="apparmor_parser" Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.086:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="QtWebEngineProcess" pid=1410 comm="apparmor_parser" Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.086:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="1password" pid=1407 comm="apparmor_parser" Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.086:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="chromium" pid=1420 comm="apparmor_parser" Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.087:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="balena-etcher" pid=1412 comm="apparmor_parser" Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.087:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="lc-compliance" pid=1438 comm="apparmor_parser" Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.087:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="github-desktop" pid=1433 comm="apparmor_parser" Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.087:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="vscode" pid=1421 comm="apparmor_parser" Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.087:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="ch-checkns" pid=1417 comm="apparmor_parser" Dec 04 03:29:33 32core kernel: audit: type=1400 audit(1764790173.087:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="loupe" pid=1441 comm="apparmor_parser" Dec 04 03:29:33 32core systemd[1]: Mounted proc-sys-fs-binfmt_misc.mount - Arbitrary Executable File Formats File System. Dec 04 03:29:33 32core systemd[1]: Finished systemd-binfmt.service - Set Up Additional Binary Formats. Dec 04 03:29:33 32core systemd[1]: Finished systemd-tmpfiles-setup.service - Create System Files and Directories. Dec 04 03:29:33 32core systemd[1]: Mounting run-rpc_pipefs.mount - RPC Pipe File System... Dec 04 03:29:33 32core systemd[1]: ldconfig.service - Rebuild Dynamic Linker Cache was skipped because no trigger condition checks were met. Dec 04 03:29:33 32core systemd[1]: Starting rpcbind.service - RPC bind portmap service... Dec 04 03:29:33 32core systemd[1]: systemd-firstboot.service - First Boot Wizard was skipped because of an unmet condition check (ConditionFirstBoot=yes). Dec 04 03:29:33 32core systemd[1]: first-boot-complete.target - First Boot Complete was skipped because of an unmet condition check (ConditionFirstBoot=yes). Dec 04 03:29:33 32core systemd[1]: systemd-journal-catalog-update.service - Rebuild Journal Catalog was skipped because of an unmet condition check (ConditionNeedsUpdate=/var). Dec 04 03:29:33 32core systemd[1]: systemd-machine-id-commit.service - Save Transient machine-id to Disk was skipped because of an unmet condition check (ConditionPathIsMountPoint=/etc/machine-id). Dec 04 03:29:33 32core systemd[1]: systemd-update-done.service - Update is Completed was skipped because no trigger condition checks were met. Dec 04 03:29:33 32core systemd[1]: Finished apparmor.service - Load AppArmor profiles. Dec 04 03:29:33 32core systemd[1]: Reached target sysinit.target - System Initialization. Dec 04 03:29:33 32core systemd[1]: Started apt-daily.timer - Daily apt download activities. Dec 04 03:29:33 32core systemd[1]: Started apt-daily-upgrade.timer - Daily apt upgrade and clean activities. Dec 04 03:29:33 32core systemd[1]: Started dpkg-db-backup.timer - Daily dpkg database backup timer. Dec 04 03:29:33 32core systemd[1]: Started e2scrub_all.timer - Periodic ext4 Online Metadata Check for All Filesystems. Dec 04 03:29:33 32core systemd[1]: Started fstrim.timer - Discard unused filesystem blocks once a week. Dec 04 03:29:33 32core systemd[1]: Started fwupd-refresh.timer - Refresh fwupd metadata regularly. Dec 04 03:29:33 32core systemd[1]: Started logrotate.timer - Daily rotation of log files. Dec 04 03:29:33 32core systemd[1]: Started man-db.timer - Daily man-db regeneration. Dec 04 03:29:33 32core systemd[1]: Started pve-daily-update.timer - Daily PVE download activities. Dec 04 03:29:33 32core systemd[1]: Started systemd-tmpfiles-clean.timer - Daily Cleanup of Temporary Directories. Dec 04 03:29:33 32core systemd[1]: Started xfs_scrub_all.timer - Periodic XFS Online Metadata Check for All Filesystems. Dec 04 03:29:33 32core systemd[1]: Reached target timers.target - Timer Units. Dec 04 03:29:33 32core systemd[1]: Listening on dbus.socket - D-Bus System Message Bus Socket. Dec 04 03:29:33 32core systemd[1]: Listening on iscsid.socket - Open-iSCSI iscsid Socket. Dec 04 03:29:33 32core systemd[1]: Listening on netavark-dhcp-proxy.socket - Netavark DHCP proxy socket. Dec 04 03:29:33 32core systemd[1]: Listening on rrdcached.socket - sockets activating rrdcached. Dec 04 03:29:33 32core systemd[1]: Listening on sshd-unix-local.socket - OpenSSH Server Socket (systemd-ssh-generator, AF_UNIX Local). Dec 04 03:29:33 32core systemd[1]: Listening on systemd-hostnamed.socket - Hostname Service Socket. Dec 04 03:29:33 32core systemd[1]: Reached target sockets.target - Socket Units. Dec 04 03:29:33 32core systemd[1]: systemd-pcrphase-sysinit.service - TPM PCR Barrier (Initialization) was skipped because of an unmet condition check (ConditionSecurity=measured-uki). Dec 04 03:29:33 32core systemd[1]: Reached target basic.target - Basic System. Dec 04 03:29:33 32core systemd[1]: System is tainted: unmerged-bin Dec 04 03:29:33 32core kernel: iwlwifi 0000:46:00.0: base HW address: 50:e0:85:f3:21:e5 Dec 04 03:29:33 32core systemd[1]: Starting chrony.service - chrony, an NTP client/server... Dec 04 03:29:33 32core systemd[1]: Starting dbus.service - D-Bus System Message Bus... Dec 04 03:29:33 32core systemd[1]: Starting e2scrub_reap.service - Remove Stale Online ext4 Metadata Check Snapshots... Dec 04 03:29:33 32core systemd[1]: getty-static.service - getty on tty2-tty6 if dbus and logind are not available was skipped because of an unmet condition check (ConditionPathExists=!/usr/bin/dbus-daemon). Dec 04 03:29:33 32core systemd[1]: Starting grub-common.service - Record successful boot for GRUB... Dec 04 03:29:33 32core systemd[1]: Starting hardinfo2.service - Hardinfo2 support for root access... Dec 04 03:29:33 32core systemd[1]: Starting ksmtuned.service - Kernel Samepage Merging (KSM) Tuning Daemon... Dec 04 03:29:33 32core systemd[1]: Starting lm-sensors.service - Initialize hardware monitoring sensors... Dec 04 03:29:33 32core systemd[1]: Starting lxcfs.service - FUSE filesystem for LXC... Dec 04 03:29:33 32core systemd[1]: Starting netavark-dhcp-proxy.service - Netavark DHCP proxy service... Dec 04 03:29:33 32core systemd[1]: Starting polkit.service - Authorization Manager... Dec 04 03:29:33 32core systemd[1]: proxmox-boot-cleanup.service - Clean up bootloader next-boot setting was skipped because of an unmet condition check (ConditionPathExists=/etc/kernel/next-boot-pin). Dec 04 03:29:33 32core systemd[1]: Starting pve-lxc-syscalld.service - Proxmox VE LXC Syscall Daemon... Dec 04 03:29:33 32core systemd[1]: Starting pve-query-machine-capabilities.service - PVE Query Machine Capabilities... Dec 04 