- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] vhost/vdpa: Add support to bind, unbind, attach and detach iommufd
by frenkjason 31 Mar '25

31 Mar '25

From: frankyj915 <yangjieyj.yang(a)huawei.com> VHOST_VDPA_BIND_IOMMUFD, VHOST_VDPA_UNBIND_IOMMUFD, VHOST_VDPA_ATTACH_IOMMUFD_PT and VHOST_VDPA_DETACH_IOMMUFD_PT are introduced. Signed-off-by: frankyj915 <yangjieyj.yang(a)huawei.com> --- drivers/vhost/vdpa.c | 105 +++++++++++++++++++++++++++++++ include/uapi/linux/vhost.h | 28 +++++++++ include/uapi/linux/vhost_types.h | 5 ++ tools/include/uapi/linux/vhost.h | 28 +++++++++ 4 files changed, 166 insertions(+) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index ef7009a9d5ec..6d18e8cca2f0 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -22,9 +22,12 @@ #include <linux/vdpa.h> #include <linux/nospec.h> #include <linux/vhost.h> +#include <linux/iommufd.h> #include "vhost.h" +MODULE_IMPORT_NS(IOMMUFD); + enum { VHOST_VDPA_BACKEND_FEATURES = (1ULL << VHOST_BACKEND_F_IOTLB_MSG_V2) | @@ -60,6 +63,8 @@ struct vhost_vdpa { int in_batch; struct vdpa_iova_range range; u32 batch_asid; + struct iommufd_device *iommufd_dev; + bool iommufd_attached; }; static DEFINE_IDA(vhost_vdpa_ida); @@ -569,6 +574,89 @@ static long vhost_vdpa_resume(struct vhost_vdpa *v) return ops->resume(vdpa); } +static long vhost_vdpa_bind_iommufd(struct vhost_vdpa *v, int __user *argp) +{ + struct vhost_vdpa_bind_iommufd bind; + struct iommufd_ctx *iommufd_ctx; + struct iommufd_device *idev; + struct device *dma_dev = vdpa_get_dma_dev(v->vdpa); + struct iommu_group *iommu_group = iommu_group_get(dma_dev); + int ret; + + if (copy_from_user(&bind, argp, sizeof(bind))) + return -EFAULT; + + iommufd_ctx = iommufd_ctx_from_fd(bind.iommufd); + if (IS_ERR(iommufd_ctx)) + return PTR_ERR(iommufd_ctx); + + if (v->domain) { + iommu_detach_device(v->domain, dma_dev); + iommu_domain_free(v->domain); + v->domain = NULL; + } + + // Default iommu domain is created when vdpa device driver probes. + // Unuse default domain first to avoid failure when claiming dma owner. + if (dma_dev->bus && dma_dev->bus->dma_cleanup) + dma_dev->bus->dma_cleanup(dma_dev); + ret = iommu_group_claim_dma_owner(iommu_group, iommufd_ctx); + if (ret) + return ret; + + idev = iommufd_device_bind(iommufd_ctx, dma_dev, &bind.out_devid); + if (IS_ERR(idev)) + return PTR_ERR(idev); + v->iommufd_dev = idev; + + if (copy_to_user(argp, &bind, sizeof(bind))) + return -EFAULT; + return 0; +} + +static long vhost_vdpa_attach_iommufd_pt(struct vhost_vdpa *v, u32 __user *argp) +{ + u32 pt_id = 0; + int ret; + + if (copy_from_user(&pt_id, argp, sizeof(pt_id))) + return -EFAULT; + + ret = iommufd_device_attach(v->iommufd_dev, &pt_id); + if (ret) + return ret; + v->iommufd_attached = true; + + if (copy_to_user(argp, &pt_id, sizeof(pt_id))) + return -EFAULT; + return 0; +} + +static void vhost_vdpa_detach_iommufd_pt(struct vhost_vdpa *v) +{ + if (WARN_ON(!v->iommufd_dev) || !v->iommufd_attached) + return; + + iommufd_device_detach(v->iommufd_dev); + v->iommufd_attached = false; +} + +static void vhost_vdpa_unbind_iommufd(struct vhost_vdpa *v) +{ + struct device *dma_dev = vdpa_get_dma_dev(v->vdpa); + struct iommu_group *iommu_group = iommu_group_get(dma_dev); + + if (!v->iommufd_dev) + return; + + vhost_vdpa_detach_iommufd_pt(v); + iommufd_device_unbind(v->iommufd_dev); + v->iommufd_dev = NULL; + iommu_group_release_dma_owner(iommu_group); + if (dma_dev->bus && dma_dev->bus->dma_configure) + dma_dev->bus->dma_configure(dma_dev); +} + #ifdef CONFIG_VHOST_VDPA_MIGRATION static int vhost_vdpa_get_dev_buffer_size(struct vhost_vdpa *v, uint32_t __user *argp) @@ -916,6 +1004,18 @@ static long vhost_vdpa_unlocked_ioctl(struct file *filep, case VHOST_VDPA_RESUME: r = vhost_vdpa_resume(v); break; + case VHOST_VDPA_BIND_IOMMUFD: + r = vhost_vdpa_bind_iommufd(v, argp); + break; + case VHOST_VDPA_UNBIND_IOMMUFD: + vhost_vdpa_unbind_iommufd(v); + break; + case VHOST_VDPA_ATTACH_IOMMUFD_PT: + r = vhost_vdpa_attach_iommufd_pt(v, argp); + break; + case VHOST_VDPA_DETACH_IOMMUFD_PT: + vhost_vdpa_detach_iommufd_pt(v); + break; #ifdef CONFIG_VHOST_VDPA_MIGRATION case VHOST_GET_DEV_BUFFER_SIZE: r = vhost_vdpa_get_dev_buffer_size(v, argp); @@ -1556,6 +1656,8 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep) struct vhost_vdpa *v = filep->private_data; struct vhost_dev *d = &v->vdev; + vhost_vdpa_unbind_iommufd(v); + mutex_lock(&d->mutex); filep->private_data = NULL; vhost_vdpa_clean_irq(v); @@ -1709,6 +1811,9 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa) for (i = 0; i < VHOST_VDPA_IOTLB_BUCKETS; i++) INIT_HLIST_HEAD(&v->as[i]); + v->iommufd_dev = NULL; + v->iommufd_attached = false; + return 0; err: diff --git a/include/uapi/linux/vhost.h b/include/uapi/linux/vhost.h index a54098c7b0bc..898cde933168 100644 --- a/include/uapi/linux/vhost.h +++ b/include/uapi/linux/vhost.h @@ -223,6 +223,34 @@ */ #define VHOST_VDPA_RESUME _IO(VHOST_VIRTIO, 0x7E) +/* Bind a vDPA device to the specified iommufd + * + * After the return of this ioctl the vDPA device is binded to the specified + * iommufd, and the device id is also returned. + */ +#define VHOST_VDPA_BIND_IOMMUFD _IO(VHOST_VIRTIO, 0x90) + +/* Unbind a vDPA device from the specified iommufd + * + * After the return of this ioctl the vDPA device is unbinded from the specified + * iommufd. + */ +#define VHOST_VDPA_UNBIND_IOMMUFD _IO(VHOST_VIRTIO, 0x91) + +/* Associate the vDPA device with an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is attached to the bound + * iommufd. + */ +#define VHOST_VDPA_ATTACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x92) + +/* Detach the vDPA device from an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is detached from the address + * space within the bound iommufd. + */ +#define VHOST_VDPA_DETACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x93) + /* set and get device buffer */ #define VHOST_GET_DEV_BUFFER _IOR(VHOST_VIRTIO, 0xb0, struct vhost_vdpa_config) #define VHOST_SET_DEV_BUFFER _IOW(VHOST_VIRTIO, 0xb1, struct vhost_vdpa_config) diff --git a/include/uapi/linux/vhost_types.h b/include/uapi/linux/vhost_types.h index c7f25b0f7645..450214d2ada5 100644 --- a/include/uapi/linux/vhost_types.h +++ b/include/uapi/linux/vhost_types.h @@ -163,6 +163,11 @@ struct vhost_vdpa_iova_range { __u64 last; }; +struct vhost_vdpa_bind_iommufd { + __s32 iommufd; + __u32 out_devid; +}; + /* vhost vdpa device migration statue */ enum { VHOST_VDPA_DEVICE_START, diff --git a/tools/include/uapi/linux/vhost.h b/tools/include/uapi/linux/vhost.h index f5c48b61ab62..679c7b137f75 100644 --- a/tools/include/uapi/linux/vhost.h +++ b/tools/include/uapi/linux/vhost.h @@ -219,4 +219,32 @@ */ #define VHOST_VDPA_RESUME _IO(VHOST_VIRTIO, 0x7E) +/* Bind a vDPA device to the specified iommufd + * + * After the return of this ioctl the vDPA device is binded to the specified + * iommufd, and the device id is also returned. + */ +#define VHOST_VDPA_BIND_IOMMUFD _IO(VHOST_VIRTIO, 0x90) + +/* Unbind a vDPA device from the specified iommufd + * + * After the return of this ioctl the vDPA device is unbinded from the specified + * iommufd. + */ +#define VHOST_VDPA_UNBIND_IOMMUFD _IO(VHOST_VIRTIO, 0x91) + +/* Associate the vDPA device with an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is attached to the bound + * iommufd. + */ +#define VHOST_VDPA_ATTACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x92) + +/* Detach the vDPA device from an address space within the bound iommufd. + * + * After the return of this ioctl the vDPA device is detached from the address + * space within the bound iommufd. + */ +#define VHOST_VDPA_DETACH_IOMMUFD_PT _IO(VHOST_VIRTIO, 0x93) + #endif -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] nfc: nci: add flush_workqueue to prevent uaf
by Ye Bin 31 Mar '25

