October 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] thermal: core: Reference count the zone in thermal_zone_get_by_id()
by Xiongfeng Wang 31 Oct '24

31 Oct '24

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.12-rc3 commit a42a5839f400e929c489bb1b58f54596c4535167 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF5 CVE: CVE-2024-50028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There are places in the thermal netlink code where nothing prevents the thermal zone object from going away while being accessed after it has been returned by thermal_zone_get_by_id(). To address this, make thermal_zone_get_by_id() get a reference on the thermal zone device object to be returned with the help of get_device(), under thermal_list_lock, and adjust all of its callers to this change with the help of the cleanup.h infrastructure. Fixes: 1ce50e7d408e ("thermal: core: genetlink support for events/cmd/sampling") Cc: 6.8+ <stable(a)vger.kernel.org> # 6.8+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Lukasz Luba <lukasz.luba(a)arm.com> Link: https://patch.msgid.link/6112242.lOV4Wx5bFT@rjwysocki.net Conflicts: drivers/thermal/thermal_netlink.c drivers/thermal/thermal_core.h [wangxiongfeng: fix conflict because __cleanup() based infrastructure DEFINE_CLASS() is not introduced.] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/thermal/thermal_core.c | 1 + drivers/thermal/thermal_netlink.c | 20 +++++++++++++++----- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 1cf49912dc96..49e3cb07ae9e 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -760,6 +760,7 @@ struct thermal_zone_device *thermal_zone_get_by_id(int id) mutex_lock(&thermal_list_lock); list_for_each_entry(tz, &thermal_tz_list, node) { if (tz->id == id) { + get_device(&tz->device); match = tz; break; } diff --git a/drivers/thermal/thermal_netlink.c b/drivers/thermal/thermal_netlink.c index dc535831b660..c50cd9ca1cc1 100644 --- a/drivers/thermal/thermal_netlink.c +++ b/drivers/thermal/thermal_netlink.c @@ -463,8 +463,10 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) return -EINVAL; start_trip = nla_nest_start(msg, THERMAL_GENL_ATTR_TZ_TRIP); - if (!start_trip) + if (!start_trip) { + put_device(&tz->device); return -EMSGSIZE; + } mutex_lock(&tz->lock); @@ -489,10 +491,13 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) nla_nest_end(msg, start_trip); + put_device(&tz->device); + return 0; out_cancel_nest: mutex_unlock(&tz->lock); + put_device(&tz->device); return -EMSGSIZE; } @@ -514,13 +519,17 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p) ret = thermal_zone_get_temp(tz, &temp); if (ret) - return ret; + goto out; if (nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_ID, id) || - nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_TEMP, temp)) - return -EMSGSIZE; + nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_TEMP, temp)) { + ret = -EMSGSIZE; + goto out; + } - return 0; +out: + put_device(&tz->device); + return ret; } static int thermal_genl_cmd_tz_get_gov(struct param *p) @@ -546,6 +555,7 @@ static int thermal_genl_cmd_tz_get_gov(struct param *p) ret = -EMSGSIZE; mutex_unlock(&tz->lock); + put_device(&tz->device); return ret; } -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-50063
by Pu Lehui 31 Oct '24

31 Oct '24

Xu Kuohai (2): bpf: Prevent tail call between progs attached to different hooks selftests/bpf: Add test for lsm tail call include/linux/bpf.h | 1 + kernel/bpf/core.c | 15 ++++++ .../selftests/bpf/prog_tests/test_lsm.c | 46 ++++++++++++++++++- .../selftests/bpf/progs/lsm_tailcall.c | 34 ++++++++++++++ 4 files changed, 95 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/progs/lsm_tailcall.c -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 15243/23920] arch/arm64/kernel/mpam/mpam_device.c:99:24: warning: no previous prototype for 'mpam_component_get'
by kernel test robot 31 Oct '24