03:29:33 32core systemd[1]: Starting qmeventd.service - PVE Qemu Event Daemon... Dec 04 03:29:33 32core systemd[1]: Started rrdcached.service - Data caching daemon for rrdtool. Dec 04 03:29:33 32core systemd[1]: Starting rsyslog.service - System Logging Service... Dec 04 03:29:33 32core systemd[1]: Starting smartmontools.service - Self Monitoring and Reporting Technology (SMART) Daemon... Dec 04 03:29:33 32core systemd[1]: sshd-keygen.service - Generate sshd host keys on first boot was skipped because of an unmet condition check (ConditionFirstBoot=yes). Dec 04 03:29:33 32core query-machine-capabilities[1543]: AuthenticAMD Dec 04 03:29:33 32core systemd[1]: Starting systemd-logind.service - User Login Management... Dec 04 03:29:33 32core systemd[1]: Starting udisks2.service - Disk Manager... Dec 04 03:29:33 32core systemd[1]: Started watchdog-mux.service - Proxmox VE watchdog multiplexer. Dec 04 03:29:33 32core systemd[1]: Starting zfs-share.service - ZFS file system shares... Dec 04 03:29:33 32core systemd[1]: Started zfs-zed.service - ZFS Event Daemon (zed). Dec 04 03:29:33 32core systemd[1]: Started netavark-dhcp-proxy.service - Netavark DHCP proxy service. Dec 04 03:29:33 32core systemd[1]: Started rpcbind.service - RPC bind portmap service. Dec 04 03:29:33 32core systemd[1]: Started pve-lxc-syscalld.service - Proxmox VE LXC Syscall Daemon. Dec 04 03:29:33 32core systemd[1]: e2scrub_reap.service: Deactivated successfully. Dec 04 03:29:33 32core systemd[1]: Finished e2scrub_reap.service - Remove Stale Online ext4 Metadata Check Snapshots. Dec 04 03:29:33 32core systemd[1]: Started ksmtuned.service - Kernel Samepage Merging (KSM) Tuning Daemon. Dec 04 03:29:33 32core systemd[1]: Started lxcfs.service - FUSE filesystem for LXC. Dec 04 03:29:33 32core systemd[1]: Finished pve-query-machine-capabilities.service - PVE Query Machine Capabilities. Dec 04 03:29:33 32core systemd[1]: Started qmeventd.service - PVE Qemu Event Daemon. Dec 04 03:29:33 32core systemd[1]: Finished zfs-share.service - ZFS file system shares. Dec 04 03:29:33 32core zed[1582]: ZFS Event Daemon 2.3.4-pve1 (PID 1582) Dec 04 03:29:33 32core systemd[1]: Reached target rpcbind.target - RPC Port Mapper. Dec 04 03:29:33 32core systemd[1]: Reached target zfs.target - ZFS startup target. Dec 04 03:29:33 32core kernel: iwlwifi 0000:46:00.0 wlp70s0: renamed from wlan0 Dec 04 03:29:33 32core zed[1582]: Processing events since eid=0 Dec 04 03:29:33 32core udisksd[1558]: udisks daemon version 2.10.1 starting Dec 04 03:29:33 32core lxcfs[1636]: Starting LXCFS at /usr/bin/lxcfs Dec 04 03:29:33 32core watchdog-mux[1559]: Watchdog driver 'Software Watchdog', version 0 Dec 04 03:29:33 32core kernel: softdog: initialized. soft_noboot=0 soft_margin=60 sec soft_panic=0 (nowayout=0) Dec 04 03:29:33 32core kernel: softdog: soft_reboot_cmd=<not set> soft_active_on_boot=0 Dec 04 03:29:33 32core smartd[1551]: smartd 7.4 2024-10-15 r5620 [x86_64-linux-6.17.2-2-pve] (local build) Dec 04 03:29:33 32core smartd[1551]: Opened configuration file /etc/smartd.conf Dec 04 03:29:33 32core smartd[1551]: Drive: DEVICESCAN, implied '-a' Directive on line 18 of file /etc/smartd.conf Dec 04 03:29:33 32core smartd[1551]: Configuration file /etc/smartd.conf was parsed, found DEVICESCAN, scanning devices Dec 04 03:29:33 32core smartd[1551]: Device: /dev/sda [SAT], opened Dec 04 03:29:33 32core lxcfs[1636]: Using runtime path /run Dec 04 03:29:33 32core lxcfs[1636]: Running lxcfslib_init to reload liblxcfs Dec 04 03:29:33 32core lxcfs[1636]: mount namespace: 7 Dec 04 03:29:33 32core lxcfs[1636]: hierarchies: Dec 04 03:29:33 32core lxcfs[1636]: 0: fd: 8: cpuset,cpu,io,memory,hugetlb,pids,rdma,misc,dmem Dec 04 03:29:33 32core lxcfs[1636]: Kernel supports pidfds Dec 04 03:29:33 32core lxcfs[1636]: Kernel supports swap accounting Dec 04 03:29:33 32core lxcfs[1636]: api_extensions: Dec 04 03:29:33 32core lxcfs[1636]: - cgroups Dec 04 03:29:33 32core lxcfs[1636]: - sys_cpu_online Dec 04 03:29:33 32core lxcfs[1636]: - proc_cpuinfo Dec 04 03:29:33 32core lxcfs[1636]: - proc_diskstats Dec 04 03:29:33 32core lxcfs[1636]: - proc_loadavg Dec 04 03:29:33 32core lxcfs[1636]: - proc_meminfo Dec 04 03:29:33 32core lxcfs[1636]: - proc_stat Dec 04 03:29:33 32core lxcfs[1636]: - proc_swaps Dec 04 03:29:33 32core lxcfs[1636]: - proc_uptime Dec 04 03:29:33 32core lxcfs[1636]: - proc_slabinfo Dec 04 03:29:33 32core lxcfs[1636]: - shared_pidns Dec 04 03:29:33 32core lxcfs[1636]: - cpuview_daemon Dec 04 03:29:33 32core lxcfs[1636]: - loadavg_daemon Dec 04 03:29:33 32core lxcfs[1636]: - pidfds Dec 04 03:29:33 32core smartd[1551]: Device: /dev/sda [SAT], WDC WD10JMVW-11S5XS0, S/N:WD-WXC1EC2KL905, WWN:5-0014ee-6ade71d74, FW:01.01A01, 1.00 TB Dec 04 03:29:33 32core dbus-daemon[1527]: [system] AppArmor D-Bus mediation is enabled Dec 04 03:29:33 32core systemd[1]: Started dbus.service - D-Bus System Message Bus. Dec 04 03:29:33 32core kernel: RPC: Registered named UNIX socket transport module. Dec 04 03:29:33 32core kernel: RPC: Registered udp transport module. Dec 04 03:29:33 32core kernel: RPC: Registered tcp transport module. Dec 04 03:29:33 32core kernel: RPC: Registered tcp-with-tls transport module. Dec 04 03:29:33 32core kernel: RPC: Registered tcp NFSv4.1 backchannel transport module. Dec 04 03:29:33 32core systemd[1]: Mounted run-rpc_pipefs.mount - RPC Pipe File System. Dec 04 03:29:33 32core smartd[1551]: Device: /dev/sda [SAT], found in smartd database 7.3/5528: Western Digital Elements / My Passport (USB, AF) Dec 04 03:29:33 32core systemd[1]: grub-common.service: Deactivated successfully. Dec 04 03:29:33 32core systemd[1]: Finished grub-common.service - Record successful boot for GRUB. Dec 04 03:29:33 32core systemd[1]: Reached target rpc_pipefs.target. Dec 04 03:29:33 32core systemd[1]: Starting nfs-blkmap.service - pNFS block layout mapping daemon... Dec 04 03:29:33 32core systemd[1]: rpc-gssd.service - RPC security service for NFS client and server was skipped because of an unmet condition check (ConditionPathExists=/etc/krb5.keytab). Dec 04 03:29:33 32core addgroup[1542]: The group `hardinfo2' already exists. Dec 04 03:29:33 32core systemd[1]: Reached target nfs-client.target - NFS client services. Dec 04 03:29:33 32core blkmapd[1691]: open pipe file /run/rpc_pipefs/nfs/blocklayout failed: No such file or directory Dec 04 03:29:33 32core systemd[1]: Started nfs-blkmap.service - pNFS block layout mapping daemon. Dec 04 03:29:33 32core systemd-logind[1555]: New seat seat0. Dec 04 03:29:33 32core dbus-daemon[1527]: [system] Activating via systemd: service name='org.freedesktop.PolicyKit1' unit='polkit.service' requested by ':1.0' (uid=0 pid=1558 comm="/usr/libexec/udisks2/udisksd" label="unconfined") Dec 04 03:29:33 32core systemd-logind[1555]: Watching system buttons on /dev/input/event1 (Power Button) Dec 04 03:29:33 32core systemd-logind[1555]: Watching system buttons on /dev/input/event0 (Power Button) Dec 04 03:29:33 32core chronyd[1703]: chronyd version 4.6.1 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +NTS +SECHASH +IPV6 -DEBUG) Dec 