- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] arm64/mpam: Try reading again if monitor instance returns not ready
by Zeng Heng 24 Feb '25

24 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG93D -------------------------------- If the MSC monitor instance is the first time to configure, this single monitor need to wait 'not ready' time before getting the valid value. Components made up of multiple MSC may need values from each MSC, so when getting the whole component monitor values, need to wait every single monitor instance 'not ready' time instead of once per component. Fixes: bb66b4d115e5 ("arm_mpam: Add mpam_msmon_read() to read monitor value") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 37 +++++++++++++--------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 6031551ed827..4aebefd58ac1 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -1038,11 +1038,14 @@ static void __ris_msmon_read(void *arg) } *(m->val) += now; + m->err = 0; } static int _msmon_read(struct mpam_component *comp, struct mon_read *arg) { int err, idx; + bool read_again; + u64 wait_jiffies; struct mpam_msc *msc; struct mpam_msc_ris *ris; @@ -1051,10 +1054,23 @@ static int _msmon_read(struct mpam_component *comp, struct mon_read *arg) arg->ris = ris; msc = ris->msc; + read_again = false; +again: mutex_lock(&msc->lock); err = smp_call_function_any(&msc->accessibility, __ris_msmon_read, arg, true); mutex_unlock(&msc->lock); + + if (arg->err == -EBUSY && !read_again) { + read_again = true; + + wait_jiffies = usecs_to_jiffies(comp->class->nrdy_usec); + while (wait_jiffies) + wait_jiffies = schedule_timeout_uninterruptible(wait_jiffies); + + goto again; + } + if (!err && arg->err) err = arg->err; if (err) @@ -1068,9 +1084,7 @@ static int _msmon_read(struct mpam_component *comp, struct mon_read *arg) int mpam_msmon_read(struct mpam_component *comp, struct mon_cfg *ctx, enum mpam_device_features type, u64 *val) { - int err; struct mon_read arg; - u64 wait_jiffies = 0; struct mpam_props *cprops = &comp->class->props; might_sleep(); @@ -1087,24 +1101,7 @@ int mpam_msmon_read(struct mpam_component *comp, struct mon_cfg *ctx, arg.val = val; *val = 0; - err = _msmon_read(comp, &arg); - if (err == -EBUSY) - wait_jiffies = usecs_to_jiffies(comp->class->nrdy_usec); - - while (wait_jiffies) - wait_jiffies = schedule_timeout_uninterruptible(wait_jiffies); - - if (err == -EBUSY) { - memset(&arg, 0, sizeof(arg)); - arg.ctx = ctx; - arg.type = type; - arg.val = val; - *val = 0; - - err = _msmon_read(comp, &arg); - } - - return err; + return _msmon_read(comp, &arg); } void mpam_msmon_reset_all_mbwu(struct mpam_component *comp) -- 2.25.1

2 1

[PATCH OLK-5.10] power: supply: gpio-charger: Fix set charge current limits
by Wenyu Huang 24 Feb '25

24 Feb '25

From: Dimitri Fedrau <dimitri.fedrau(a)liebherr.com> stable inclusion from stable-v5.10.233 commit b29c7783ac1fe36d639c089cf471ac7a46df05f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI63F CVE: CVE-2024-57792 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit afc6e39e824ad0e44b2af50a97885caec8d213d1 upstream. Fix set charge current limits for devices which allow to set the lowest charge current limit to be greater zero. If requested charge current limit is below lowest limit, the index equals current_limit_map_size which leads to accessing memory beyond allocated memory. Fixes: be2919d8355e ("power: supply: gpio-charger: add charge-current-limit feature") Cc: stable(a)vger.kernel.org Signed-off-by: Dimitri Fedrau <dimitri.fedrau(a)liebherr.com> Link: https://lore.kernel.org/r/20241209-fix-charge-current-limit-v1-1-760d9b8f2a… Signed-off-by: Sebastian Reichel <sebastian.reichel(a)collabora.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/power/supply/gpio-charger.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/power/supply/gpio-charger.c b/drivers/power/supply/gpio-charger.c index 68212b39785b..6139f736ecbe 100644 --- a/drivers/power/supply/gpio-charger.c +++ b/drivers/power/supply/gpio-charger.c @@ -67,6 +67,14 @@ static int set_charge_current_limit(struct gpio_charger *gpio_charger, int val) if (gpio_charger->current_limit_map[i].limit_ua <= val) break; } + + /* + * If a valid charge current limit isn't found, default to smallest + * current limitation for safety reasons. + */ + if (i >= gpio_charger->current_limit_map_size) + i = gpio_charger->current_limit_map_size - 1; + mapping = gpio_charger->current_limit_map[i]; for (i = 0; i < ndescs; i++) { -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] CVE-2024-57857
by Liu Jian 24 Feb '25