31 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c6de47cf1f63ecc3ed337601e06ab8dc1c707563 commit: 73d5cd426ed0b4aed565a11aa8eb86d90b444d94 [15243/23920] arm64/mpam: Add mpam driver discovery phase and kbuild boiler plate config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241031/202410311541.Ld1wpJ0T-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241031/202410311541.Ld1wpJ0T-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410311541.Ld1wpJ0T-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/mpam/mpam_device.c:99:24: warning: no previous prototype for 'mpam_component_get' [-Wmissing-prototypes] 99 | struct mpam_component *mpam_component_get(struct mpam_class *class, int id, | ^~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_device.c:190:1: warning: no previous prototype for '__mpam_device_create' [-Wmissing-prototypes] 190 | __mpam_device_create(u8 level_idx, enum mpam_class_types type, | ^~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_device.c:248:12: warning: no previous prototype for 'mpam_discovery_start' [-Wmissing-prototypes] 248 | int __init mpam_discovery_start(void) | ^~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_device.c:256:12: warning: no previous prototype for 'mpam_discovery_complete' [-Wmissing-prototypes] 256 | int __init mpam_discovery_complete(void) | ^~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_device.c:261:13: warning: no previous prototype for 'mpam_discovery_failed' [-Wmissing-prototypes] 261 | void __init mpam_discovery_failed(void) | ^~~~~~~~~~~~~~~~~~~~~ vim +/mpam_component_get +99 arch/arm64/kernel/mpam/mpam_device.c 98 > 99 struct mpam_component *mpam_component_get(struct mpam_class *class, int id, 100 bool alloc) 101 { 102 struct mpam_component *comp; 103 104 list_for_each_entry(comp, &class->components, class_list) { 105 if (comp->comp_id == id) 106 return comp; 107 } 108 109 if (!alloc) 110 return ERR_PTR(-ENOENT); 111 112 comp = mpam_component_alloc(id); 113 if (IS_ERR(comp)) 114 return comp; 115 116 list_add(&comp->class_list, &class->components); 117 118 return comp; 119 } 120 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] smack: tcp: ipv4, fix incorrect labeling
by Dong Chenchen 31 Oct '24

31 Oct '24

From: Casey Schaufler <casey(a)schaufler-ca.com> stable inclusion from stable-v5.10.226 commit a948ec993541db4ef392b555c37a1186f4d61670 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU3F CVE: CVE-2024-47659 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550 ] Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So, 1) returned packets are incorrectly labeled ('foo' instead of 'bar') 2) 'bar' can write to 'foo' without being authorized to write. Here is a scenario how to see this: * Take two machines, let's call them C and S, with active Smack in the default state (no settings, no rules, no labeled hosts, only builtin labels) * At S, add Smack rule 'foo bar w' (labels 'foo' and 'bar' are instantiated at S at this moment) * At S, at label 'bar', launch a program that listens for incoming tcp/ipv4 connections * From C, at label 'foo', connect to the listener at S. (label 'foo' is instantiated at C at this moment) Connection succeedes and works. * Send some data in both directions. * Collect network traffic of this connection. All packets in both directions are labeled with the CIPSO of the label 'foo'. Hence, label 'bar' writes to 'foo' without being authorized, and even without ever being known at C. If anybody cares: exactly the same happens with DCCP. This behavior 1st manifested in release 2.6.29.4 (see Fixes below) and it looks unintentional. At least, no explanation was provided. I changed returned packes label into the 'bar', to bring it into line with the Smack documentation claims. Signed-off-by: Konstantin Andreev <andreev(a)swemel.ru> Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- security/smack/smack_lsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 6d8aaa4a86ba..81275e49c0b3 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4211,7 +4211,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, rcu_read_unlock(); if (hskp == NULL) - rc = netlbl_req_setattr(req, &skp->smk_netlabel); + rc = netlbl_req_setattr(req, &ssp->smk_out->smk_netlabel); else netlbl_req_delattr(req); -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] smack: tcp: ipv4, fix incorrect labeling
by Dong Chenchen 31 Oct '24