04 03:29:33 32core systemd-logind[1555]: Watching system buttons on /dev/input/event3 (Logitech USB Receiver) Dec 04 03:29:33 32core systemd-logind[1555]: Watching system buttons on /dev/input/event5 (Logitech USB Receiver Consumer Control) Dec 04 03:29:33 32core systemd-logind[1555]: Watching system buttons on /dev/input/event6 (Logitech USB Receiver System Control) Dec 04 03:29:33 32core systemd-logind[1555]: Watching system buttons on /dev/input/event9 (Generic USB Audio Consumer Control) Dec 04 03:29:33 32core chronyd[1703]: Loaded 0 symmetric keys Dec 04 03:29:33 32core systemd[1]: Started systemd-logind.service - User Login Management. Dec 04 03:29:33 32core chronyd[1703]: Using leap second list /usr/share/zoneinfo/leap-seconds.list Dec 04 03:29:33 32core chronyd[1703]: Frequency -27.572 +/- 2.569 ppm read from /var/lib/chrony/chrony.drift Dec 04 03:29:33 32core chronyd[1703]: Loaded seccomp filter (level 1) Dec 04 03:29:33 32core systemd[1]: Started chrony.service - chrony, an NTP client/server. Dec 04 03:29:33 32core rsyslogd[1550]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2504.0] Dec 04 03:29:33 32core rsyslogd[1550]: [origin software="rsyslogd" swVersion="8.2504.0" x-pid="1550" x-info="https://www.rsyslog.com"] start Dec 04 03:29:33 32core systemd[1]: Started rsyslog.service - System Logging Service. Dec 04 03:29:33 32core polkitd[1538]: Started polkitd version 126 Dec 04 03:29:33 32core polkitd[1538]: Loading rules from directory /etc/polkit-1/rules.d Dec 04 03:29:33 32core polkitd[1538]: Loading rules from directory /run/polkit-1/rules.d Dec 04 03:29:33 32core polkitd[1538]: Error opening rules directory: Error opening directory “/run/polkit-1/rules.d”: No such file or directory (g-file-error-quark, 4) Dec 04 03:29:33 32core systemd[1]: hardinfo2.service: Deactivated successfully. Dec 04 03:29:33 32core polkitd[1538]: Loading rules from directory /usr/local/share/polkit-1/rules.d Dec 04 03:29:33 32core polkitd[1538]: Error opening rules directory: Error opening directory “/usr/local/share/polkit-1/rules.d”: No such file or directory (g-file-error-quark, 4) Dec 04 03:29:33 32core polkitd[1538]: Loading rules from directory /usr/share/polkit-1/rules.d Dec 04 03:29:33 32core systemd[1]: Finished hardinfo2.service - Hardinfo2 support for root access. Dec 04 03:29:33 32core polkitd[1538]: Finished loading, compiling and executing 4 rules Dec 04 03:29:33 32core systemd[1]: Started polkit.service - Authorization Manager. Dec 04 03:29:33 32core dbus-daemon[1527]: [system] Successfully activated service 'org.freedesktop.PolicyKit1' Dec 04 03:29:33 32core polkitd[1538]: Acquired the name org.freedesktop.PolicyKit1 on the system bus Dec 04 03:29:33 32core systemd[1]: Starting ModemManager.service - Modem Manager... Dec 04 03:29:33 32core kernel: nvme nvme0: using unchecked data buffer Dec 04 03:29:33 32core sensors[1674]: iwlwifi_1-virtual-0 Dec 04 03:29:33 32core sensors[1674]: Adapter: Virtual device Dec 04 03:29:33 32core sensors[1674]: temp1: N/A Dec 04 03:29:33 32core sensors[1674]: k10temp-pci-00c3 Dec 04 03:29:33 32core sensors[1674]: Adapter: PCI adapter Dec 04 03:29:33 32core sensors[1674]: Tctl: +58.4°C Dec 04 03:29:33 32core sensors[1674]: Tccd1: +46.0°C Dec 04 03:29:33 32core sensors[1674]: Tccd3: +44.2°C Dec 04 03:29:33 32core sensors[1674]: Tccd5: +59.0°C Dec 04 03:29:33 32core sensors[1674]: Tccd7: +48.2°C Dec 04 03:29:33 32core sensors[1674]: nvme-pci-4b00 Dec 04 03:29:33 32core sensors[1674]: Adapter: PCI adapter Dec 04 03:29:33 32core sensors[1674]: Composite: +45.9°C (low = -0.1°C, high = +74.8°C) Dec 04 03:29:33 32core sensors[1674]: (crit = +79.8°C) Dec 04 03:29:33 32core sensors[1674]: nvme-pci-4300 Dec 04 03:29:33 32core sensors[1674]: Adapter: PCI adapter Dec 04 03:29:33 32core sensors[1674]: Composite: +28.9°C (low = -20.1°C, high = +74.8°C) Dec 04 03:29:33 32core sensors[1674]: (crit = +79.8°C) Dec 04 03:29:33 32core sensors[1674]: radeon-pci-0100 Dec 04 03:29:33 32core sensors[1674]: Adapter: PCI adapter Dec 04 03:29:33 32core sensors[1674]: temp1: +34.0°C (crit = +120.0°C, hyst = +90.0°C) Dec 04 03:29:33 32core sensors[1674]: pwm1: 36% Dec 04 03:29:33 32core sensors[1674]: freq1: 300 MHz Dec 04 03:29:33 32core sensors[1674]: enp69s0-pci-4500 Dec 04 03:29:33 32core sensors[1674]: Adapter: PCI adapter Dec 04 03:29:33 32core sensors[1674]: PHY Temperature: +51.3°C Dec 04 03:29:33 32core sensors[1674]: MAC Temperature: +51.9°C Dec 04 03:29:33 32core sensors[1674]: nvme-pci-4c00 Dec 04 03:29:33 32core sensors[1674]: Adapter: PCI adapter Dec 04 03:29:33 32core sensors[1674]: Composite: +54.9°C (low = -20.1°C, high = +84.8°C) Dec 04 03:29:33 32core sensors[1674]: (crit = +81.8°C) Dec 04 03:29:33 32core sensors[1674]: Sensor 1: +54.9°C (low = -20.1°C, high = +84.8°C) Dec 04 03:29:33 32core systemd[1]: Finished lm-sensors.service - Initialize hardware monitoring sensors. Dec 04 03:29:33 32core udisksd[1558]: Error probing device: Error sending ATA command IDENTIFY DEVICE to '/dev/sda': Unexpected sense data returned: 0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ (g-io-error-quark, 0) Dec 04 03:29:33 32core ModemManager[1735]: <msg> ModemManager (version 1.24.0) starting in system bus... Dec 04 03:29:33 32core systemd[1]: Finished pvebanner.service - Proxmox VE Login Banner. Dec 04 03:29:33 32core kernel: NET: Registered PF_QIPCRTR protocol family Dec 04 03:29:33 32core systemd[1]: Started ModemManager.service - Modem Manager. Dec 04 03:29:33 32core smartd[1551]: Device: /dev/sda [SAT], not capable of SMART Health Status check Dec 04 03:29:33 32core smartd[1551]: Device: /dev/sda [SAT], no ATA CHECK POWER STATUS support, ignoring -n Directive Dec 04 03:29:33 32core smartd[1551]: Device: /dev/sda [SAT], is SMART capable. Adding to "monitor" list. Dec 04 03:29:33 32core smartd[1551]: Device: /dev/sda [SAT], state read from /var/lib/smartmontools/smartd.WDC_WD10JMVW_11S5XS0-WD_WXC1EC2KL905.ata.state Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme0, opened Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme0, PNY CS2130 4TB SSD, S/N:PNY21122103150100005, FW:CS213530, 4.00 TB Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme0, is SMART capable. Adding to "monitor" list. Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme0, state read from /var/lib/smartmontools/smartd.PNY_CS2130_4TB_SSD-PNY21122103150100005.nvme.state Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme1, opened Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme1, Asgard AN2TNVMe M.2/80, S/N:100000000074, FW:FWSS0104 Dec 04 03:29:33 32core systemd[1]: Started udisks2.service - Disk Manager. Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme1, is SMART capable. Adding to "monitor" list. Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme1, state read from /var/lib/smartmontools/smartd.Asgard_AN2TNVMe_M_2_80-100000000074.nvme.state Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme2, opened Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme2, THNSN51T02DU7 TOSHIBA, S/N:76IS1009TTQV, FW:57HA4103 Dec 04 03:29:33 32core udisksd[1558]: Acquired the name org.freedesktop.UDisks2 on the system message bus Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme2, is SMART capable. Adding to "monitor" list. Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme2, state read from /var/lib/smartmontools/smartd.THNSN51T02DU7_TOSHIBA-76IS1009TTQV.nvme.state Dec 04 03:29:33 32core smartd[1551]: Monitoring 1 ATA/SATA, 0 SCSI/SAS and 3 NVMe devices Dec 04 03:29:33 32core smartd[1551]: Device: /dev/sda [SAT], SMART Prefailure Attribute: 3 Spin_Up_Time changed from 188 to 187 Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme0, NVMe error count increased from 853 to 856 (0 new, 1 ignored, 2 unknown) Dec 04 03:29:33 32core smartd[1551]: Device: /dev/sda [SAT], state written to /var/lib/smartmontools/smartd.WDC_WD10JMVW_11S5XS0-WD_WXC1EC2KL905.ata.state Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme0, state written to /var/lib/smartmontools/smartd.PNY_CS2130_4TB_SSD-PNY21122103150100005.nvme.state Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme1, state written to /var/lib/smartmontools/smartd.Asgard_AN2TNVMe_M_2_80-100000000074.nvme.state Dec 04 03:29:33 32core smartd[1551]: Device: /dev/nvme2, state written to /var/lib/smartmontools/smartd.THNSN51T02DU7_TOSHIBA-76IS1009TTQV.nvme.state Dec 04 03:29:33 32core systemd[1]: Started smartmontools.service - Self Monitoring and Reporting Technology (SMART) Daemon. Dec 04 03:29:33 32core networking[1757]: error: vmbr0: bridge port enp68s0 does not exist Dec 04 03:29:33 32core /usr/sbin/ifup[1757]: error: vmbr0: bridge port enp68s0 does not exist Dec 04 03:29:33 32core networking[1757]: error: vmbr0: bridge port enp70s0 does not exist Dec 04 03:29:33 32core /usr/sbin/ifup[1757]: error: vmbr0: bridge port enp70s0 does not exist Dec 04 03:29:33 32core networking[1757]: error: vmbr0: bridge port enp72s0 does not exist Dec 04 03:29:33 32core /usr/sbin/ifup[1757]: error: vmbr0: bridge port enp72s0 does not exist Dec 04 03:29:33 32core kernel: vmbr0: port 1(enp69s0) entered blocking state Dec 04 03:29:33 32core kernel: vmbr0: port 1(enp69s0) entered disabled state Dec 04 03:29:33 32core kernel: atlantic 0000:45:00.0 enp69s0: entered allmulticast mode Dec 04 03:29:33 32core kernel: atlantic 0000:45:00.0 enp69s0: entered promiscuous mode Dec 04 03:29:33 32core kernel: vmbr0: port 2(enp71s0) entered blocking state Dec 04 03:29:33 32core kernel: vmbr0: port 2(enp71s0) entered disabled state Dec 04 03:29:33 32core kernel: r8169 0000:47:00.0 enp71s0: entered allmulticast mode Dec 04 03:29:33 32core kernel: r8169 0000:47:00.0 enp71s0: entered promiscuous mode Dec 04 03:29:33 32core networking[1757]: warning: vmbr0: apply bridge ports settings: bridge configuration failed (missing ports) Dec 04 03:29:33 32core /usr/sbin/ifup[1757]: warning: vmbr0: apply bridge ports settings: bridge configuration failed (missing ports) Dec 04 03:29:34 32core kernel: Realtek Internal NBASE-T PHY r8169-0-4700:00: attached PHY driver (mii_bus:phy_addr=r8169-0-4700:00, irq=MAC) Dec 04 03:29:34 32core kernel: r8169 0000:47:00.0 enp71s0: Link is Down Dec 04 03:29:34 32core kernel: vmbr0: port 2(enp71s0) entered blocking state Dec 04 03:29:34 32core kernel: vmbr0: port 2(enp71s0) entered forwarding state Dec 04 03:29:34 32core networking[1757]: error: >>> Full logs available in: /var/log/ifupdown2/network_config_ifupdown2_282_Dec-04-2025_03:29:33.465229 <<< Dec 04 03:29:34 32core /usr/sbin/ifup[1757]: >>> Full logs available in: /var/log/ifupdown2/network_config_ifupdown2_282_Dec-04-2025_03:29:33.465229 <<< Dec 04 03:29:34 32core systemd[1]: Finished networking.service - Network initialization. Dec 04 03:29:34 32core systemd[1]: Reached target network.target - Network. Dec 04 03:29:34 32core systemd[1]: Reached target network-online.target - Network is Online. Dec 04 03:29:34 32core systemd[1]: Starting iscsid.service - iSCSI initiator daemon (iscsid)... Dec 04 03:29:34 32core systemd[1]: Started lxc-monitord.service - LXC Container Monitoring Daemon. Dec 04 03:29:34 32core systemd[1]: Starting lxc-net.service - LXC network bridge setup... Dec 04 03:29:34 32core systemd[1]: Starting postfix.service - Postfix Mail Transport Agent (main/default instance)... Dec 04 03:29:34 32core systemd[1]: Starting pve-cluster.service - The Proxmox VE cluster filesystem... Dec 04 03:29:34 32core kernel: vmbr0: port 2(enp71s0) entered disabled state Dec 04 03:29:34 32core systemd[1]: Starting rbdmap.service - Map RBD devices... Dec 04 03:29:34 32core systemd[1]: Starting rpc-statd-notify.service - Notify NFS peers of a restart... Dec 04 03:29:34 32core systemd[1]: rsync.service - fast remote file copy program daemon was skipped because of an unmet condition check (ConditionPathExists=/etc/rsyncd.conf). Dec 04 03:29:34 32core systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Dec 04 03:29:34 32core sm-notify[1838]: Version 2.8.3 starting Dec 04 03:29:34 32core systemd[1]: Finished rbdmap.service - Map RBD devices. Dec 04 03:29:34 32core systemd[1]: Started rpc-statd-notify.service - Notify NFS peers of a restart. Dec 04 03:29:34 32core pmxcfs[1832]: [main] notice: resolved node name '32core' to '192.168.199.12' for default node IP address Dec 04 03:29:34 32core pmxcfs[1832]: [main] notice: resolved node name '32core' to '192.168.199.12' for default node IP address Dec 04 03:29:34 32core postfix[1831]: postfix: Postfix is using backwards-compatible default settings Dec 04 03:29:34 32core postfix[1831]: postfix: See https://www.postfix.org/COMPATIBILITY_README.html for details Dec 04 03:29:34 32core postfix[1831]: postfix: To disable backwards compatibility use "postconf compatibility_level=3.6" and "postfix reload" Dec 04 03:29:34 32core postfix[1831]: Postfix is using backwards-compatible default settings Dec 04 03:29:34 32core postfix[1831]: See https://www.postfix.org/COMPATIBILITY_README.html for details Dec 04 03:29:34 32core postfix[1831]: To disable backwards compatibility use "postconf compatibility_level=3.6" and "postfix reload" Dec 04 03:29:34 32core iscsid[1840]: iSCSI logger with pid=1846 started! Dec 04 03:29:34 32core systemd[1]: Started iscsid.service - iSCSI initiator daemon (iscsid). Dec 04 03:29:34 32core systemd[1]: open-iscsi.service - Login to default iSCSI targets was skipped because no trigger condition checks were met. Dec 04 03:29:34 32core systemd[1]: Reached target remote-fs-pre.target - Preparation for Remote File Systems. Dec 04 03:29:34 32core systemd[1]: Reached target remote-fs.target - Remote File Systems. Dec 04 03:29:34 32core systemd[1]: Reached target pve-storage.target - PVE Storage Target. Dec 04 03:29:34 32core systemd[1]: Starting blk-availability.service - Availability of block devices... Dec 04 03:29:34 32core systemd[1]: systemd-pcrphase.service - TPM PCR Barrier (User) was skipped because of an unmet condition check (ConditionSecurity=measured-uki). Dec 04 03:29:34 32core systemd[1]: Starting systemd-user-sessions.service - Permit User Sessions... Dec 04 03:29:34 32core systemd[1]: Finished lxc-net.service - LXC network