April 2023 - openSUSE Kernel Bugs - openSUSE Mailing Lists

[Bug 1210329] use after free bug in da9150_charger_remove due to race condition
by bugzilla-noreply＠suse.com 12 Apr '23

12 Apr '23

http://bugzilla.suse.com/show_bug.cgi?id=1210329 http://bugzilla.suse.com/show_bug.cgi?id=1210329#c7 --- Comment #7 from Zheng Wang <hackerzheng666(a)gmail.com> --- (In reply to Takashi Iwai from comment #6) > OK, then let's toss to the security team. > > The corresponding upstream commit is 06615d11cc78162dfd5116efb71f29eb29502d37 Thanks for your effort. Hope you have a nice day. Best regards, Zheng -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1210329] use after free bug in da9150_charger_remove due to race condition
by bugzilla-noreply＠suse.com 12 Apr '23

12 Apr '23

http://bugzilla.suse.com/show_bug.cgi?id=1210329 http://bugzilla.suse.com/show_bug.cgi?id=1210329#c6 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Kernel |Security Flags|needinfo?(kernel-bugs@opens | |use.org) | Assignee|kernel-bugs(a)opensuse.org |security-team(a)suse.de --- Comment #6 from Takashi Iwai <tiwai(a)suse.com> --- OK, then let's toss to the security team. The corresponding upstream commit is 06615d11cc78162dfd5116efb71f29eb29502d37 -- You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug.

1 0

[Bug 1210329] use after free bug in da9150_charger_remove due to race condition
by bugzilla-noreply＠suse.com 12 Apr '23

12 Apr '23

http://bugzilla.suse.com/show_bug.cgi?id=1210329 http://bugzilla.suse.com/show_bug.cgi?id=1210329#c5 Zheng Wang <hackerzheng666(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kernel-bugs(a)opensuse.org Flags| |needinfo?(kernel-bugs@opens | |use.org) --- Comment #5 from Zheng Wang <hackerzheng666(a)gmail.com> --- (In reply to Takashi Iwai from comment #4) > (In reply to Zheng Wang from comment #3) > > (In reply to Takashi Iwai from comment #2) > > > The fix patch has been already backported to stable and SLE15-SP4/SP5 > > > branches. > > > > May I ask if this issue will be assigned with a CVE number ? > > No, unless you explicitly ask for it. > Do you want us to request a CVE number? Sorry for my unfamiliar about bug-report policy. Thanks for your explain and I want to request a CVE number. Here is the credit Information: Zheng Wang(@xmzyshypnc), Zhuorao Yang(@A1ex), Yang Hu(@BlueSheep) and Zong Cao(@P1umer) If you need any other information, please feel free to let me know. Best reagrds, Zheng Wang -- You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug.

1 0

needinfo requested: [Bug 1210329] use after free bug in da9150_charger_remove due to race condition
by bugzilla-noreply＠suse.com 12 Apr '23

12 Apr '23

Zheng Wang <hackerzheng666(a)gmail.com> has asked openSUSE Kernel Bugs <kernel-bugs(a)opensuse.org> for needinfo: Bug 1210329: use after free bug in da9150_charger_remove due to race condition http://bugzilla.suse.com/show_bug.cgi?id=1210329 --- Comment #5 from Zheng Wang <hackerzheng666(a)gmail.com> --- (In reply to Takashi Iwai from comment #4) > (In reply to Zheng Wang from comment #3) > > (In reply to Takashi Iwai from comment #2) > > > The fix patch has been already backported to stable and SLE15-SP4/SP5 > > > branches. > > > > May I ask if this issue will be assigned with a CVE number ? > > No, unless you explicitly ask for it. > Do you want us to request a CVE number? Sorry for my unfamiliar about bug-report policy. Thanks for your explain and I want to request a CVE number. Here is the credit Information: Zheng Wang(@xmzyshypnc), Zhuorao Yang(@A1ex), Yang Hu(@BlueSheep) and Zong Cao(@P1umer) If you need any other information, please feel free to let me know. Best reagrds, Zheng Wang

1 0

[Bug 1206843] Lenovo T14s Gen3 AMD resume from sleep broken
by bugzilla-noreply＠suse.com 12 Apr '23

12 Apr '23

http://bugzilla.suse.com/show_bug.cgi?id=1206843 http://bugzilla.suse.com/show_bug.cgi?id=1206843#c26 --- Comment #26 from Takashi Iwai <tiwai(a)suse.com> --- The above is the dmesg output from 6.3-rc6 kernel with S3. The dock is removed before S3 resume (around 35.0), then it spews the kernel warning from DRM core. The graphics on the laptop screen returns, nevertheless. Then, reconnecting the dock and configuring the graphics leads to another kernel warning (around 61.0), leading to the failure like: amdgpu 0000:33:00.0: [drm] *ERROR* No payload for [MST PORT:00000000e4d2801f] found in mst state 0000000002176b50 In the log, it's tried again around (62.9), leading to the similar error in the end. -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1206843] Lenovo T14s Gen3 AMD resume from sleep broken
by bugzilla-noreply＠suse.com 12 Apr '23