31 Oct '24

From: Casey Schaufler <casey(a)schaufler-ca.com> stable inclusion from stable-v4.19.322 commit d3f56c653c65f170b172d3c23120bc64ada645d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU3F CVE: CVE-2024-47659 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550 ] Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So, 1) returned packets are incorrectly labeled ('foo' instead of 'bar') 2) 'bar' can write to 'foo' without being authorized to write. Here is a scenario how to see this: * Take two machines, let's call them C and S, with active Smack in the default state (no settings, no rules, no labeled hosts, only builtin labels) * At S, add Smack rule 'foo bar w' (labels 'foo' and 'bar' are instantiated at S at this moment) * At S, at label 'bar', launch a program that listens for incoming tcp/ipv4 connections * From C, at label 'foo', connect to the listener at S. (label 'foo' is instantiated at C at this moment) Connection succeedes and works. * Send some data in both directions. * Collect network traffic of this connection. All packets in both directions are labeled with the CIPSO of the label 'foo'. Hence, label 'bar' writes to 'foo' without being authorized, and even without ever being known at C. If anybody cares: exactly the same happens with DCCP. This behavior 1st manifested in release 2.6.29.4 (see Fixes below) and it looks unintentional. At least, no explanation was provided. I changed returned packes label into the 'bar', to bring it into line with the Smack documentation claims. Signed-off-by: Konstantin Andreev <andreev(a)swemel.ru> Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- security/smack/smack_lsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 221de4c755c3..919f67d88f10 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4252,7 +4252,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, rcu_read_unlock(); if (hskp == NULL) - rc = netlbl_req_setattr(req, &skp->smk_netlabel); + rc = netlbl_req_setattr(req, &ssp->smk_out->smk_netlabel); else netlbl_req_delattr(req); -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-50055
by Yongqiang Liu 31 Oct '24

31 Oct '24

Zijun Hu (1): driver core: bus: Fix double free in driver API bus_register() drivers/base/bus.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.25.1

2 2

[PATCH OLK-5.10] selinux: add the processing of the failure of avc_add_xperms_decision()
by Gu Bowen 31 Oct '24

31 Oct '24

From: Zhen Lei <thunder.leizhen(a)huawei.com> stable inclusion from stable-v6.6.48 commit 5295951b53bd372767600a0296b01ee031ca1b1b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0X4B Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6dd1e4c045afa6a4ba5d46f044c83bd357c593c2 upstream. When avc_add_xperms_decision() fails, the information recorded by the new avc node is incomplete. In this case, the new avc node should be released instead of replacing the old avc node. Cc: stable(a)vger.kernel.org Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") Suggested-by: Stephen Smalley <stephen.smalley.work(a)gmail.com> Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Acked-by: Stephen Smalley <stephen.smalley.work(a)gmail.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: security/selinux/avc.c [Due to commit e67b79850fcc4 (selinux: stop passing selinux_state pointers and their offspring) stop passing selinux_state pointers, which not merge in this version, so add pointer to function parameter.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/selinux/avc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/security/selinux/avc.c b/security/selinux/avc.c index ab71d0948205..06c89a8b6d77 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -927,7 +927,11 @@ static int avc_update_node(struct selinux_avc *avc, node->ae.avd.auditdeny &= ~perms; break; case AVC_CALLBACK_ADD_XPERMS: - avc_add_xperms_decision(node, xpd); + rc = avc_add_xperms_decision(node, xpd); + if (rc) { + avc_node_kill(avc, node); + goto out_unlock; + } break; } avc_node_replace(avc, node, orig); -- 2.25.1

2 1

[openeuler:OLK-5.10 12950/30000] drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:263:5: warning: no previous prototype for 'txgbe_read_v2p_mailbox'
by kernel test robot 31 Oct '24

31 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ef5d1e35e964c2582be72addba582d0529ec73c7 commit: 3ddd74dceeba1f4ea8b20db59276ea3c6eded3d5 [12950/30000] openeuler: net: txgbe: Fix some known bugs, merge net-swift txgbe-1.2.3 out-of-tree config: x86_64-randconfig-002-20241031 (https://download.01.org/0day-ci/archive/20241031/202410311329.lKBVIwUs-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241031/202410311329.lKBVIwUs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410311329.lKBVIwUs-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:25: drivers/net/ethernet/netswift/txgbe/txgbe.h: In function 'txgbe_misc_isb': drivers/net/ethernet/netswift/txgbe/txgbe.h:927:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 927 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c: At top level: drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:132:5: warning: no previous prototype for 'txgbe_poll_for_msg' [-Wmissing-prototypes] 132 | int txgbe_poll_for_msg(struct txgbe_hw *hw, u16 mbx_id) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:162:5: warning: no previous prototype for 'txgbe_poll_for_ack' [-Wmissing-prototypes] 162 | int txgbe_poll_for_ack(struct txgbe_hw *hw, u16 mbx_id) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:263:5: warning: no previous prototype for 'txgbe_read_v2p_mailbox' [-Wmissing-prototypes] 263 | u32 txgbe_read_v2p_mailbox(struct txgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:284:5: warning: no previous prototype for 'txgbe_check_for_bit_vf' [-Wmissing-prototypes] 284 | int txgbe_check_for_bit_vf(struct txgbe_hw *hw, u32 mask) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:300:5: warning: no previous prototype for 'txgbe_check_for_msg_vf' [-Wmissing-prototypes] 300 | int txgbe_check_for_msg_vf(struct txgbe_hw *hw, u16 __always_unused mbx_id) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:320:5: warning: no previous prototype for 'txgbe_check_for_ack_vf' [-Wmissing-prototypes] 320 | int txgbe_check_for_ack_vf(struct txgbe_hw *hw, u16 __always_unused mbx_id) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:340:5: warning: no previous prototype for 'txgbe_check_for_rst_vf' [-Wmissing-prototypes] 340 | int txgbe_check_for_rst_vf(struct txgbe_hw *hw, u16 __always_unused mbx_id) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:359:5: warning: no previous prototype for 'txgbe_obtain_mbx_lock_vf' [-Wmissing-prototypes] 359 | int txgbe_obtain_mbx_lock_vf(struct txgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:387:5: warning: no previous prototype for 'txgbe_write_mbx_vf' [-Wmissing-prototypes] 387 | int txgbe_write_mbx_vf(struct txgbe_hw *hw, u32 *msg, u16 size, | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:425:5: warning: no previous prototype for 'txgbe_read_mbx_vf' [-Wmissing-prototypes] 425 | int txgbe_read_mbx_vf(struct txgbe_hw *hw, u32 *msg, u16 size, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:483:5: warning: no previous prototype for 'txgbe_check_for_bit_pf' [-Wmissing-prototypes] 483 | int txgbe_check_for_bit_pf(struct txgbe_hw *hw, u32 mask, int index) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:503:5: warning: no previous prototype for 'txgbe_check_for_msg_pf' [-Wmissing-prototypes] 503 | int txgbe_check_for_msg_pf(struct txgbe_hw *hw, u16 vf) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:525:5: warning: no previous prototype for 'txgbe_check_for_ack_pf' [-Wmissing-prototypes] 525 | int txgbe_check_for_ack_pf(struct txgbe_hw *hw, u16 vf) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:547:5: warning: no previous prototype for 'txgbe_check_for_rst_pf' [-Wmissing-prototypes] 547 | int txgbe_check_for_rst_pf(struct txgbe_hw *hw, u16 vf) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:572:5: warning: no previous prototype for 'txgbe_obtain_mbx_lock_pf' [-Wmissing-prototypes] 572 | int txgbe_obtain_mbx_lock_pf(struct txgbe_hw *hw, u16 vf) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:601:5: warning: no previous prototype for 'txgbe_write_mbx_pf' [-Wmissing-prototypes] 601 | int txgbe_write_mbx_pf(struct txgbe_hw *hw, u32 *msg, u16 size, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c:644:5: warning: no previous prototype for 'txgbe_read_mbx_pf' [-Wmissing-prototypes] 644 | int txgbe_read_mbx_pf(struct txgbe_hw *hw, u32 *msg, u16 size, | ^~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/netswift/txgbe/txgbe_bp.h:22, from drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:19: drivers/net/ethernet/netswift/txgbe/txgbe.h: In function 'txgbe_misc_isb': drivers/net/ethernet/netswift/txgbe/txgbe.h:927:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 927 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_bp.c: At top level: >> drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:450:5: warning: no previous prototype for 'read_phy_lane_txeq' [-Wmissing-prototypes] 450 | int read_phy_lane_txeq(unsigned short lane, struct txgbe_adapter *adapter, int post_t, int mode) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:513:5: warning: no previous prototype for 'en_cl72_krtr' [-Wmissing-prototypes] 513 | int en_cl72_krtr(unsigned int enable, struct txgbe_adapter *adapter) | ^~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_bp.c:567:5: warning: no previous prototype for 'chk_cl72_krtr_status' [-Wmissing-prototypes] 567 | int chk_cl72_krtr_status(struct txgbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/netswift/txgbe/txgbe_phy.h:28, from drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:27: drivers/net/ethernet/netswift/txgbe/txgbe.h: In function 'txgbe_misc_isb': drivers/net/ethernet/netswift/txgbe/txgbe.h:927:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 927 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c: At top level: drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1004:6: warning: no previous prototype for 'txgbe_add_uc_addr' [-Wmissing-prototypes] 1004 | void txgbe_add_uc_addr(struct txgbe_hw *hw, u8 *addr, u32 vmdq) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:1138:6: warning: no previous prototype for 'txgbe_set_mta' [-Wmissing-prototypes] 1138 | void txgbe_set_mta(struct txgbe_hw *hw, u8 *mc_addr) | ^~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2707:5: warning: no previous prototype for 'txgbe_setup_mac_link_hostif' [-Wmissing-prototypes] 2707 | s32 txgbe_setup_mac_link_hostif(struct txgbe_hw *hw, u32 speed) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2744:5: warning: no previous prototype for 'txgbe_crc16_ccitt' [-Wmissing-prototypes] 2744 | u16 txgbe_crc16_ccitt(const u8 *buf, int size) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2853:4: warning: no previous prototype for 'fmgr_cmd_op' [-Wmissing-prototypes] 2853 | u8 fmgr_cmd_op(struct txgbe_hw *hw, u32 cmd, u32 cmd_addr) | ^~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2874:4: warning: no previous prototype for 'fmgr_usr_cmd_op' [-Wmissing-prototypes] 2874 | u8 fmgr_usr_cmd_op(struct txgbe_hw *hw, u32 usr_cmd) | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2884:4: warning: no previous prototype for 'flash_erase_chip' [-Wmissing-prototypes] 2884 | u8 flash_erase_chip(struct txgbe_hw *hw) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2890:4: warning: no previous prototype for 'flash_erase_sector' [-Wmissing-prototypes] 2890 | u8 flash_erase_sector(struct txgbe_hw *hw, u32 sec_addr) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2897:5: warning: no previous prototype for 'flash_read_dword' [-Wmissing-prototypes] 2897 | u32 flash_read_dword(struct txgbe_hw *hw, u32 addr) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2907:4: warning: no previous prototype for 'flash_write_dword' [-Wmissing-prototypes] 2907 | u8 flash_write_dword(struct txgbe_hw *hw, u32 addr, u32 dword) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2922:5: warning: no previous prototype for 'txgbe_flash_write_cab' [-Wmissing-prototypes] 