bridge setup. Dec 04 03:29:34 32core systemd[1]: Finished blk-availability.service - Availability of block devices. Dec 04 03:29:34 32core kernel: Loading iSCSI transport class v2.0-870. Dec 04 03:29:34 32core systemd[1]: Starting lxc.service - LXC Container Initialization and Autoboot Code... Dec 04 03:29:34 32core systemd[1]: Finished systemd-user-sessions.service - Permit User Sessions. Dec 04 03:29:34 32core systemd[1]: Started getty(a)tty1.service - Getty on tty1. Dec 04 03:29:34 32core systemd[1]: Reached target getty.target - Login Prompts. Dec 04 03:29:34 32core sshd[1855]: Server listening on 0.0.0.0 port 22. Dec 04 03:29:34 32core sshd[1855]: Server listening on :: port 22. Dec 04 03:29:34 32core systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Dec 04 03:29:34 32core systemd[1]: Finished lxc.service - LXC Container Initialization and Autoboot Code. Dec 04 03:29:34 32core postfix[1986]: postfix: Postfix is using backwards-compatible default settings Dec 04 03:29:34 32core postfix[1986]: postfix: See https://www.postfix.org/COMPATIBILITY_README.html for details Dec 04 03:29:34 32core postfix[1986]: postfix: To disable backwards compatibility use "postconf compatibility_level=3.6" and "postfix reload" Dec 04 03:29:34 32core postfix[1986]: Postfix is using backwards-compatible default settings Dec 04 03:29:34 32core postfix[1986]: See https://www.postfix.org/COMPATIBILITY_README.html for details Dec 04 03:29:34 32core postfix[1986]: To disable backwards compatibility use "postconf compatibility_level=3.6" and "postfix reload" Dec 04 03:29:34 32core postfix/master[1994]: daemon started -- version 3.10.5, configuration /etc/postfix Dec 04 03:29:34 32core systemd[1]: Started postfix.service - Postfix Mail Transport Agent (main/default instance). Dec 04 03:29:35 32core iscsid[1846]: iSCSI daemon with pid=1847 started! Dec 04 03:29:35 32core systemd[1]: Started pve-cluster.service - The Proxmox VE cluster filesystem. Dec 04 03:29:35 32core systemd[1]: corosync.service - Corosync Cluster Engine was skipped because of an unmet condition check (ConditionPathExists=/etc/corosync/corosync.conf). Dec 04 03:29:35 32core systemd[1]: Started cron.service - Regular background program processing daemon. Dec 04 03:29:35 32core systemd[1]: Starting pve-firewall-commit.service - Commit Proxmox VE Firewall changes... Dec 04 03:29:35 32core systemd[1]: Starting pve-firewall.service - Proxmox VE firewall... Dec 04 03:29:35 32core systemd[1]: Starting pve-sdn-commit.service - Commit Proxmox VE SDN changes... Dec 04 03:29:35 32core systemd[1]: Starting pvedaemon.service - PVE API Daemon... Dec 04 03:29:35 32core systemd[1]: Starting pvestatd.service - PVE Status Daemon... Dec 04 03:29:35 32core cron[2002]: (CRON) INFO (pidfile fd = 3) Dec 04 03:29:35 32core cron[2002]: (CRON) INFO (Running @reboot jobs) Dec 04 03:29:35 32core systemd[1]: Finished pve-firewall-commit.service - Commit Proxmox VE Firewall changes. Dec 04 03:29:35 32core pve-sdn-commit[2005]: No changes to SDN configuration detected, skipping reload Dec 04 03:29:35 32core systemd[1]: Finished pve-sdn-commit.service - Commit Proxmox VE SDN changes. Dec 04 03:29:36 32core pve-firewall[2018]: starting server Dec 04 03:29:36 32core pvestatd[2020]: starting server Dec 04 03:29:36 32core systemd[1]: Started pve-firewall.service - Proxmox VE firewall. Dec 04 03:29:36 32core systemd[1]: Started pvestatd.service - PVE Status Daemon. Dec 04 03:29:36 32core pvedaemon[2046]: starting server Dec 04 03:29:36 32core pvedaemon[2046]: starting 3 worker(s) Dec 04 03:29:36 32core pvedaemon[2046]: worker 2047 started Dec 04 03:29:36 32core pvedaemon[2046]: worker 2048 started Dec 04 03:29:36 32core pvedaemon[2046]: worker 2049 started Dec 04 03:29:36 32core systemd[1]: Started pvedaemon.service - PVE API Daemon. Dec 04 03:29:36 32core systemd[1]: Starting pve-ha-crm.service - PVE Cluster HA Resource Manager Daemon... Dec 04 03:29:36 32core systemd[1]: Starting pveproxy.service - PVE API Proxy Server... Dec 04 03:29:37 32core pve-ha-crm[2056]: starting server Dec 04 03:29:37 32core pve-ha-crm[2056]: status change startup => wait_for_quorum Dec 04 03:29:37 32core systemd[1]: Started pve-ha-crm.service - PVE Cluster HA Resource Manager Daemon. Dec 04 03:29:37 32core ModemManager[1735]: <msg> [base-manager] couldn't check support for device '/sys/devices/pci0000:40/0000:40:01.1/0000:41:00.0/0000:42:03.0/0000:45:00.0': not supported by any plugin Dec 04 03:29:37 32core ModemManager[1735]: <msg> [base-manager] couldn't check support for device '/sys/devices/pci0000:40/0000:40:01.1/0000:41:00.0/0000:42:04.0/0000:46:00.0': not supported by any plugin Dec 04 03:29:37 32core ModemManager[1735]: <msg> [base-manager] couldn't check support for device '/sys/devices/pci0000:40/0000:40:01.1/0000:41:00.0/0000:42:05.0/0000:47:00.0': not supported by any plugin Dec 04 03:29:37 32core pveproxy[2058]: starting server Dec 04 03:29:37 32core pveproxy[2058]: starting 3 worker(s) Dec 04 03:29:37 32core pveproxy[2058]: worker 2059 started Dec 04 03:29:37 32core pveproxy[2058]: worker 2060 started Dec 04 03:29:37 32core pveproxy[2058]: worker 2061 started Dec 04 03:29:37 32core systemd[1]: Started pveproxy.service - PVE API Proxy Server. Dec 04 03:29:37 32core systemd[1]: Starting pve-ha-lrm.service - PVE Local HA Resource Manager Daemon... Dec 04 03:29:37 32core systemd[1]: Starting spiceproxy.service - PVE SPICE Proxy Server... Dec 04 03:29:37 32core spiceproxy[2067]: starting server Dec 04 03:29:37 32core spiceproxy[2067]: starting 1 worker(s) Dec 04 03:29:37 32core spiceproxy[2067]: worker 2068 started Dec 04 03:29:37 32core systemd[1]: Started spiceproxy.service - PVE SPICE Proxy Server. Dec 04 03:29:38 32core pve-ha-lrm[2070]: starting server Dec 04 03:29:38 32core pve-ha-lrm[2070]: status change startup => wait_for_agent_lock Dec 04 03:29:38 32core systemd[1]: Started pve-ha-lrm.service - PVE Local HA Resource Manager Daemon. Dec 04 03:29:38 32core systemd[1]: Starting pve-guests.service - PVE guests... Dec 04 03:29:38 32core systemd[1]: systemd-rfkill.service: Deactivated successfully. Dec 04 03:29:38 32core pve-guests[2075]: <root@pam> starting task UPID:32core:0000081C:000005D6:69308FA2:startall::root@pam: Dec 04 03:29:38 32core pve-guests[2075]: <root@pam> end task UPID:32core:0000081C:000005D6:69308FA2:startall::root@pam: OK Dec 04 03:29:38 32core systemd[1]: Finished pve-guests.service - PVE guests. Dec 04 03:29:38 32core systemd[1]: Starting pvescheduler.service - Proxmox VE scheduler... Dec 04 03:29:39 32core kernel: atlantic 0000:45:00.0 enp69s0: atlantic: link change old 0 new 10000 Dec 04 03:29:39 32core kernel: vmbr0: port 1(enp69s0) entered blocking state Dec 04 03:29:39 32core kernel: vmbr0: port 1(enp69s0) entered forwarding state Dec 04 03:29:39 32core pvescheduler[2079]: starting server Dec 04 03:29:39 32core systemd[1]: Started pvescheduler.service - Proxmox VE scheduler. Dec 04 03:29:39 32core systemd[1]: Reached target multi-user.target - Multi-User System. Dec 04 03:29:39 32core systemd[1]: Reached target