12 Apr '23

http://bugzilla.suse.com/show_bug.cgi?id=1206843 http://bugzilla.suse.com/show_bug.cgi?id=1206843#c25 --- Comment #25 from Takashi Iwai <tiwai(a)suse.com> --- Created attachment 866267 --> http://bugzilla.suse.com/attachment.cgi?id=866267&action=edit dmesg from S3 test with dock removal on 6.3-rc6 kernel (failed) -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1206843] Lenovo T14s Gen3 AMD resume from sleep broken
by bugzilla-noreply＠suse.com 12 Apr '23

12 Apr '23

http://bugzilla.suse.com/show_bug.cgi?id=1206843 http://bugzilla.suse.com/show_bug.cgi?id=1206843#c24 --- Comment #24 from Takashi Iwai <tiwai(a)suse.com> --- (In reply to Patrik Jakobsson from comment #22) > Christian, can you please try the kernel at home:patrikjakobsson:bsc1206843 I checked it and this kernel resulted in NULL dereference Oops at plugging the dock and configuring the graphics, unfortunately. Meanwhile, I backported DP-MST-related patches on top of my amdgpu backports, too (even with kABI workaround). You can try the kernel in OBS home:tiwai:bsc1206843-2 repo: http://download.opensuse.org/repositories/home:/tiwai:/bsc1206843-2/pool/ This should lead to the similar result as on the recent upstream 6.2.x and 6.3-rc. *HOWEVER* I noticed that the S3/S4 with the removal of the dock doesn't work properly even with the recent upstream 6.2.9 and 6.3-rc6. My patched kernel above suffers from the same problem, too. So this should be addressed in the upstream at first, then we may backport the fixes later. -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1209724] kernel can not be built for s390x because of outside array bounds
by bugzilla-noreply＠suse.com 12 Apr '23

12 Apr '23

The content of this message was lost. It was probably cross-posted to multiple lists and previously handled on another list.

1 0

[Bug 1210329] New: use after free bug in da9150_charger_remove due to race condition
by bugzilla_noreply＠suse.com 12 Apr '23

12 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1210329 Bug ID: 1210329 Summary: use after free bug in da9150_charger_remove due to race condition Classification: openSUSE Product: openSUSE Distribution Version: Leap 16.0 Hardware: x86-64 OS: Linux Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: hackerzheng666(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- In da9150_charger_probe, &charger->otg_work is bound with da9150_charger_otg_work. da9150_charger_otg_ncb may be called to start the work. If we remove the module which will call da9150_charger_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: Fix it by canceling the work before cleanup in the da9150_charger_remove CPU0 CPUc1 |da9150_charger_otg_work da9150_charger_remove | power_supply_unregister | device_unregister | power_supply_dev_release | kfree(psy) | | | power_supply_changed(charger->usb); | //use There's no kernel log. Here is the patch link of [1] Linux-v6.3 and [2]patchwork [1] https://lore.kernel.org/all/CAHk-=whcaHLNpb7Mu_QX7ABwPgyRyfW-V8=v4Mv0S22fpj… [2] https://lore.kernel.org/all/20230328142620.323334485@linuxfoundation.org/ -- You are receiving this mail because: You are the assignee for the bug.

1 4

[Bug 1210271] New: nouveau: RIP: 0010:__handle_irq_event_percpu+0x150/0x1a0
by bugzilla_noreply＠suse.com 11 Apr '23

11 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1210271 Bug ID: 1210271 Summary: nouveau: RIP: 0010:__handle_irq_event_percpu+0x150/0x1a0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: dufresnep(a)zoho.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 866217 --> http://bugzilla.opensuse.org/attachment.cgi?id=866217&action=edit first dmesg.txt This is a GTX 660 card I acquired in the last few days. Seems stable under Windows 11, although one of the 2 fans stops seconds after starting computer. Have issued with nouveau driver on probably all distributions tested when using drm-nouveau (softwre renderer seems fine, but too slow). Usually about CTX_SWITCH, (happend just now while doing Alt-Tab), but this one is an error in a irq_event: oh well, much more complex that I thought: journalctl -b -1 > err3.txt localhost:~ # ls -lh err3.txt -rw-r--r-- 1 root root 604K Apr 9 20:35 err3.txt localhost:~ # I'll try to attach the file. -- You are receiving this mail because: You are the assignee for the bug.

1 6