31 Mar '25

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v4.19.239 commit 1a1748d0dd0f0a98535c6baeef671c8722107639 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1G8 CVE: CVE-2022-49059 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ef27324e2cb7bb24542d6cb2571740eefe6b00dc ] Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF. This UAF is easy to trigger, crash trace by POC is like below [ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] <TASK> [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae To fix the UAF, this patch adds flush_workqueue() to ensure the nci_cmd_work is finished before the following del_timer_sync. This combination will promise the timer is actually detached. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- net/nfc/nci/core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index e6f1530f64f9..dad961aaeb83 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -560,6 +560,10 @@ static int nci_close_device(struct nci_dev *ndev) mutex_lock(&ndev->req_lock); if (!test_and_clear_bit(NCI_UP, &ndev->flags)) { + /* Need to flush the cmd wq in case + * there is a queued/running cmd_work + */ + flush_workqueue(ndev->cmd_wq); del_timer_sync(&ndev->cmd_timer); del_timer_sync(&ndev->data_timer); mutex_unlock(&ndev->req_lock); -- 2.34.1

2 1

[openeuler:OLK-5.10 2829/2829] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 31 Mar '25

31 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2d7a642a3b89c993676c887941944d0f932d2052 commit: abd5078bcd21063944ed133282ee3fafdc92092c [2829/2829] net: wangxun: fix resolving ipv6 pakets extension header errors config: x86_64-randconfig-122-20250330 (https://download.01.org/0day-ci/archive/20250331/202503311730.Gkig2fxG-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503311730.Gkig2fxG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503311730.Gkig2fxG-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:177:6: sparse: sparse: symbol 'txgbe_service_event_schedule' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:940:40: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] vlan_proto @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:940:40: sparse: expected restricted __be16 [usertype] vlan_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:940:40: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2647:6: sparse: sparse: symbol 'txgbe_disable_tx_queue' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2792:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2796:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2807:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2807:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2807:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2811:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2811:25: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2811:25: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2873:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2873:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2873:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2928:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2928:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:2928:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3336:5: sparse: sparse: symbol 'txgbe_add_cloud_switcher' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3351:5: sparse: sparse: symbol 'txgbe_del_cloud_switcher' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3671:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3671:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3671:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3701:6: sparse: sparse: symbol 'txgbe_configure_isb' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3715:6: sparse: sparse: symbol 'txgbe_configure_port' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3964:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3964:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:3964:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4291:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4291:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4291:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4368:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4368:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4368:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4386:5: sparse: sparse: symbol 'txgbe_init_shared_code' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4476:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4476:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4476:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4905:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4905:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:4905:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5037:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5037:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:5037:17: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6047:40: sparse: sparse: restricted __be16 degrades to integer >> drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6057:62: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6075:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6079:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6089:32: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6090:36: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6094:67: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6108:37: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6119:61: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6119:61: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6119:61: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6136:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6148:61: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6148:61: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6148:61: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6292:62: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6292:62: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6292:62: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6388:70: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6388:70: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6388:70: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6448:61: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] *frag_offp @@ got unsigned short * @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6448:61: sparse: expected restricted __be16 [usertype] *frag_offp drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6448:61: sparse: got unsigned short * drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6774:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6774:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6774:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6776:33: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6776:33: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6776:33: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6778:38: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6779:25: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6779:25: sparse: left side has type unsigned short drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6779:25: sparse: right side has type restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6783:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6783:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6783:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6793:27: sparse: sparse: invalid assignment: ^= drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6793:27: sparse: left side has type unsigned