graphical.target - Graphical Interface. Dec 04 03:29:39 32core systemd[1]: Startup finished in 40.684s (firmware) + 6.890s (loader) + 4.456s (kernel) + 11.103s (userspace) = 1min 3.135s. Dec 04 03:30:03 32core netavark[1535]: timeout met: exiting after 30 secs of inactivity Dec 04 03:30:03 32core systemd[1]: netavark-dhcp-proxy.service: Deactivated successfully. Dec 04 03:30:07 32core pvedaemon[2047]: <root@pam> successful auth for user 'root@pam' Dec 04 03:30:17 32core chronyd[1703]: Selected source 15.204.87.223 (2.debian.pool.ntp.org) Dec 04 03:30:17 32core chronyd[1703]: System clock TAI offset set to 37 seconds Dec 04 03:30:17 32core sshd-session[2221]: Accepted password for root from 192.168.199.2 port 6648 ssh2 Dec 04 03:30:17 32core sshd-session[2221]: pam_unix(sshd:session): session opened for user root(uid=0) by root(uid=0) Dec 04 03:30:17 32core systemd[1]: Created slice user-0.slice - User Slice of UID 0. Dec 04 03:30:17 32core systemd[1]: Starting user-runtime-dir(a)0.service - User Runtime Directory /run/user/0... Dec 04 03:30:17 32core systemd-logind[1555]: New session 1 of user root. Dec 04 03:30:17 32core systemd[1]: Finished user-runtime-dir(a)0.service - User Runtime Directory /run/user/0. Dec 04 03:30:17 32core systemd[1]: Starting user(a)0.service - User Manager for UID 0... Dec 04 03:30:17 32core (systemd)[2227]: pam_unix(systemd-user:session): session opened for user root(uid=0) by root(uid=0) Dec 04 03:30:17 32core systemd-logind[1555]: New session 2 of user root. Dec 04 03:30:17 32core systemd[2227]: Queued start job for default target default.target. Dec 04 03:30:17 32core systemd[2227]: Created slice app.slice - User Application Slice. Dec 04 03:30:17 32core systemd[2227]: Reached target paths.target - Paths. Dec 04 03:30:17 32core systemd[2227]: Reached target timers.target - Timers. Dec 04 03:30:17 32core systemd[2227]: Starting dbus.socket - D-Bus User Message Bus Socket... Dec 04 03:30:17 32core systemd[2227]: Listening on dirmngr.socket - GnuPG network certificate management daemon. Dec 04 03:30:17 32core systemd[2227]: Listening on gpg-agent-browser.socket - GnuPG cryptographic agent and passphrase cache (access for web browsers). Dec 04 03:30:17 32core systemd[2227]: Listening on gpg-agent-extra.socket - GnuPG cryptographic agent and passphrase cache (restricted). Dec 04 03:30:17 32core systemd[2227]: Starting gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation)... Dec 04 03:30:17 32core systemd[2227]: Starting gpg-agent.socket - GnuPG cryptographic agent and passphrase cache... Dec 04 03:30:17 32core systemd[2227]: Listening on keyboxd.socket - GnuPG public key management service. Dec 04 03:30:17 32core systemd[2227]: Starting ssh-agent.socket - OpenSSH Agent socket... Dec 04 03:30:17 32core systemd[2227]: Listening on dbus.socket - D-Bus User Message Bus Socket. Dec 04 03:30:17 32core systemd[2227]: Listening on ssh-agent.socket - OpenSSH Agent socket. Dec 04 03:30:17 32core systemd[2227]: Listening on gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation). Dec 04 03:30:17 32core systemd[2227]: Listening on gpg-agent.socket - GnuPG cryptographic agent and passphrase cache. Dec 04 03:30:17 32core systemd[2227]: Reached target sockets.target - Sockets. Dec 04 03:30:17 32core systemd[2227]: Reached target basic.target - Basic System. Dec 04 03:30:17 32core systemd[2227]: Reached target default.target - Main User Target. Dec 04 03:30:17 32core systemd[2227]: Startup finished in 272ms. Dec 04 03:30:17 32core systemd[1]: Started user(a)0.service - User Manager for UID 0. Dec 04 03:30:18 32core systemd[1]: Started session-1.scope - Session 1 of User root. Dec 04 03:30:19 32core chronyd[1703]: Selected source 12.205.28.193 (2.debian.pool.ntp.org) Dec 04 03:30:26 32core kernel: NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 Dec 04 03:31:57 32core kernel: BUG: kernel NULL pointer dereference, address: 0000000000000008 Dec 04 03:31:57 32core kernel: #PF: supervisor write access in kernel mode Dec 04 03:31:57 32core kernel: #PF: error_code(0x0002) - not-present page Dec 04 03:31:57 32core kernel: PGD 0 P4D 0 Dec 04 03:31:57 32core kernel: Oops: Oops: 0002 [#1] SMP NOPTI Dec 04 03:31:57 32core kernel: CPU: 50 UID: 0 PID: 2365 Comm: zstd Tainted: P O 6.17.2-2-pve #1 PREEMPT(voluntary) Dec 04 03:31:57 32core kernel: Tainted: [P]=PROPRIETARY_MODULE, [O]=OOT_MODULE Dec 04 03:31:57 32core kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./TRX40 Creator, BIOS P1.88C 12/23/2024 Dec 04 03:31:57 32core kernel: RIP: 0010:list_lru_del+0xc0/0x180 Dec 04 03:31:57 32core kernel: Code: 00 00 00 00 00 00 00 80 48 39 c2 74 64 e8 58 62 db ff 49 8b 55 00 49 39 d5 0f 84 9c 00 00 00 49 8b 4d 00 49 8b 55 08 4c 89 e7 <48> 89 51 08 48 89 0a 4d 89 6d 00 4d 89 6d 08 49 83 6f 10 01 e8 f7 Dec 04 03:31:57 32core kernel: RSP: 0018:ffffd3ed589ef600 EFLAGS: 00010086 Dec 04 03:31:57 32core kernel: RAX: 0000000000000000 RBX: ffffffff997f07e0 RCX: 0000000000000000 Dec 04 03:31:57 32core kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b43c3fa30e8 Dec 04 03:31:57 32core kernel: RBP: ffffd3ed589ef640 R08: 0000000000000000 R09: 0000000000000000 Dec 04 03:31:57 32core kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8b43c3fa30e8 Dec 04 03:31:57 32core kernel: R13: ffff8b61a34319e8 R14: ffff8b43dfcfabc0 R15: ffff8b43c3fa30d0 Dec 04 03:31:57 32core kernel: FS: 00007ea767a956c0(0000) GS:ffff8b6325286000(0000) knlGS:0000000000000000 Dec 04 03:31:57 32core kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Dec 04 03:31:57 32core kernel: CR2: 0000000000000008 CR3: 000000014b096000 CR4: 0000000000350ef0 Dec 04 03:31:57 32core kernel: Call Trace: Dec 04 03:31:57 32core kernel: <TASK> Dec 04 03:31:57 32core kernel: list_lru_del_obj+0x7f/0xe0 Dec 04 03:31:57 32core kernel: workingset_update_node+0x61/0xb0 Dec 04 03:31:57 32core kernel: xas_store+0x25f/0x6d0 Dec 04 03:31:57 32core kernel: __filemap_add_folio+0x234/0x510 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? __pfx_workingset_update_node+0x10/0x10 Dec 04 03:31:57 32core kernel: filemap_add_folio+0x99/0xf0 Dec 04 03:31:57 32core kernel: page_cache_ra_order+0x205/0x3b0 Dec 04 03:31:57 32core kernel: page_cache_async_ra+0x19f/0x1f0 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? filemap_get_read_batch+0x15b/0x2e0 Dec 04 03:31:57 32core kernel: filemap_readahead.isra.0+0x73/0xb0 Dec 04 03:31:57 32core kernel: filemap_get_pages+0x40f/0x740 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? sched_clock_noinstr+0x9/0x10 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: filemap_read+0x114/0x4a0 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: generic_file_read_iter+0xbb/0x110 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? apparmor_file_permission+0x1f/0x30 Dec 04 03:31:57 32core kernel: ext4_file_read_iter+0x60/0x200 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: vfs_read+0x274/0x390 Dec 04 03:31:57 32core kernel: ksys_read+0x6f/0xf0 Dec 04 03:31:57 32core kernel: __x64_sys_read+0x19/0x30 Dec 04 03:31:57 32core kernel: x64_sys_call+0x1e95/0x2330 