- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/1] writeback softlockup
by Chen Ridong 16 Apr '24

16 Apr '24

*** BLURB HERE *** Chen Ridong (1): cgroup_writeback: fix softlockup for blkcg->memcg_list mm/backing-dev.c | 15 ++++++++++----- mm/memcontrol.c | 5 ++--- 2 files changed, 12 insertions(+), 8 deletions(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 15455/22120] drivers/staging/gmjstcm/tcm_tis_spi.c:109:5: sparse: sparse: symbol 'tcm_tis_spi_transfer' was not declared. Should it be static?
by kernel test robot 16 Apr '24

16 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ab90000f05ebb295378878af0ab18daacb6f3ccf commit: 5ebbfc8c29eb5eb6dfdab853bdb2a622e0533d7e [15455/22120] staging: TCM: add GMJS(Nationz Tech) TCM driver. config: arm64-randconfig-r111-20240331 (https://download.01.org/0day-ci/archive/20240416/202404161103.X6fwAkxa-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240416/202404161103.X6fwAkxa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404161103.X6fwAkxa-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void *static [noderef] [toplevel] <asn:2> gpio1_a5 @@ drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: expected void volatile [noderef] <asn:2> *addr drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: got void *static [noderef] [toplevel] <asn:2> gpio1_a5 drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void *static [noderef] [toplevel] <asn:2> gpio1_a5 @@ drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: expected void volatile [noderef] <asn:2> *addr drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: got void *static [noderef] [toplevel] <asn:2> gpio1_a5 >> drivers/staging/gmjstcm/tcm_tis_spi.c:109:5: sparse: sparse: symbol 'tcm_tis_spi_transfer' was not declared. Should it be static? drivers/staging/gmjstcm/tcm_tis_spi.c:710:32: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *static [noderef] [toplevel] <asn:2> reuse_conf_reg @@ got void [noderef] <asn:2> * @@ drivers/staging/gmjstcm/tcm_tis_spi.c:710:32: sparse: expected void *static [noderef] [toplevel] <asn:2> reuse_conf_reg drivers/staging/gmjstcm/tcm_tis_spi.c:710:32: sparse: got void [noderef] <asn:2> * drivers/staging/gmjstcm/tcm_tis_spi.c:718:26: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *static [noderef] [toplevel] <asn:2> gpio1_a5 @@ got void [noderef] <asn:2> * @@ drivers/staging/gmjstcm/tcm_tis_spi.c:718:26: sparse: expected void *static [noderef] [toplevel] <asn:2> gpio1_a5 drivers/staging/gmjstcm/tcm_tis_spi.c:718:26: sparse: got void [noderef] <asn:2> * drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] <asn:2> *addr @@ got void *static [noderef] [toplevel] <asn:2> reuse_conf_reg @@ drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: expected void const volatile [noderef] <asn:2> *addr drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: got void *static [noderef] [toplevel] <asn:2> reuse_conf_reg drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void *static [noderef] [toplevel] <asn:2> reuse_conf_reg @@ drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: expected void volatile [noderef] <asn:2> *addr drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: got void *static [noderef] [toplevel] <asn:2> reuse_conf_reg