int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6793:27: sparse: right side has type restricted __be32 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6813:5: sparse: sparse: symbol 'txgbe_skb_pad_nonzero' was not declared. Should it be static? drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6855:30: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6855:30: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6855:30: sparse: got restricted __be16 [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6902:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6902:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6902:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6903:29: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6915:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6915:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6915:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6948:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] h_vlan_TCI @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6948:42: sparse: expected restricted __be16 [usertype] h_vlan_TCI drivers/net/ethernet/netswift/txgbe/txgbe_main.c:6948:42: sparse: got unsigned short [usertype] drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7327:23: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7393:46: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7395:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7403:47: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7405:37: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7497:26: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7497:26: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7497:26: sparse: got restricted __be16 [usertype] protocol drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7513:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7513:22: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7513:22: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7540:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_add_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7540:35: sparse: expected int ( *ndo_vlan_rx_add_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7540:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7541:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_kill_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7541:35: sparse: expected int ( *ndo_vlan_rx_kill_vid )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7541:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7698:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7698:9: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7698:9: sparse: int drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7901:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7901:17: sparse: void drivers/net/ethernet/netswift/txgbe/txgbe_main.c:7901:17: sparse: int vim +6057 drivers/net/ethernet/netswift/txgbe/txgbe_main.c 6030 6031 static txgbe_dptype encode_tx_desc_ptype(const struct txgbe_tx_buffer *first) 6032 { 6033 struct sk_buff *skb = first->skb; 6034 u8 tun_prot = 0; 6035 u8 l4_prot = 0; 6036 u8 ptype = 0; 6037 unsigned char *exthdr; 6038 unsigned char *l4_hdr; 6039 __be16 frag_off; 6040 6041 if (skb->encapsulation) { 6042 union network_header hdr; 6043 6044 switch (first->protocol) { 6045 case __constant_htons(ETH_P_IP): 6046 tun_prot = ip_hdr(skb)->protocol; 6047 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) 6048 goto encap_frag; 6049 ptype = TXGBE_PTYPE_TUN_IPV4; 6050 break; 6051 case __constant_htons(ETH_P_IPV6): 6052 l4_hdr = skb_transport_header(skb); 6053 exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr); 6054 tun_prot = ipv6_hdr(skb)->nexthdr; 6055 if (l4_hdr != exthdr) 6056 ipv6_skip_exthdr(skb, exthdr - skb->data, > 6057 &tun_prot, &frag_off); 6058 if (tun_prot == NEXTHDR_FRAGMENT) 6059 goto encap_frag; 6060 ptype = TXGBE_PTYPE_TUN_IPV6; 6061 break; 6062 default: 6063 goto exit; 6064 } 6065 6066 if (tun_prot == IPPROTO_IPIP || 6067 tun_prot == IPPROTO_IPV6) { 6068 hdr.raw = (void *)inner_ip_hdr(skb); 6069 ptype |= TXGBE_PTYPE_PKT_IPIP; 6070 } else if (tun_prot == IPPROTO_UDP) { 6071 hdr.raw = (void *)inner_ip_hdr(skb); 6072 /* fixme: VXLAN-GPE neither ETHER nor IP */ 6073 6074 if (skb->inner_protocol_type != ENCAP_TYPE_ETHER || 6075 skb->inner_protocol != htons(ETH_P_TEB)) { 6076 ptype |= TXGBE_PTYPE_PKT_IG; 6077 } else { 6078 if (((struct ethhdr *) 6079 skb_inner_mac_header(skb))->h_proto 6080 == htons(ETH_P_8021Q)) { 6081 ptype |= TXGBE_PTYPE_PKT_IGMV; 6082 } else { 6083 ptype |= TXGBE_PTYPE_PKT_IGM; 6084 } 6085 } 6086 6087 } else if (tun_prot == IPPROTO_GRE) { 6088 hdr.raw = (void *)inner_ip_hdr(skb); 6089 if (skb->inner_protocol == htons(ETH_P_IP) || 6090 skb->inner_protocol == htons(ETH_P_IPV6)) { 6091 ptype |= TXGBE_PTYPE_PKT_IG; 6092 } else { 6093 if (((struct ethhdr *) 6094 skb_inner_mac_header(skb))->h_proto 6095 == htons(ETH_P_8021Q)) { 6096 ptype |= TXGBE_PTYPE_PKT_IGMV; 6097 } else { 6098 ptype |= TXGBE_PTYPE_PKT_IGM; 6099 } 6100 } 6101 } else { 6102 goto exit; 6103 } 6104 6105 switch (hdr.ipv4->version) { 6106 case IPVERSION: 6107 l4_prot = hdr.ipv4->protocol; 6108 if (hdr.ipv4->frag_off & htons(IP_MF | IP_OFFSET)) { 6109 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6110 goto exit; 6111 } 6112 break; 6113 case 6: 6114 l4_hdr = skb_inner_transport_header(skb); 6115 exthdr = skb_inner_network_header(skb) + sizeof(struct ipv6hdr); 6116 l4_prot = inner_ipv6_hdr(skb)->nexthdr; 6117 if (l4_hdr != exthdr) 6118 ipv6_skip_exthdr(skb, exthdr - skb->data, 6119 &l4_prot, &frag_off); 6120 ptype |= TXGBE_PTYPE_PKT_IPV6; 6121 if (l4_prot == NEXTHDR_FRAGMENT) { 6122 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6123 goto exit; 6124 } 6125 break; 6126 default: 6127 goto exit; 6128 } 6129 } else { 6130 encap_frag: 6131 6132 switch (first->protocol) { 6133 case __constant_htons(ETH_P_IP): 6134 l4_prot = ip_hdr(skb)->protocol; 6135 ptype = TXGBE_PTYPE_PKT_IP; 6136 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { 6137 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6138 goto exit; 6139 } 6140 break; 6141 #ifdef NETIF_F_IPV6_CSUM 6142 case __constant_htons(ETH_P_IPV6): 6143 l4_hdr = skb_transport_header(skb); 6144 exthdr = skb_network_header(skb) + sizeof(struct ipv6hdr); 6145 l4_prot = ipv6_hdr(skb)->nexthdr; 6146 if (l4_hdr != exthdr) 6147 ipv6_skip_exthdr(skb, exthdr - skb->data, 6148 &l4_prot, &frag_off); 6149 6150 ptype = TXGBE_PTYPE_PKT_IP | TXGBE_PTYPE_PKT_IPV6; 6151 if (l4_prot == NEXTHDR_FRAGMENT) { 6152 ptype |= TXGBE_PTYPE_TYP_IPFRAG; 6153 goto exit; 6154 } 6155 break; 6156 #endif /* NETIF_F_IPV6_CSUM */ 6157 case __constant_htons(ETH_P_1588): 6158 ptype = TXGBE_PTYPE_L2_TS; 6159 goto exit; 6160 case __constant_htons(ETH_P_FIP): 6161 ptype = TXGBE_PTYPE_L2_FIP; 6162 goto exit; 6163 case __constant_htons(TXGBE_ETH_P_LLDP): 6164 ptype = TXGBE_PTYPE_L2_LLDP; 6165 goto exit; 6166 case __constant_htons(TXGBE_ETH_P_CNM): 6167 ptype = TXGBE_PTYPE_L2_CNM; 6168 goto exit; 6169 case __constant_htons(ETH_P_PAE): 6170 ptype = TXGBE_PTYPE_L2_EAPOL; 6171 goto exit; 6172 case __constant_htons(ETH_P_ARP): 6173 ptype = TXGBE_PTYPE_L2_ARP; 6174 goto exit; 6175 default: 6176 ptype = TXGBE_PTYPE_L2_MAC; 6177 goto exit; 6178 } 6179 6180 } 6181 6182 switch (l4_prot) { 6183 case IPPROTO_TCP: 6184 ptype |= TXGBE_PTYPE_TYP_TCP; 6185 break; 6186 case IPPROTO_UDP: 6187 ptype |= TXGBE_PTYPE_TYP_UDP; 6188 break; 6189 case IPPROTO_SCTP: 6190 ptype |= TXGBE_PTYPE_TYP_SCTP; 6191 break; 6192 default: 6193 ptype |= TXGBE_PTYPE_TYP_IP; 6194 break; 6195 } 6196 6197 exit: 6198 return txgbe_decode_ptype(ptype); 6199 } 6200 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] media: uvcvideo: Fix double free in error path
by Gu Bowen 31 Mar '25

31 Mar '25

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> stable inclusion from stable-v6.6.76 commit 6c36dcd662ec5276782838660f8533a7cb26be49 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBDI CVE: CVE-2024-57980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac upstream. If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Fixes: a31a4055473b ("V4L/DVB:usbvideo:don't use part of buffer for USB transfer #4") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241107235130.31372-1-laurent.pinchart@ideasonbo… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/usb/uvc/uvc_status.c [Context conflicts due to commit adfd3910c27fb ("media: uvcvideo: Remove void casting for the status endpoint") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/uvc/uvc_status.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index 73725051cc16..6edf491dd873 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -269,6 +269,7 @@ int uvc_status_init(struct uvc_device *dev) dev->int_urb = usb_alloc_urb(0, GFP_KERNEL); if (dev->int_urb == NULL) { kfree(dev->status); + dev->status = NULL; return -ENOMEM; } -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2022-49513
by Zhang Kunbo 31 Mar '25

31 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2022-49513
by Zhang Kunbo 31 Mar '25

31 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49370
by Xia Fukun 31 Mar '25

31 Mar '25

Fix CVE-2022-49370. Chen Zhongjin (1): firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle Miaoqian Lin (1): firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle drivers/firmware/dmi-sysfs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 1424/1424] mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type
by kernel test robot 31 Mar '25

31 Mar '25

Hi Daniel, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5b56c883c34a890a3f9ca7baa8aea426538c88a8 commit: eb761d6521c32c006a4987260394a61c6684fb35 [1424/1424] mm: parallelize deferred struct page initialization within each node config: x86_64-buildonly-randconfig-003-20250217 (https://download.01.org/0day-ci/archive/20250331/202503311145.7abslQzz-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250331/202503311145.7abslQzz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503311145.7abslQzz-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/page_alloc.c:1412:6: warning: no previous prototype for function 'set_zone_contiguous' [-Wmissing-prototypes] 1412 | void set_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1412:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1412 | void set_zone_contiguous(struct zone *zone) | ^ | static mm/page_alloc.c:1433:6: warning: no previous prototype for function 'clear_zone_contiguous' [-Wmissing-prototypes] 1433 | void clear_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1433:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1433 | void clear_zone_contiguous(struct zone *zone) | ^ | static >> mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] 1645 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1646 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1661:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] 1661 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1662 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. vim +1645 mm/page_alloc.c 1587 1588 /* Initialise remaining memory on a node */ 1589 static int __init deferred_init_memmap(void *data) 1590 { 1591 pg_data_t *pgdat = data; 1592 int nid = pgdat->node_id; 1593 unsigned long start = jiffies; 1594 unsigned long nr_init = 0, nr_free = 0; 1595 unsigned long spfn, epfn, first_init_pfn, flags; 1596 phys_addr_t spa, epa; 1597 int zid; 1598 struct zone *zone; 1599 const struct cpumask *cpumask = cpumask_of_node(pgdat->node_id); 1600 u64 i; 1601 unsigned long nr_node_cpus; 1602 struct ktask_node kn; 1603 1604 /* Bind memory initialisation thread to a local node if possible */ 1605 if (!cpumask_empty(cpumask)) 1606 set_cpus_allowed_ptr(current, cpumask); 1607 1608 pgdat_resize_lock(pgdat, &flags); 1609 first_init_pfn = pgdat->first_deferred_pfn; 1610 if (first_init_pfn == ULONG_MAX) { 1611 pgdat_resize_unlock(pgdat, &flags); 1612 pgdat_init_report_one_done(); 1613 return 0; 1614 } 1615 1616 /* 1617 * We'd like to know the memory bandwidth of the chip to calculate the 1618 * most efficient number of threads to start, but we can't. In 1619 * testing, a good value for a variety of systems was a quarter of the 1620 * CPUs on the node. 1621 */ 1622 nr_node_cpus = DIV_ROUND_UP(cpumask_weight(cpumask), 4); 1623 1624 /* Sanity check boundaries */ 1625 BUG_ON(pgdat->first_deferred_pfn < pgdat->node_start_pfn); 1626 BUG_ON(pgdat->first_deferred_pfn > pgdat_end_pfn(pgdat)); 1627 pgdat->first_deferred_pfn = ULONG_MAX; 1628 1629 /* Only the highest zone is deferred so find it */ 1630 for (zid = 0; zid < MAX_NR_ZONES; zid++) { 1631 zone = pgdat->node_zones + zid; 1632 if (first_init_pfn < zone_end_pfn(zone)) 1633 break; 1634 } 1635 first_init_pfn = max(zone->zone_start_pfn, first_init_pfn); 1636 1637 /* 1638 * Initialize and free pages. We do it in two loops: first we initialize 1639 * struct page, than free to buddy allocator, because while we are 1640 * freeing pages we can access pages that are ahead (computing buddy 1641 * page in __free_one_page()). 1642 */ 1643 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1644 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; > 1645 DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, 1646 KTASK_PTE_MINCHUNK); 1647 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1648 1649 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1650 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1651 1652 kn.kn_start = (void *)spfn; 1653 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1654 kn.kn_nid = nid; 1655 (void) ktask_run_numa(&kn, 1, &ctl); 1656 1657 nr_init += atomic64_read(&args.nr_pages); 1658 } 1659 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1660 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; 1661 DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, 1662 KTASK_PTE_MINCHUNK); 1663 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1664 1665 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1666 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1667 1668 kn.kn_start = (void *)spfn; 1669 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1670 kn.kn_nid = nid; 1671 (void) ktask_run_numa(&kn, 1, &ctl); 1672 1673 nr_free += atomic64_read(&args.nr_pages); 1674 } 1675 pgdat_resize_unlock(pgdat, &flags); 1676 1677 /* Sanity check that the next zone really is unpopulated */ 1678 WARN_ON(++zid < MAX_NR_ZONES && populated_zone(++zone)); 1679 VM_BUG_ON(nr_init != nr_free); 1680 1681 zone->managed_pages += nr_free; 1682 1683 pr_info("node %d initialised, %lu pages in %ums\n", nid, nr_free, 1684 jiffies_to_msecs(jiffies - start)); 1685 1686 pgdat_init_report_one_done(); 1687 return 0; 1688 } 1689 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drbd: Fix five use after free bugs in get_initial_state
by Xiaomeng Zhang 31 Mar '25