Dec 04 03:31:57 32core kernel: do_syscall_64+0x80/0xa30 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? ksys_read+0xd9/0xf0 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? __x64_sys_read+0x19/0x30 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? x64_sys_call+0x1e95/0x2330 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? do_syscall_64+0xb8/0xa30 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? ext4_file_read_iter+0x60/0x200 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? vfs_read+0x274/0x390 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? ksys_read+0xd9/0xf0 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? __x64_sys_read+0x19/0x30 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? x64_sys_call+0x1e95/0x2330 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? do_syscall_64+0xb8/0xa30 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? do_syscall_64+0xb8/0xa30 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? do_syscall_64+0xb8/0xa30 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: ? do_syscall_64+0xb8/0xa30 Dec 04 03:31:57 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:31:57 32core kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Dec 04 03:31:57 32core kernel: RIP: 0033:0x7ea7684929ee Dec 04 03:31:57 32core kernel: Code: 08 0f 85 f5 4b ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 Dec 04 03:31:57 32core kernel: RSP: 002b:00007ea767a94d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 Dec 04 03:31:57 32core kernel: RAX: ffffffffffffffda RBX: 00007ea767a956c0 RCX: 00007ea7684929ee Dec 04 03:31:57 32core kernel: RDX: 0000000000020000 RSI: 00007ea76716c010 RDI: 0000000000000003 Dec 04 03:31:57 32core kernel: RBP: 00007ea7685ddfd0 R08: 0000000000000000 R09: 0000000000000000 Dec 04 03:31:57 32core kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007ea76716c010 Dec 04 03:31:57 32core kernel: R13: 0000000000020000 R14: 00007ea7685dde80 R15: 0000000000020000 Dec 04 03:31:57 32core kernel: </TASK> Dec 04 03:31:57 32core kernel: Modules linked in: ebtable_filter ebtables ip_set ip6table_raw iptable_raw ip6table_filter ip6_tables iptable_filter scsi_transport_iscsi nf_tables qrtr bonding tls at24 spd5118 softdog sunrpc binfmt_misc nfnetlink_log iwlmvm mac80211 libarc4 btusb btrtl btintel btbcm btmtk iwlwifi bluetooth input_leds cfg80211 amd_atl intel_rapl_msr intel_rapl_common sch_fq_codel amdgpu amdxcp snd_hda_codec_atihdmi edac_mce_amd drm_panel_backlight_quirks snd_hda_codec_hdmi snd_hda_intel gpu_sched radeon snd_hda_codec drm_buddy snd_usb_audio kvm_amd snd_hda_core drm_ttm_helper snd_usbmidi_lib ttm drm_exec snd_intel_dspcfg snd_ump drm_suballoc_helper snd_intel_sdw_acpi snd_rawmidi snd_hwdep kvm snd_seq_device drm_display_helper snd_pcm cec polyval_clmulni snd_timer rc_core ghash_clmulni_intel snd aesni_intel joydev i2c_algo_bit rapl wmi_bmof pcspkr ccp mxm_wmi ee1004 video k10temp soundcore mac_hid mc zfs(PO) spl(O) vhost_net vhost vhost_iotlb tap nct6683 lm83 vfio_pci vfio_pci_core irqbypass vfio_iommu_type1 vfio iommufd Dec 04 03:31:57 32core kernel: msr efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 btrfs blake2b_generic xor raid6_pq hid_multitouch uas usb_storage usbkbd usbmouse hid_generic usbhid hid dm_thin_pool dm_persistent_data dm_bio_prison dm_bufio nvme atlantic r8169 nvme_core xhci_pci ahci nvme_keyring libahci macsec realtek nvme_auth xhci_hcd i2c_piix4 i2c_smbus wmi Dec 04 03:31:57 32core kernel: CR2: 0000000000000008 Dec 04 03:31:57 32core kernel: ---[ end trace 0000000000000000 ]--- Dec 04 03:31:57 32core kernel: RIP: 0010:list_lru_del+0xc0/0x180 Dec 04 03:31:57 32core kernel: Code: 00 00 00 00 00 00 00 80 48 39 c2 74 64 e8 58 62 db ff 49 8b 55 00 49 39 d5 0f 84 9c 00 00 00 49 8b 4d 00 49 8b 55 08 4c 89 e7 <48> 89 51 08 48 89 0a 4d 89 6d 00 4d 89 6d 08 49 83 6f 10 01 e8 f7 Dec 04 03:31:57 32core kernel: RSP: 0018:ffffd3ed589ef600 EFLAGS: 00010086 Dec 04 03:31:57 32core kernel: RAX: 0000000000000000 RBX: ffffffff997f07e0 RCX: 0000000000000000 Dec 04 03:31:57 32core kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b43c3fa30e8 Dec 04 03:31:57 32core kernel: RBP: ffffd3ed589ef640 R08: 0000000000000000 R09: 0000000000000000 Dec 04 03:31:57 32core kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8b43c3fa30e8 Dec 04 03:31:57 32core kernel: R13: ffff8b61a34319e8 R14: ffff8b43dfcfabc0 R15: ffff8b43c3fa30d0 Dec 04 03:31:57 32core kernel: FS: 00007ea767a956c0(0000) GS:ffff8b6325286000(0000) knlGS:0000000000000000 Dec 04 03:31:57 32core kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Dec 04 03:31:57 32core kernel: CR2: 0000000000000008 CR3: 000000014b096000 CR4: 0000000000350ef0 Dec 04 03:31:57 32core kernel: note: zstd[2365] exited with irqs disabled Dec 04 03:31:57 32core kernel: note: zstd[2365] exited with preempt_count 2 Dec 04 03:32:33 32core kernel: Oops: general protection fault, probably for non-canonical address 0x9a3ae555524f6ec2: 0000 [#2] SMP NOPTI Dec 04 03:32:33 32core kernel: CPU: 50 UID: 0 PID: 1547 Comm: ksmtuned Tainted: P D O 6.17.2-2-pve #1 PREEMPT(voluntary) Dec 04 03:32:33 32core kernel: Tainted: [P]=PROPRIETARY_MODULE, [D]=DIE, [O]=OOT_MODULE Dec 04 03:32:33 32core kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./TRX40 Creator, BIOS P1.88C 12/23/2024 Dec 04 03:32:33 32core kernel: RIP: 0010:kmem_cache_alloc_noprof+0x203/0x3e0 Dec 04 03:32:33 32core kernel: Code: 84 ce fe ff ff 48 85 db 0f 84 c5 fe ff ff 48 8b 03 48 c1 e8 36 41 39 c2 0f 85 b5 fe ff ff 41 8b 44 24 28 49 8b 34 24 48 01 f8 <48> 8b 18 48 89 c1 49 33 9c 24 b8 00 00 00 48 89 f8 48 0f c9 48 31 Dec 04 03:32:33 32core kernel: RSP: 0018:ffffd3ed42de3990 EFLAGS: 00010282 Dec 04 03:32:33 32core kernel: RAX: 9a3ae555524f6ec2 RBX: fffffc073b8d0c00 RCX: 0000000000000000 Dec 04 03:32:33 32core kernel: RDX: 0000000033e52032 RSI: ffffffff996b42d0 RDI: 9a3ae555524f6c82 Dec 04 03:32:33 32core kernel: RBP: ffffd3ed42de39d8 R08: 0000000000000028 R09: 0000000000000000 Dec 04 03:32:33 32core kernel: R10: 00000000ffffffff R11: 00000000003fffff R12: ffff8b43c0055e00 Dec 04 03:32:33 32core kernel: R13: 0000000000002820 R14: 0000000000000240 R15: ffffffff97cac677 Dec 04 03:32:33 32core kernel: FS: 000074d3ea109740(0000) GS:ffff8b6325286000(0000) knlGS:0000000000000000 Dec 04 03:32:33 32core kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Dec 04 03:32:33 32core kernel: CR2: 000074d3ea2f57b0 CR3: 00000001112c5000 CR4: 0000000000350ef0 Dec 04 03:32:33 32core kernel: Call Trace: Dec 04 03:32:33 32core kernel: <TASK> Dec 04 03:32:33 32core kernel: radix_tree_node_alloc.constprop.0+0xb7/0x100 Dec 04 03:32:33 32core kernel: idr_get_free+0x26d/0x330 Dec 04 03:32:33 32core kernel: idr_alloc_u32+0x7d/0xf0 Dec 04 03:32:33 32core kernel: idr_alloc_cyclic+0x57/0xc0 Dec 04 03:32:33 32core kernel: alloc_pid+0x1b8/0x410 Dec 04 03:32:33 32core kernel: copy_process+0x1298/0x1ca0 Dec 04 03:32:33 32core kernel: kernel_clone+0xb6/0x4b0 Dec 04 03:32:33 32core kernel: __do_sys_clone+0x68/0xa0 Dec 04 03:32:33 32core kernel: __x64_sys_clone+0x25/0x40 Dec 04 03:32:33 32core