drivers/staging/gmjstcm/tcm_tis_spi.c:729:42: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void * @@ drivers/staging/gmjstcm/tcm_tis_spi.c:729:42: sparse: expected void volatile [noderef] <asn:2> *addr drivers/staging/gmjstcm/tcm_tis_spi.c:729:42: sparse: got void * drivers/staging/gmjstcm/tcm_tis_spi.c:790:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void *static [noderef] [toplevel] <asn:2> reuse_conf_reg @@ drivers/staging/gmjstcm/tcm_tis_spi.c:790:33: sparse: expected void volatile [noderef] <asn:2> *addr drivers/staging/gmjstcm/tcm_tis_spi.c:790:33: sparse: got void *static [noderef] [toplevel] <asn:2> reuse_conf_reg drivers/staging/gmjstcm/tcm_tis_spi.c:792:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void *static [noderef] [toplevel] <asn:2> gpio1_a5 @@ drivers/staging/gmjstcm/tcm_tis_spi.c:792:33: sparse: expected void volatile [noderef] <asn:2> *addr drivers/staging/gmjstcm/tcm_tis_spi.c:792:33: sparse: got void *static [noderef] [toplevel] <asn:2> gpio1_a5 drivers/staging/gmjstcm/tcm_tis_spi.c:805:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void *static [noderef] [toplevel] <asn:2> reuse_conf_reg @@ drivers/staging/gmjstcm/tcm_tis_spi.c:805:33: sparse: expected void volatile [noderef] <asn:2> *addr drivers/staging/gmjstcm/tcm_tis_spi.c:805:33: sparse: got void *static [noderef] [toplevel] <asn:2> reuse_conf_reg drivers/staging/gmjstcm/tcm_tis_spi.c:807:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] <asn:2> *addr @@ got void *static [noderef] [toplevel] <asn:2> gpio1_a5 @@ drivers/staging/gmjstcm/tcm_tis_spi.c:807:33: sparse: expected void volatile [noderef] <asn:2> *addr drivers/staging/gmjstcm/tcm_tis_spi.c:807:33: sparse: got void *static [noderef] [toplevel] <asn:2> gpio1_a5 >> drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: sparse: dereference of noderef expression >> drivers/staging/gmjstcm/tcm_tis_spi.c:125:32: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:178:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:234:13: sparse: sparse: context imbalance in 'cleanup_tis' - wrong count at exit drivers/staging/gmjstcm/tcm_tis_spi.c:711:22: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:719:22: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:726:37: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:727:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:729:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:729:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:789:21: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:790:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:791:21: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:792:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:804:21: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:805:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:806:21: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:807:33: sparse: sparse: dereference of noderef expression drivers/staging/gmjstcm/tcm_tis_spi.c:109:5: warning: no previous prototype for 'tcm_tis_spi_transfer' [-Wmissing-prototypes] 109 | int tcm_tis_spi_transfer(struct device *dev, u32 addr, u16 len, | ^~~~~~~~~~~~~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c: In function 'recv_data': drivers/staging/gmjstcm/tcm_tis_spi.c:423:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 423 | int ret; | ^~~ drivers/staging/gmjstcm/tcm_tis_spi.c: At top level: drivers/staging/gmjstcm/tcm_tis_spi.c:817:36: warning: 'tcm_tis_spi_acpi_match' defined but not used [-Wunused-const-variable=] 817 | static const struct acpi_device_id tcm_tis_spi_acpi_match[] = { | ^~~~~~~~~~~~~~~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c: In function 'cleanup_tis': drivers/staging/gmjstcm/tcm_tis_spi.c:249:17: warning: 'inten' may be used uninitialized [-Wmaybe-uninitialized] 249 | tcm_tis_writel(chip->dev, TCM_INT_ENABLE(chip->vendor.locality), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 250 | ~TCM_GLOBAL_INT_ENABLE & inten); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c:237:13: note: 'inten' was declared here 237 | u32 inten; | ^~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c: In function 'tcm_tis_init': drivers/staging/gmjstcm/tcm_tis_spi.c:264:21: warning: 'vendor' may be used uninitialized [-Wmaybe-uninitialized] 264 | if ((vendor & 0xffff) != 0x19f5 && (vendor & 0xffff) != 0x1B4E) | ~~~~~~~~^~~~~~~~~ drivers/staging/gmjstcm/tcm_tis_spi.c:260:13: note: 'vendor' was declared here 260 | u32 vendor, intfcaps; | ^~~~~~ vim +/tcm_tis_spi_transfer +109 drivers/staging/gmjstcm/tcm_tis_spi.c 108 > 109 int tcm_tis_spi_transfer(struct device *dev, u32 addr, u16 len, 110 u8 *in, const u8 *out) 111 { 112 struct tcm_tis_spi_phy *phy = dev_get_drvdata(dev); 113 int ret = 0; 114 struct spi_message m; 115 struct spi_transfer spi_xfer; 116 u8 transfer_len; 117 118 tcm_dbg("TCM-dbg: %s, addr: 0x%x, len: %x, %s\n", 119 __func__, addr, len, (in) ? "in" : "out"); 120 121 spi_bus_lock(phy->spi_device->master); 122 123 /* set gpio1_a5 to LOW */ 124 if (is_ft_all() && (phy->spi_device->chip_select == 0)) { > 125 iowrite32(0x0, gpio1_a5); 126 } 127 128 while (len) { 129 transfer_len = min_t(u16, len, MAX_SPI_FRAMESIZE); 130 131 phy->iobuf[0] = (in ? 0x80 : 0) | (transfer_len - 1); 132 phy->iobuf[1] = 0xd4; 133 phy->iobuf[2] = addr >> 8; 134 phy->iobuf[3] = addr; 135 136 memset(&spi_xfer, 0, sizeof(spi_xfer)); 137 spi_xfer.tx_buf = phy->iobuf; 138 spi_xfer.rx_buf = phy->iobuf; 139 spi_xfer.len = 4; 140 spi_xfer.cs_change = 1; 141 142 spi_message_init(&m); 143 spi_message_add_tail(&spi_xfer, &m); 144 ret = spi_sync_locked(phy->spi_device, &m); 145 if (ret < 0) 146 goto exit; 147 148 spi_xfer.cs_change = 0; 149 spi_xfer.len = transfer_len; 150 spi_xfer.delay_usecs = 5; 151 152 if (in) { 153 spi_xfer.tx_buf = NULL; 154 } else if (out) { 155 spi_xfer.rx_buf = NULL; 156 memcpy(phy->iobuf, out, transfer_len); 157 out += transfer_len; 158 } 159 160 spi_message_init(&m); 161 spi_message_add_tail(&spi_xfer, &m); 162 reinit_completion(&phy->ready); 163 ret = spi_sync_locked(phy->spi_device, &m); 164 if (ret < 0) 165 goto exit; 166 167 if (in) { 168 memcpy(in, phy->iobuf, transfer_len); 169 in += transfer_len; 170 } 171 172 len -= transfer_len; 173 } 174 175 exit: 176 /* set gpio1_a5 to HIGH */ 177 if (is_ft_all() && (phy->spi_device->chip_select == 0)) { 178 iowrite32(0x20, gpio1_a5); 179 } 180 181 spi_bus_unlock(phy->spi_device->master); 182 tcm_dbg("TCM-dbg: ret: %d\n", ret); 183 return ret; 184 } 185 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net/sched: act_mirred: don't override retval if we already lost the skb
by Zhengchao Shao 16 Apr '24

16 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LZ CVE: CVE-2024-26739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it. Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index 336db2c938b5..2563c128f381 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -305,15 +305,18 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, } err = tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb2); - if (err) { -out: + if (err) qstats_overlimit_inc(this_cpu_ptr(m->common.cpu_qstats)); - if (tcf_mirred_is_act_redirect(m_eaction)) - retval = TC_ACT_SHOT; - } __this_cpu_dec(mirred_rec_level); return retval; + +out: + qstats_overlimit_inc(this_cpu_ptr(m->common.cpu_qstats)); + if (tcf_mirred_is_act_redirect(m_eaction)) + retval = TC_ACT_SHOT; + __this_cpu_dec(mirred_rec_level); + return retval; } static void tcf_stats_update(struct tc_action *a, u64 bytes, u32 packets, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] i40e: Fix NULL ptr dereference on VSI filter sync
by Zhang Zekun 16 Apr '24

16 Apr '24

From: Michal Maloszewski <michal.maloszewski(a)intel.com> stable inclusion from stable-4.19.218 commit 87c421ab4a43433cb009fea44bbbc77f46913e1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFW CVE: CVE-2021-47184 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------ [ Upstream commit 37d9e304acd903a445df8208b8a13d707902dea6 ] Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update the VSI filter list after VSI is removed, that's causing a kernel oops. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek(a)intel.com> Signed-off-by: Michal Maloszewski <michal.maloszewski(a)intel.com> Reviewed-by: Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com> Reviewed-by: Witold Fijalkowski <witoldx.fijalkowski(a)intel.com> Reviewed-by: Jaroslaw Gawin <jaroslawx.gawin(a)intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Tested-by: Tony Brelinski <tony.brelinski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h index 6fcf51baca13..3bccf23135da 100644 --- a/drivers/net/ethernet/intel/i40e/i40e.h +++ b/drivers/net/ethernet/intel/i40e/i40e.h @@ -166,6 +166,7 @@ enum i40e_vsi_state_t { __I40E_VSI_OVERFLOW_PROMISC, __I40E_VSI_REINIT_REQUESTED, __I40E_VSI_DOWN_REQUESTED, + __I40E_VSI_RELEASING, /* This must be last as it determines the size of the BITMAP */ __I40E_VSI_STATE_SIZE__, }; diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index a728b6a7872c..fc6550979118 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -2584,7 +2584,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) for (v = 0; v < pf->num_alloc_vsi; v++) { if (pf->vsi[v] && - (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) { + (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) && + !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) { int ret = i40e_sync_vsi_filters(pf->vsi[v]); if (ret) { @@ -12425,7 +12426,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi) dev_info(&pf->pdev->dev, "Can't remove PF VSI\n"); return -ENODEV; } - + set_bit(__I40E_VSI_RELEASING, vsi->state); uplink_seid = vsi->uplink_seid; if (vsi->type != I40E_VSI_SRIOV) { if (vsi->netdev_registered) { -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] i40e: Fix NULL ptr dereference on VSI filter sync
by Zhang Zekun 16 Apr '24

16 Apr '24

From: Michal Maloszewski <michal.maloszewski(a)intel.com> stable inclusion from stable-4.19.218 commit 87c421ab4a43433cb009fea44bbbc77f46913e1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------ [ Upstream commit 37d9e304acd903a445df8208b8a13d707902dea6 ] Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update the VSI filter list after VSI is removed, that's causing a kernel oops. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek(a)intel.com> Signed-off-by: Michal Maloszewski <michal.maloszewski(a)intel.com> Reviewed-by: Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com> Reviewed-by: Witold Fijalkowski <witoldx.fijalkowski(a)intel.com> Reviewed-by: Jaroslaw Gawin <jaroslawx.gawin(a)intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Tested-by: Tony Brelinski <tony.brelinski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h index 6fcf51baca13..3bccf23135da 100644 --- a/drivers/net/ethernet/intel/i40e/i40e.h +++ b/drivers/net/ethernet/intel/i40e/i40e.h @@ -166,6 +166,7 @@ enum i40e_vsi_state_t { __I40E_VSI_OVERFLOW_PROMISC, __I40E_VSI_REINIT_REQUESTED, __I40E_VSI_DOWN_REQUESTED, + __I40E_VSI_RELEASING, /* This must be last as it determines the size of the BITMAP */ __I40E_VSI_STATE_SIZE__, }; diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index a728b6a7872c..fc6550979118 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -2584,7 +2584,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) for (v = 0; v < pf->num_alloc_vsi; v++) { if (pf->vsi[v] && - (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) { + (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) && + !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) { int ret = i40e_sync_vsi_filters(pf->vsi[v]); if (ret) { @@ -12425,7 +12426,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi) dev_info(&pf->pdev->dev, "Can't remove PF VSI\n"); return -ENODEV; } - + set_bit(__I40E_VSI_RELEASING, vsi->state); uplink_seid = vsi->uplink_seid; if (vsi->type != I40E_VSI_SRIOV) { if (vsi->netdev_registered) { -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] net/sched: act_mirred: don't override retval if we already lost the skb
by Zhengchao Shao 16 Apr '24

16 Apr '24

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.8-rc6 commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LZ CVE: CVE-2024-26739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it. Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_mirred.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_mirred.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index 336db2c938b5..9866e0521297 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -305,15 +305,18 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, } err = tcf_mirred_forward(skb_at_tc_ingress(skb), want_ingress, skb2); - if (err) { -out: + if (err) qstats_overlimit_inc(this_cpu_ptr(m->common.cpu_qstats)); - if (tcf_mirred_is_act_redirect(m_eaction)) - retval = TC_ACT_SHOT; - } __this_cpu_dec(mirred_rec_level); return retval; + +out: + tcf_action_inc_overlimit_qstats(&m->common); + if (tcf_mirred_is_act_redirect(m_eaction)) + retval = TC_ACT_SHOT; + __this_cpu_dec(mirred_rec_level); + return retval; } static void tcf_stats_update(struct tc_action *a, u64 bytes, u32 packets, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-26812
by Jinjie Ruan 16 Apr '24

16 Apr '24

Fix CVE-2024-26812. Alex Williamson (2): vfio: Introduce interface to flush virqfd inject workqueue vfio/pci: Create persistent INTx handler drivers/vfio/pci/vfio_pci_intrs.c | 149 ++++++++++++++++-------------- drivers/vfio/virqfd.c | 21 +++++ include/linux/vfio.h | 2 + 3 files changed, 105 insertions(+), 67 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 14630/22116] drivers/net/xen-netback/interface.c:170:49: sparse: sparse: dubious: !x | !y
by kernel test robot 16 Apr '24

16 Apr '24

Hi Juergen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b152f5a5ef7efe0b5bf8de2aae6e73a549d0d223 commit: b8f0cb59f64793764cac8b6db7bee9b6157ceb7e [14630/22116] xen/netback: use lateeoi irq binding config: arm64-randconfig-r111-20240331 (https://download.01.org/0day-ci/archive/20240416/202404160915.wAO7ibZH-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240416/202404160915.wAO7ibZH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404160915.wAO7ibZH-lkp@intel.com/ All errors (new ones prefixed by >>): /tmp/ccKkN2Zj.s: Assembler messages: >> /tmp/ccKkN2Zj.s:1072: Error: immediate out of range at operand 3 -- `bic w0,w1,5' sparse warnings: (new ones prefixed by >>) >> drivers/net/xen-netback/interface.c:170:49: sparse: sparse: dubious: !x | !y vim +170 drivers/net/xen-netback/interface.c 160 161 irqreturn_t xenvif_interrupt(int irq, void *dev_id) 162 { 163 struct xenvif_queue *queue = dev_id; 164 int old; 165 166 old = atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending); 167 WARN(old, "Interrupt while EOI pending\n"); 168 169 /* Use bitwise or as we need to call both functions. */ > 170 if ((!xenvif_handle_tx_interrupt(queue) | 171 !xenvif_handle_rx_interrupt(queue))) { 172 atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending); 173 xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS); 174 } 175 176 return IRQ_HANDLED; 177 } 178 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION acea9ae4ff468479f36da39a79938b22666ee087
by kernel test robot 16 Apr '24

