- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 1/2] bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
by Pu Lehui 19 Mar '25

19 Mar '25

From: Andrii Nakryiko <andrii(a)kernel.org> stable inclusion from stable-v6.6.80 commit fc01ba097319ae2033f118da3075bd783f4a08e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSW0M CVE: CVE-2025-21853 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 98671a0fd1f14e4a518ee06b19037c20014900eb ] For all BPF maps we ensure that VM_MAYWRITE is cleared when memory-mapping BPF map contents as initially read-only VMA. This is because in some cases BPF verifier relies on the underlying data to not be modified afterwards by user space, so once something is mapped read-only, it shouldn't be re-mmap'ed as read-write. As such, it's not necessary to check VM_MAYWRITE in bpf_map_mmap() and map->ops->map_mmap() callbacks: VM_WRITE should be consistently set for read-write mappings, and if VM_WRITE is not set, there is no way for user space to upgrade read-only mapping to read-write one. This patch cleans up this VM_WRITE vs VM_MAYWRITE handling within bpf_map_mmap(), which is an entry point for any BPF map mmap()-ing logic. We also drop unnecessary sanitization of VM_MAYWRITE in BPF ringbuf's map_mmap() callback implementation, as it is already performed by common code in bpf_map_mmap(). Note, though, that in bpf_map_mmap_{open,close}() callbacks we can't drop VM_MAYWRITE use, because it's possible (and is outside of subsystem's control) to have initially read-write memory mapping, which is subsequently dropped to read-only by user space through mprotect(). In such case, from BPF verifier POV it's read-write data throughout the lifetime of BPF map, and is counted as "active writer". But its VMAs will start out as VM_WRITE|VM_MAYWRITE, then mprotect() can change it to just VM_MAYWRITE (and no VM_WRITE), so when its finally munmap()'ed and bpf_map_mmap_close() is called, vm_flags will be just VM_MAYWRITE, but we still need to decrement active writer count with bpf_map_write_active_dec() as it's still considered to be a read-write mapping by the rest of BPF subsystem. Similar reasoning applies to bpf_map_mmap_open(), which is called whenever mmap(), munmap(), and/or mprotect() forces mm subsystem to split original VMA into multiple discontiguous VMAs. Memory-mapping handling is a bit tricky, yes. Cc: Jann Horn <jannh(a)google.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/r/20250129012246.1515826-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Stable-dep-of: bc27c52eea18 ("bpf: avoid holding freeze_mutex during mmap operation") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/ringbuf.c | 4 ---- kernel/bpf/syscall.c | 10 ++++++++-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 00688545742f..6aff5ee483b6 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -268,8 +268,6 @@ static int ringbuf_map_mmap_kern(struct bpf_map *map, struct vm_area_struct *vma /* allow writable mapping for the consumer_pos only */ if (vma->vm_pgoff != 0 || vma->vm_end - vma->vm_start != PAGE_SIZE) return -EPERM; - } else { - vm_flags_clear(vma, VM_MAYWRITE); } /* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range(vma, rb_map->rb, @@ -289,8 +287,6 @@ static int ringbuf_map_mmap_user(struct bpf_map *map, struct vm_area_struct *vma * position, and the ring buffer data itself. */ return -EPERM; - } else { - vm_flags_clear(vma, VM_MAYWRITE); } /* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range(vma, rb_map->rb, vma->vm_pgoff + RINGBUF_PGOFF); diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index f8edda3bf396..f79b8915d8c8 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -913,15 +913,21 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) vma->vm_ops = &bpf_map_default_vmops; vma->vm_private_data = map; vm_flags_clear(vma, VM_MAYEXEC); + /* If mapping is read-only, then disallow potentially re-mapping with + * PROT_WRITE by dropping VM_MAYWRITE flag. This VM_MAYWRITE clearing + * means that as far as BPF map's memory-mapped VMAs are concerned, + * VM_WRITE and VM_MAYWRITE and equivalent, if one of them is set, + * both should be set, so we can forget about VM_MAYWRITE and always + * check just VM_WRITE + */ if (!(vma->vm_flags & VM_WRITE)) - /* disallow re-mapping with PROT_WRITE */ vm_flags_clear(vma, VM_MAYWRITE); err = map->ops->map_mmap(map, vma); if (err) goto out; - if (vma->vm_flags & VM_MAYWRITE) + if (vma->vm_flags & VM_WRITE) bpf_map_write_active_inc(map); out: mutex_unlock(&map->freeze_mutex); -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] block: fix error unwinding in blk_register_queue
by Zheng Qixing 19 Mar '25

19 Mar '25

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.2-rc1 commit 40602997be26887bdfa3d58659c3acb4579099e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSG04 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ blk_register_queue fails to handle errors from blk_mq_sysfs_register, leaks various resources on errors and accidentally sets queue refs percpu refcount to percpu mode on kobject_add failure. Fix all that by properly unwinding on errors. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20221114042637.1009333-4-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-sysfs.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-sysfs.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index b23d82fbe736..05d8a5b236f5 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -961,15 +961,21 @@ int blk_register_queue(struct gendisk *disk) return ret; mutex_lock(&queue_to_wrapper(q)->sysfs_dir_lock); - ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue"); if (ret < 0) { blk_trace_remove_sysfs(dev); goto unlock; } - if (q->mq_ops) - __blk_mq_register_dev(dev, q); + if (q->mq_ops) { + ret = __blk_mq_register_dev(dev, q); + if (ret) { + blk_trace_remove_sysfs(dev); + kobject_del(&q->kobj); + kobject_put(&dev->kobj); + goto unlock; + } + } mutex_lock(&q->sysfs_lock); mutex_lock(&q->debugfs_mutex); -- 2.39.2

2 1

[openeuler:OLK-6.6 2041/2041] arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used
by kernel test robot 18 Mar '25

18 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 010e974aad58e203f1e68707107db00593fcf851 commit: 7bd845b17aab36ac5d381557b797845404aaeb57 [2041/2041] LoongArch: Update the flush cache policy config: loongarch-randconfig-001-20250318 (https://download.01.org/0day-ci/archive/20250318/202503182233.88LCSaAj-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250318/202503182233.88LCSaAj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503182233.88LCSaAj-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/loongarch/mm/cache.c: In function 'flush_cache_last_level': >> arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used [-Wunused-but-set-variable] 69 | int i, j, nr_nodes, way_size; | ^~~~~~~~ vim +/way_size +69 arch/loongarch/mm/cache.c 65 66 static void flush_cache_last_level(unsigned int leaf) 67 { 68 u64 addr; > 69 int i, j, nr_nodes, way_size; 70 struct cache_desc *cdesc = current_cpu_data.cache_leaves + leaf; 71 72 nr_nodes = loongson_sysconf.nr_nodes; 73 74 addr = CSR_DMW1_BASE; 75 iocsr_write8(0x1, 0x280); 76 way_size = cdesc->sets * cdesc->linesz; 77 do { 78 for (i = 0; i < (cdesc->ways * 3); i++) { 79 for (j = 0; j < (cdesc->sets); j++) { 80 READ_ONCE(*(u32 *)addr); 81 addr += cdesc->linesz; 82 } 83 } 84 addr += 0x100000000000; 85 } while (--nr_nodes > 0); 86 } 87 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49508
by Chen Ridong 18 Mar '25

18 Mar '25

CVE-2022-49508 Dinghao Liu (1): HID: elan: Fix memleak in elan_input_configured Miaoqian Lin (1): HID: elan: Fix potential double free in elan_input_configured drivers/hid/hid-elan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6] smb: client: Add check for next_buffer in receive_encrypted_standard()
by Li Lingfeng 18 Mar '25

18 Mar '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.80 commit 9e5d99a4cf2e23c716b44862975548415fae5391 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZD CVE: CVE-2025-21844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 860ca5e50f73c2a1cef7eefc9d39d04e275417f7 upstream. Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent null pointer dereference. Fixes: eec04ea11969 ("smb: client: fix OOB in receive_encrypted_standard()") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index fc6d00344c50..55269d3a8278 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4904,6 +4904,10 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); + if (!next_buffer) { + cifs_server_dbg(VFS, "No memory for (large) SMB response\n"); + return -1; + } memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] two bugfixs
by Tong Tiangen 18 Mar '25

18 Mar '25

Brian Geffon (1): mm: fix finish_fault() handling for large folios Zi Yan (1): mm/migrate: fix shmem xarray update during migration mm/memory.c | 15 ++++++++++----- mm/migrate.c | 10 ++++------ 2 files changed, 14 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH olk-6.6 0/2] two bugfixs
by Tong Tiangen 18 Mar '25

18 Mar '25

Brian Geffon (1): mm: fix finish_fault() handling for large folios Zi Yan (1): mm/migrate: fix shmem xarray update during migration mm/memory.c | 15 ++++++++++----- mm/migrate.c | 10 ++++------ 2 files changed, 14 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
by Zheng Qixing 18 Mar '25

18 Mar '25

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v5.19-rc3 commit 14dc7a18abbe4176f5626c13c333670da8e06aa1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1ZW CVE: CVE-2022-49720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ This patch prevents that test nvme/004 triggers the following: UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x3b __ubsan_handle_out_of_bounds.cold+0x44/0x49 blk_mq_alloc_request_hctx+0x304/0x310 __nvme_submit_sync_cmd+0x70/0x200 [nvme_core] nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics] nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop] nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop] nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics] nvmf_dev_write+0xae/0x111 [nvme_fabrics] vfs_write+0x144/0x560 ksys_write+0xb7/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Cc: Christoph Hellwig <hch(a)lst.de> Cc: Ming Lei <ming.lei(a)redhat.com> Fixes: 20e4d8139319 ("blk-mq: simplify queue mapping & schedule with each possisble CPU") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20220615210004.1031820-1-bvanassche@acm.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-mq.c [Due to not merging commit a5ea5811058d ("blk-mq: move the call to blk_queue_enter_live out of blk_mq_get_request").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-mq.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index 0392b014ac89..e1253b18516b 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -515,6 +515,10 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, return ERR_PTR(-EXDEV); } cpu = cpumask_first_and(alloc_data.hctx->cpumask, cpu_online_mask); + if (cpu >= nr_cpu_ids) { + blk_queue_exit(q); + return ERR_PTR(-EXDEV); + } alloc_data.ctx = __blk_mq_get_ctx(q, cpu); rq = blk_mq_get_request(q, NULL, op, &alloc_data); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: target: tcmu: Fix possible page UAF
by Zheng Qixing 18 Mar '25

18 Mar '25

From: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> stable inclusion from stable-v4.19.239 commit e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6TV CVE: CVE-2022-49053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit a6968f7a367f128d120447360734344d5a3d5336 ] tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release(). Link: https://lore.kernel.org/r/20220311132206.24515-1-xiaoguang.wang@linux.aliba… Reviewed-by: Bodo Stroesser <bostroesser(a)gmail.com> Signed-off-by: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/target/target_core_user.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c index de27014685ac..eed2d8e1c92f 100644 --- a/drivers/target/target_core_user.c +++ b/drivers/target/target_core_user.c @@ -1528,6 +1528,7 @@ static struct page *tcmu_try_get_block_page(struct tcmu_dev *udev, uint32_t dbi) mutex_lock(&udev->cmdr_lock); page = tcmu_get_block_page(udev, dbi); if (likely(page)) { + get_page(page); mutex_unlock(&udev->cmdr_lock); return page; } @@ -1566,6 +1567,7 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) /* For the vmalloc()ed cmd area pages */ addr = (void *)(unsigned long)info->mem[mi].addr + offset; page = vmalloc_to_page(addr); + get_page(page); } else { uint32_t dbi; @@ -1576,7 +1578,6 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) return VM_FAULT_SIGBUS; } - get_page(page); vmf->page = page; return 0; } -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1501/1501] lib/ubsan.c:195:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_add_overflow'; expected 'void *'
by kernel test robot 18 Mar '25

18 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a304375c0bb304fd38fa85987919aff3d831cf9b commit: d2e5767132d657577127f1d35764bb4721dd3cc5 [1501/1501] ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings config: arm64-randconfig-001-20250318 (https://download.01.org/0day-ci/archive/20250318/202503181741.vcHyKenV-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250318/202503181741.vcHyKenV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503181741.vcHyKenV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> lib/ubsan.c:195:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_add_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 195 | void __ubsan_handle_add_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:203:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_sub_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 203 | void __ubsan_handle_sub_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:210:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_mul_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 210 | void __ubsan_handle_mul_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:217:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_negate_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 217 | void __ubsan_handle_negate_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:238:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_divrem_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 238 | void __ubsan_handle_divrem_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ lib/ubsan.c:323:6: warning: no previous prototype for '__ubsan_handle_type_mismatch' [-Wmissing-prototypes] 323 | void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:337:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_type_mismatch_v1'; expected 'void *' [-Wbuiltin-declaration-mismatch] 337 | void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:352:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_vla_bound_not_positive'; expected 'void *' [-Wbuiltin-declaration-mismatch] 352 | void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:370:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_out_of_bounds'; expected 'void *' [-Wbuiltin-declaration-mismatch] 370 | void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:387:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_shift_out_of_bounds'; expected 'void *' [-Wbuiltin-declaration-mismatch] 387 | void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ lib/ubsan.c:427:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_builtin_unreachable'; expected 'void *' [-Wbuiltin-declaration-mismatch] 427 | void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:438:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_load_invalid_value'; expected 'void *' [-Wbuiltin-declaration-mismatch] 438 | void __ubsan_handle_load_invalid_value(struct invalid_value_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +195 lib/ubsan.c c6d308534aef6c Andrey Ryabinin 2016-01-20 194 c6d308534aef6c Andrey Ryabinin 2016-01-20 @195 void __ubsan_handle_add_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 196 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 197 { c6d308534aef6c Andrey Ryabinin 2016-01-20 198 c6d308534aef6c Andrey Ryabinin 2016-01-20 199 handle_overflow(data, lhs, rhs, '+'); c6d308534aef6c Andrey Ryabinin 2016-01-20 200 } c6d308534aef6c Andrey Ryabinin 2016-01-20 201 EXPORT_SYMBOL(__ubsan_handle_add_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 202 c6d308534aef6c Andrey Ryabinin 2016-01-20 @203 void __ubsan_handle_sub_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 204 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 205 { c6d308534aef6c Andrey Ryabinin 2016-01-20 206 handle_overflow(data, lhs, rhs, '-'); c6d308534aef6c Andrey Ryabinin 2016-01-20 207 } c6d308534aef6c Andrey Ryabinin 2016-01-20 208 EXPORT_SYMBOL(__ubsan_handle_sub_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 209 c6d308534aef6c Andrey Ryabinin 2016-01-20 @210 void __ubsan_handle_mul_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 211 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 212 { c6d308534aef6c Andrey Ryabinin 2016-01-20 213 handle_overflow(data, lhs, rhs, '*'); c6d308534aef6c Andrey Ryabinin 2016-01-20 214 } c6d308534aef6c Andrey Ryabinin 2016-01-20 215 EXPORT_SYMBOL(__ubsan_handle_mul_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 216 c6d308534aef6c Andrey Ryabinin 2016-01-20 @217 void __ubsan_handle_negate_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 218 void *old_val) c6d308534aef6c Andrey Ryabinin 2016-01-20 219 { c6d308534aef6c Andrey Ryabinin 2016-01-20 220 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 221 char old_val_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 222 c6d308534aef6c Andrey Ryabinin 2016-01-20 223 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 224 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 225 c6d308534aef6c Andrey Ryabinin 2016-01-20 226 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 227 c6d308534aef6c Andrey Ryabinin 2016-01-20 228 val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val); c6d308534aef6c Andrey Ryabinin 2016-01-20 229 c6d308534aef6c Andrey Ryabinin 2016-01-20 230 pr_err("negation of %s cannot be represented in type %s:\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 231 old_val_str, data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 232 c6d308534aef6c Andrey Ryabinin 2016-01-20 233 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 234 } c6d308534aef6c Andrey Ryabinin 2016-01-20 235 EXPORT_SYMBOL(__ubsan_handle_negate_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 236 c6d308534aef6c Andrey Ryabinin 2016-01-20 237 c6d308534aef6c Andrey Ryabinin 2016-01-20 @238 void __ubsan_handle_divrem_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 239 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 240 { c6d308534aef6c Andrey Ryabinin 2016-01-20 241 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 242 char rhs_val_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 243 c6d308534aef6c Andrey Ryabinin 2016-01-20 244 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 245 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 246 c6d308534aef6c Andrey Ryabinin 2016-01-20 247 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 248 c6d308534aef6c Andrey Ryabinin 2016-01-20 249 val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs); c6d308534aef6c Andrey Ryabinin 2016-01-20 250 c6d308534aef6c Andrey Ryabinin 2016-01-20 251 if (type_is_signed(data->type) && get_signed_val(data->type, rhs) == -1) c6d308534aef6c Andrey Ryabinin 2016-01-20 252 pr_err("division of %s by -1 cannot be represented in type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 253 rhs_val_str, data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 254 else c6d308534aef6c Andrey Ryabinin 2016-01-20 255 pr_err("division by zero\n"); c6d308534aef6c Andrey Ryabinin 2016-01-20 256 c6d308534aef6c Andrey Ryabinin 2016-01-20 257 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 258 } c6d308534aef6c Andrey Ryabinin 2016-01-20 259 EXPORT_SYMBOL(__ubsan_handle_divrem_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 260 42440c1f9911b4 Andrey Ryabinin 2018-02-06 261 static void handle_null_ptr_deref(struct type_mismatch_data_common *data) c6d308534aef6c Andrey Ryabinin 2016-01-20 262 { c6d308534aef6c Andrey Ryabinin 2016-01-20 263 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 264 42440c1f9911b4 Andrey Ryabinin 2018-02-06 265 if (suppress_report(data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 266 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 267 42440c1f9911b4 Andrey Ryabinin 2018-02-06 268 ubsan_prologue(data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 269 c6d308534aef6c Andrey Ryabinin 2016-01-20 270 pr_err("%s null pointer of type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 271 type_check_kinds[data->type_check_kind], c6d308534aef6c Andrey Ryabinin 2016-01-20 272 data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 273 c6d308534aef6c Andrey Ryabinin 2016-01-20 274 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 275 } c6d308534aef6c Andrey Ryabinin 2016-01-20 276 42440c1f9911b4 Andrey Ryabinin 2018-02-06 277 static void handle_misaligned_access(struct type_mismatch_data_common *data, c6d308534aef6c Andrey Ryabinin 2016-01-20 278 unsigned long ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 279 { c6d308534aef6c Andrey Ryabinin 2016-01-20 280 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 281 42440c1f9911b4 Andrey Ryabinin 2018-02-06 282 if (suppress_report(data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 283 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 284 42440c1f9911b4 Andrey Ryabinin 2018-02-06 285 ubsan_prologue(data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 286 c6d308534aef6c Andrey Ryabinin 2016-01-20 287 pr_err("%s misaligned address %p for type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 288 type_check_kinds[data->type_check_kind], c6d308534aef6c Andrey Ryabinin 2016-01-20 289 (void *)ptr, data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 290 pr_err("which requires %ld byte alignment\n", data->alignment); c6d308534aef6c Andrey Ryabinin 2016-01-20 291 c6d308534aef6c Andrey Ryabinin 2016-01-20 292 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 293 } c6d308534aef6c Andrey Ryabinin 2016-01-20 294 42440c1f9911b4 Andrey Ryabinin 2018-02-06 295 static void handle_object_size_mismatch(struct type_mismatch_data_common *data, c6d308534aef6c Andrey Ryabinin 2016-01-20 296 unsigned long ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 297 { c6d308534aef6c Andrey Ryabinin 2016-01-20 298 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 299 42440c1f9911b4 Andrey Ryabinin 2018-02-06 300 if (suppress_report(data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 301 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 302 42440c1f9911b4 Andrey Ryabinin 2018-02-06 303 ubsan_prologue(data->location, &flags); 901d805c33fc4c Nicolas Iooss 2016-08-02 304 pr_err("%s address %p with insufficient space\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 305 type_check_kinds[data->type_check_kind], c6d308534aef6c Andrey Ryabinin 2016-01-20 306 (void *) ptr); c6d308534aef6c Andrey Ryabinin 2016-01-20 307 pr_err("for an object of type %s\n", data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 308 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 309 } c6d308534aef6c Andrey Ryabinin 2016-01-20 310 42440c1f9911b4 Andrey Ryabinin 2018-02-06 311 static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data, c6d308534aef6c Andrey Ryabinin 2016-01-20 312 unsigned long ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 313 { c6d308534aef6c Andrey Ryabinin 2016-01-20 314 c6d308534aef6c Andrey Ryabinin 2016-01-20 315 if (!ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 316 handle_null_ptr_deref(data); c6d308534aef6c Andrey Ryabinin 2016-01-20 317 else if (data->alignment && !IS_ALIGNED(ptr, data->alignment)) b8fe1120b4ba34 Andrew Morton 2018-02-06 318 handle_misaligned_access(data, ptr); c6d308534aef6c Andrey Ryabinin 2016-01-20 319 else c6d308534aef6c Andrey Ryabinin 2016-01-20 320 handle_object_size_mismatch(data, ptr); c6d308534aef6c Andrey Ryabinin 2016-01-20 321 } 42440c1f9911b4 Andrey Ryabinin 2018-02-06 322 42440c1f9911b4 Andrey Ryabinin 2018-02-06 323 void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 324 void *ptr) 42440c1f9911b4 Andrey Ryabinin 2018-02-06 325 { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 326 struct type_mismatch_data_common common_data = { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 327 .location = &data->location, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 328 .type = data->type, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 329 .alignment = data->alignment, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 330 .type_check_kind = data->type_check_kind 42440c1f9911b4 Andrey Ryabinin 2018-02-06 331 }; 42440c1f9911b4 Andrey Ryabinin 2018-02-06 332 d2e5767132d657 Andrey Ryabinin 2019-05-13 333 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr); 42440c1f9911b4 Andrey Ryabinin 2018-02-06 334 } c6d308534aef6c Andrey Ryabinin 2016-01-20 335 EXPORT_SYMBOL(__ubsan_handle_type_mismatch); c6d308534aef6c Andrey Ryabinin 2016-01-20 336 42440c1f9911b4 Andrey Ryabinin 2018-02-06 @337 void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 338 void *ptr) 42440c1f9911b4 Andrey Ryabinin 2018-02-06 339 { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 340 42440c1f9911b4 Andrey Ryabinin 2018-02-06 341 struct type_mismatch_data_common common_data = { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 342 .location = &data->location, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 343 .type = data->type, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 344 .alignment = 1UL << data->log_alignment, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 345 .type_check_kind = data->type_check_kind 42440c1f9911b4 Andrey Ryabinin 2018-02-06 346 }; 42440c1f9911b4 Andrey Ryabinin 2018-02-06 347 d2e5767132d657 Andrey Ryabinin 2019-05-13 348 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr); 42440c1f9911b4 Andrey Ryabinin 2018-02-06 349 } 42440c1f9911b4 Andrey Ryabinin 2018-02-06 350 EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1); 42440c1f9911b4 Andrey Ryabinin 2018-02-06 351 c6d308534aef6c Andrey Ryabinin 2016-01-20 @352 void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 353 void *bound) c6d308534aef6c Andrey Ryabinin 2016-01-20 354 { c6d308534aef6c Andrey Ryabinin 2016-01-20 355 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 356 char bound_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 357 c6d308534aef6c Andrey Ryabinin 2016-01-20 358 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 359 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 360 c6d308534aef6c Andrey Ryabinin 2016-01-20 361 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 362 c6d308534aef6c Andrey Ryabinin 2016-01-20 363 val_to_string(bound_str, sizeof(bound_str), data->type, bound); c6d308534aef6c Andrey Ryabinin 2016-01-20 364 pr_err("variable length array bound value %s <= 0\n", bound_str); c6d308534aef6c Andrey Ryabinin 2016-01-20 365 c6d308534aef6c Andrey Ryabinin 2016-01-20 366 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 367 } c6d308534aef6c Andrey Ryabinin 2016-01-20 368 EXPORT_SYMBOL(__ubsan_handle_vla_bound_not_positive); c6d308534aef6c Andrey Ryabinin 2016-01-20 369 d2e5767132d657 Andrey Ryabinin 2019-05-13 @370 void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) c6d308534aef6c Andrey Ryabinin 2016-01-20 371 { c6d308534aef6c Andrey Ryabinin 2016-01-20 372 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 373 char index_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 374 c6d308534aef6c Andrey Ryabinin 2016-01-20 375 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 376 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 377 c6d308534aef6c Andrey Ryabinin 2016-01-20 378 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 379 c6d308534aef6c Andrey Ryabinin 2016-01-20 380 val_to_string(index_str, sizeof(index_str), data->index_type, index); c6d308534aef6c Andrey Ryabinin 2016-01-20 381 pr_err("index %s is out of range for type %s\n", index_str, c6d308534aef6c Andrey Ryabinin 2016-01-20 382 data->array_type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 383 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 384 } c6d308534aef6c Andrey Ryabinin 2016-01-20 385 EXPORT_SYMBOL(__ubsan_handle_out_of_bounds); c6d308534aef6c Andrey Ryabinin 2016-01-20 386 c6d308534aef6c Andrey Ryabinin 2016-01-20 @387 void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 388 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 389 { c6d308534aef6c Andrey Ryabinin 2016-01-20 390 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 391 struct type_descriptor *rhs_type = data->rhs_type; c6d308534aef6c Andrey Ryabinin 2016-01-20 392 struct type_descriptor *lhs_type = data->lhs_type; c6d308534aef6c Andrey Ryabinin 2016-01-20 393 char rhs_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 394 char lhs_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 395 c6d308534aef6c Andrey Ryabinin 2016-01-20 396 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 397 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 398 c6d308534aef6c Andrey Ryabinin 2016-01-20 399 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 400 c6d308534aef6c Andrey Ryabinin 2016-01-20 401 val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs); c6d308534aef6c Andrey Ryabinin 2016-01-20 402 val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs); c6d308534aef6c Andrey Ryabinin 2016-01-20 403 c6d308534aef6c Andrey Ryabinin 2016-01-20 404 if (val_is_negative(rhs_type, rhs)) c6d308534aef6c Andrey Ryabinin 2016-01-20 405 pr_err("shift exponent %s is negative\n", rhs_str); c6d308534aef6c Andrey Ryabinin 2016-01-20 406 c6d308534aef6c Andrey Ryabinin 2016-01-20 407 else if (get_unsigned_val(rhs_type, rhs) >= c6d308534aef6c Andrey Ryabinin 2016-01-20 408 type_bit_width(lhs_type)) c6d308534aef6c Andrey Ryabinin 2016-01-20 409 pr_err("shift exponent %s is too large for %u-bit type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 410 rhs_str, c6d308534aef6c Andrey Ryabinin 2016-01-20 411 type_bit_width(lhs_type), c6d308534aef6c Andrey Ryabinin 2016-01-20 412 lhs_type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 413 else if (val_is_negative(lhs_type, lhs)) c6d308534aef6c Andrey Ryabinin 2016-01-20 414 pr_err("left shift of negative value %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 415 lhs_str); c6d308534aef6c Andrey Ryabinin 2016-01-20 416 else c6d308534aef6c Andrey Ryabinin 2016-01-20 417 pr_err("left shift of %s by %s places cannot be" c6d308534aef6c Andrey Ryabinin 2016-01-20 418 " represented in type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 419 lhs_str, rhs_str, c6d308534aef6c Andrey Ryabinin 2016-01-20 420 lhs_type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 421 c6d308534aef6c Andrey Ryabinin 2016-01-20 422 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 423 } c6d308534aef6c Andrey Ryabinin 2016-01-20 424 EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); c6d308534aef6c Andrey Ryabinin 2016-01-20 425 c6d308534aef6c Andrey Ryabinin 2016-01-20 426 :::::: The code at line 195 was first introduced by commit :::::: c6d308534aef6c99904bf5862066360ae067abc4 UBSAN: run-time undefined behavior sanity checker :::::: TO: Andrey Ryabinin <aryabinin(a)virtuozzo.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0