2922 | int txgbe_flash_write_cab(struct txgbe_hw *hw, u32 addr, u32 value, u16 lan_id) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2944:5: warning: no previous prototype for 'txgbe_flash_read_cab' [-Wmissing-prototypes] 2944 | int txgbe_flash_read_cab(struct txgbe_hw *hw, u32 addr, u16 lan_id) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2975:5: warning: no previous prototype for 'txgbe_flash_write_unlock' [-Wmissing-prototypes] 2975 | int txgbe_flash_write_unlock(struct txgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2998:5: warning: no previous prototype for 'txgbe_flash_write_lock' [-Wmissing-prototypes] 2998 | int txgbe_flash_write_lock(struct txgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4396:5: warning: no previous prototype for 'txgbe_enable_rx_adapter' [-Wmissing-prototypes] 4396 | s32 txgbe_enable_rx_adapter(struct txgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4417:5: warning: no previous prototype for 'txgbe_set_sgmii_an37_ability' [-Wmissing-prototypes] 4417 | s32 txgbe_set_sgmii_an37_ability(struct txgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:4963:5: warning: no previous prototype for 'txgbe_set_link_to_sfi' [-Wmissing-prototypes] 4963 | s32 txgbe_set_link_to_sfi(struct txgbe_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:5345:5: warning: no previous prototype for 'txgbe_reset_misc' [-Wmissing-prototypes] 5345 | int txgbe_reset_misc(struct txgbe_hw *hw) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6593:5: warning: no previous prototype for 'txgbe_read_ee_hostif_data' [-Wmissing-prototypes] 6593 | s32 txgbe_read_ee_hostif_data(struct txgbe_hw *hw, u16 offset, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:6737:5: warning: no previous prototype for 'txgbe_write_ee_hostif_data' [-Wmissing-prototypes] 6737 | s32 txgbe_write_ee_hostif_data(struct txgbe_hw *hw, u16 offset, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3188:17: warning: 'txgbe_emc_therm_limit' defined but not used [-Wunused-const-variable=] 3188 | STATIC const u8 txgbe_emc_therm_limit[4] = { | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:3182:17: warning: 'txgbe_emc_temp_data' defined but not used [-Wunused-const-variable=] 3182 | STATIC const u8 txgbe_emc_temp_data[4] = { | ^~~~~~~~~~~~~~~~~~~ vim +/txgbe_read_v2p_mailbox +263 drivers/net/ethernet/netswift/txgbe/txgbe_mbx.c 255 256 /** 257 * txgbe_read_v2p_mailbox - read v2p mailbox 258 * @hw: pointer to the HW structure 259 * 260 * This function is used to read the v2p mailbox without losing the read to 261 * clear status bits. 262 **/ > 263 u32 txgbe_read_v2p_mailbox(struct txgbe_hw *hw) 264 { 265 u32 v2p_mailbox = rd32(hw, TXGBE_VXMAILBOX); 266 267 v2p_mailbox |= hw->mbx.v2p_mailbox; 268 /* read and clear mirrored mailbox flags */ 269 v2p_mailbox |= rd32a(hw, TXGBE_VXMBMEM, TXGBE_VXMAILBOX_SIZE); 270 wr32a(hw, TXGBE_VXMBMEM, TXGBE_VXMAILBOX_SIZE, 0); 271 hw->mbx.v2p_mailbox |= v2p_mailbox & TXGBE_VXMAILBOX_R2C_BITS; 272 273 return v2p_mailbox; 274 } 275 276 /** 277 * txgbe_check_for_bit_vf - Determine if a status bit was set 278 * @hw: pointer to the HW structure 279 * @mask: bitmask for bits to be tested and cleared 280 * 281 * This function is used to check for the read to clear bits within 282 * the V2P mailbox. 283 **/ > 284 int txgbe_check_for_bit_vf(struct txgbe_hw *hw, u32 mask) 285 { 286 u32 mailbox = txgbe_read_v2p_mailbox(hw); 287 288 hw->mbx.v2p_mailbox &= ~mask; 289 290 return (mailbox & mask ? 0 : TXGBE_ERR_MBX); 291 } 292 293 /** 294 * txgbe_check_for_msg_vf - checks to see if the PF has sent mail 295 * @hw: pointer to the HW structure 296 * @mbx_id: id of mailbox to check 297 * 298 * returns SUCCESS if the PF has set the Status bit or else ERR_MBX 299 **/ > 300 int txgbe_check_for_msg_vf(struct txgbe_hw *hw, u16 __always_unused mbx_id) 301 { 302 int err = TXGBE_ERR_MBX; 303 304 /* read clear the pf sts bit */ 305 if (!txgbe_check_for_bit_vf(hw, TXGBE_VXMAILBOX_PFSTS)) { 306 err = 0; 307 hw->mbx.stats.reqs++; 308 } 309 310 return err; 311 } 312 313 /** 314 * txgbe_check_for_ack_vf - checks to see if the PF has ACK'd 315 * @hw: pointer to the HW structure 316 * @mbx_id: id of mailbox to check 317 * 318 * returns SUCCESS if the PF has set the ACK bit or else ERR_MBX 319 **/ > 320 int txgbe_check_for_ack_vf(struct txgbe_hw *hw, u16 __always_unused mbx_id) 321 { 322 int err = TXGBE_ERR_MBX; 323 324 /* read clear the pf ack bit */ 325 if (!txgbe_check_for_bit_vf(hw, TXGBE_VXMAILBOX_PFACK)) { 326 err = 0; 327 hw->mbx.stats.acks++; 328 } 329 330 return err; 331 } 332 333 /** 334 * txgbe_check_for_rst_vf - checks to see if the PF has reset 335 * @hw: pointer to the HW structure 336 * @mbx_id: id of mailbox to check 337 * 338 * returns true if the PF has set the reset done bit or else false 339 **/ > 340 int txgbe_check_for_rst_vf(struct txgbe_hw *hw, u16 __always_unused mbx_id) 341 { 342 int err = TXGBE_ERR_MBX; 343 344 if (!txgbe_check_for_bit_vf(hw, (TXGBE_VXMAILBOX_RSTD | 345 TXGBE_VXMAILBOX_RSTI))) { 346 err = 0; 347 hw->mbx.stats.rsts++; 348 } 349 350 return err; 351 } 352 353 /** 354 * txgbe_obtain_mbx_lock_vf - obtain mailbox lock 355 * @hw: pointer to the HW structure 356 * 357 * return SUCCESS if we obtained the mailbox lock 358 **/ > 359 int txgbe_obtain_mbx_lock_vf(struct txgbe_hw *hw) 360 { 361 int err = TXGBE_ERR_MBX; 362 u32 mailbox; 363 364 /* Take ownership of the buffer */ 365 wr32(hw, TXGBE_VXMAILBOX, TXGBE_VXMAILBOX_VFU); 366 367 /* reserve mailbox for vf use */ 368 mailbox = txgbe_read_v2p_mailbox(hw); 369 if (mailbox & TXGBE_VXMAILBOX_VFU) 370 err = 0; 371 else 372 ERROR_REPORT2(TXGBE_ERROR_POLLING, 373 "Failed to obtain mailbox lock for VF"); 374 375 return err; 376 } 377 378 /** 379 * txgbe_write_mbx_vf - Write a message to the mailbox 380 * @hw: pointer to the HW structure 381 * @msg: The message buffer 382 * @size: Length of buffer 383 * @mbx_id: id of mailbox to write 384 * 385 * returns SUCCESS if it successfully copied message into the buffer 386 **/ > 387 int txgbe_write_mbx_vf(struct txgbe_hw *hw, u32 *msg, u16 size, 388 u16 __always_unused mbx_id) 389 { 390 int err; 391 u16 i; 392 393 /* lock the mailbox to prevent pf/vf race condition */ 394 err = txgbe_obtain_mbx_lock_vf(hw); 395 if (err) 396 goto out_no_write; 397 398 /* flush msg and acks as we are overwriting the message buffer */ 399 txgbe_check_for_msg_vf(hw, 0); 400 txgbe_check_for_ack_vf(hw, 0); 401 402 /* copy the caller specified message to the mailbox memory buffer */ 403 for (i = 0; i < size; i++) 404 wr32a(hw, TXGBE_VXMBMEM, i, msg[i]); 405 406 /* update stats */ 407 hw->mbx.stats.msgs_tx++; 408 409 /* Drop VFU and interrupt the PF to tell it a message has been sent */ 410 wr32(hw, TXGBE_VXMAILBOX, TXGBE_VXMAILBOX_REQ); 411 412 out_no_write: 413 return err; 414 } 415 416 /** 417 * txgbe_read_mbx_vf - Reads a message from the inbox intended for vf 418 * @hw: pointer to the HW structure 419 * @msg: The message buffer 420 * @size: Length of buffer 421 * @mbx_id: id of mailbox to read 422 * 423 * returns SUCCESS if it successfully read message from buffer 424 **/ > 425 int txgbe_read_mbx_vf(struct txgbe_hw *hw, u32 *msg, u16 size, 426 u16 __always_unused mbx_id) 427 { 428 int err = 0; 429 u16 i; 430 431 /* lock the mailbox to prevent pf/vf race condition */ 432 err = txgbe_obtain_mbx_lock_vf(hw); 433 if (err) 434 goto out_no_read; 435 436 /* copy the message from the mailbox memory buffer */ 437 for (i = 0; i < size; i++) 438 msg[i] = rd32a(hw, TXGBE_VXMBMEM, i); 439 440 /* Acknowledge receipt and release mailbox, then we're done */ 441 wr32(hw, TXGBE_VXMAILBOX, TXGBE_VXMAILBOX_ACK); 442 443 /* update stats */ 444 hw->mbx.stats.msgs_rx++; 445 446 out_no_read: 447 return err; 448 } 449 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 7622/30000] drivers/gpu/drm/amd/amdgpu/amdgpu_object.o: warning: objtool: amdgpu_bo_release_notify()+0x2a3: unreachable instruction
by kernel test robot 31 Oct '24

31 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f3af467e22b5869f73a416310ce9ba5558603b5b commit: 613db224006696c7a210a0f850f37d8b4ad88fad [7622/30000] drm/amdgpu: Fix recursive locking warning config: x86_64-buildonly-randconfig-001-20241030 (https://download.01.org/0day-ci/archive/20241031/202410311230.Fxmrdp4m-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241031/202410311230.Fxmrdp4m-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410311230.Fxmrdp4m-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/gpu/drm/amd/amdgpu/amdgpu_object.o: warning: objtool: amdgpu_bo_release_notify()+0x2a3: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
by Xia Fukun 31 Oct '24

31 Oct '24

From: Junlin Li <make24(a)iscas.ac.cn> mainline inclusion from mainline-v6.12-rc5 commit 46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJG CVE: CVE-2024-47697 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue. Fixes: df70ddad81b4 ("[media] rtl2830: implement PID filter") Signed-off-by: Junlin Li <make24(a)iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/media/dvb-frontends/rtl2830.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c index c0659568471b..8cda25902d63 100644 --- a/drivers/media/dvb-frontends/rtl2830.c +++ b/drivers/media/dvb-frontends/rtl2830.c @@ -619,7 +619,7 @@ static int rtl2830_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, int on index, pid, onoff); /* skip invalid PIDs (0x2000) */ - if (pid > 0x1fff || index > 32) + if (pid > 0x1fff || index >= 32) return 0; if (onoff) -- 2.34.1

2 1