16 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: acea9ae4ff468479f36da39a79938b22666ee087 !6108 udma: optimize latency for non-share-jfr mode Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202404160310.lPDiksZx-lkp@intel.com Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-005-20240415 | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit `-- x86_64-randconfig-071-20240415 |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains `-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-arm-cpu.yaml:properties:capacity-dmips-mhz:ref-should-not-be-valid-under-const:ref | |-- Documentation-devicetree-bindings-arm-cpu.yaml:title:ARM-CPUs-bindings-should-not-be-valid-under-pattern:(-Bb-inding-Ss-chema) | |-- Documentation-devicetree-bindings-arm-cpus.yaml:examples:cpus-arm-pbha-performance-only-bits-arm-pbha-no-aliases-bits-ncpu-device_type-cpu-compatible-arm-cortex-a57-...-n-is-not-of-type-array | |-- Documentation-devicetree-bindings-arm-cpus.yaml:maintainers-is-a-required-property | |-- description:Display-controller-reference-clock-source-is-not-of-type-object-boolean | |-- description:Display-controller-reference-clock-source-is-too-short | |-- description:Offset-and-length-of-the-memory-mapped-registers-is-too-short | |-- items-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneOf-r | `-- minItems-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneO |-- x86_64-allnoconfig | `-- drivers-net-ethernet-mucse-rnpm-rnpm_common.h:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- drivers-infiniband-hw-xsc-mem.c:warning:no-previous-prototype-for-function-xsc_find_chunk_cont_0 | |-- drivers-infiniband-hw-xsc-mr.c:warning:variable-using_peer_mem-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-common-xsc_core.h:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_eth_change_link_status | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_get_vf_config | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_get_linear_frag_sz | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_is_linear_skb | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_select_queue | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:variable-txq_ix-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-buffer_size-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-curr_pfc_en-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-prio2buffer-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_devid_to_pcie_no | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-find_kallsyms_lookup_name | `-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-noop_pre `-- x86_64-randconfig-123-20240416 `-- arch-x86-kernel-alternative.c:sparse:sparse:symbol-x86nops-was-not-declared.-Should-it-be-static elapsed time: 725m configs tested: 35 configs skipped: 147 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240415 clang arm64 randconfig-002-20240415 clang arm64 randconfig-003-20240415 clang arm64 randconfig-004-20240415 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240415 clang x86_64 buildonly-randconfig-002-20240415 clang x86_64 buildonly-randconfig-003-20240415 clang x86_64 buildonly-randconfig-004-20240415 clang x86_64 buildonly-randconfig-005-20240415 gcc x86_64 buildonly-randconfig-006-20240415 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240415 gcc x86_64 randconfig-002-20240415 gcc x86_64 randconfig-003-20240415 clang x86_64 randconfig-004-20240415 gcc x86_64 randconfig-005-20240415 clang x86_64 randconfig-006-20240415 clang x86_64 randconfig-011-20240415 clang x86_64 randconfig-012-20240415 clang x86_64 randconfig-013-20240415 gcc x86_64 randconfig-014-20240415 clang x86_64 randconfig-015-20240415 clang x86_64 randconfig-016-20240415 clang x86_64 randconfig-071-20240415 gcc x86_64 randconfig-072-20240415 clang x86_64 randconfig-073-20240415 clang x86_64 randconfig-074-20240415 clang x86_64 randconfig-075-20240415 clang x86_64 randconfig-076-20240415 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29355/30000] arch/x86/kernel/alternative.c:78:21: sparse: sparse: symbol 'x86nops' was not declared. Should it be static?
by kernel test robot 16 Apr '24

16 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: acea9ae4ff468479f36da39a79938b22666ee087 commit: 8243b036681b074fab34e18024d1ee24c656b432 [29355/30000] x86: Remove dynamic NOP selection config: x86_64-randconfig-123-20240416 (https://download.01.org/0day-ci/archive/20240416/202404160310.lPDiksZx-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240416/202404160310.lPDiksZx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404160310.lPDiksZx-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kernel/alternative.c:78:21: sparse: sparse: symbol 'x86nops' was not declared. Should it be static? vim +/x86nops +78 arch/x86/kernel/alternative.c 77 > 78 const unsigned char x86nops[] = 79 { 80 BYTES_NOP1, 81 BYTES_NOP2, 82 BYTES_NOP3, 83 BYTES_NOP4, 84 BYTES_NOP5, 85 BYTES_NOP6, 86 BYTES_NOP7, 87 BYTES_NOP8, 88 }; 89 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0