24 Feb '25

CVE-2024-57857 Bernard Metzler (2): RDMA/siw: Enable siw on tunnel devices RDMA/siw: Remove direct link to net_device Chuck Lever (1): RDMA/siw: Fabricate a GID on tun and loopback devices Kamal Heib (1): RDMA/siw: Use helper function to set sys_image_guid drivers/infiniband/sw/siw/siw.h | 8 +++--- drivers/infiniband/sw/siw/siw_cm.c | 27 ++++++++++++++---- drivers/infiniband/sw/siw/siw_main.c | 38 +++++++------------------ drivers/infiniband/sw/siw/siw_verbs.c | 41 ++++++++++++++++++--------- 4 files changed, 64 insertions(+), 50 deletions(-) -- 2.34.1

2 5

[openeuler:OLK-6.6 1966/1966] include/linux/fortify-string.h:57:33: warning: '__builtin_memcpy' reading between 65 and 536870912 bytes from a region of size 64
by kernel test robot 24 Feb '25

24 Feb '25

Hi Guo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 88b69da4524a4c574fa7642d89cb392506b4595e commit: f04c0f3eb9b49427c273cd3e4d5a2ff895855b4b [1966/1966] make OPTIMIZE_INLINING config editable config: arm64-randconfig-001-20250224 (https://download.01.org/0day-ci/archive/20250224/202502241304.ilCBBhWc-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250224/202502241304.ilCBBhWc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502241304.ilCBBhWc-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/string.h:294, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from include/linux/smp.h:13, from include/linux/lockdep.h:14, from include/linux/spinlock.h:63, from include/linux/swait.h:7, from include/linux/completion.h:12, from kernel/padata.c:14: In function 'bitmap_copy', inlined from 'cpumask_copy' at include/linux/cpumask.h:740:2, inlined from '__padata_set_cpumasks' at kernel/padata.c:709:2: >> include/linux/fortify-string.h:57:33: warning: '__builtin_memcpy' reading between 65 and 536870912 bytes from a region of size 64 [-Wstringop-overread] 57 | #define __underlying_memcpy __builtin_memcpy | ^ include/linux/fortify-string.h:648:9: note: in expansion of macro '__underlying_memcpy' 648 | __underlying_##op(p, q, __fortify_size); \ | ^~~~~~~~~~~~~ include/linux/fortify-string.h:693:26: note: in expansion of macro '__fortify_memcpy_chk' 693 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^~~~~~~~~~~~~~~~~~~~ include/linux/bitmap.h:268:17: note: in expansion of macro 'memcpy' 268 | memcpy(dst, src, len); | ^~~~~~ kernel/padata.c: In function '__padata_set_cpumasks': kernel/padata.c:692:48: note: source object 'pcpumask' of size [0, 64] 692 | cpumask_var_t pcpumask, | ~~~~~~~~~~~~~~^~~~~~~~ In function 'bitmap_copy', inlined from 'cpumask_copy' at include/linux/cpumask.h:740:2, inlined from '__padata_set_cpumasks' at kernel/padata.c:709:2: >> include/linux/fortify-string.h:57:33: warning: '__builtin_memcpy' reading between 65 and 536870912 bytes from a region of size 64 [-Wstringop-overread] 57 | #define __underlying_memcpy __builtin_memcpy | ^ include/linux/fortify-string.h:648:9: note: in expansion of macro '__underlying_memcpy' 648 | __underlying_##op(p, q, __fortify_size); \ | ^~~~~~~~~~~~~ include/linux/fortify-string.h:693:26: note: in expansion of macro '__fortify_memcpy_chk' 693 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^~~~~~~~~~~~~~~~~~~~ include/linux/bitmap.h:268:17: note: in expansion of macro 'memcpy' 268 | memcpy(dst, src, len); | ^~~~~~ kernel/padata.c: In function '__padata_set_cpumasks': kernel/padata.c:692:48: note: source object 'pcpumask' of size [0, 64] 692 | cpumask_var_t pcpumask, | ~~~~~~~~~~~~~~^~~~~~~~ vim +/__builtin_memcpy +57 include/linux/fortify-string.h 78a498c3a227f2 Alexander Potapenko 2022-10-24 46 78a498c3a227f2 Alexander Potapenko 2022-10-24 47 #if defined(__SANITIZE_MEMORY__) 78a498c3a227f2 Alexander Potapenko 2022-10-24 48 /* 78a498c3a227f2 Alexander Potapenko 2022-10-24 49 * For KMSAN builds all memcpy/memset/memmove calls should be replaced by the 78a498c3a227f2 Alexander Potapenko 2022-10-24 50 * corresponding __msan_XXX functions. 78a498c3a227f2 Alexander Potapenko 2022-10-24 51 */ 78a498c3a227f2 Alexander Potapenko 2022-10-24 52 #include <linux/kmsan_string.h> 78a498c3a227f2 Alexander Potapenko 2022-10-24 53 #define __underlying_memcpy __msan_memcpy 78a498c3a227f2 Alexander Potapenko 2022-10-24 54 #define __underlying_memmove __msan_memmove 78a498c3a227f2 Alexander Potapenko 2022-10-24 55 #define __underlying_memset __msan_memset 78a498c3a227f2 Alexander Potapenko 2022-10-24 56 #else a28a6e860c6cf2 Francis Laniel 2021-02-25 @57 #define __underlying_memcpy __builtin_memcpy a28a6e860c6cf2 Francis Laniel 2021-02-25 58 #define __underlying_memmove __builtin_memmove a28a6e860c6cf2 Francis Laniel 2021-02-25 59 #define __underlying_memset __builtin_memset 78a498c3a227f2 Alexander Potapenko 2022-10-24 60 #endif 78a498c3a227f2 Alexander Potapenko 2022-10-24 61 :::::: The code at line 57 was first introduced by commit :::::: a28a6e860c6cf231cf3c5171c75c342adcd00406 string.h: move fortified functions definitions in a dedicated header. :::::: TO: Francis Laniel <laniel_francis(a)privacyrequired.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] iio: pressure: zpa2326: fix information leak in triggered buffer
by Wenyu Huang 24 Feb '25

24 Feb '25

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> stable inclusion from stable-v6.6.72 commit fefb88a4da961a0b9c2473cbdcfce1a942fcfa9a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQW6 CVE: CVE-2024-57912 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6007d10c5262f6f71479627c1216899ea7f09073 upstream. The 'sample' local struct is used to push data to user space from a triggered buffer, but it has a hole between the temperature and the timestamp (u32 pressure, u16 temperature, GAP, u64 timestamp). This hole is never initialized. Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace. Cc: stable(a)vger.kernel.org Fixes: 03b262f2bbf4 ("iio:pressure: initial zpa2326 barometer support") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-3-0cb6e98d895c@g… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/iio/pressure/zpa2326.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c index 2cecbe0adb3f..b8bc2c67462d 100644 --- a/drivers/iio/pressure/zpa2326.c +++ b/drivers/iio/pressure/zpa2326.c @@ -586,6 +586,8 @@ static int zpa2326_fill_sample_buffer(struct iio_dev *indio_dev, } sample; int err; + memset(&sample, 0, sizeof(sample)); + if (test_bit(0, indio_dev->active_scan_mask)) { /* Get current pressure from hardware FIFO. */ err = zpa2326_dequeue_pressure(indio_dev, &sample.pressure); -- 2.34.1

2 1

[PATCH OLK-6.6 0/7] CVE-2024-57952
by Yongjian Sun 24 Feb '25

24 Feb '25

*** BLURB HERE *** Al Viro (1): [Backport] dentry: switch the lists of children to hlist Chuck Lever (5): [Backport] libfs: Return ENOSPC when the directory offset range is exhausted [Backport] Revert "libfs: Add simple_offset_empty()" [Backport] Revert "libfs: fix infinite directory reads for offset dir" [Backport] libfs: Replace simple_offset end-of-directory detection [Backport] libfs: Use d_children list to iterate simple_offset directories Yongjian Sun (1): [Huawei] fs: fix dentry kabi broken Documentation/filesystems/porting.rst | 9 + arch/powerpc/platforms/cell/spufs/inode.c | 5 +- fs/afs/dynroot.c | 5 +- fs/autofs/expire.c | 7 +- fs/ceph/dir.c | 2 +- fs/ceph/mds_client.c | 2 +- fs/coda/cache.c | 2 +- fs/dcache.c | 76 ++++---- fs/libfs.c | 207 ++++++++++------------ fs/nfsd/nfsctl.c | 5 +- fs/notify/fsnotify.c | 2 +- include/linux/dcache.h | 14 +- include/linux/fs.h | 1 - mm/shmem.c | 4 +- 14 files changed, 173 insertions(+), 168 deletions(-) -- 2.39.2

2 8

[PATCH openEuler-1.0-LTS] nfsd: make sure exp active before svc_export_show
by Li Lingfeng 24 Feb '25

24 Feb '25

From: Yang Erkun <yangerkun(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit be8f982c369c965faffa198b46060f8853e0f1f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMQ CVE: CVE-2024-56558 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function `e_show` was called with protection from RCU. This only ensures that `exp` will not be freed. Therefore, the reference count for `exp` can drop to zero, which will trigger a refcount use-after-free warning when `exp_get` is called. To resolve this issue, use `cache_get_rcu` to ensure that `exp` remains active. ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 819 at lib/refcount.c:25 refcount_warn_saturate+0xb1/0x120 CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb1/0x120 ... Call Trace: <TASK> e_show+0x20b/0x230 [nfsd] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: bf18f163e89c ("NFSD: Using exp_get for export getting") Cc: stable(a)vger.kernel.org # 4.20+ Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/export.c [Commit ae74136b4bb6 ("SUNRPC: Allow cache lookups to use RCU protection rather than the r/w spinlock") add the definition of cache_get_rcu.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/export.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c index 170456ba2e0b..20e36bb38554 100644 --- a/fs/nfsd/export.c +++ b/fs/nfsd/export.c @@ -1220,9 +1220,12 @@ static int e_show(struct seq_file *m, void *p) return 0; } - exp_get(exp); + if (!(kref_get_unless_zero(&(&exp->h)->ref))) + return 0; + if (cache_check(cd, &exp->h, NULL)) return 0; + exp_put(exp); return svc_export_show(m, cd, cp); } -- 2.31.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 59e807fc6b29960f736cb1bcf4f323ab1e2bc395
by kernel test robot 23 Feb '25

23 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 59e807fc6b29960f736cb1bcf4f323ab1e2bc395 !15170 The QoS feature adapts to the cfs bandwidth throttling Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250222 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250222 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250222 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250222 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allmodconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250222 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- loongarch-randconfig-002-20250222 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_PRELOAD-when-selected-by-PGP_PRELOAD_PUBLIC_KEYS | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250222 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250222 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250222 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250222 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250222 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250222 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-161-20250223 |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 828m configs tested: 19 configs skipped: 124 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250222 gcc-14.2.0 arm64 randconfig-002-20250222 clang-21 arm64 randconfig-003-20250222 clang-18 arm64 randconfig-004-20250222 clang-21 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250222 gcc-14.2.0 loongarch randconfig-002-20250222 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250222 clang-19 x86_64 buildonly-randconfig-002-20250222 gcc-12 x86_64 buildonly-randconfig-003-20250222 gcc-12 x86_64 buildonly-randconfig-004-20250222 clang-19 x86_64 buildonly-randconfig-005-20250222 clang-19 x86_64 buildonly-randconfig-006-20250222 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2759/2759] cc1: warning: drivers/net/ethernet/bzwx/nce/ne6x_vf: No such file or directory
by kernel test robot 23 Feb '25

23 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4d88bf76198b8a462646f7be261586ebb2bbf5f3 commit: 5b3d89af9629848d7a4a4928fd911364e310cb06 [2759/2759] drivers: add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver config: x86_64-randconfig-101-20250222 (https://download.01.org/0day-ci/archive/20250223/202502230031.3Wt6JhSy-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250223/202502230031.3Wt6JhSy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502230031.3Wt6JhSy-lkp@intel.com/ All warnings (new ones prefixed by >>): >> cc1: warning: drivers/net/ethernet/bzwx/nce/ne6x_vf: No such file or directory [-Wmissing-include-dirs] drivers/net/ethernet/bzwx/nce/comm/txrx.c:5:10: fatal error: ne6x_trace.h: No such file or directory 5 | #include "ne6x_trace.h" | ^~~~~~~~~~~~~~ compilation terminated. -- >> cc1: warning: drivers/net/ethernet/bzwx/nce/ne6x_vf: No such file or directory [-Wmissing-include-dirs] In file included from drivers/net/ethernet/bzwx/nce/ne6x/ne6x_main.c:14: drivers/net/ethernet/bzwx/nce/ne6x/ne6x.h:35:10: fatal error: reg.h: No such file or directory 35 | #include "reg.h" | ^~~~~~~ compilation terminated. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1958/1958] include/linux/fortify-string.h:583:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()?
by kernel test robot 22 Feb '25

22 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 97a32f076246fcfdb99917daa4daffc96a22e3d9 commit: 165b3cc224374728856b5584455d7ae7f054fbe5 [1958/1958] SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250222/202502221657.bPUaL9Yl-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250222/202502221657.bPUaL9Yl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502221657.bPUaL9Yl-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/scsi/sssraid/sssraid_fw.c:7: In file included from include/linux/pci.h:27: In file included from include/linux/mod_devicetable.h:14: In file included from include/linux/uuid.h:11: In file included from include/linux/string.h:294: >> include/linux/fortify-string.h:583:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] 583 | __write_overflow_field(p_size_field, size); | ^ 1 warning generated. vim +583 include/linux/fortify-string.h a28a6e860c6cf2 Francis Laniel 2021-02-25 527 f68f2ff91512c1 Kees Cook 2021-04-20 528 /* f68f2ff91512c1 Kees Cook 2021-04-20 529 * To make sure the compiler can enforce protection against buffer overflows, f68f2ff91512c1 Kees Cook 2021-04-20 530 * memcpy(), memmove(), and memset() must not be used beyond individual f68f2ff91512c1 Kees Cook 2021-04-20 531 * struct members. If you need to copy across multiple members, please use f68f2ff91512c1 Kees Cook 2021-04-20 532 * struct_group() to create a named mirror of an anonymous struct union. f68f2ff91512c1 Kees Cook 2021-04-20 533 * (e.g. see struct sk_buff.) Read overflow checking is currently only f68f2ff91512c1 Kees Cook 2021-04-20 534 * done when a write overflow is also present, or when building with W=1. f68f2ff91512c1 Kees Cook 2021-04-20 535 * f68f2ff91512c1 Kees Cook 2021-04-20 536 * Mitigation coverage matrix f68f2ff91512c1 Kees Cook 2021-04-20 537 * Bounds checking at: f68f2ff91512c1 Kees Cook 2021-04-20 538 * +-------+-------+-------+-------+ f68f2ff91512c1 Kees Cook 2021-04-20 539 * | Compile time | Run time | f68f2ff91512c1 Kees Cook 2021-04-20 540 * memcpy() argument sizes: | write | read | write | read | f68f2ff91512c1 Kees Cook 2021-04-20 541 * dest source length +-------+-------+-------+-------+ f68f2ff91512c1 Kees Cook 2021-04-20 542 * memcpy(known, known, constant) | y | y | n/a | n/a | f68f2ff91512c1 Kees Cook 2021-04-20 543 * memcpy(known, unknown, constant) | y | n | n/a | V | f68f2ff91512c1 Kees Cook 2021-04-20 544 * memcpy(known, known, dynamic) | n | n | B | B | f68f2ff91512c1 Kees Cook 2021-04-20 545 * memcpy(known, unknown, dynamic) | n | n | B | V | f68f2ff91512c1 Kees Cook 2021-04-20 546 * memcpy(unknown, known, constant) | n | y | V | n/a | f68f2ff91512c1 Kees Cook 2021-04-20 547 * memcpy(unknown, unknown, constant) | n | n | V | V | f68f2ff91512c1 Kees Cook 2021-04-20 548 * memcpy(unknown, known, dynamic) | n | n | V | B | f68f2ff91512c1 Kees Cook 2021-04-20 549 * memcpy(unknown, unknown, dynamic) | n | n | V | V | f68f2ff91512c1 Kees Cook 2021-04-20 550 * +-------+-------+-------+-------+ f68f2ff91512c1 Kees Cook 2021-04-20 551 * f68f2ff91512c1 Kees Cook 2021-04-20 552 * y = perform deterministic compile-time bounds checking f68f2ff91512c1 Kees Cook 2021-04-20 553 * n = cannot perform deterministic compile-time bounds checking f68f2ff91512c1 Kees Cook 2021-04-20 554 * n/a = no run-time bounds checking needed since compile-time deterministic f68f2ff91512c1 Kees Cook 2021-04-20 555 * B = can perform run-time bounds checking (currently unimplemented) f68f2ff91512c1 Kees Cook 2021-04-20 556 * V = vulnerable to run-time overflow (will need refactoring to solve) f68f2ff91512c1 Kees Cook 2021-04-20 557 * f68f2ff91512c1 Kees Cook 2021-04-20 558 */ 54d9469bc515dc Kees Cook 2021-06-24 559 __FORTIFY_INLINE bool fortify_memcpy_chk(__kernel_size_t size, f68f2ff91512c1 Kees Cook 2021-04-20 560 const size_t p_size, f68f2ff91512c1 Kees Cook 2021-04-20 561 const size_t q_size, f68f2ff91512c1 Kees Cook 2021-04-20 562 const size_t p_size_field, f68f2ff91512c1 Kees Cook 2021-04-20 563 const size_t q_size_field, f68f2ff91512c1 Kees Cook 2021-04-20 564 const char *func) a28a6e860c6cf2 Francis Laniel 2021-02-25 565 { a28a6e860c6cf2 Francis Laniel 2021-02-25 566 if (__builtin_constant_p(size)) { f68f2ff91512c1 Kees Cook 2021-04-20 567 /* f68f2ff91512c1 Kees Cook 2021-04-20 568 * Length argument is a constant expression, so we f68f2ff91512c1 Kees Cook 2021-04-20 569 * can perform compile-time bounds checking where fa35198f39571b Kees Cook 2022-09-19 570 * buffer sizes are also known at compile time. f68f2ff91512c1 Kees Cook 2021-04-20 571 */ f68f2ff91512c1 Kees Cook 2021-04-20 572 f68f2ff91512c1 Kees Cook 2021-04-20 573 /* Error when size is larger than enclosing struct. */ fa35198f39571b Kees Cook 2022-09-19 574 if (__compiletime_lessthan(p_size_field, p_size) && fa35198f39571b Kees Cook 2022-09-19 575 __compiletime_lessthan(p_size, size)) a28a6e860c6cf2 Francis Laniel 2021-02-25 576 __write_overflow(); fa35198f39571b Kees Cook 2022-09-19 577 if (__compiletime_lessthan(q_size_field, q_size) && fa35198f39571b Kees Cook 2022-09-19 578 __compiletime_lessthan(q_size, size)) a28a6e860c6cf2 Francis Laniel 2021-02-25 579 __read_overflow2(); f68f2ff91512c1 Kees Cook 2021-04-20 580 f68f2ff91512c1 Kees Cook 2021-04-20 581 /* Warn when write size argument larger than dest field. */ fa35198f39571b Kees Cook 2022-09-19 582 if (__compiletime_lessthan(p_size_field, size)) f68f2ff91512c1 Kees Cook 2021-04-20 @583 __write_overflow_field(p_size_field, size); f68f2ff91512c1 Kees Cook 2021-04-20 584 /* f68f2ff91512c1 Kees Cook 2021-04-20 585 * Warn for source field over-read when building with W=1 f68f2ff91512c1 Kees Cook 2021-04-20 586 * or when an over-write happened, so both can be fixed at f68f2ff91512c1 Kees Cook 2021-04-20 587 * the same time. f68f2ff91512c1 Kees Cook 2021-04-20 588 */ fa35198f39571b Kees Cook 2022-09-19 589 if ((IS_ENABLED(KBUILD_EXTRA_WARN1) || fa35198f39571b Kees Cook 2022-09-19 590 __compiletime_lessthan(p_size_field, size)) && fa35198f39571b Kees Cook 2022-09-19 591 __compiletime_lessthan(q_size_field, size)) f68f2ff91512c1 Kees Cook 2021-04-20 592 __read_overflow2_field(q_size_field, size); a28a6e860c6cf2 Francis Laniel 2021-02-25 593 } f68f2ff91512c1 Kees Cook 2021-04-20 594 /* f68f2ff91512c1 Kees Cook 2021-04-20 595 * At this point, length argument may not be a constant expression, f68f2ff91512c1 Kees Cook 2021-04-20 596 * so run-time bounds checking can be done where buffer sizes are f68f2ff91512c1 Kees Cook 2021-04-20 597 * known. (This is not an "else" because the above checks may only f68f2ff91512c1 Kees Cook 2021-04-20 598 * be compile-time warnings, and we want to still warn for run-time f68f2ff91512c1 Kees Cook 2021-04-20 599 * overflows.) f68f2ff91512c1 Kees Cook 2021-04-20 600 */ f68f2ff91512c1 Kees Cook 2021-04-20 601 f68f2ff91512c1 Kees Cook 2021-04-20 602 /* f68f2ff91512c1 Kees Cook 2021-04-20 603 * Always stop accesses beyond the struct that contains the f68f2ff91512c1 Kees Cook 2021-04-20 604 * field, when the buffer's remaining size is known. 311fb40aa0569a Kees Cook 2022-09-02 605 * (The SIZE_MAX test is to optimize away checks where the buffer f68f2ff91512c1 Kees Cook 2021-04-20 606 * lengths are unknown.) f68f2ff91512c1 Kees Cook 2021-04-20 607 */ 311fb40aa0569a Kees Cook 2022-09-02 608 if ((p_size != SIZE_MAX && p_size < size) || 311fb40aa0569a Kees Cook 2022-09-02 609 (q_size != SIZE_MAX && q_size < size)) f68f2ff91512c1 Kees Cook 2021-04-20 610 fortify_panic(func); 54d9469bc515dc Kees Cook 2021-06-24 611 54d9469bc515dc Kees Cook 2021-06-24 612 /* 54d9469bc515dc Kees Cook 2021-06-24 613 * Warn when writing beyond destination field size. 54d9469bc515dc Kees Cook 2021-06-24 614 * 54d9469bc515dc Kees Cook 2021-06-24 615 * We must ignore p_size_field == 0 for existing 0-element 54d9469bc515dc Kees Cook 2021-06-24 616 * fake flexible arrays, until they are all converted to 54d9469bc515dc Kees Cook 2021-06-24 617 * proper flexible arrays. 54d9469bc515dc Kees Cook 2021-06-24 618 * 9f7d69c5cd2390 Kees Cook 2022-09-19 619 * The implementation of __builtin_*object_size() behaves 54d9469bc515dc Kees Cook 2021-06-24 620 * like sizeof() when not directly referencing a flexible 54d9469bc515dc Kees Cook 2021-06-24 621 * array member, which means there will be many bounds checks 54d9469bc515dc Kees Cook 2021-06-24 622 * that will appear at run-time, without a way for them to be 54d9469bc515dc Kees Cook 2021-06-24 623 * detected at compile-time (as can be done when the destination 54d9469bc515dc Kees Cook 2021-06-24 624 * is specifically the flexible array member). 54d9469bc515dc Kees Cook 2021-06-24 625 * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101832 54d9469bc515dc Kees Cook 2021-06-24 626 */ 54d9469bc515dc Kees Cook 2021-06-24 627 if (p_size_field != 0 && p_size_field != SIZE_MAX && 54d9469bc515dc Kees Cook 2021-06-24 628 p_size != p_size_field && p_size_field < size) 54d9469bc515dc Kees Cook 2021-06-24 629 return true; 54d9469bc515dc Kees Cook 2021-06-24 630 54d9469bc515dc Kees Cook 2021-06-24 631 return false; a28a6e860c6cf2 Francis Laniel 2021-02-25 632 } a28a6e860c6cf2 Francis Laniel 2021-02-25 633 :::::: The code at line 583 was first introduced by commit :::::: f68f2ff91512c199ec24883001245912afc17873 fortify: Detect struct member overflows in memcpy() at compile-time :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0