31 Mar '25

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v5.10.111 commit 594205b4936771a250f9d141e7e0fff21c3dd2d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6VU CVE: CVE-2022-49085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aadb22ba2f656581b2f733deb3a467c48cc618f6 ] In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug. What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened. My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid. v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/ Fixes: a29728463b254 ("drbd: Backport the "events2" command") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder(a)linbit.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/block/drbd/drbd_int.h | 8 ++--- drivers/block/drbd/drbd_nl.c | 41 ++++++++++++++++---------- drivers/block/drbd/drbd_state.c | 18 +++++------ drivers/block/drbd/drbd_state_change.h | 8 ++--- 4 files changed, 42 insertions(+), 33 deletions(-) diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h index e35a234b0a8f..4f66cf6879fd 100644 --- a/drivers/block/drbd/drbd_int.h +++ b/drivers/block/drbd/drbd_int.h @@ -1688,22 +1688,22 @@ struct sib_info { }; void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); -extern void notify_resource_state(struct sk_buff *, +extern int notify_resource_state(struct sk_buff *, unsigned int, struct drbd_resource *, struct resource_info *, enum drbd_notification_type); -extern void notify_device_state(struct sk_buff *, +extern int notify_device_state(struct sk_buff *, unsigned int, struct drbd_device *, struct device_info *, enum drbd_notification_type); -extern void notify_connection_state(struct sk_buff *, +extern int notify_connection_state(struct sk_buff *, unsigned int, struct drbd_connection *, struct connection_info *, enum drbd_notification_type); -extern void notify_peer_device_state(struct sk_buff *, +extern int notify_peer_device_state(struct sk_buff *, unsigned int, struct drbd_peer_device *, struct peer_device_info *, diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c index 5b15ffd0c7f5..5a80453be553 100644 --- a/drivers/block/drbd/drbd_nl.c +++ b/drivers/block/drbd/drbd_nl.c @@ -4598,7 +4598,7 @@ static int nla_put_notification_header(struct sk_buff *msg, return drbd_notification_header_to_skb(msg, &nh, true); } -void notify_resource_state(struct sk_buff *skb, +int notify_resource_state(struct sk_buff *skb, unsigned int seq, struct drbd_resource *resource, struct resource_info *resource_info, @@ -4640,16 +4640,17 @@ void notify_resource_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_device_state(struct sk_buff *skb, +int notify_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_device *device, struct device_info *device_info, @@ -4689,16 +4690,17 @@ void notify_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_connection_state(struct sk_buff *skb, +int notify_connection_state(struct sk_buff *skb, unsigned int seq, struct drbd_connection *connection, struct connection_info *connection_info, @@ -4738,16 +4740,17 @@ void notify_connection_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } -void notify_peer_device_state(struct sk_buff *skb, +int notify_peer_device_state(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device *peer_device, struct peer_device_info *peer_device_info, @@ -4788,13 +4791,14 @@ void notify_peer_device_state(struct sk_buff *skb, if (err && err != -ESRCH) goto failed; } - return; + return 0; nla_put_failure: nlmsg_free(skb); failed: drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", err, seq); + return err; } void notify_helper(enum drbd_notification_type type, @@ -4845,7 +4849,7 @@ void notify_helper(enum drbd_notification_type type, err, seq); } -static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) +static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) { struct drbd_genlmsghdr *dh; int err; @@ -4859,11 +4863,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) if (nla_put_notification_header(skb, NOTIFY_EXISTS)) goto nla_put_failure; genlmsg_end(skb, dh); - return; + return 0; nla_put_failure: nlmsg_free(skb); pr_err("Error %d sending event. Event seq:%u\n", err, seq); + return err; } static void free_state_changes(struct list_head *list) @@ -4890,6 +4895,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) unsigned int seq = cb->args[2]; unsigned int n; enum drbd_notification_type flags = 0; + int err = 0; /* There is no need for taking notification_mutex here: it doesn't matter if the initial state events mix with later state chage @@ -4898,32 +4904,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[5]--; if (cb->args[5] == 1) { - notify_initial_state_done(skb, seq); + err = notify_initial_state_done(skb, seq); goto out; } n = cb->args[4]++; if (cb->args[4] < cb->args[3]) flags |= NOTIFY_CONTINUES; if (n < 1) { - notify_resource_state_change(skb, seq, state_change->resource, + err = notify_resource_state_change(skb, seq, state_change->resource, NOTIFY_EXISTS | flags); goto next; } n--; if (n < state_change->n_connections) { - notify_connection_state_change(skb, seq, &state_change->connections[n], + err = notify_connection_state_change(skb, seq, &state_change->connections[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_connections; if (n < state_change->n_devices) { - notify_device_state_change(skb, seq, &state_change->devices[n], + err = notify_device_state_change(skb, seq, &state_change->devices[n], NOTIFY_EXISTS | flags); goto next; } n -= state_change->n_devices; if (n < state_change->n_devices * state_change->n_connections) { - notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], NOTIFY_EXISTS | flags); goto next; } @@ -4938,7 +4944,10 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) cb->args[4] = 0; } out: - return skb->len; + if (err) + return err; + else + return skb->len; } int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c index b452359b6aae..1474250f9440 100644 --- a/drivers/block/drbd/drbd_state.c +++ b/drivers/block/drbd/drbd_state.c @@ -1549,7 +1549,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, return rv; } -void notify_resource_state_change(struct sk_buff *skb, +int notify_resource_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_resource_state_change *resource_state_change, enum drbd_notification_type type) @@ -1562,10 +1562,10 @@ void notify_resource_state_change(struct sk_buff *skb, .res_susp_fen = resource_state_change->susp_fen[NEW], }; - notify_resource_state(skb, seq, resource, &resource_info, type); + return notify_resource_state(skb, seq, resource, &resource_info, type); } -void notify_connection_state_change(struct sk_buff *skb, +int notify_connection_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_connection_state_change *connection_state_change, enum drbd_notification_type type) @@ -1576,10 +1576,10 @@ void notify_connection_state_change(struct sk_buff *skb, .conn_role = connection_state_change->peer_role[NEW], }; - notify_connection_state(skb, seq, connection, &connection_info, type); + return notify_connection_state(skb, seq, connection, &connection_info, type); } -void notify_device_state_change(struct sk_buff *skb, +int notify_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_device_state_change *device_state_change, enum drbd_notification_type type) @@ -1589,10 +1589,10 @@ void notify_device_state_change(struct sk_buff *skb, .dev_disk_state = device_state_change->disk_state[NEW], }; - notify_device_state(skb, seq, device, &device_info, type); + return notify_device_state(skb, seq, device, &device_info, type); } -void notify_peer_device_state_change(struct sk_buff *skb, +int notify_peer_device_state_change(struct sk_buff *skb, unsigned int seq, struct drbd_peer_device_state_change *p, enum drbd_notification_type type) @@ -1606,7 +1606,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], }; - notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); } static void broadcast_state_change(struct drbd_state_change *state_change) @@ -1614,7 +1614,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; bool resource_state_has_changed; unsigned int n_device, n_connection, n_peer_device, n_peer_devices; - void (*last_func)(struct sk_buff *, unsigned int, void *, + int (*last_func)(struct sk_buff *, unsigned int, void *, enum drbd_notification_type) = NULL; void *uninitialized_var(last_arg); diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h index ba80f612d6ab..d5b0479bc9a6 100644 --- a/drivers/block/drbd/drbd_state_change.h +++ b/drivers/block/drbd/drbd_state_change.h @@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ extern void copy_old_to_new_state_change(struct drbd_state_change *); extern void forget_state_change(struct drbd_state_change *); -extern void notify_resource_state_change(struct sk_buff *, +extern int notify_resource_state_change(struct sk_buff *, unsigned int, struct drbd_resource_state_change *, enum drbd_notification_type type); -extern void notify_connection_state_change(struct sk_buff *, +extern int notify_connection_state_change(struct sk_buff *, unsigned int, struct drbd_connection_state_change *, enum drbd_notification_type type); -extern void notify_device_state_change(struct sk_buff *, +extern int notify_device_state_change(struct sk_buff *, unsigned int, struct drbd_device_state_change *, enum drbd_notification_type type); -extern void notify_peer_device_state_change(struct sk_buff *, +extern int notify_peer_device_state_change(struct sk_buff *, unsigned int, struct drbd_peer_device_state_change *, enum drbd_notification_type type); -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] Some bug fix patches for RDMA/hns to olk-6.6
by Junxian Huang 31 Mar '25

31 Mar '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bug fix patches for RDMA/hns to olk-6.6 Chengchang Tang (1): RDMA/hns: Fix a meaningless loop in free_buffer_pages_proc() Junxian Huang (7): RDMA/hns: Change mtr member to pointer in hns QP/CQ/MR/SRQ/EQ struct RDMA/hns: Move mtr_node into the mtr struct RDMA/hns: Fix delayed destruction of db not taking effect RDMA/hns: Fix delay-destruction mechanism not processing kernel db RDMA/hns: Fix mismatched kzalloc vs kvfree RDMA/hns: Fix DCA error path in alloc_wqe_buf() RDMA/hns: Reorder uctx deallocation Yuyu Li (1): RDMA/hns: Fix remove debugfs after device has been unregistered drivers/infiniband/hw/hns/hns_roce_bond.c | 2 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 35 ++--- drivers/infiniband/hw/hns/hns_roce_db.c | 81 ++++++---- drivers/infiniband/hw/hns/hns_roce_dca.c | 8 +- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 10 +- drivers/infiniband/hw/hns/hns_roce_debugfs.h | 3 +- drivers/infiniband/hw/hns/hns_roce_device.h | 69 ++++----- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 81 +++++----- drivers/infiniband/hw/hns/hns_roce_main.c | 23 ++- drivers/infiniband/hw/hns/hns_roce_mr.c | 145 ++++++++---------- drivers/infiniband/hw/hns/hns_roce_qp.c | 40 ++--- drivers/infiniband/hw/hns/hns_roce_restrack.c | 4 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 63 +++----- 13 files changed, 269 insertions(+), 295 deletions(-) -- 2.33.0

2 10