kernel: x64_sys_call+0x1b4d/0x2330 Dec 04 03:32:33 32core kernel: do_syscall_64+0x80/0xa30 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? __handle_mm_fault+0xadb/0xfd0 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? count_memcg_events+0xd7/0x1a0 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? __set_task_blocked+0x29/0x80 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? _copy_to_user+0x31/0x60 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? __x64_sys_rt_sigprocmask+0xee/0x160 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? x64_sys_call+0x178d/0x2330 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? do_syscall_64+0xb8/0xa30 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? x64_sys_call+0x178d/0x2330 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? do_syscall_64+0xb8/0xa30 Dec 04 03:32:33 32core kernel: ? irqentry_exit+0x43/0x50 Dec 04 03:32:33 32core kernel: ? srso_return_thunk+0x5/0x5f Dec 04 03:32:33 32core kernel: ? exc_page_fault+0x90/0x1b0 Dec 04 03:32:33 32core kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Dec 04 03:32:33 32core kernel: RIP: 0033:0x74d3ea1e9202 Dec 04 03:32:33 32core kernel: Code: 89 e7 e8 71 3b f6 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 89 c5 85 c0 75 31 64 48 8b 04 25 10 00 00 Dec 04 03:32:33 32core kernel: RSP: 002b:00007ffd24e48590 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 Dec 04 03:32:33 32core kernel: RAX: ffffffffffffffda RBX: 00007ffd24e48590 RCX: 000074d3ea1e9202 Dec 04 03:32:33 32core kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 Dec 04 03:32:33 32core kernel: RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 Dec 04 03:32:33 32core kernel: R10: 000074d3ea109a10 R11: 0000000000000246 R12: 00007ffd24e48700 Dec 04 03:32:33 32core kernel: R13: 0000000000000000 R14: 0000000000000000 R15: 00000000ffffffff Dec 04 03:32:33 32core kernel: </TASK> Dec 04 03:32:33 32core kernel: Modules linked in: ebtable_filter ebtables ip_set ip6table_raw iptable_raw ip6table_filter ip6_tables iptable_filter scsi_transport_iscsi nf_tables qrtr bonding tls at24 spd5118 softdog sunrpc binfmt_misc nfnetlink_log iwlmvm mac80211 libarc4 btusb btrtl btintel btbcm btmtk iwlwifi bluetooth input_leds cfg80211 amd_atl intel_rapl_msr intel_rapl_common sch_fq_codel amdgpu amdxcp snd_hda_codec_atihdmi edac_mce_amd drm_panel_backlight_quirks snd_hda_codec_hdmi snd_hda_intel gpu_sched radeon snd_hda_codec drm_buddy snd_usb_audio kvm_amd snd_hda_core drm_ttm_helper snd_usbmidi_lib ttm drm_exec snd_intel_dspcfg snd_ump drm_suballoc_helper snd_intel_sdw_acpi snd_rawmidi snd_hwdep kvm snd_seq_device drm_display_helper snd_pcm cec polyval_clmulni snd_timer rc_core ghash_clmulni_intel snd aesni_intel joydev i2c_algo_bit rapl wmi_bmof pcspkr ccp mxm_wmi ee1004 video k10temp soundcore mac_hid mc zfs(PO) spl(O) vhost_net vhost vhost_iotlb tap nct6683 lm83 vfio_pci vfio_pci_core irqbypass vfio_iommu_type1 vfio iommufd Dec 04 03:32:33 32core kernel: msr efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 btrfs blake2b_generic xor raid6_pq hid_multitouch uas usb_storage usbkbd usbmouse hid_generic usbhid hid dm_thin_pool dm_persistent_data dm_bio_prison dm_bufio nvme atlantic r8169 nvme_core xhci_pci ahci nvme_keyring libahci macsec realtek nvme_auth xhci_hcd i2c_piix4 i2c_smbus wmi Dec 04 03:32:33 32core kernel: ---[ end trace 0000000000000000 ]--- Dec 04 03:32:33 32core kernel: RIP: 0010:list_lru_del+0xc0/0x180 Dec 04 03:32:33 32core kernel: Code: 00 00 00 00 00 00 00 80 48 39 c2 74 64 e8 58 62 db ff 49 8b 55 00 49 39 d5 0f 84 9c 00 00 00 49 8b 4d 00 49 8b 55 08 4c 89 e7 <48> 89 51 08 48 89 0a 4d 89 6d 00 4d 89 6d 08 49 83 6f 10 01 e8 f7 Dec 04 03:32:33 32core kernel: RSP: 0018:ffffd3ed589ef600 EFLAGS: 00010086 Dec 04 03:32:33 32core kernel: RAX: 0000000000000000 RBX: ffffffff997f07e0 RCX: 0000000000000000 Dec 04 03:32:33 32core kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b43c3fa30e8 Dec 04 03:32:33 32core kernel: RBP: ffffd3ed589ef640 R08: 0000000000000000 R09: 0000000000000000 Dec 04 03:32:33 32core kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8b43c3fa30e8 Dec 04 03:32:33 32core kernel: R13: ffff8b61a34319e8 R14: ffff8b43dfcfabc0 R15: ffff8b43c3fa30d0 Dec 04 03:32:33 32core kernel: FS: 000074d3ea109740(0000) GS:ffff8b6325286000(0000) knlGS:0000000000000000 Dec 04 03:32:33 32core kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Dec 04 03:32:33 32core kernel: CR2: 000074d3ea2f57b0 CR3: 00000001112c5000 CR4: 0000000000350ef0 Dec 04 03:32:33 32core kernel: note: ksmtuned[1547] exited with preempt_count 2 Dec 04 03:32:33 32core systemd[1]: ksmtuned.service: Main process exited, code=killed, status=11/SEGV Dec 04 03:32:33 32core systemd[1]: ksmtuned.service: Failed with result 'signal'. Dec 04 03:33:00 32core kernel: watchdog: BUG: soft lockup - CPU#17 stuck for 23s! [pve-firewall:2018] -- 此致礼罗勇刚 Yours sincerely, Yonggang Luo

2 weeks, 2 days

2
2
0 0

[PATCH v2 0/2] netrom: fix deadlock and refcount leak in nr_rt_device_down

by Junjie Cao

Hi, syzbot reported a circular locking dependency in the NET/ROM routing code involving nr_neigh_list_lock, nr_node_list_lock and nr_node->node_lock when nr_rt_device_down() interacts with the ioctl path. This series fixes that deadlock and also addresses a long-standing reference count leak found while auditing the same code. Patch 1/2 refactors nr_rt_device_down() to avoid nested locking between nr_neigh_list_lock and nr_node_list_lock by doing two separate passes over nodes and neighbours, and adjusts nr_rt_free() to follow the same lock ordering. Patch 2/2 fixes a per-route reference count leak by dropping nr_neigh->count and calling nr_neigh_put() when removing routes from nr_rt_device_down(), mirroring the behaviour of nr_dec_obs()/nr_del_node(). [1] https://syzkaller.appspot.com/bug?extid=14afda08dc3484d5db82 Thanks, Junjie

2 weeks, 2 days

1
2
0 0

[PATCH v2] net/handshake: restore destructor on submit failure

by caoping

handshake_req_submit() replaces sk->sk_destruct but never restores it when submission fails before the request is hashed. handshake_sk_destruct() then returns early and the original destructor never runs, leaking the socket. Restore sk_destruct on the error path. Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Signed-off-by: caoping <caoping(a)cmss.chinamobile.com> --- net/handshake/request.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/handshake/request.c b/net/handshake/request.c index 274d2c89b6b2..89435ed755cd 100644 --- a/net/handshake/request.c +++ b/net/handshake/request.c @@ -276,6 +276,8 @@ int handshake_req_submit(struct socket *sock, struct handshake_req *req, out_unlock: spin_unlock(&hn->hn_lock); out_err: + /* Restore original destructor so socket teardown still runs on failure */ + req->hr_sk->sk_destruct = req->hr_odestruct; trace_handshake_submit_err(net, req, req->hr_sk, ret); handshake_req_destroy(req); return ret; base-commit: 4a26e7032d7d57c998598c08a034872d6f0d3945 -- 2.47.3

2 weeks, 2 days

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror