- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 11013/30000] drivers/ide/ide-io.c:456:58: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: caa1ae20bcc64a80625a9449240580f5190ed3a0 commit: 8a6bee347626968d467aef07453c4547bc23cb64 [11013/30000] blk-mq: fix potential uaf for 'queue_hw_ctx' config: x86_64-randconfig-122-20240313 (https://download.01.org/0day-ci/archive/20240314/202403140313.Qwz6h2Lt-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403140313.Qwz6h2Lt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403140313.Qwz6h2Lt-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/ide/ide-io.c:456:58: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@ drivers/ide/ide-io.c:456:58: sparse: expected struct blk_mq_hw_ctx *hctx drivers/ide/ide-io.c:456:58: sparse: got struct blk_mq_hw_ctx [noderef] __rcu * vim +456 drivers/ide/ide-io.c 5b31f855f10d00 Bartlomiej Zolnierkiewicz 2009-01-06 446 782b86e2656762 Jens Axboe 2011-04-05 447 void ide_requeue_and_plug(ide_drive_t *drive, struct request *rq) 782b86e2656762 Jens Axboe 2011-04-05 448 { 782b86e2656762 Jens Axboe 2011-04-05 449 struct request_queue *q = drive->queue; 782b86e2656762 Jens Axboe 2011-04-05 450 600335205b8d16 Jens Axboe 2018-10-26 451 /* Use 3ms as that was the old plug delay */ 600335205b8d16 Jens Axboe 2018-10-26 452 if (rq) { 600335205b8d16 Jens Axboe 2018-10-26 453 blk_mq_requeue_request(rq, false); 600335205b8d16 Jens Axboe 2018-10-26 454 blk_mq_delay_kick_requeue_list(q, 3); 600335205b8d16 Jens Axboe 2018-10-26 455 } else 600335205b8d16 Jens Axboe 2018-10-26 @456 blk_mq_delay_run_hw_queue(q->queue_hw_ctx[0], 3); 782b86e2656762 Jens Axboe 2011-04-05 457 } 782b86e2656762 Jens Axboe 2011-04-05 458 :::::: The code at line 456 was first introduced by commit :::::: 600335205b8d162891b5ef2e32343f5b8020efd8 ide: convert to blk-mq :::::: TO: Jens Axboe <axboe(a)kernel.dk> :::::: CC: Jens Axboe <axboe(a)kernel.dk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] Upgrade driver for Broadcom NIC BCM57414
by Dapeng Yu 14 Mar '24

14 Mar '24

Upgrade driver for Broadcom NIC BCM57414 Florian Fainelli (2): net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close Somnath Kotur (2): bnxt_en: Query default VLAN before VNIC setup on a VF bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks Sreekanth Reddy (1): bnxt_en: Don't issue AP reset during ethtool's reset operation Tobias Heider (1): Add MODULE_FIRMWARE() for FIRMWARE_TG357766. drivers/net/ethernet/broadcom/bnxt/bnxt.c | 28 ++++++++++++++----- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 9 +++--- drivers/net/ethernet/broadcom/tg3.c | 1 + 4 files changed, 28 insertions(+), 12 deletions(-) -- 2.43.0

1 6

[openeuler:OLK-6.6 1812/3958] kernel/sched/fair.c:175:5: sparse: sparse: symbol 'sysctl_sched_util_low_pct' was not declared. Should it be static?
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f066d3699b4816fda2b6f452885b51bd22199c43 commit: 2e1dfc02d115143587ccfee1815ad295763050f2 [1812/3958] sched: Adjust wakeup cpu range according CPU util dynamicly config: x86_64-randconfig-123-20240313 (https://download.01.org/0day-ci/archive/20240313/202403132127.OaVz6UjY-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403132127.OaVz6UjY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403132127.OaVz6UjY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:144:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? >> kernel/sched/fair.c:175:5: sparse: sparse: symbol 'sysctl_sched_util_low_pct' was not declared. Should it be static? kernel/sched/fair.c:1256:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1256:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1256:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:3039:13: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct task_struct *tsk @@ got struct task_struct [noderef] __rcu * @@ kernel/sched/fair.c:3039:13: sparse: expected struct task_struct *tsk kernel/sched/fair.c:3039:13: sparse: got struct task_struct [noderef] __rcu * kernel/sched/fair.c:12740:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12740:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12740:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5891:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5891:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:5891:22: sparse: struct task_struct * kernel/sched/fair.c:6633:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6633:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6633:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:7964:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7964:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:7964:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8258:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8258:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8258:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8367:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8367:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8367:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8587:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8587:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8587:22: sparse: struct task_struct * kernel/sched/fair.c:8941:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8941:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8941:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9934:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:9934:40: sparse: expected struct sched_domain *child kernel/sched/fair.c:9934:40: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:10571:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:10571:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:10571:22: sparse: struct task_struct * kernel/sched/fair.c:12012:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12012:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12012:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:11669:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11669:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:11669:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12108:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12108:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12108:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:2985:9: sparse: sparse: context imbalance in 'task_numa_placement' - different lock contexts for basic block kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * kernel/sched/sched.h:2309:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2309:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2309:9: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * vim +/sysctl_sched_util_low_pct +175 kernel/sched/fair.c 64 65 /* 66 * The initial- and re-scaling of tunables is configurable 67 * 68 * Options are: 69 * 70 * SCHED_TUNABLESCALING_NONE - unscaled, always *1 71 * SCHED_TUNABLESCALING_LOG - scaled logarithmical, *1+ilog(ncpus) 72 * SCHED_TUNABLESCALING_LINEAR - scaled linear, *ncpus 73 * 74 * (default SCHED_TUNABLESCALING_LOG = *(1+ilog(ncpus)) 75 */ > 76 unsigned int sysctl_sched_tunable_scaling = SCHED_TUNABLESCALING_LOG; 77 78 /* 79 * Minimal preemption granularity for CPU-bound tasks: 80 * 81 * (default: 0.75 msec * (1 + ilog(ncpus)), units: nanoseconds) 82 */ 83 unsigned int sysctl_sched_base_slice = 750000ULL; 84 static unsigned int normalized_sysctl_sched_base_slice = 750000ULL; 85 86 /* 87 * After fork, child runs first. If set to 0 (default) then 88 * parent will (try to) run first. 89 */ 90 unsigned int sysctl_sched_child_runs_first __read_mostly; 91 92 const_debug unsigned int sysctl_sched_migration_cost = 500000UL; 93 94 int sched_thermal_decay_shift; 95 static int __init setup_sched_thermal_decay_shift(char *str) 96 { 97 int _shift = 0; 98 99 if (kstrtoint(str, 0, &_shift)) 100 pr_warn("Unable to set scheduler thermal pressure decay shift parameter\n"); 101 102 sched_thermal_decay_shift = clamp(_shift, 0, 10); 103 return 1; 104 } 105 __setup("sched_thermal_decay_shift=", setup_sched_thermal_decay_shift); 106 107 #ifdef CONFIG_SMP 108 /* 109 * For asym packing, by default the lower numbered CPU has higher priority. 110 */ 111 int __weak arch_asym_cpu_priority(int cpu) 112 { 113 return -cpu; 114 } 115 116 /* 117 * The margin used when comparing utilization with CPU capacity. 118 * 119 * (default: ~20%) 120 */ 121 #define fits_capacity(cap, max) ((cap) * 1280 < (max) * 1024) 122 123 /* 124 * The margin used when comparing CPU capacities. 125 * is 'cap1' noticeably greater than 'cap2' 126 * 127 * (default: ~5%) 128 */ 129 #define capacity_greater(cap1, cap2) ((cap1) * 1024 > (cap2) * 1078) 130 #endif 131 132 #ifdef CONFIG_QOS_SCHED 133 134 /* 135 * To distinguish cfs bw, use QOS_THROTTLED mark cfs_rq->throttled 136 * when qos throttled(and cfs bw throttle mark cfs_rq->throttled as 1). 137 */ 138 #define QOS_THROTTLED 2 139 140 static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, qos_throttled_cfs_rq); 141 static DEFINE_PER_CPU_SHARED_ALIGNED(struct hrtimer, qos_overload_timer); 142 static DEFINE_PER_CPU(int, qos_cpu_overload); 143 unsigned int sysctl_overload_detect_period = 5000; /* in ms */ 144 unsigned int sysctl_offline_wait_interval = 100; /* in ms */ 145 static int one_thousand = 1000; 146 static int hundred_thousand = 100000; 147 static int unthrottle_qos_cfs_rqs(int cpu); 148 #endif 149 150 #ifdef CONFIG_CFS_BANDWIDTH 151 /* 152 * Amount of runtime to allocate from global (tg) to local (per-cfs_rq) pool 153 * each time a cfs_rq requests quota. 154 * 155 * Note: in the case that the slice exceeds the runtime remaining (either due 156 * to consumption or the quota being specified to be smaller than the slice) 157 * we will always only issue the remaining available time. 158 * 159 * (default: 5 msec, units: microseconds) 160 */ 161 static unsigned int sysctl_sched_cfs_bandwidth_slice = 5000UL; 162 #endif 163 164 #ifdef CONFIG_NUMA_BALANCING 165 /* Restrict the NUMA promotion throughput (MB/s) for each target node. */ 166 static unsigned int sysctl_numa_balancing_promote_rate_limit = 65536; 167 #endif 168 169 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 170 /* 171 * Low utilization threshold for CPU 172 * 173 * (default: 85%), units: percentage of CPU utilization) 174 */ > 175 int sysctl_sched_util_low_pct = 85; 176 #endif 177 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/22] mTHP anon support
by Kefeng Wang 13 Mar '24

13 Mar '24

Let's support mTHP for anon page. David Hildenbrand (9): mm/rmap: drop stale comment in page_add_anon_rmap and hugepage_add_anon_rmap() mm/rmap: move SetPageAnonExclusive out of __page_set_anon_rmap() mm/rmap: move folio_test_anon() check out of __folio_set_anon() mm/rmap: warn on new PTE-mapped folios in page_add_anon_rmap() mm/rmap: simplify PageAnonExclusive sanity checks when adding anon rmap mm/rmap: pass folio to hugepage_add_anon_rmap() mm/rmap: move SetPageAnonExclusive() out of page_move_anon_rmap() mm/rmap: convert page_move_anon_rmap() to folio_move_anon_rmap() memory: move exclusivity detection in do_wp_page() into wp_can_reuse_anon_folio() Ryan Roberts (12): mm: more ptep_get() conversion mm/readahead: do not allow order-1 folio mm: allow deferred splitting of arbitrary anon large folios mm: non-pmd-mappable, large folios for folio_add_new_anon_rmap() mm: thp: introduce multi-size THP sysfs interface mm: thp: support allocation of anonymous multi-size THP selftests/mm/kugepaged: restore thp settings at exit selftests/mm: factor out thp settings management selftests/mm: support multi-size THP interface in thp_settings selftests/mm/khugepaged: enlighten for multi-size THP selftests/mm/cow: generalize do_run_with_thp() helper selftests/mm/cow: add tests for anonymous multi-size THP Zach O'Keefe (1): mm/thp: fix "mm: thp: kill __transhuge_page_enabled()" Documentation/admin-guide/mm/transhuge.rst | 97 ++++- Documentation/filesystems/proc.rst | 6 +- fs/proc/task_mmu.c | 3 +- include/linux/huge_mm.h | 183 +++++++-- include/linux/rmap.h | 4 +- mm/filemap.c | 2 +- mm/huge_memory.c | 248 +++++++++++-- mm/hugetlb.c | 6 +- mm/khugepaged.c | 20 +- mm/ksm.c | 2 +- mm/memory.c | 204 +++++++--- mm/migrate.c | 2 +- mm/page_vma_mapped.c | 3 +- mm/readahead.c | 14 +- mm/rmap.c | 126 ++++--- mm/userfaultfd.c | 2 +- tools/testing/selftests/mm/Makefile | 4 +- tools/testing/selftests/mm/cow.c | 183 ++++++--- tools/testing/selftests/mm/khugepaged.c | 410 ++++----------------- tools/testing/selftests/mm/run_vmtests.sh | 2 + tools/testing/selftests/mm/thp_settings.c | 349 ++++++++++++++++++ tools/testing/selftests/mm/thp_settings.h | 80 ++++ 22 files changed, 1332 insertions(+), 618 deletions(-) create mode 100644 tools/testing/selftests/mm/thp_settings.c create mode 100644 tools/testing/selftests/mm/thp_settings.h -- 2.27.0

2 23

[openeuler:openEuler-1.0-LTS 8452/21854] kernel/ktask.c:80:5: sparse: sparse: symbol 'ktask_max_threads' was not declared. Should it be static?
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b318937609077b966b3bd130583ee3aaaa4d015a commit: c48676ef6b6f9cb8497d6264ae9ff71b87630337 [8452/21854] ktask: multithread CPU-intensive kernel work config: x86_64-randconfig-122-20240313 (https://download.01.org/0day-ci/archive/20240313/202403132000.KEN5Ibpb-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403132000.KEN5Ibpb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403132000.KEN5Ibpb-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/ktask.c:80:5: sparse: sparse: symbol 'ktask_max_threads' was not declared. Should it be static? vim +/ktask_max_threads +80 kernel/ktask.c 78 79 /* Maximum number of threads for a single task. */ > 80 int ktask_max_threads = KTASK_DEFAULT_MAX_THREADS; 81 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 16901/30000] mm/clear_freelist_page.c:141:50: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: caa1ae20bcc64a80625a9449240580f5190ed3a0 commit: 426b9efea56f9b065151d165caab2ebd32906505 [16901/30000] mm: Add sysctl to clear free list pages config: x86_64-randconfig-r121-20240313 (https://download.01.org/0day-ci/archive/20240313/202403131805.usWE0GjN-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403131805.usWE0GjN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403131805.usWE0GjN-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/clear_freelist_page.c:141:50: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/clear_freelist_page.c:141:50: sparse: expected void * mm/clear_freelist_page.c:141:50: sparse: got void [noderef] __user *buffer >> mm/clear_freelist_page.c:155:36: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/clear_freelist_page.c:155:36: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/clear_freelist_page.c:155:36: sparse: got int ( * )( ... ) vim +141 mm/clear_freelist_page.c 133 134 static int sysctl_clear_freelist_handler(struct ctl_table *table, int write, 135 void __user *buffer, size_t *lenp, loff_t *ppos) 136 { 137 int ret; 138 int val; 139 140 table->data = &val; > 141 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 142 143 if (!ret && write) 144 clear_freelist_pages(); 145 146 return ret; 147 } 148 149 static struct ctl_table clear_freelist_table[] = { 150 { 151 .procname = "clear_freelist_pages", 152 .data = NULL, 153 .maxlen = sizeof(int), 154 .mode = 0200, > 155 .proc_handler = &sysctl_clear_freelist_handler, 156 .extra1 = SYSCTL_ONE, 157 .extra2 = SYSCTL_ONE, 158 }, 159 { } 160 }; 161 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] Add Huawei Intelligent Network Card Driver: hinic3
by Zhou Shuai 13 Mar '24

13 Mar '24

Update hinic3 driver, the NIC driver supports the following features: Supports IPv4/IPv6 TCP/UDP checksum offload, TSO/LRO/RSS. Supports interrupt aggregation parameter configuration and interrupt adaptation. Supports 802.1Q VLAN (Virtual Local Area Network) offloading and filtering. Supports NIC SR-IOV (Single Root I/O Virtualization). Loopback testing is supported. Support port lighting. Support Ethernet mouth self-negotiation, support pause frame. Zhou Shuai (1): net/hinic3: add huawei/hinic3 driver Documentation/networking/hinic3.rst | 128 + MAINTAINERS | 25 +- drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/hinic3/Kconfig | 13 + drivers/net/ethernet/huawei/hinic3/Makefile | 45 + .../ethernet/huawei/hinic3/cfg_mgt_comm_pub.h | 212 ++ .../ethernet/huawei/hinic3/comm_cmdq_intf.h | 239 ++ .../net/ethernet/huawei/hinic3/comm_defs.h | 100 + .../ethernet/huawei/hinic3/comm_msg_intf.h | 664 +++++ .../ethernet/huawei/hinic3/hinic3_comm_cmd.h | 185 ++ .../ethernet/huawei/hinic3/hinic3_common.h | 118 + .../net/ethernet/huawei/hinic3/hinic3_crm.h | 1162 +++++++++ .../net/ethernet/huawei/hinic3/hinic3_dbg.c | 983 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.c | 405 ++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.h | 78 + .../ethernet/huawei/hinic3/hinic3_ethtool.c | 1332 ++++++++++ .../huawei/hinic3/hinic3_ethtool_stats.c | 1259 ++++++++++ .../ethernet/huawei/hinic3/hinic3_filter.c | 483 ++++ .../net/ethernet/huawei/hinic3/hinic3_hw.h | 828 +++++++ .../net/ethernet/huawei/hinic3/hinic3_irq.c | 189 ++ .../net/ethernet/huawei/hinic3/hinic3_lld.h | 205 ++ .../ethernet/huawei/hinic3/hinic3_mag_cfg.c | 953 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_main.c | 1115 +++++++++ .../huawei/hinic3/hinic3_mgmt_interface.h | 1209 ++++++++++ .../net/ethernet/huawei/hinic3/hinic3_mt.h | 681 ++++++ .../huawei/hinic3/hinic3_netdev_ops.c | 1945 +++++++++++++++ .../net/ethernet/huawei/hinic3/hinic3_nic.h | 183 ++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.c | 1608 +++++++++++++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.h | 620 +++++ .../huawei/hinic3/hinic3_nic_cfg_vf.c | 637 +++++ .../ethernet/huawei/hinic3/hinic3_nic_cmd.h | 159 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.c | 146 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.h | 21 + .../ethernet/huawei/hinic3/hinic3_nic_dev.h | 387 +++ .../ethernet/huawei/hinic3/hinic3_nic_event.c | 580 +++++ .../ethernet/huawei/hinic3/hinic3_nic_io.c | 1121 +++++++++ .../ethernet/huawei/hinic3/hinic3_nic_io.h | 325 +++ .../ethernet/huawei/hinic3/hinic3_nic_prof.c | 47 + .../ethernet/huawei/hinic3/hinic3_nic_prof.h | 59 + .../ethernet/huawei/hinic3/hinic3_nic_qp.h | 384 +++ .../ethernet/huawei/hinic3/hinic3_ntuple.c | 904 +++++++ .../ethernet/huawei/hinic3/hinic3_profile.h | 146 ++ .../net/ethernet/huawei/hinic3/hinic3_rss.c | 971 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_rss.h | 95 + .../ethernet/huawei/hinic3/hinic3_rss_cfg.c | 384 +++ .../net/ethernet/huawei/hinic3/hinic3_rx.c | 1343 +++++++++++ .../net/ethernet/huawei/hinic3/hinic3_rx.h | 155 ++ .../ethernet/huawei/hinic3/hinic3_srv_nic.h | 213 ++ .../net/ethernet/huawei/hinic3/hinic3_tx.c | 1002 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_tx.h | 157 ++ .../net/ethernet/huawei/hinic3/hinic3_wq.h | 130 + .../huawei/hinic3/hw/hinic3_api_cmd.c | 1210 ++++++++++ .../huawei/hinic3/hw/hinic3_api_cmd.h | 286 +++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.c | 1540 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.h | 204 ++ .../ethernet/huawei/hinic3/hw/hinic3_common.c | 93 + .../ethernet/huawei/hinic3/hw/hinic3_csr.h | 187 ++ .../huawei/hinic3/hw/hinic3_dev_mgmt.c | 802 +++++++ .../huawei/hinic3/hw/hinic3_dev_mgmt.h | 105 + .../huawei/hinic3/hw/hinic3_devlink.c | 392 +++ .../huawei/hinic3/hw/hinic3_devlink.h | 149 ++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.c | 1379 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.h | 164 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.c | 453 ++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.h | 141 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 1480 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 332 +++ .../huawei/hinic3/hw/hinic3_hw_comm.c | 1540 ++++++++++++ .../huawei/hinic3/hw/hinic3_hw_comm.h | 51 + .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.c | 598 +++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.h | 49 + .../ethernet/huawei/hinic3/hw/hinic3_hwdev.c | 2133 +++++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwdev.h | 175 ++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 994 ++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.h | 113 + .../ethernet/huawei/hinic3/hw/hinic3_lld.c | 1383 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.c | 1837 ++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.h | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.c | 1512 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.h | 179 ++ .../huawei/hinic3/hw/hinic3_nictool.c | 974 ++++++++ .../huawei/hinic3/hw/hinic3_nictool.h | 35 + .../huawei/hinic3/hw/hinic3_pci_id_tbl.h | 18 + .../huawei/hinic3/hw/hinic3_prof_adap.c | 44 + .../huawei/hinic3/hw/hinic3_prof_adap.h | 109 + .../ethernet/huawei/hinic3/hw/hinic3_sm_lt.h | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sml_lt.c | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.c | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.h | 35 + .../net/ethernet/huawei/hinic3/hw/hinic3_wq.c | 157 ++ .../huawei/hinic3/hw/ossl_knl_linux.c | 107 + drivers/net/ethernet/huawei/hinic3/mag_cmd.h | 818 +++++++ .../ethernet/huawei/hinic3/mgmt_msg_base.h | 27 + .../net/ethernet/huawei/hinic3/nic_cfg_comm.h | 63 + drivers/net/ethernet/huawei/hinic3/ossl_knl.h | 35 + .../ethernet/huawei/hinic3/ossl_knl_linux.h | 269 +++ 97 files changed, 49344 insertions(+), 17 deletions(-) create mode 100644 Documentation/networking/hinic3.rst create mode 100644 drivers/net/ethernet/huawei/hinic3/Kconfig create mode 100644 drivers/net/ethernet/huawei/hinic3/Makefile create mode 100644 drivers/net/ethernet/huawei/hinic3/cfg_mgt_comm_pub.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_cmdq_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_msg_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_comm_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_crm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_filter.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_hw.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_irq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_lld.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_main.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_netdev_ops.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_event.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_profile.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_srv_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_common.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_pci_id_tbl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/ossl_knl_linux.c create mode 100644 drivers/net/ethernet/huawei/hinic3/mag_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/mgmt_msg_base.h create mode 100644 drivers/net/ethernet/huawei/hinic3/nic_cfg_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h -- 2.24.0

2 2

[openeuler:OLK-5.10 25744/30000] arch/arm64/kernel/cpufeature.c:1627:6: warning: no previous prototype for 'update_pbha_perf_only_bit'
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fa7099066983597bd415dde5a3e416bf2bd8f7c commit: f43933b3f947a7f9314ec8d704c6ae01041dbbba [25744/30000] arm64: cpufeature: Enable PBHA for stage1 early via FDT config: arm64-randconfig-002-20240312 (https://download.01.org/0day-ci/archive/20240313/202403131533.AIOfBKrb-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403131533.AIOfBKrb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403131533.AIOfBKrb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/cpufeature.c:1627:6: warning: no previous prototype for 'update_pbha_perf_only_bit' [-Wmissing-prototypes] 1627 | void update_pbha_perf_only_bit(const u8 *bits, int cnt) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/cpufeature.c:1729:13: warning: no previous prototype for 'early_pbha_init' [-Wmissing-prototypes] 1729 | void __init early_pbha_init(void) | ^~~~~~~~~~~~~~~ vim +/update_pbha_perf_only_bit +1627 arch/arm64/kernel/cpufeature.c 1626 > 1627 void update_pbha_perf_only_bit(const u8 *bits, int cnt) 1628 { 1629 u8 val; 1630 int i; 1631 1632 /* any listed value is usable at stage 1 */ 1633 for (i = 0 ; i < cnt; i++) { 1634 val = bits[i]; 1635 if (val > 0xf) 1636 continue; 1637 1638 pbha_stage1_enable_bits |= val; 1639 set_bit(val, &arm64_pbha_perf_only_values); 1640 } 1641 } 1642 1643 static bool plat_can_use_pbha_stage1(const struct arm64_cpu_capabilities *cap, 1644 int scope) 1645 { 1646 u8 val; 1647 struct device_node *cpus; 1648 const u8 *perf_only_vals; 1649 int num_perf_only_vals, i; 1650 1651 if (!has_cpuid_feature(cap, scope)) 1652 return false; 1653 1654 /* 1655 * Calls with scope == SCOPE_LOCAL_CPU need only testing whether this 1656 * cpu has the feature. A later 'system' scope call will check for a 1657 * firmware description. 1658 */ 1659 if (scope == SCOPE_LOCAL_CPU) 1660 return true; 1661 1662 spin_lock(&pbha_dt_lock); 1663 if (pbha_enabled) 1664 goto out_unlock; 1665 1666 cpus = of_find_node_by_path("/cpus"); 1667 if (!cpus) 1668 goto done; 1669 1670 perf_only_vals = of_get_property(cpus, "arm,pbha-performance-only", 1671 &num_perf_only_vals); 1672 if (!perf_only_vals) 1673 goto done; 1674 1675 update_pbha_perf_only_bit(perf_only_vals, num_perf_only_vals); 1676 1677 /* 1678 * for stage2 the values are collapsed back to 4 bits that can only 1679 * enable values in the arm64_pbha_perf_only_values mask. 1680 */ 1681 for (i = 0 ; i < num_perf_only_vals; i++) { 1682 val = perf_only_vals[i]; 1683 if (val > 0xf) 1684 continue; 1685 1686 stage2_test_pbha_value(val); 1687 } 1688 1689 done: 1690 of_node_put(cpus); 1691 pbha_enabled = true; 1692 1693 out_unlock: 1694 spin_unlock(&pbha_dt_lock); 1695 return !!pbha_stage1_enable_bits; 1696 } 1697 1698 static void enable_pbha_inner(void) 1699 { 1700 u64 tcr; 1701 1702 if (!pbha_stage1_enable_bits) 1703 return; 1704 1705 tcr = read_sysreg(tcr_el1); 1706 tcr |= FIELD_PREP(TCR_HWU0nn_MASK, pbha_stage1_enable_bits); 1707 tcr |= FIELD_PREP(TCR_HWU1nn_MASK, pbha_stage1_enable_bits); 1708 tcr |= FIELD_PREP(TCR_HPD0, 1) | FIELD_PREP(TCR_HPD1, 1); 1709 1710 write_sysreg(tcr, tcr_el1); 1711 isb(); 1712 local_flush_tlb_all(); 1713 } 1714 1715 static void cpu_enable_pbha(struct arm64_cpu_capabilities const *cap) 1716 { 1717 enable_pbha_inner(); 1718 } 1719 1720 static inline bool cpu_has_pbha(void) 1721 { 1722 u64 mmfr1 = read_cpuid(ID_AA64MMFR1_EL1); 1723 int val = cpuid_feature_extract_unsigned_field(mmfr1, 1724 ID_AA64MMFR1_HPD_SHIFT); 1725 1726 return val == 2; 1727 } 1728 > 1729 void __init early_pbha_init(void) 1730 { 1731 void *fdt; 1732 int node; 1733 const u8 *prop; 1734 int size; 1735 1736 spin_lock(&pbha_dt_lock); 1737 1738 fdt = get_early_fdt_ptr(); 1739 if (!fdt) 1740 goto unlock; 1741 1742 node = fdt_path_offset(fdt, "/cpus"); 1743 if (node < 0) 1744 goto unlock; 1745 1746 prop = fdt_getprop(fdt, node, "arm,pbha-performance-only", &size); 1747 if (!prop) 1748 goto unlock; 1749 1750 if (!cpu_has_pbha()) 1751 goto unlock; 1752 1753 update_pbha_perf_only_bit(prop, size); 1754 enable_pbha_inner(); 1755 1756 pbha_enabled = true; 1757 1758 unlock: 1759 spin_unlock(&pbha_dt_lock); 1760 } 1761 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] Update Huawei Intelligent Network Card Driver: hinic
by Zhou Shuai 13 Mar '24

13 Mar '24

Update hinic driver, the NIC driver supports the following features: Supports IPv4/IPv6 TCP/UDP checksum offload, TSO (TCP Segmentation Offload), LRO (Large Receive Offload) offload and RSS (Receive Side Scaling) functions Supports interrupt aggregation parameter configuration and interrupt adaptation. Supports 802.1Q VLAN (Virtual Local Area Network) offloading and filtering. Supports NIC SR-IOV (Single Root I/O Virtualization). Support PF promiscuous mode, unicast list filtering, multicast list filtering, and full multicast mode. Support VF unicast list filtering, multicast list filtering, and full multicast mode. Supports VF QinQ mode. Supports VF link state configuration and QoS configuration. Support VF MAC address management. Support VF spoofchk check. Loopback testing is supported. Support port lighting. Support Ethernet mouth self-negotiation, support pause frame. Zhou Shuai (1): net/hinic: Update Huawei Intelligent Network Card Driver: hinic drivers/net/ethernet/huawei/hinic/Makefile | 14 +- .../net/ethernet/huawei/hinic/hinic_api_cmd.c | 1164 ++++ .../net/ethernet/huawei/hinic/hinic_api_cmd.h | 298 + drivers/net/ethernet/huawei/hinic/hinic_cfg.c | 2478 ++++++++ drivers/net/ethernet/huawei/hinic/hinic_cfg.h | 526 ++ .../net/ethernet/huawei/hinic/hinic_cmdq.c | 1575 ++++++ .../net/ethernet/huawei/hinic/hinic_cmdq.h | 217 + .../net/ethernet/huawei/hinic/hinic_common.c | 71 - .../net/ethernet/huawei/hinic/hinic_common.h | 29 - drivers/net/ethernet/huawei/hinic/hinic_csr.h | 207 + .../net/ethernet/huawei/hinic/hinic_ctx_def.h | 242 + drivers/net/ethernet/huawei/hinic/hinic_dbg.h | 93 + .../ethernet/huawei/hinic/hinic_dbgtool_knl.c | 899 +++ .../ethernet/huawei/hinic/hinic_dbgtool_knl.h | 120 + drivers/net/ethernet/huawei/hinic/hinic_dcb.c | 1795 ++++++ drivers/net/ethernet/huawei/hinic/hinic_dcb.h | 67 + .../net/ethernet/huawei/hinic/hinic_debugfs.c | 324 -- .../net/ethernet/huawei/hinic/hinic_debugfs.h | 113 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 132 - .../net/ethernet/huawei/hinic/hinic_devlink.c | 584 -- .../net/ethernet/huawei/hinic/hinic_devlink.h | 119 - .../net/ethernet/huawei/hinic/hinic_dfx_def.h | 150 + drivers/net/ethernet/huawei/hinic/hinic_eqs.c | 1462 +++++ drivers/net/ethernet/huawei/hinic/hinic_eqs.h | 177 + .../net/ethernet/huawei/hinic/hinic_ethtool.c | 3078 ++++++---- drivers/net/ethernet/huawei/hinic/hinic_hw.h | 770 +++ .../ethernet/huawei/hinic/hinic_hw_api_cmd.c | 987 ---- .../ethernet/huawei/hinic/hinic_hw_api_cmd.h | 203 - .../net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 963 ---- .../net/ethernet/huawei/hinic/hinic_hw_cmdq.h | 185 - .../net/ethernet/huawei/hinic/hinic_hw_csr.h | 139 - .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 1197 ---- .../net/ethernet/huawei/hinic/hinic_hw_dev.h | 660 --- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 996 ---- .../net/ethernet/huawei/hinic/hinic_hw_eqs.h | 262 - .../net/ethernet/huawei/hinic/hinic_hw_if.c | 419 -- .../net/ethernet/huawei/hinic/hinic_hw_if.h | 295 - .../net/ethernet/huawei/hinic/hinic_hw_io.c | 634 --- .../net/ethernet/huawei/hinic/hinic_hw_io.h | 123 - .../net/ethernet/huawei/hinic/hinic_hw_mbox.h | 172 - .../net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 681 --- .../net/ethernet/huawei/hinic/hinic_hw_mgmt.h | 636 ++- .../net/ethernet/huawei/hinic/hinic_hw_qp.c | 971 ---- .../net/ethernet/huawei/hinic/hinic_hw_qp.h | 232 - .../ethernet/huawei/hinic/hinic_hw_qp_ctxt.h | 210 - .../net/ethernet/huawei/hinic/hinic_hw_wq.c | 904 --- .../net/ethernet/huawei/hinic/hinic_hw_wq.h | 111 - .../net/ethernet/huawei/hinic/hinic_hw_wqe.h | 430 -- .../net/ethernet/huawei/hinic/hinic_hwdev.c | 5001 +++++++++++++++++ .../net/ethernet/huawei/hinic/hinic_hwdev.h | 370 ++ .../net/ethernet/huawei/hinic/hinic_hwif.c | 1005 ++++ .../net/ethernet/huawei/hinic/hinic_hwif.h | 123 + drivers/net/ethernet/huawei/hinic/hinic_lld.c | 2923 ++++++++++ drivers/net/ethernet/huawei/hinic/hinic_lld.h | 128 + .../net/ethernet/huawei/hinic/hinic_main.c | 3850 +++++++++---- .../hinic/{hinic_hw_mbox.c => hinic_mbox.c} | 1267 +++-- .../net/ethernet/huawei/hinic/hinic_mbox.h | 241 + .../net/ethernet/huawei/hinic/hinic_mgmt.c | 1446 +++++ .../net/ethernet/huawei/hinic/hinic_mgmt.h | 245 + .../huawei/hinic/hinic_mgmt_interface.h | 987 ++++ .../ethernet/huawei/hinic/hinic_msix_attr.c | 130 + .../ethernet/huawei/hinic/hinic_msix_attr.h | 69 + .../huawei/hinic/hinic_multi_host_mgmt.c | 972 ++++ .../huawei/hinic/hinic_multi_host_mgmt.h | 107 + drivers/net/ethernet/huawei/hinic/hinic_nic.h | 115 + .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 3996 +++++++++++++ .../net/ethernet/huawei/hinic/hinic_nic_cfg.h | 638 +++ .../net/ethernet/huawei/hinic/hinic_nic_dbg.c | 294 + .../net/ethernet/huawei/hinic/hinic_nic_dev.h | 289 + .../net/ethernet/huawei/hinic/hinic_nic_io.c | 1047 ++++ .../net/ethernet/huawei/hinic/hinic_nic_io.h | 99 + .../net/ethernet/huawei/hinic/hinic_nictool.c | 2503 +++++++++ .../net/ethernet/huawei/hinic/hinic_nictool.h | 277 + .../ethernet/huawei/hinic/hinic_pci_id_tbl.h | 40 + .../net/ethernet/huawei/hinic/hinic_port.c | 1412 ----- .../net/ethernet/huawei/hinic/hinic_port.h | 900 --- .../ethernet/huawei/hinic/hinic_port_cmd.h | 541 ++ .../net/ethernet/huawei/hinic/hinic_qe_def.h | 459 ++ drivers/net/ethernet/huawei/hinic/hinic_qp.c | 222 + drivers/net/ethernet/huawei/hinic/hinic_qp.h | 143 + drivers/net/ethernet/huawei/hinic/hinic_rx.c | 1342 +++-- drivers/net/ethernet/huawei/hinic/hinic_rx.h | 126 +- .../net/ethernet/huawei/hinic/hinic_sm_lt.h | 228 + .../ethernet/huawei/hinic/hinic_sml_counter.c | 310 + .../ethernet/huawei/hinic/hinic_sml_counter.h | 119 + .../net/ethernet/huawei/hinic/hinic_sml_lt.c | 286 + .../net/ethernet/huawei/hinic/hinic_sriov.c | 1535 ++--- .../net/ethernet/huawei/hinic/hinic_sriov.h | 98 +- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 1426 +++-- drivers/net/ethernet/huawei/hinic/hinic_tx.h | 127 +- drivers/net/ethernet/huawei/hinic/hinic_wq.c | 683 +++ drivers/net/ethernet/huawei/hinic/hinic_wq.h | 117 + drivers/net/ethernet/huawei/hinic/ossl_knl.h | 63 + 93 files changed, 46545 insertions(+), 19868 deletions(-) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_ctx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dfx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_csr.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp_ctxt.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wqe.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.h rename drivers/net/ethernet/huawei/hinic/{hinic_hw_mbox.c => hinic_mbox.c} (58%) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_pci_id_tbl.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qe_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic/ossl_knl.h -- 2.24.0

2 2

[openeuler:OLK-5.10 16692/30000] mm/share_pool.c:4227:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fa7099066983597bd415dde5a3e416bf2bd8f7c commit: bec70574669710bd0962f1f6807363915fc94f16 [16692/30000] mm/sharepool: fix hugepage_rsvd count increase error config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240313/202403131259.tZO2bTEt-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403131259.tZO2bTEt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403131259.tZO2bTEt-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:865:23: warning: no previous prototype for 'find_spg_node_by_spg' [-Wmissing-prototypes] 865 | struct sp_group_node *find_spg_node_by_spg(struct mm_struct *mm, | ^~~~~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3085:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3085 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3085:21: error: invalid initializer mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:3462:14: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 3462 | bool is_hugepage = true; | ^~~~~~~~~~~ mm/share_pool.c: At top level: mm/share_pool.c:3954:6: warning: no previous prototype for 'spa_overview_show' [-Wmissing-prototypes] 3954 | void spa_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:4036:6: warning: no previous prototype for 'spg_overview_show' [-Wmissing-prototypes] 4036 | void spg_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sharepool_no_page': >> mm/share_pool.c:4227:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4227 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4227:64: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:4233:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4233 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4246:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4246 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4268:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4268 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4270:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4270 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub cc1: some warnings being treated as errors vim +/HUGETLB_ALLOC_BUDDY +4227 mm/share_pool.c 4193 4194 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4195 struct vm_area_struct *vma, 4196 struct address_space *mapping, pgoff_t idx, 4197 unsigned long address, pte_t *ptep, unsigned int flags) 4198 { 4199 struct hstate *h = hstate_vma(vma); 4200 vm_fault_t ret = VM_FAULT_SIGBUS; 4201 unsigned long size; 4202 struct page *page; 4203 pte_t new_pte; 4204 spinlock_t *ptl; 4205 unsigned long haddr = address & huge_page_mask(h); 4206 bool new_page = false; 4207 int err; 4208 int node_id; 4209 struct sp_area *spa; 4210 4211 spa = vma->vm_private_data; 4212 if (!spa) { 4213 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4214 return ret; 4215 } 4216 node_id = spa->node_id; 4217 4218 retry: 4219 page = find_lock_page(mapping, idx); 4220 if (!page) { 4221 size = i_size_read(mapping->host) >> huge_page_shift(h); 4222 if (idx >= size) 4223 goto out; 4224 4225 page = alloc_huge_page(vma, haddr, 0); 4226 if (IS_ERR(page)) { > 4227 page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); 4228 if (!page) 4229 page = ERR_PTR(-ENOMEM); 4230 } 4231 if (IS_ERR(page)) { 4232 ptl = huge_pte_lock(h, mm, ptep); 4233 if (!huge_pte_none(huge_ptep_get(ptep))) { 4234 ret = 0; 4235 spin_unlock(ptl); 4236 goto out; 4237 } 4238 spin_unlock(ptl); 4239 ret = vmf_error(PTR_ERR(page)); 4240 goto out; 4241 } 4242 __SetPageUptodate(page); 4243 new_page = true; 4244 4245 /* sharepool pages are all shared */ 4246 err = huge_add_to_page_cache(page, mapping, idx); 4247 if (err) { 4248 put_page(page); 4249 if (err == -EEXIST) 4250 goto retry; 4251 goto out; 4252 } 4253 } 4254 4255 4256 ptl = huge_pte_lock(h, mm, ptep); 4257 size = i_size_read(mapping->host) >> huge_page_shift(h); 4258 if (idx >= size) 4259 goto backout; 4260 4261 ret = 0; 4262 if (!huge_pte_none(huge_ptep_get(ptep))) 4263 goto backout; 4264 4265 page_dup_rmap(page, true); 4266 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4267 && (vma->vm_flags & VM_SHARED))); 4268 set_huge_pte_at(mm, haddr, ptep, new_pte); 4269 4270 hugetlb_count_add(pages_per_huge_page(h), mm); 4271 4272 spin_unlock(ptl); 4273 4274 if (new_page) { 4275 SetPagePrivate(&page[1]); 4276 } 4277 4278 unlock_page(page); 4279 out: 4280 return ret; 4281 4282 backout: 4283 spin_unlock(ptl); 4284 unlock_page(page); 4285 put_page(page); 4286 goto out; 4287 } 4288 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net: nfc: llcp: Add lock when modifying device list
by Ziyang Xuan 13 Mar '24

13 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v5.10.198 commit dba849cc98113b145c6e720122942c00b8012bdb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1R CVE: CVE-2023-52524 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfc7f7a988dad34c3bf4c053124fb26aa6c5f916 ] The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered. Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") Link: https://lore.kernel.org/r/20230908235853.1319596-1-jeremy@jcline.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/llcp_core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index ddfd159f64e13..b1107570eaee8 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -1646,7 +1646,9 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) timer_setup(&local->sdreq_timer, nfc_llcp_sdreq_timer, 0); INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work); + spin_lock(&llcp_devices_lock); list_add(&local->list, &llcp_devices); + spin_unlock(&llcp_devices_lock); return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: nfc: llcp: Add lock when modifying device list
by Ziyang Xuan 13 Mar '24

13 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> mainline inclusion from mainline-v6.6-rc5 commit dfc7f7a988dad34c3bf4c053124fb26aa6c5f916 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1R CVE: CVE-2023-52524 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered. Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") Link: https://lore.kernel.org/r/20230908235853.1319596-1-jeremy@jcline.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/llcp_core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 2c38e739ab71a..aaaf498aaaea2 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -1653,7 +1653,9 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) timer_setup(&local->sdreq_timer, nfc_llcp_sdreq_timer, 0); INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work); + spin_lock(&llcp_devices_lock); list_add(&local->list, &llcp_devices); + spin_unlock(&llcp_devices_lock); return 0; } -- 2.25.1

2 1

[PATCH OLK-6.6 v2 00/11] KVM: arm64: Enable 'writable' ID registers
by chenxiang 13 Mar '24

13 Mar '24

From: caijian <caijian11(a)h-partners.com> Backport the code of enabling 'writable' ID registers from mainline to openEuler 6.6. It is the fundation of live migration between different platforms. Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Oliver Upton (6): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs Documentation/virt/kvm/api.rst | 52 +++++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 +++++ arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/include/uapi/asm/kvm.h | 32 +++ arch/arm64/kvm/arm.c | 10 + arch/arm64/kvm/sys_regs.c | 194 ++++++++++++++++--- include/uapi/linux/kvm.h | 2 + 8 files changed, 309 insertions(+), 32 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.30.0

2 12

[PATCH openEuler-1.0-LTS 0/2] arm64/mpam: Fix use-after-free when deleting resource groups
by Zeng Heng 13 Mar '24

13 Mar '24

Wang ShaoBo (1): arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak Zeng Heng (1): arm64/mpam: Fix use-after-free when deleting resource groups arch/arm64/include/asm/resctrl.h | 18 +++++++++++++ arch/arm64/kernel/mpam/mpam_ctrlmon.c | 8 ------ arch/arm64/kernel/mpam/mpam_resctrl.c | 2 +- fs/resctrlfs.c | 37 ++++++++++----------------- 4 files changed, 32 insertions(+), 33 deletions(-) -- 2.25.1

2 3

[PATCH 0/8] Support hns roce bonding
by Chengchang Tang 13 Mar '24

13 Mar '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Support hns roce bonding. Junxian Huang (8): RDMA/hns: Support RoCE bonding RDMA/hns: Set IB port state depending on upper device for RoCE bonding RDMA/hns: Support dispatching IB event for RoCE bonding RDMA/hns: Add functions to obtain netdev and bus_num from an hr_dev RDMA/hns: Support reset recovery for RoCE bonding RDMA/hns: Fix wild pointer error of RoCE bonding when rmmod hns3 RDMA/hns: Fix the device loss after unbinding RoCE bond resource slave RDMA/hns: Fix the concurrency error between bond and reset. drivers/infiniband/hw/hns/Makefile | 4 +- drivers/infiniband/hw/hns/hns_roce_ah.c | 1 - drivers/infiniband/hw/hns/hns_roce_bond.c | 951 ++++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_bond.h | 92 ++ drivers/infiniband/hw/hns/hns_roce_device.h | 21 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 173 +++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 19 + drivers/infiniband/hw/hns/hns_roce_main.c | 153 +++- drivers/infiniband/hw/hns/hns_roce_pd.c | 1 - drivers/infiniband/hw/hns/hns_roce_qp.c | 5 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 1 - 11 files changed, 1387 insertions(+), 34 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_bond.c create mode 100644 drivers/infiniband/hw/hns/hns_roce_bond.h -- 2.30.0

1 8

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING 4fa7099066983597bd415dde5a3e416bf2bd8f7c
by kernel test robot 13 Mar '24

13 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4fa7099066983597bd415dde5a3e416bf2bd8f7c !5152 arm64/mpam: Remove warning about no msc corresponding to the online cpu Warning reports: https://lore.kernel.org/oe-kbuild-all/202403122352.tvX5nEio-lkp@intel.com Warning: (recently discovered and may have been fixed) arch/arm64/kernel/smp.c:1232:5: warning: no previous prototype for 'hw_nmi_get_sample_period' [-Wmissing-prototypes] Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-002-20240312 `-- arch-arm64-kernel-smp.c:warning:no-previous-prototype-for-hw_nmi_get_sample_period clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 732m configs tested: 35 configs skipped: 149 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240313 clang arm64 randconfig-002-20240313 clang arm64 randconfig-003-20240313 clang arm64 randconfig-004-20240313 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240313 clang x86_64 buildonly-randconfig-002-20240313 gcc x86_64 buildonly-randconfig-003-20240313 clang x86_64 buildonly-randconfig-004-20240313 clang x86_64 buildonly-randconfig-005-20240313 gcc x86_64 buildonly-randconfig-006-20240313 clang x86_64 defconfig gcc x86_64 randconfig-001-20240313 clang x86_64 randconfig-002-20240313 gcc x86_64 randconfig-003-20240313 clang x86_64 randconfig-004-20240313 gcc x86_64 randconfig-005-20240313 gcc x86_64 randconfig-006-20240313 clang x86_64 randconfig-011-20240313 clang x86_64 randconfig-012-20240313 clang x86_64 randconfig-013-20240313 clang x86_64 randconfig-014-20240313 clang x86_64 randconfig-015-20240313 gcc x86_64 randconfig-016-20240313 gcc x86_64 randconfig-071-20240313 gcc x86_64 randconfig-072-20240313 clang x86_64 randconfig-073-20240313 clang x86_64 randconfig-074-20240313 gcc x86_64 randconfig-075-20240313 clang x86_64 randconfig-076-20240313 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f066d3699b4816fda2b6f452885b51bd22199c43
by kernel test robot 13 Mar '24

13 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f066d3699b4816fda2b6f452885b51bd22199c43 !4427 【OLK-6.6】watchdog: Support watchdog_sdei coexist with existing watchdogs Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-002-20240312 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- arm64-randconfig-003-20240312 | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_disable_msi | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_enable_msi | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-002-20240312 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-buildonly-randconfig-005-20240312 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-004-20240312 | |-- ld.lld:error:undefined-symbol:arch_elf_adjust_prot | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-buildonly-randconfig-001-20240312 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead elapsed time: 730m configs tested: 40 configs skipped: 145 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240312 gcc arm64 randconfig-002-20240312 gcc arm64 randconfig-003-20240312 gcc arm64 randconfig-004-20240312 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240312 gcc loongarch randconfig-002-20240312 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240312 clang x86_64 buildonly-randconfig-002-20240312 clang x86_64 buildonly-randconfig-003-20240312 clang x86_64 buildonly-randconfig-004-20240312 clang x86_64 buildonly-randconfig-005-20240312 gcc x86_64 buildonly-randconfig-006-20240312 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240312 clang x86_64 randconfig-002-20240312 clang x86_64 randconfig-003-20240312 gcc x86_64 randconfig-004-20240312 gcc x86_64 randconfig-005-20240312 gcc x86_64 randconfig-006-20240312 clang x86_64 randconfig-011-20240312 gcc x86_64 randconfig-012-20240312 clang x86_64 randconfig-013-20240312 gcc x86_64 randconfig-014-20240312 gcc x86_64 randconfig-015-20240312 clang x86_64 randconfig-016-20240312 clang x86_64 randconfig-071-20240312 gcc x86_64 randconfig-072-20240312 gcc x86_64 randconfig-073-20240312 clang x86_64 randconfig-074-20240312 gcc x86_64 randconfig-075-20240312 gcc x86_64 randconfig-076-20240312 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20704/21850] kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v'
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: ce35ded5d5774f055f6850b15032066ff4936414 [20704/21850] sched: smart grid: init sched_grid_qos structure on QOS purpose config: x86_64-randconfig-161-20240313 (https://download.01.org/0day-ci/archive/20240313/202403130506.ha6K0yEi-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403130506.ha6K0yEi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403130506.ha6K0yEi-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/grid/qos.c:19: kernel/sched/grid/qos.c: In function 'sched_grid_preferred_interleave_nid': >> kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v' 84 | if (nodes_equal(policy->v.nodes, *preferred_nmask)) | ^~ include/linux/nodemask.h:202:41: note: in definition of macro 'nodes_equal' 202 | __nodes_equal(&(src1), &(src2), MAX_NUMNODES) | ^~~~ kernel/sched/grid/qos.c:91:32: error: 'struct mempolicy' has no member named 'v' 91 | nodes_and(nmask, policy->v.nodes, *preferred_nmask); | ^~ include/linux/nodemask.h:162:47: note: in definition of macro 'nodes_and' 162 | __nodes_and(&(dst), &(src1), &(src2), MAX_NUMNODES) | ^~~~ >> kernel/sched/grid/qos.c:95:31: error: 'struct task_struct' has no member named 'il_prev' 95 | next = next_node_in(me->il_prev, nmask); | ^~ include/linux/nodemask.h:278:46: note: in definition of macro 'next_node_in' 278 | #define next_node_in(n, src) __next_node_in((n), &(src)) | ^ kernel/sched/grid/qos.c:97:19: error: 'struct task_struct' has no member named 'il_prev' 97 | me->il_prev = next; | ^~ In file included from kernel/sched/grid/qos.c:20: include/linux/mempolicy.h: At top level: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +84 kernel/sched/grid/qos.c 68 69 /* dynamic select a more appropriate preferred interleave nid for process */ 70 int sched_grid_preferred_interleave_nid(struct mempolicy *policy) 71 { 72 nodemask_t nmask; 73 unsigned int next; 74 struct task_struct *me = current; 75 nodemask_t *preferred_nmask = NULL; 76 77 if (likely(me->grid_qos)) 78 preferred_nmask = 79 &me->grid_qos->affinity.mem_preferred_node_mask; 80 81 if (!preferred_nmask || !policy) 82 return NUMA_NO_NODE; 83 > 84 if (nodes_equal(policy->v.nodes, *preferred_nmask)) 85 return NUMA_NO_NODE; 86 /* 87 * We perceive the actual consumption of memory bandwidth 88 * in each node and post a preferred interleave nid in 89 * more appropriate range. 90 */ 91 nodes_and(nmask, policy->v.nodes, *preferred_nmask); 92 if (nodes_empty(nmask)) 93 return NUMA_NO_NODE; 94 > 95 next = next_node_in(me->il_prev, nmask); 96 if (next < MAX_NUMNODES) 97 me->il_prev = next; 98 return next; 99 } 100 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13427/21850] kernel/watchdog_hld.c:123:13: error: implicit declaration of function 'is_hardlockup'
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: 818ac22d9d2f02632b39ef1a4f472e6dbe0d417a [13427/21850] sdei_watchdog: fix compile error when CONFIG_HARDLOCKUP_DETECTOR is not set config: arm64-randconfig-001-20240312 (https://download.01.org/0day-ci/archive/20240313/202403130340.177twYMV-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403130340.177twYMV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403130340.177twYMV-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/watchdog_hld.c: In function 'watchdog_hardlockup_check': >> kernel/watchdog_hld.c:123:13: error: implicit declaration of function 'is_hardlockup' [-Werror=implicit-function-declaration] 123 | if (is_hardlockup()) { | ^~~~~~~~~~~~~ >> kernel/watchdog_hld.c:142:21: error: 'sysctl_hardlockup_all_cpu_backtrace' undeclared (first use in this function) 142 | if (sysctl_hardlockup_all_cpu_backtrace && | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/watchdog_hld.c:142:21: note: each undeclared identifier is reported only once for each function it appears in cc1: some warnings being treated as errors -- arch/arm64/kernel/watchdog_sdei.c: In function 'watchdog_nmi_enable': >> arch/arm64/kernel/watchdog_sdei.c:38:42: error: 'watchdog_thresh' undeclared (first use in this function); did you mean 'proc_watchdog_thresh'? 38 | sdei_api_set_secure_timer_period(watchdog_thresh); | ^~~~~~~~~~~~~~~ | proc_watchdog_thresh arch/arm64/kernel/watchdog_sdei.c:38:42: note: each undeclared identifier is reported only once for each function it appears in arch/arm64/kernel/watchdog_sdei.c: In function 'watchdog_nmi_probe': arch/arm64/kernel/watchdog_sdei.c:119:46: error: 'watchdog_thresh' undeclared (first use in this function); did you mean 'proc_watchdog_thresh'? 119 | if (sdei_api_set_secure_timer_period(watchdog_thresh)) { | ^~~~~~~~~~~~~~~ | proc_watchdog_thresh Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for HARDLOCKUP_DETECTOR Depends on [n]: DEBUG_KERNEL [=n] && !S390 && (HAVE_HARDLOCKUP_DETECTOR_PERF [=n] || HAVE_HARDLOCKUP_DETECTOR_ARCH [=y]) Selected by [y]: - SDEI_WATCHDOG [=y] && <choice> && ARM_SDE_INTERFACE [=y] && !HARDLOCKUP_CHECK_TIMESTAMP [=n] vim +/is_hardlockup +123 kernel/watchdog_hld.c 7edaeb6841dfb2 Thomas Gleixner 2017-08-15 106 b8163908982cff Xiongfeng Wang 2019-01-28 107 void watchdog_hardlockup_check(struct pt_regs *regs) 73ce0511c43686 Babu Moger 2016-12-14 108 { 73ce0511c43686 Babu Moger 2016-12-14 109 if (__this_cpu_read(watchdog_nmi_touch) == true) { 73ce0511c43686 Babu Moger 2016-12-14 110 __this_cpu_write(watchdog_nmi_touch, false); 73ce0511c43686 Babu Moger 2016-12-14 111 return; 73ce0511c43686 Babu Moger 2016-12-14 112 } 73ce0511c43686 Babu Moger 2016-12-14 113 7edaeb6841dfb2 Thomas Gleixner 2017-08-15 114 if (!watchdog_check_timestamp()) 7edaeb6841dfb2 Thomas Gleixner 2017-08-15 115 return; 7edaeb6841dfb2 Thomas Gleixner 2017-08-15 116 73ce0511c43686 Babu Moger 2016-12-14 117 /* check for a hardlockup 73ce0511c43686 Babu Moger 2016-12-14 118 * This is done by making sure our timer interrupt 73ce0511c43686 Babu Moger 2016-12-14 119 * is incrementing. The timer interrupt should have 73ce0511c43686 Babu Moger 2016-12-14 120 * fired multiple times before we overflow'd. If it hasn't 73ce0511c43686 Babu Moger 2016-12-14 121 * then this is a good indication the cpu is stuck 73ce0511c43686 Babu Moger 2016-12-14 122 */ 73ce0511c43686 Babu Moger 2016-12-14 @123 if (is_hardlockup()) { 73ce0511c43686 Babu Moger 2016-12-14 124 int this_cpu = smp_processor_id(); 73ce0511c43686 Babu Moger 2016-12-14 125 73ce0511c43686 Babu Moger 2016-12-14 126 /* only print hardlockups once */ 73ce0511c43686 Babu Moger 2016-12-14 127 if (__this_cpu_read(hard_watchdog_warn) == true) 73ce0511c43686 Babu Moger 2016-12-14 128 return; 73ce0511c43686 Babu Moger 2016-12-14 129 73ce0511c43686 Babu Moger 2016-12-14 130 pr_emerg("Watchdog detected hard LOCKUP on cpu %d", this_cpu); 73ce0511c43686 Babu Moger 2016-12-14 131 print_modules(); 73ce0511c43686 Babu Moger 2016-12-14 132 print_irqtrace_events(current); 73ce0511c43686 Babu Moger 2016-12-14 133 if (regs) 73ce0511c43686 Babu Moger 2016-12-14 134 show_regs(regs); 73ce0511c43686 Babu Moger 2016-12-14 135 else 73ce0511c43686 Babu Moger 2016-12-14 136 dump_stack(); 73ce0511c43686 Babu Moger 2016-12-14 137 73ce0511c43686 Babu Moger 2016-12-14 138 /* 73ce0511c43686 Babu Moger 2016-12-14 139 * Perform all-CPU dump only once to avoid multiple hardlockups 73ce0511c43686 Babu Moger 2016-12-14 140 * generating interleaving traces 73ce0511c43686 Babu Moger 2016-12-14 141 */ 73ce0511c43686 Babu Moger 2016-12-14 @142 if (sysctl_hardlockup_all_cpu_backtrace && 73ce0511c43686 Babu Moger 2016-12-14 143 !test_and_set_bit(0, &hardlockup_allcpu_dumped)) 73ce0511c43686 Babu Moger 2016-12-14 144 trigger_allbutself_cpu_backtrace(); 73ce0511c43686 Babu Moger 2016-12-14 145 73ce0511c43686 Babu Moger 2016-12-14 146 if (hardlockup_panic) 73ce0511c43686 Babu Moger 2016-12-14 147 nmi_panic(regs, "Hard LOCKUP"); 73ce0511c43686 Babu Moger 2016-12-14 148 73ce0511c43686 Babu Moger 2016-12-14 149 __this_cpu_write(hard_watchdog_warn, true); 73ce0511c43686 Babu Moger 2016-12-14 150 return; 73ce0511c43686 Babu Moger 2016-12-14 151 } 73ce0511c43686 Babu Moger 2016-12-14 152 73ce0511c43686 Babu Moger 2016-12-14 153 __this_cpu_write(hard_watchdog_warn, false); 73ce0511c43686 Babu Moger 2016-12-14 154 return; 73ce0511c43686 Babu Moger 2016-12-14 155 } 6c19c0e5140a24 Xiongfeng Wang 2019-04-20 156 NOKPROBE_SYMBOL(watchdog_hardlockup_check); 73ce0511c43686 Babu Moger 2016-12-14 157 :::::: The code at line 123 was first introduced by commit :::::: 73ce0511c43686095efd2f65ef564aab952e07bc kernel/watchdog.c: move hardlockup detector to separate file :::::: TO: Babu Moger <babu.moger(a)oracle.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21846/21850] drivers/dma/pl330.c:2598:22: warning: 'dst' may be used uninitialized
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: 0299853c014aa0eecf7fb85ac2f1ebd0a9a6ba73 [21846/21850] dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV config: arm64-defconfig (https://download.01.org/0day-ci/archive/20240313/202403130014.Z6L6BJzl-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403130014.Z6L6BJzl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403130014.Z6L6BJzl-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In function 'fill_px', inlined from 'pl330_prep_dma_cyclic' at drivers/dma/pl330.c:2716:3: >> drivers/dma/pl330.c:2598:22: warning: 'dst' may be used uninitialized [-Wmaybe-uninitialized] 2598 | px->dst_addr = dst; | ~~~~~~~~~~~~~^~~~~ drivers/dma/pl330.c: In function 'pl330_prep_dma_cyclic': drivers/dma/pl330.c:2656:20: note: 'dst' was declared here 2656 | dma_addr_t dst; | ^~~ In function 'fill_px', inlined from 'pl330_prep_dma_cyclic' at drivers/dma/pl330.c:2716:3: >> drivers/dma/pl330.c:2599:22: warning: 'src' may be used uninitialized [-Wmaybe-uninitialized] 2599 | px->src_addr = src; | ~~~~~~~~~~~~~^~~~~ drivers/dma/pl330.c: In function 'pl330_prep_dma_cyclic': drivers/dma/pl330.c:2657:20: note: 'src' was declared here 2657 | dma_addr_t src; | ^~~ drivers/dma/pl330.c:297: warning: cannot understand function prototype: 'struct pl330_reqcfg ' vim +/dst +2598 drivers/dma/pl330.c b3040e40675ec2 Jassi Brar 2010-05-23 2593 b3040e40675ec2 Jassi Brar 2010-05-23 2594 static inline void fill_px(struct pl330_xfer *px, b3040e40675ec2 Jassi Brar 2010-05-23 2595 dma_addr_t dst, dma_addr_t src, size_t len) b3040e40675ec2 Jassi Brar 2010-05-23 2596 { b3040e40675ec2 Jassi Brar 2010-05-23 2597 px->bytes = len; b3040e40675ec2 Jassi Brar 2010-05-23 @2598 px->dst_addr = dst; b3040e40675ec2 Jassi Brar 2010-05-23 @2599 px->src_addr = src; b3040e40675ec2 Jassi Brar 2010-05-23 2600 } b3040e40675ec2 Jassi Brar 2010-05-23 2601 :::::: The code at line 2598 was first introduced by commit :::::: b3040e40675ec2c43542331cd30d4ee3dae797e8 DMA: PL330: Add dma api driver :::::: TO: Jassi Brar <jassi.brar(a)samsung.com> :::::: CC: Dan Williams <dan.j.williams(a)intel.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION c38cc0a3be12e5c70b9a2a015cbee44014a52518
by kernel test robot 12 Mar '24

12 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: c38cc0a3be12e5c70b9a2a015cbee44014a52518 !5133 CVE-2021-46926 Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403122233.J2ozeWSt-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202403122249.xsnDebIP-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240312 |-- mm-share_pool.c:error:HUGETLB_ALLOC_NONE-undeclared-(first-use-in-this-function) `-- mm-share_pool.c:error:implicit-declaration-of-function-hugetlb_alloc_hugepage clang_recent_errors `-- x86_64-buildonly-randconfig-003-20240312 `-- drivers-platform-x86-.tmp_dell-smbios-wmi.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 741m configs tested: 34 configs skipped: 147 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240312 gcc arm64 randconfig-002-20240312 gcc arm64 randconfig-003-20240312 gcc arm64 randconfig-004-20240312 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240312 clang x86_64 buildonly-randconfig-002-20240312 clang x86_64 buildonly-randconfig-003-20240312 clang x86_64 buildonly-randconfig-004-20240312 clang x86_64 buildonly-randconfig-005-20240312 gcc x86_64 buildonly-randconfig-006-20240312 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240312 clang x86_64 randconfig-002-20240312 clang x86_64 randconfig-003-20240312 gcc x86_64 randconfig-004-20240312 gcc x86_64 randconfig-005-20240312 gcc x86_64 randconfig-006-20240312 clang x86_64 randconfig-011-20240312 gcc x86_64 randconfig-012-20240312 clang x86_64 randconfig-013-20240312 gcc x86_64 randconfig-014-20240312 gcc x86_64 randconfig-015-20240312 clang x86_64 randconfig-016-20240312 clang x86_64 randconfig-071-20240312 gcc x86_64 randconfig-072-20240312 gcc x86_64 randconfig-073-20240312 clang x86_64 randconfig-074-20240312 gcc x86_64 randconfig-075-20240312 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 280/30000] arch/arm64/kernel/smp.c:1232:5: warning: no previous prototype for 'hw_nmi_get_sample_period'
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fa7099066983597bd415dde5a3e416bf2bd8f7c commit: 22a589ef7833a36ba116897ac86e671290b86f2b [280/30000] arm64: Add support for hard lockup by using pmu counter config: arm64-randconfig-002-20240312 (https://download.01.org/0day-ci/archive/20240312/202403122352.tvX5nEio-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240312/202403122352.tvX5nEio-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403122352.tvX5nEio-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/smp.c: In function 'smp_prepare_cpus': arch/arm64/kernel/smp.c:786:30: error: 'cpu_madt_gicc' undeclared (first use in this function) 786 | if ((cpu_madt_gicc[cpu].flags & ACPI_MADT_ENABLED)) | ^~~~~~~~~~~~~ arch/arm64/kernel/smp.c:786:30: note: each undeclared identifier is reported only once for each function it appears in arch/arm64/kernel/smp.c: At top level: arch/arm64/kernel/smp.c:844:6: warning: no previous prototype for 'arch_irq_work_raise' [-Wmissing-prototypes] 844 | void arch_irq_work_raise(void) | ^~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/smp.c:864:6: warning: no previous prototype for 'panic_smp_self_stop' [-Wmissing-prototypes] 864 | void panic_smp_self_stop(void) | ^~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/smp.c:1232:5: warning: no previous prototype for 'hw_nmi_get_sample_period' [-Wmissing-prototypes] 1232 | u64 hw_nmi_get_sample_period(int watchdog_thresh) | ^~~~~~~~~~~~~~~~~~~~~~~~ vim +/hw_nmi_get_sample_period +1232 arch/arm64/kernel/smp.c 1231 > 1232 u64 hw_nmi_get_sample_period(int watchdog_thresh) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18183/21850] mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'?
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: 4a280fac30d27ae2aff096f9f99aa12d50f83426 [18183/21850] ascend: share_pool: support share pool features for ascend platform config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240312/202403122233.J2ozeWSt-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240312/202403122233.J2ozeWSt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403122233.J2ozeWSt-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': >> mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ cc1: some warnings being treated as errors vim +2263 mm/share_pool.c 2257 2258 2259 struct page *sp_alloc_pages(struct vm_struct *area, gfp_t mask, 2260 unsigned int page_order, int node) 2261 { 2262 if (area->flags & VM_HUGE_PAGES) > 2263 return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); 2264 else 2265 return alloc_pages_node(node, mask, page_order); 2266 } 2267 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21699/21850] drivers/platform/x86/.tmp_dell-smbios-wmi.o: warning: objtool: missing symbol for section .text
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: 14dbb7913c699931c3e0314f650058dacdaf566b [21699/21850] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios config: x86_64-buildonly-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240312/202403122249.xsnDebIP-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240312/202403122249.xsnDebIP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403122249.xsnDebIP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/platform/x86/.tmp_dell-smbios-wmi.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] *** SUBJECT HERE ***
by Zhou Shuai 12 Mar '24

12 Mar '24

*** BLURB HERE *** Zhou Shuai (1): net/hinic: Update Huawei Intelligent Network Card Driver: hinic drivers/net/ethernet/huawei/hinic/Makefile | 14 +- .../net/ethernet/huawei/hinic/hinic_api_cmd.c | 1164 ++++ .../net/ethernet/huawei/hinic/hinic_api_cmd.h | 298 + drivers/net/ethernet/huawei/hinic/hinic_cfg.c | 2478 ++++++++ drivers/net/ethernet/huawei/hinic/hinic_cfg.h | 526 ++ .../net/ethernet/huawei/hinic/hinic_cmdq.c | 1575 ++++++ .../net/ethernet/huawei/hinic/hinic_cmdq.h | 217 + .../net/ethernet/huawei/hinic/hinic_common.c | 71 - .../net/ethernet/huawei/hinic/hinic_common.h | 29 - drivers/net/ethernet/huawei/hinic/hinic_csr.h | 207 + .../net/ethernet/huawei/hinic/hinic_ctx_def.h | 242 + drivers/net/ethernet/huawei/hinic/hinic_dbg.h | 93 + .../ethernet/huawei/hinic/hinic_dbgtool_knl.c | 899 +++ .../ethernet/huawei/hinic/hinic_dbgtool_knl.h | 120 + drivers/net/ethernet/huawei/hinic/hinic_dcb.c | 1795 ++++++ drivers/net/ethernet/huawei/hinic/hinic_dcb.h | 67 + .../net/ethernet/huawei/hinic/hinic_debugfs.c | 324 -- .../net/ethernet/huawei/hinic/hinic_debugfs.h | 113 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 132 - .../net/ethernet/huawei/hinic/hinic_devlink.c | 584 -- .../net/ethernet/huawei/hinic/hinic_devlink.h | 119 - .../net/ethernet/huawei/hinic/hinic_dfx_def.h | 150 + drivers/net/ethernet/huawei/hinic/hinic_eqs.c | 1462 +++++ drivers/net/ethernet/huawei/hinic/hinic_eqs.h | 177 + .../net/ethernet/huawei/hinic/hinic_ethtool.c | 3078 ++++++---- drivers/net/ethernet/huawei/hinic/hinic_hw.h | 770 +++ .../ethernet/huawei/hinic/hinic_hw_api_cmd.c | 987 ---- .../ethernet/huawei/hinic/hinic_hw_api_cmd.h | 203 - .../net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 963 ---- .../net/ethernet/huawei/hinic/hinic_hw_cmdq.h | 185 - .../net/ethernet/huawei/hinic/hinic_hw_csr.h | 139 - .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 1197 ---- .../net/ethernet/huawei/hinic/hinic_hw_dev.h | 660 --- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 996 ---- .../net/ethernet/huawei/hinic/hinic_hw_eqs.h | 262 - .../net/ethernet/huawei/hinic/hinic_hw_if.c | 419 -- .../net/ethernet/huawei/hinic/hinic_hw_if.h | 295 - .../net/ethernet/huawei/hinic/hinic_hw_io.c | 634 --- .../net/ethernet/huawei/hinic/hinic_hw_io.h | 123 - .../net/ethernet/huawei/hinic/hinic_hw_mbox.h | 172 - .../net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 681 --- .../net/ethernet/huawei/hinic/hinic_hw_mgmt.h | 636 ++- .../net/ethernet/huawei/hinic/hinic_hw_qp.c | 971 ---- .../net/ethernet/huawei/hinic/hinic_hw_qp.h | 232 - .../ethernet/huawei/hinic/hinic_hw_qp_ctxt.h | 210 - .../net/ethernet/huawei/hinic/hinic_hw_wq.c | 904 --- .../net/ethernet/huawei/hinic/hinic_hw_wq.h | 111 - .../net/ethernet/huawei/hinic/hinic_hw_wqe.h | 430 -- .../net/ethernet/huawei/hinic/hinic_hwdev.c | 5001 +++++++++++++++++ .../net/ethernet/huawei/hinic/hinic_hwdev.h | 370 ++ .../net/ethernet/huawei/hinic/hinic_hwif.c | 1005 ++++ .../net/ethernet/huawei/hinic/hinic_hwif.h | 123 + drivers/net/ethernet/huawei/hinic/hinic_lld.c | 2923 ++++++++++ drivers/net/ethernet/huawei/hinic/hinic_lld.h | 128 + .../net/ethernet/huawei/hinic/hinic_main.c | 3848 +++++++++---- .../hinic/{hinic_hw_mbox.c => hinic_mbox.c} | 1267 +++-- .../net/ethernet/huawei/hinic/hinic_mbox.h | 241 + .../net/ethernet/huawei/hinic/hinic_mgmt.c | 1446 +++++ .../net/ethernet/huawei/hinic/hinic_mgmt.h | 245 + .../huawei/hinic/hinic_mgmt_interface.h | 987 ++++ .../ethernet/huawei/hinic/hinic_msix_attr.c | 130 + .../ethernet/huawei/hinic/hinic_msix_attr.h | 69 + .../huawei/hinic/hinic_multi_host_mgmt.c | 972 ++++ .../huawei/hinic/hinic_multi_host_mgmt.h | 107 + drivers/net/ethernet/huawei/hinic/hinic_nic.h | 115 + .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 3996 +++++++++++++ .../net/ethernet/huawei/hinic/hinic_nic_cfg.h | 638 +++ .../net/ethernet/huawei/hinic/hinic_nic_dbg.c | 294 + .../net/ethernet/huawei/hinic/hinic_nic_dev.h | 289 + .../net/ethernet/huawei/hinic/hinic_nic_io.c | 1047 ++++ .../net/ethernet/huawei/hinic/hinic_nic_io.h | 99 + .../net/ethernet/huawei/hinic/hinic_nictool.c | 2503 +++++++++ .../net/ethernet/huawei/hinic/hinic_nictool.h | 277 + .../ethernet/huawei/hinic/hinic_pci_id_tbl.h | 40 + .../net/ethernet/huawei/hinic/hinic_port.c | 1412 ----- .../net/ethernet/huawei/hinic/hinic_port.h | 900 --- .../ethernet/huawei/hinic/hinic_port_cmd.h | 541 ++ .../net/ethernet/huawei/hinic/hinic_qe_def.h | 459 ++ drivers/net/ethernet/huawei/hinic/hinic_qp.c | 222 + drivers/net/ethernet/huawei/hinic/hinic_qp.h | 143 + drivers/net/ethernet/huawei/hinic/hinic_rx.c | 1342 +++-- drivers/net/ethernet/huawei/hinic/hinic_rx.h | 126 +- .../net/ethernet/huawei/hinic/hinic_sm_lt.h | 228 + .../ethernet/huawei/hinic/hinic_sml_counter.c | 310 + .../ethernet/huawei/hinic/hinic_sml_counter.h | 119 + .../net/ethernet/huawei/hinic/hinic_sml_lt.c | 286 + .../net/ethernet/huawei/hinic/hinic_sriov.c | 1535 ++--- .../net/ethernet/huawei/hinic/hinic_sriov.h | 98 +- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 1426 +++-- drivers/net/ethernet/huawei/hinic/hinic_tx.h | 127 +- drivers/net/ethernet/huawei/hinic/hinic_wq.c | 683 +++ drivers/net/ethernet/huawei/hinic/hinic_wq.h | 117 + drivers/net/ethernet/huawei/hinic/ossl_knl.h | 63 + 93 files changed, 46543 insertions(+), 19868 deletions(-) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_ctx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dfx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_csr.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp_ctxt.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wqe.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.h rename drivers/net/ethernet/huawei/hinic/{hinic_hw_mbox.c => hinic_mbox.c} (58%) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_pci_id_tbl.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qe_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic/ossl_knl.h -- 2.24.0

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52502 for openEuler-1.0-LTS
by Liu Jian 12 Mar '24

12 Mar '24

CVE-2023-52502 Eric Dumazet (1): net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Krzysztof Kozlowski (1): nfc: constify several pointers to u8, char and sk_buff include/net/nfc/nfc.h | 4 +-- net/nfc/core.c | 4 +-- net/nfc/hci/llc_shdlc.c | 10 +++--- net/nfc/llcp.h | 8 ++--- net/nfc/llcp_commands.c | 46 ++++++++++++++------------ net/nfc/llcp_core.c | 72 ++++++++++++++++++++--------------------- net/nfc/nfc.h | 2 +- 7 files changed, 74 insertions(+), 72 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
by Liu Jian 12 Mar '24

12 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.199 commit 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXP CVE: CVE-2023-52502 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ] Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear. Fixes: 8f50020ed9b8 ("NFC: LLCP late binding") Reported-by: Sili Luo <rootlab(a)huawei.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willy Tarreau <w(a)1wt.eu> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/llcp_core.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index ddfd159f64e1..f2a2454ed07d 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -205,17 +205,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) { llcp_sock = tmp_sock; + sock_hold(&llcp_sock->sk); break; } } read_unlock(&local->sockets.lock); - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - return llcp_sock; } @@ -348,7 +344,8 @@ static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len) static struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, - const u8 *sn, size_t sn_len) + const u8 *sn, size_t sn_len, + bool needref) { struct sock *sk; struct nfc_llcp_sock *llcp_sock, *tmp_sock; @@ -384,6 +381,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) { llcp_sock = tmp_sock; + if (needref) + sock_hold(&llcp_sock->sk); break; } } @@ -425,7 +424,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, * to this service name. */ if (nfc_llcp_sock_from_sn(local, sock->service_name, - sock->service_name_len) != NULL) { + sock->service_name_len, + false) != NULL) { mutex_unlock(&local->sdp_lock); return LLCP_SAP_MAX; @@ -833,16 +833,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local, const u8 *sn, size_t sn_len) { - struct nfc_llcp_sock *llcp_sock; - - llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len); - - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - - return llcp_sock; + return nfc_llcp_sock_from_sn(local, sn, sn_len, true); } static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len) @@ -1307,7 +1298,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, } llcp_sock = nfc_llcp_sock_from_sn(local, service_name, - service_name_len); + service_name_len, + true); if (!llcp_sock) { sap = 0; goto add_snl; @@ -1327,6 +1319,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, if (sap == LLCP_SAP_MAX) { sap = 0; + nfc_llcp_sock_put(llcp_sock); goto add_snl; } @@ -1344,6 +1337,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, pr_debug("%p %d\n", llcp_sock, sap); + nfc_llcp_sock_put(llcp_sock); add_snl: sdp = nfc_llcp_build_sdres_tlv(tid, sap); if (sdp == NULL) -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] *** SUBJECT HERE ***
by Zhou Shuai 12 Mar '24

12 Mar '24

*** BLURB HERE *** Zhou Shuai (1): net/hinic: Sync hinic driver with OLK-5.10 drivers/net/ethernet/huawei/hinic/Makefile | 14 +- .../net/ethernet/huawei/hinic/hinic_api_cmd.c | 1164 ++++ .../net/ethernet/huawei/hinic/hinic_api_cmd.h | 298 + drivers/net/ethernet/huawei/hinic/hinic_cfg.c | 2478 ++++++++ drivers/net/ethernet/huawei/hinic/hinic_cfg.h | 526 ++ .../net/ethernet/huawei/hinic/hinic_cmdq.c | 1575 ++++++ .../net/ethernet/huawei/hinic/hinic_cmdq.h | 217 + .../net/ethernet/huawei/hinic/hinic_common.c | 71 - .../net/ethernet/huawei/hinic/hinic_common.h | 29 - drivers/net/ethernet/huawei/hinic/hinic_csr.h | 207 + .../net/ethernet/huawei/hinic/hinic_ctx_def.h | 242 + drivers/net/ethernet/huawei/hinic/hinic_dbg.h | 93 + .../ethernet/huawei/hinic/hinic_dbgtool_knl.c | 899 +++ .../ethernet/huawei/hinic/hinic_dbgtool_knl.h | 120 + drivers/net/ethernet/huawei/hinic/hinic_dcb.c | 1795 ++++++ drivers/net/ethernet/huawei/hinic/hinic_dcb.h | 67 + .../net/ethernet/huawei/hinic/hinic_debugfs.c | 324 -- .../net/ethernet/huawei/hinic/hinic_debugfs.h | 113 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 132 - .../net/ethernet/huawei/hinic/hinic_devlink.c | 584 -- .../net/ethernet/huawei/hinic/hinic_devlink.h | 119 - .../net/ethernet/huawei/hinic/hinic_dfx_def.h | 150 + drivers/net/ethernet/huawei/hinic/hinic_eqs.c | 1462 +++++ drivers/net/ethernet/huawei/hinic/hinic_eqs.h | 177 + .../net/ethernet/huawei/hinic/hinic_ethtool.c | 3078 ++++++---- drivers/net/ethernet/huawei/hinic/hinic_hw.h | 770 +++ .../ethernet/huawei/hinic/hinic_hw_api_cmd.c | 987 ---- .../ethernet/huawei/hinic/hinic_hw_api_cmd.h | 203 - .../net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 963 ---- .../net/ethernet/huawei/hinic/hinic_hw_cmdq.h | 185 - .../net/ethernet/huawei/hinic/hinic_hw_csr.h | 139 - .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 1197 ---- .../net/ethernet/huawei/hinic/hinic_hw_dev.h | 660 --- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 996 ---- .../net/ethernet/huawei/hinic/hinic_hw_eqs.h | 262 - .../net/ethernet/huawei/hinic/hinic_hw_if.c | 419 -- .../net/ethernet/huawei/hinic/hinic_hw_if.h | 295 - .../net/ethernet/huawei/hinic/hinic_hw_io.c | 634 --- .../net/ethernet/huawei/hinic/hinic_hw_io.h | 123 - .../net/ethernet/huawei/hinic/hinic_hw_mbox.h | 172 - .../net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 681 --- .../net/ethernet/huawei/hinic/hinic_hw_mgmt.h | 636 ++- .../net/ethernet/huawei/hinic/hinic_hw_qp.c | 971 ---- .../net/ethernet/huawei/hinic/hinic_hw_qp.h | 232 - .../ethernet/huawei/hinic/hinic_hw_qp_ctxt.h | 210 - .../net/ethernet/huawei/hinic/hinic_hw_wq.c | 904 --- .../net/ethernet/huawei/hinic/hinic_hw_wq.h | 111 - .../net/ethernet/huawei/hinic/hinic_hw_wqe.h | 430 -- .../net/ethernet/huawei/hinic/hinic_hwdev.c | 5001 +++++++++++++++++ .../net/ethernet/huawei/hinic/hinic_hwdev.h | 370 ++ .../net/ethernet/huawei/hinic/hinic_hwif.c | 1005 ++++ .../net/ethernet/huawei/hinic/hinic_hwif.h | 123 + drivers/net/ethernet/huawei/hinic/hinic_lld.c | 2923 ++++++++++ drivers/net/ethernet/huawei/hinic/hinic_lld.h | 128 + .../net/ethernet/huawei/hinic/hinic_main.c | 3848 +++++++++---- .../hinic/{hinic_hw_mbox.c => hinic_mbox.c} | 1267 +++-- .../net/ethernet/huawei/hinic/hinic_mbox.h | 241 + .../net/ethernet/huawei/hinic/hinic_mgmt.c | 1446 +++++ .../net/ethernet/huawei/hinic/hinic_mgmt.h | 245 + .../huawei/hinic/hinic_mgmt_interface.h | 987 ++++ .../ethernet/huawei/hinic/hinic_msix_attr.c | 130 + .../ethernet/huawei/hinic/hinic_msix_attr.h | 69 + .../huawei/hinic/hinic_multi_host_mgmt.c | 972 ++++ .../huawei/hinic/hinic_multi_host_mgmt.h | 107 + drivers/net/ethernet/huawei/hinic/hinic_nic.h | 115 + .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 3996 +++++++++++++ .../net/ethernet/huawei/hinic/hinic_nic_cfg.h | 638 +++ .../net/ethernet/huawei/hinic/hinic_nic_dbg.c | 294 + .../net/ethernet/huawei/hinic/hinic_nic_dev.h | 289 + .../net/ethernet/huawei/hinic/hinic_nic_io.c | 1047 ++++ .../net/ethernet/huawei/hinic/hinic_nic_io.h | 99 + .../net/ethernet/huawei/hinic/hinic_nictool.c | 2503 +++++++++ .../net/ethernet/huawei/hinic/hinic_nictool.h | 277 + .../ethernet/huawei/hinic/hinic_pci_id_tbl.h | 40 + .../net/ethernet/huawei/hinic/hinic_port.c | 1412 ----- .../net/ethernet/huawei/hinic/hinic_port.h | 900 --- .../ethernet/huawei/hinic/hinic_port_cmd.h | 541 ++ .../net/ethernet/huawei/hinic/hinic_qe_def.h | 459 ++ drivers/net/ethernet/huawei/hinic/hinic_qp.c | 222 + drivers/net/ethernet/huawei/hinic/hinic_qp.h | 143 + drivers/net/ethernet/huawei/hinic/hinic_rx.c | 1342 +++-- drivers/net/ethernet/huawei/hinic/hinic_rx.h | 126 +- .../net/ethernet/huawei/hinic/hinic_sm_lt.h | 228 + .../ethernet/huawei/hinic/hinic_sml_counter.c | 310 + .../ethernet/huawei/hinic/hinic_sml_counter.h | 119 + .../net/ethernet/huawei/hinic/hinic_sml_lt.c | 286 + .../net/ethernet/huawei/hinic/hinic_sriov.c | 1535 ++--- .../net/ethernet/huawei/hinic/hinic_sriov.h | 98 +- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 1426 +++-- drivers/net/ethernet/huawei/hinic/hinic_tx.h | 127 +- drivers/net/ethernet/huawei/hinic/hinic_wq.c | 683 +++ drivers/net/ethernet/huawei/hinic/hinic_wq.h | 117 + drivers/net/ethernet/huawei/hinic/ossl_knl.h | 63 + 93 files changed, 46543 insertions(+), 19868 deletions(-) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_ctx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dfx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_csr.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp_ctxt.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wqe.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.h rename drivers/net/ethernet/huawei/hinic/{hinic_hw_mbox.c => hinic_mbox.c} (58%) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_pci_id_tbl.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qe_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic/ossl_knl.h -- 2.24.0

2 2

[PATCH OLK-6.6 00/15] KVM: arm64: Enable 'writable' ID registers
by chenxiang 12 Mar '24

12 Mar '24

From: caijian <caijian11(a)h-partners.com> Backport the code of enabling 'writable' ID registers from mainline to openEuler 6.6. It is the fundation of live migration between different platforms. Marc Zyngier (15): KVM: arm64: vgic-v3: Upgrade AP1Rn to 64bit. KVM: arm64: vgic-v3: Allow the NMI state to make it into the LRs KVM: arm64: vgic-v3: Make NMI priority RES0 KVM: arm64: vgic-v4: Propagate the NMI state into the GICv4.1 VSGI configuration KVM: arm64: vgic-v3: Use the NMI attribute as part of the AP-list sorting KVM: arm64: vgic-v3: Add support for GIC{D,R}_INMIR registers KVM: arm64: vgic-v3: Add userspace selection for GICv3.3 NMI KVM: arm64: vgic-debug: Add the NMI field to the debug output KVM: arm64: Allow userspace to control ID_AA64PFR1_EL1.NMI KVM: arm64: Don't trap ALLINT accesses if the vcpu has FEAT_NMI KVM: arm64: vgic-v3: Don't inject an NMI if the vcpu doesn't have FEAT_NMI KVM: arm64: Allow GICv3.3 NMI if the host supports it KVM: arm64: Handle traps of ALLINT arm64: Decouple KVM from CONFIG_ARM64_NMI KVM: arm64: vgic-v3: Handle traps of ICV_NMIAR1_EL1 arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/include/asm/sysreg.h | 3 ++ arch/arm64/kernel/cpufeature.c | 15 +++--- arch/arm64/kvm/arm.c | 3 ++ arch/arm64/kvm/hyp/include/hyp/switch.h | 6 ++- arch/arm64/kvm/hyp/vgic-v3-sr.c | 14 +++-- arch/arm64/kvm/sys_regs.c | 33 +++++++++++- arch/arm64/kvm/vgic/vgic-debug.c | 9 ++-- arch/arm64/kvm/vgic/vgic-init.c | 10 +++- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 1 + arch/arm64/kvm/vgic/vgic-mmio-v3.c | 70 ++++++++++++++++++++++++- arch/arm64/kvm/vgic/vgic-mmio.c | 25 ++++++--- arch/arm64/kvm/vgic/vgic-v3.c | 12 ++++- arch/arm64/kvm/vgic/vgic-v4.c | 1 + arch/arm64/kvm/vgic/vgic.c | 8 ++- arch/arm64/kvm/vgic/vgic.h | 1 + drivers/irqchip/irq-gic-v3-its.c | 9 ++++ drivers/irqchip/irq-gic-v3.c | 12 +++++ drivers/irqchip/irq-gic-v4.c | 3 +- include/kvm/arm_vgic.h | 10 +++- include/linux/irqchip/arm-gic-v4.h | 4 +- include/linux/irqchip/arm-vgic-info.h | 2 + 23 files changed, 224 insertions(+), 32 deletions(-) -- 2.30.0

2 12

[PATCH OLK-6.6 0/6] Adding Huawei BMA driver
by Zheng Zengkai 12 Mar '24

12 Mar '24

From: Huajingjing <huajingjing1(a)huawei.com> This patch set contains 5 communication drivers for Huawei BMA software. The BMA software is a system management software. It supports the status monitoring, performance monitoring, and event monitoring of various components, including server CPUs, memory, hard disks, NICs, IB cards, PCIe cards, RAID controller cards, and optical modules. These 5 drivers are used to send/receive message through PCIe channel in different ways by BMA software. Huajingjing (6): Huawei BMA: Adding Huawei BMA driver: host_edma_drv Huawei BMA: Adding Huawei BMA driver: host_cdev_drv Huawei BMA: Adding Huawei BMA driver: host_veth_drv Huawei BMA: Adding Huawei BMA driver: host_kbox_drv Huawei BMA: Adding Huawei BMA driver: cdev_veth_drv configs: add config BMA to config files arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/bma/Kconfig | 10 + drivers/net/ethernet/huawei/bma/Makefile | 9 + .../net/ethernet/huawei/bma/cdev_drv/Makefile | 2 + .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 369 +++ .../huawei/bma/cdev_veth_drv/Makefile | 2 + .../bma/cdev_veth_drv/virtual_cdev_eth_net.c | 1864 ++++++++++++ .../bma/cdev_veth_drv/virtual_cdev_eth_net.h | 299 ++ .../net/ethernet/huawei/bma/edma_drv/Makefile | 2 + .../huawei/bma/edma_drv/bma_devintf.c | 621 ++++ .../huawei/bma/edma_drv/bma_devintf.h | 40 + .../huawei/bma/edma_drv/bma_include.h | 116 + .../ethernet/huawei/bma/edma_drv/bma_pci.c | 533 ++++ .../ethernet/huawei/bma/edma_drv/bma_pci.h | 98 + .../ethernet/huawei/bma/edma_drv/edma_host.c | 1462 ++++++++++ .../ethernet/huawei/bma/edma_drv/edma_host.h | 351 +++ .../huawei/bma/include/bma_ker_intf.h | 94 + .../net/ethernet/huawei/bma/kbox_drv/Makefile | 5 + .../ethernet/huawei/bma/kbox_drv/kbox_dump.c | 121 + .../ethernet/huawei/bma/kbox_drv/kbox_dump.h | 33 + .../ethernet/huawei/bma/kbox_drv/kbox_hook.c | 102 + .../ethernet/huawei/bma/kbox_drv/kbox_hook.h | 33 + .../huawei/bma/kbox_drv/kbox_include.h | 40 + .../ethernet/huawei/bma/kbox_drv/kbox_main.c | 176 ++ .../ethernet/huawei/bma/kbox_drv/kbox_main.h | 23 + .../ethernet/huawei/bma/kbox_drv/kbox_mce.c | 264 ++ .../ethernet/huawei/bma/kbox_drv/kbox_mce.h | 23 + .../ethernet/huawei/bma/kbox_drv/kbox_panic.c | 187 ++ .../ethernet/huawei/bma/kbox_drv/kbox_panic.h | 25 + .../huawei/bma/kbox_drv/kbox_printk.c | 363 +++ .../huawei/bma/kbox_drv/kbox_printk.h | 33 + .../huawei/bma/kbox_drv/kbox_ram_drive.c | 188 ++ .../huawei/bma/kbox_drv/kbox_ram_drive.h | 31 + .../huawei/bma/kbox_drv/kbox_ram_image.c | 135 + .../huawei/bma/kbox_drv/kbox_ram_image.h | 84 + .../huawei/bma/kbox_drv/kbox_ram_op.c | 986 +++++++ .../huawei/bma/kbox_drv/kbox_ram_op.h | 77 + .../net/ethernet/huawei/bma/veth_drv/Makefile | 2 + .../ethernet/huawei/bma/veth_drv/veth_hb.c | 2504 +++++++++++++++++ .../ethernet/huawei/bma/veth_drv/veth_hb.h | 440 +++ 43 files changed, 11751 insertions(+) create mode 100644 drivers/net/ethernet/huawei/bma/Kconfig create mode 100644 drivers/net/ethernet/huawei/bma/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.h create mode 100644 drivers/net/ethernet/huawei/bma/include/bma_ker_intf.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_dump.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_dump.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_hook.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_hook.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_image.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_image.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.h create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h -- 2.27.0

2 7

[PATCH OLK-5.10] nfc: nci: assert requested protocol is valid
by Liu Jian 12 Mar '24

12 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v5.10.199 commit a424807d860ba816aaafc3064b46b456361c0802 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1K CVE: CVE-2023-52507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ] The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+0839b78e119aae1fec78(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index ed9019d807c7..4c931bd1c174 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -894,6 +894,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, return -EINVAL; } + if (protocol >= NFC_PROTO_MAX) { + pr_err("the requested nfc protocol is invalid\n"); + return -EINVAL; + } + if (!(nci_target->supported_protocols & (1 << protocol))) { pr_err("target does not support the requested protocol 0x%x\n", protocol); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nfc: nci: assert requested protocol is valid
by Liu Jian 12 Mar '24

12 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v4.19.297 commit a686f84101680b8442181a8846fbd3c934653729 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1K CVE: CVE-2023-52507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ] The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+0839b78e119aae1fec78(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index 75017a345b5a..6ba0cdbf8c4a 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -902,6 +902,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, return -EINVAL; } + if (protocol >= NFC_PROTO_MAX) { + pr_err("the requested nfc protocol is invalid\n"); + return -EINVAL; + } + if (!(nci_target->supported_protocols & (1 << protocol))) { pr_err("target does not support the requested protocol 0x%x\n", protocol); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] arm64/mpam: Fix use-after-free when deleting resource groups
by Zeng Heng 12 Mar '24

12 Mar '24

Wang ShaoBo (1): arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak Zeng Heng (1): arm64/mpam: Fix use-after-free when deleting resource groups arch/arm64/include/asm/resctrl.h | 18 +++++++++++++ arch/arm64/kernel/mpam/mpam_ctrlmon.c | 8 ------ arch/arm64/kernel/mpam/mpam_resctrl.c | 2 +- fs/resctrlfs.c | 37 ++++++++++----------------- 4 files changed, 32 insertions(+), 33 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/srp: Do not call scsi_done() from srp_abort()
by Liu Jian 12 Mar '24

12 Mar '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.199 commit 26788a5b48d9d5cd3283d777d238631c8cd7495a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1O CVE: CVE-2023-52515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ] After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. Cc: Bob Pearson <rpearsonhpe(a)gmail.com> Cc: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 6dcdc42ed081..ec54cd687ef1 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -2917,7 +2917,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) u32 tag; u16 ch_idx; struct srp_rdma_ch *ch; - int ret; shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); @@ -2933,19 +2932,14 @@ static int srp_abort(struct scsi_cmnd *scmnd) shost_printk(KERN_ERR, target->scsi_host, "Sending SRP abort for tag %#x\n", tag); if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, - SRP_TSK_ABORT_TASK, NULL) == 0) - ret = SUCCESS; - else if (target->rport->state == SRP_RPORT_LOST) - ret = FAST_IO_FAIL; - else - ret = FAILED; - if (ret == SUCCESS) { + SRP_TSK_ABORT_TASK, NULL) == 0) { srp_free_req(ch, req, scmnd, 0); - scmnd->result = DID_ABORT << 16; - scmnd->scsi_done(scmnd); + return SUCCESS; } + if (target->rport->state == SRP_RPORT_LOST) + return FAST_IO_FAIL; - return ret; + return FAILED; } static int srp_reset_device(struct scsi_cmnd *scmnd) -- 2.34.1

2 1

[PATCH OLK-5.10] RDMA/srp: Do not call scsi_done() from srp_abort()
by Liu Jian 12 Mar '24

12 Mar '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.199 commit 26788a5b48d9d5cd3283d777d238631c8cd7495a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1O CVE: CVE-2023-52515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ] After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. Cc: Bob Pearson <rpearsonhpe(a)gmail.com> Cc: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 9b9b9557ae74..11f9cb222bdc 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -2803,7 +2803,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) u32 tag; u16 ch_idx; struct srp_rdma_ch *ch; - int ret; shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); @@ -2819,19 +2818,14 @@ static int srp_abort(struct scsi_cmnd *scmnd) shost_printk(KERN_ERR, target->scsi_host, "Sending SRP abort for tag %#x\n", tag); if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, - SRP_TSK_ABORT_TASK, NULL) == 0) - ret = SUCCESS; - else if (target->rport->state == SRP_RPORT_LOST) - ret = FAST_IO_FAIL; - else - ret = FAILED; - if (ret == SUCCESS) { + SRP_TSK_ABORT_TASK, NULL) == 0) { srp_free_req(ch, req, scmnd, 0); - scmnd->result = DID_ABORT << 16; - scmnd->scsi_done(scmnd); + return SUCCESS; } + if (target->rport->state == SRP_RPORT_LOST) + return FAST_IO_FAIL; - return ret; + return FAILED; } static int srp_reset_device(struct scsi_cmnd *scmnd) -- 2.34.1

2 1

[PATCH OLK-5.10] arm64/mpam: Remove warning about no msc corresponding to the online cpu
by Zeng Heng 12 Mar '24

12 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96YK9 CVE: NA ----------------------------- It's fine that the associated msc is not found when the CPU comes online. For example, the device platform does not support L3 cache and there is no any L3 cache msc indeed. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index 4d0ec0052133..0cfb3cd21858 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -78,9 +78,11 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, } } - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!comp)) + if (!comp) { + pr_info_once("There is no msc corresponding to CPU%d.\n", cpu); return 0; + } + dom = kzalloc_node(sizeof(*dom), GFP_KERNEL, cpu_to_node(cpu)); if (!dom) @@ -168,9 +170,10 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!d)) + if (!d) { + pr_info_once("There is no msc corresponding to CPU%d.\n", cpu); continue; + } cpumask_clear_cpu(cpu, &d->cpu_mask); -- 2.25.1

2 1

[PATCH OLK-5.10] arm64/mpam: Expand the monitor number of the resctrl root
by Zeng Heng 12 Mar '24

12 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97GSW ----------------------------- Expand the monitor number of the resctrl root to 1023, instead of 255. Fixes: 0b16164dc7a9 ("arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index 3f650eafccd0..0bbe0c50f4f9 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -672,26 +672,22 @@ static int find_rdtgrp_allocable_rmid(struct resctrl_group *rdtgrp) struct list_head *head; prgrp = rdtgrp->mon.parent; - if (prgrp == &resctrl_group_default) { - rmid = rmid_alloc(-1); - if (rmid < 0) - return rmid; - } else { - do { - rmid = rmid_alloc(prgrp->closid.reqpartid); + + do { + rmid = rmid_alloc(prgrp->closid.reqpartid); + if (rmid >= 0) + break; + + head = &prgrp->mon.crdtgrp_list; + list_for_each_entry(entry, head, mon.crdtgrp_list) { + if (entry == rdtgrp) + continue; + + rmid = rmid_alloc(entry->closid.reqpartid); if (rmid >= 0) break; - - head = &prgrp->mon.crdtgrp_list; - list_for_each_entry(entry, head, mon.crdtgrp_list) { - if (entry == rdtgrp) - continue; - rmid = rmid_alloc(entry->closid.reqpartid); - if (rmid >= 0) - break; - } - } while (0); - } + } + } while (0); if (rmid < 0) rmid = rmid_alloc(-1); -- 2.25.1

2 1

[openeuler:OLK-5.10 9183/30000] mm/share_pool.c:4221:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'?
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2ad5d68f167008a56711bd61c282768420796602 commit: c533562a2802206135467a06384ba33cff42b18a [9183/30000] share_pool: Use sharepool_no_page to alloc hugepage config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240312/202403121009.nJzCAN1u-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240312/202403121009.nJzCAN1u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403121009.nJzCAN1u-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c: In function 'mg_sp_group_id_by_pid': mm/share_pool.c:858:29: warning: ordered comparison of pointer with integer zero [-Wextra] 858 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3014:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3014 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3014:21: error: invalid initializer mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:3394:14: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 3394 | bool is_hugepage = true; | ^~~~~~~~~~~ mm/share_pool.c: At top level: mm/share_pool.c:3691:6: warning: no previous prototype for 'sp_proc_stat_drop' [-Wmissing-prototypes] 3691 | void sp_proc_stat_drop(struct sp_proc_stat *stat) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:3922:6: warning: no previous prototype for 'spa_overview_show' [-Wmissing-prototypes] 3922 | void spa_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:4004:6: warning: no previous prototype for 'spg_overview_show' [-Wmissing-prototypes] 4004 | void spg_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sharepool_no_page': >> mm/share_pool.c:4221:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4221 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock >> mm/share_pool.c:4234:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4234 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache >> mm/share_pool.c:4256:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4256 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at >> mm/share_pool.c:4258:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4258 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub cc1: some warnings being treated as errors vim +4221 mm/share_pool.c 4179 4180 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4181 struct vm_area_struct *vma, 4182 struct address_space *mapping, pgoff_t idx, 4183 unsigned long address, pte_t *ptep, unsigned int flags) 4184 { 4185 struct hstate *h = hstate_vma(vma); 4186 vm_fault_t ret = VM_FAULT_SIGBUS; 4187 unsigned long size; 4188 struct page *page; 4189 pte_t new_pte; 4190 spinlock_t *ptl; 4191 unsigned long haddr = address & huge_page_mask(h); 4192 bool new_page = false; 4193 int err; 4194 int node_id; 4195 struct sp_area *spa; 4196 4197 spa = __find_sp_area(vma->vm_start); 4198 if (!spa) { 4199 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4200 return ret; 4201 } 4202 node_id = spa->node_id; 4203 __sp_area_drop(spa); 4204 4205 retry: 4206 page = find_lock_page(mapping, idx); 4207 if (!page) { 4208 size = i_size_read(mapping->host) >> huge_page_shift(h); 4209 if (idx >= size) 4210 goto out; 4211 4212 page = alloc_huge_page(vma, haddr, 0); 4213 if (IS_ERR(page)) { 4214 page = alloc_huge_page_nodemask(hstate_file(vma->vm_file), 4215 node_id, NULL, GFP_KERNEL); 4216 if (!page) 4217 page = ERR_PTR(-ENOMEM); 4218 } 4219 if (IS_ERR(page)) { 4220 ptl = huge_pte_lock(h, mm, ptep); > 4221 if (!huge_pte_none(huge_ptep_get(ptep))) { 4222 ret = 0; 4223 spin_unlock(ptl); 4224 goto out; 4225 } 4226 spin_unlock(ptl); 4227 ret = vmf_error(PTR_ERR(page)); 4228 goto out; 4229 } 4230 __SetPageUptodate(page); 4231 new_page = true; 4232 4233 /* sharepool pages are all shared */ > 4234 err = huge_add_to_page_cache(page, mapping, idx); 4235 if (err) { 4236 put_page(page); 4237 if (err == -EEXIST) 4238 goto retry; 4239 goto out; 4240 } 4241 } 4242 4243 4244 ptl = huge_pte_lock(h, mm, ptep); 4245 size = i_size_read(mapping->host) >> huge_page_shift(h); 4246 if (idx >= size) 4247 goto backout; 4248 4249 ret = 0; 4250 if (!huge_pte_none(huge_ptep_get(ptep))) 4251 goto backout; 4252 4253 page_dup_rmap(page, true); 4254 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4255 && (vma->vm_flags & VM_SHARED))); > 4256 set_huge_pte_at(mm, haddr, ptep, new_pte); 4257 > 4258 hugetlb_count_add(pages_per_huge_page(h), mm); 4259 4260 spin_unlock(ptl); 4261 4262 if (new_page) { 4263 SetPagePrivate(&page[1]); 4264 } 4265 4266 unlock_page(page); 4267 out: 4268 return ret; 4269 4270 backout: 4271 spin_unlock(ptl); 4272 unlock_page(page); 4273 put_page(page); 4274 goto out; 4275 } 4276 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] arm64/mpam: Fix use-after-free when deleting resource groups
by Zeng Heng 12 Mar '24

12 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97KAV -------------------------------- Refer to the below commit: commit b8511ccc75c0 ("x86/resctrl: Fix use-after-free when deleting resource groups") Before removing rdtgroup, we need to refer to waitcount counter, otherwise when unmounting the resctrl file system or deleting ctrl_mon groups, and there were a waiter on resctrl system, then a use-after-free issue would occurs. Fix that by removing rdtgroup after checking the waitcount. Fixes: 3b856c03b36a ("arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index e02e4769edc0..3f650eafccd0 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -485,7 +485,10 @@ static void free_all_child_rdtgrp(struct resctrl_group *rdtgrp) /* rmid may not be used */ rmid_free(sentry->mon.rmid); list_del(&sentry->mon.crdtgrp_list); - rdtgroup_remove(sentry); + if (atomic_read(&sentry->waitcount) != 0) + sentry->flags = RDT_DELETED; + else + rdtgroup_remove(sentry); } } @@ -519,7 +522,10 @@ static void rmdir_all_sub(void) kernfs_remove(rdtgrp->kn); list_del(&rdtgrp->resctrl_group_list); - rdtgroup_remove(rdtgrp); + if (atomic_read(&rdtgrp->waitcount) != 0) + rdtgrp->flags = RDT_DELETED; + else + rdtgroup_remove(rdtgrp); } /* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */ update_closid_rmid(cpu_online_mask, &resctrl_group_default); -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 2ad5d68f167008a56711bd61c282768420796602
by kernel test robot 12 Mar '24

12 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2ad5d68f167008a56711bd61c282768420796602 !5117 fix CVE-2023-52527 Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240312 `-- drivers-gpu-drm-phytium-phytium_dp.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 736m configs tested: 35 configs skipped: 150 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240312 gcc arm64 randconfig-002-20240312 gcc arm64 randconfig-003-20240312 gcc arm64 randconfig-004-20240312 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240312 clang x86_64 buildonly-randconfig-002-20240312 clang x86_64 buildonly-randconfig-003-20240312 clang x86_64 buildonly-randconfig-004-20240312 clang x86_64 buildonly-randconfig-005-20240312 gcc x86_64 buildonly-randconfig-006-20240312 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240312 clang x86_64 randconfig-002-20240312 clang x86_64 randconfig-003-20240312 gcc x86_64 randconfig-004-20240312 gcc x86_64 randconfig-005-20240312 gcc x86_64 randconfig-006-20240312 clang x86_64 randconfig-011-20240312 gcc x86_64 randconfig-012-20240312 clang x86_64 randconfig-013-20240312 gcc x86_64 randconfig-014-20240312 gcc x86_64 randconfig-015-20240312 clang x86_64 randconfig-016-20240312 clang x86_64 randconfig-071-20240312 gcc x86_64 randconfig-072-20240312 gcc x86_64 randconfig-073-20240312 clang x86_64 randconfig-074-20240312 gcc x86_64 randconfig-075-20240312 gcc x86_64 randconfig-076-20240312 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f0a83d8e747248d5b1628d7afec65bee2e48e580
by kernel test robot 12 Mar '24

12 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f0a83d8e747248d5b1628d7afec65bee2e48e580 !4927 ima: digest list new support modsig Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-002-20240312 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- arm64-randconfig-003-20240312 | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_disable_msi | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_enable_msi | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-002-20240312 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-buildonly-randconfig-005-20240312 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-004-20240312 | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-buildonly-randconfig-001-20240312 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead elapsed time: 732m configs tested: 36 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240312 gcc arm64 randconfig-002-20240312 gcc arm64 randconfig-003-20240312 gcc arm64 randconfig-004-20240312 clang loongarch alldefconfig gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240312 gcc loongarch randconfig-002-20240312 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240312 clang x86_64 buildonly-randconfig-002-20240312 clang x86_64 buildonly-randconfig-003-20240312 clang x86_64 buildonly-randconfig-004-20240312 clang x86_64 buildonly-randconfig-005-20240312 gcc x86_64 buildonly-randconfig-006-20240312 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240312 clang x86_64 randconfig-002-20240312 clang x86_64 randconfig-003-20240312 gcc x86_64 randconfig-004-20240312 gcc x86_64 randconfig-005-20240312 gcc x86_64 randconfig-006-20240312 clang x86_64 randconfig-011-20240312 gcc x86_64 randconfig-012-20240312 clang x86_64 randconfig-013-20240312 gcc x86_64 randconfig-014-20240312 gcc x86_64 randconfig-015-20240312 clang x86_64 randconfig-016-20240312 clang x86_64 randconfig-071-20240312 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 3160/21845] drivers/acpi/arm64/iort.c:1370:73: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8393e1c316adfa8f2fdbba0d7c69fc7ae2293393 commit: 68088650bec0647cef4d822b31f818a094f5eead [3160/21845] perf/smmuv3_pmu: Enable HiSilicon Erratum 162001800 quirk config: arm64-randconfig-r132-20240304 (https://download.01.org/0day-ci/archive/20240312/202403120704.BrgZdp3c-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240312/202403120704.BrgZdp3c-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403120704.BrgZdp3c-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/acpi/arm64/iort.c:1370:73: sparse: sparse: Using plain integer as NULL pointer drivers/acpi/arm64/iort.c:61: warning: Function parameter or member 'iort_node' not described in 'iort_set_fwnode' drivers/acpi/arm64/iort.c:61: warning: Excess function parameter 'node' description in 'iort_set_fwnode' drivers/acpi/arm64/iort.c:980: warning: Function parameter or member 'dma_size' not described in 'iort_dma_setup' drivers/acpi/arm64/iort.c:980: warning: Excess function parameter 'size' description in 'iort_dma_setup' drivers/acpi/arm64/iort.c:1447: warning: Function parameter or member 'ops' not described in 'iort_add_platform_device' vim +1370 drivers/acpi/arm64/iort.c 1367 1368 static struct acpi_platform_list pmcg_plat_info[] __initdata = { 1369 /* HiSilicon Hip08 Platform */ > 1370 {"HISI ", "HIP08 ", 0, ACPI_SIG_IORT, greater_than_or_equal, 0, 1371 IORT_SMMU_V3_PMCG_HISI_HIP08}, 1372 { } 1373 }; 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/8] cpuset exclusive feature
by Chen Ridong 11 Mar '24

11 Mar '24

Harshit Mogalapalli (1): cgroup/cpuset: Cleanup signedness issue in cpu_exclusive_check() Kamalesh Babulal (1): cgroup/cpuset: Fix retval in update_cpumask() Waiman Long (6): cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2 cgroup/cpuset: Add cpuset.cpus.exclusive for v2 cgroup/cpuset: Introduce remote partition cgroup/cpuset: Check partition conflict with housekeeping setup cgroup/cpuset: Enable invalid to valid local partition transition cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask() kernel/cgroup/cpuset.c | 1306 ++++++++++++++++++++++++++++++---------- 1 file changed, 975 insertions(+), 331 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS] arm64/mpam: Expand the monitor number of the resctrl root
by Zeng Heng 11 Mar '24

11 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9758Q ----------------------------- Expand the monitor number of the resctrl root to 1023, instead of 255. Fixes: 750084197059 ("arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index 0e6753012140..4e9a1cdb9b13 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -550,26 +550,22 @@ static int find_rdtgrp_allocable_rmid(struct resctrl_group *rdtgrp) struct list_head *head; prgrp = rdtgrp->mon.parent; - if (prgrp == &resctrl_group_default) { - rmid = rmid_alloc(-1); - if (rmid < 0) - return rmid; - } else { - do { - rmid = rmid_alloc(prgrp->closid.reqpartid); + + do { + rmid = rmid_alloc(prgrp->closid.reqpartid); + if (rmid >= 0) + break; + + head = &prgrp->mon.crdtgrp_list; + list_for_each_entry(entry, head, mon.crdtgrp_list) { + if (entry == rdtgrp) + continue; + + rmid = rmid_alloc(entry->closid.reqpartid); if (rmid >= 0) break; - - head = &prgrp->mon.crdtgrp_list; - list_for_each_entry(entry, head, mon.crdtgrp_list) { - if (entry == rdtgrp) - continue; - rmid = rmid_alloc(entry->closid.reqpartid); - if (rmid >= 0) - break; - } - } while (0); - } + } + } while (0); if (rmid < 0) rmid = rmid_alloc(-1); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] arm64/mpam: Expand the monitor number of the resctrl root
by Zeng Heng 11 Mar '24

11 Mar '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9758Q ----------------------------- Expand the monitor number of the resctrl root to 1023, instead of 255. Fixes: 750084197059 ("arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index 0e6753012140..4e9a1cdb9b13 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -550,26 +550,22 @@ static int find_rdtgrp_allocable_rmid(struct resctrl_group *rdtgrp) struct list_head *head; prgrp = rdtgrp->mon.parent; - if (prgrp == &resctrl_group_default) { - rmid = rmid_alloc(-1); - if (rmid < 0) - return rmid; - } else { - do { - rmid = rmid_alloc(prgrp->closid.reqpartid); + + do { + rmid = rmid_alloc(prgrp->closid.reqpartid); + if (rmid >= 0) + break; + + head = &prgrp->mon.crdtgrp_list; + list_for_each_entry(entry, head, mon.crdtgrp_list) { + if (entry == rdtgrp) + continue; + + rmid = rmid_alloc(entry->closid.reqpartid); if (rmid >= 0) break; - - head = &prgrp->mon.crdtgrp_list; - list_for_each_entry(entry, head, mon.crdtgrp_list) { - if (entry == rdtgrp) - continue; - rmid = rmid_alloc(entry->closid.reqpartid); - if (rmid >= 0) - break; - } - } while (0); - } + } + } while (0); if (rmid < 0) rmid = rmid_alloc(-1); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-v5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: 189657 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- fs/nfs/fs_context.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c index 29ec8b09a52d..05b39e8f97b9 100644 --- a/fs/nfs/fs_context.c +++ b/fs/nfs/fs_context.c @@ -937,6 +937,15 @@ static int nfs23_parse_monolithic(struct fs_context *fc, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_fs_context, which nfs_fill_super * can deal with. @@ -1037,6 +1046,9 @@ static int nfs23_parse_monolithic(struct fs_context *fc, out_invalid_fh: return nfs_invalf(fc, "NFS: invalid root filehandle"); + +out_invalid_data: + return nfs_invalf(fc, "NFS: invalid binary mount data"); } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

1 0

[PATCH OLK-6.6] modpost: Optimize symbol search from linear to binary search
by Hongchen Zhang 11 Mar '24

11 Mar '24

From: Jack Brennen <jbrennen(a)google.com> mainline inclusion from mainline-v6.7-rc1 commit 4074532758c5c367d3fcb8d124150824a254659d category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I97HOU CVE: NA -------------------------------- Modify modpost to use binary search for converting addresses back into symbol references. Previously it used linear search. This change saves a few seconds of wall time for defconfig builds, but can save several minutes on allyesconfigs. Before: $ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 198.38user 1.27system 3:19.71elapsed After: $ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 11.91user 0.85system 0:12.78elapsed Signed-off-by: Jack Brennen <jbrennen(a)google.com> Tested-by: Nick Desaulniers <ndesaulniers(a)google.com> Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> --- scripts/mod/Makefile | 4 +- scripts/mod/modpost.c | 70 ++------------ scripts/mod/modpost.h | 25 +++++ scripts/mod/symsearch.c | 199 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 232 insertions(+), 66 deletions(-) create mode 100644 scripts/mod/symsearch.c diff --git a/scripts/mod/Makefile b/scripts/mod/Makefile index c9e38ad937fd..3c54125eb373 100644 --- a/scripts/mod/Makefile +++ b/scripts/mod/Makefile @@ -5,7 +5,7 @@ CFLAGS_REMOVE_empty.o += $(CC_FLAGS_LTO) hostprogs-always-y += modpost mk_elfconfig always-y += empty.o -modpost-objs := modpost.o file2alias.o sumversion.o +modpost-objs := modpost.o file2alias.o sumversion.o symsearch.o devicetable-offsets-file := devicetable-offsets.h @@ -16,7 +16,7 @@ targets += $(devicetable-offsets-file) devicetable-offsets.s # dependencies on generated files need to be listed explicitly -$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o: $(obj)/elfconfig.h +$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o $(obj)/symsearch.o: $(obj)/elfconfig.h $(obj)/file2alias.o: $(obj)/$(devicetable-offsets-file) quiet_cmd_elfconfig = MKELF $@ diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index ac4ef3e206bb..e6c8b096362e 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c @@ -22,7 +22,6 @@ #include <errno.h> #include "modpost.h" #include "../../include/linux/license.h" -#include "../../include/linux/module_symbol.h" static bool module_enabled; /* Are we using CONFIG_MODVERSIONS? */ @@ -577,11 +576,14 @@ static int parse_elf(struct elf_info *info, const char *filename) *p = TO_NATIVE(*p); } + symsearch_init(info); + return 1; } static void parse_elf_finish(struct elf_info *info) { + symsearch_finish(info); release_file(info->hdr, info->size); } @@ -1050,71 +1052,10 @@ static int secref_whitelist(const char *fromsec, const char *fromsym, return 1; } -/* - * If there's no name there, ignore it; likewise, ignore it if it's - * one of the magic symbols emitted used by current tools. - * - * Otherwise if find_symbols_between() returns those symbols, they'll - * fail the whitelist tests and cause lots of false alarms ... fixable - * only by merging __exit and __init sections into __text, bloating - * the kernel (which is especially evil on embedded platforms). - */ -static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) -{ - const char *name = elf->strtab + sym->st_name; - - if (!name || !strlen(name)) - return 0; - return !is_mapping_symbol(name); -} - -/* Look up the nearest symbol based on the section and the address */ -static Elf_Sym *find_nearest_sym(struct elf_info *elf, Elf_Addr addr, - unsigned int secndx, bool allow_negative, - Elf_Addr min_distance) -{ - Elf_Sym *sym; - Elf_Sym *near = NULL; - Elf_Addr sym_addr, distance; - bool is_arm = (elf->hdr->e_machine == EM_ARM); - - for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { - if (get_secindex(elf, sym) != secndx) - continue; - if (!is_valid_name(elf, sym)) - continue; - - sym_addr = sym->st_value; - - /* - * For ARM Thumb instruction, the bit 0 of st_value is set - * if the symbol is STT_FUNC type. Mask it to get the address. - */ - if (is_arm && ELF_ST_TYPE(sym->st_info) == STT_FUNC) - sym_addr &= ~1; - - if (addr >= sym_addr) - distance = addr - sym_addr; - else if (allow_negative) - distance = sym_addr - addr; - else - continue; - - if (distance <= min_distance) { - min_distance = distance; - near = sym; - } - - if (min_distance == 0) - break; - } - return near; -} - static Elf_Sym *find_fromsym(struct elf_info *elf, Elf_Addr addr, unsigned int secndx) { - return find_nearest_sym(elf, addr, secndx, false, ~0); + return symsearch_find_nearest(elf, addr, secndx, false, ~0); } static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) @@ -1127,7 +1068,8 @@ static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) * Strive to find a better symbol name, but the resulting name may not * match the symbol referenced in the original code. */ - return find_nearest_sym(elf, addr, get_secindex(elf, sym), true, 20); + return symsearch_find_nearest(elf, addr, get_secindex(elf, sym), + true, 20); } static bool is_executable_section(struct elf_info *elf, unsigned int secndx) diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h index 5f94c2c9f2d9..6413f26fcb6b 100644 --- a/scripts/mod/modpost.h +++ b/scripts/mod/modpost.h @@ -10,6 +10,7 @@ #include <fcntl.h> #include <unistd.h> #include <elf.h> +#include "../../include/linux/module_symbol.h" #include "list.h" #include "elfconfig.h" @@ -128,6 +129,8 @@ struct elf_info { * take shndx from symtab_shndx_start[N] instead */ Elf32_Word *symtab_shndx_start; Elf32_Word *symtab_shndx_stop; + + struct symsearch *symsearch; }; /* Accessor for sym->st_shndx, hides ugliness of "64k sections" */ @@ -154,6 +157,28 @@ static inline unsigned int get_secindex(const struct elf_info *info, return index; } +/* + * If there's no name there, ignore it; likewise, ignore it if it's + * one of the magic symbols emitted used by current tools. + * + * Internal symbols created by tools should be ignored by modpost. + */ +static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) +{ + const char *name = elf->strtab + sym->st_name; + + if (!name || !strlen(name)) + return 0; + return !is_mapping_symbol(name); +} + +/* symsearch.c */ +void symsearch_init(struct elf_info *elf); +void symsearch_finish(struct elf_info *elf); +Elf_Sym *symsearch_find_nearest(struct elf_info *elf, Elf_Addr addr, + unsigned int secndx, bool allow_negative, + Elf_Addr min_distance); + /* file2alias.c */ void handle_moddevtable(struct module *mod, struct elf_info *info, Elf_Sym *sym, const char *symname); diff --git a/scripts/mod/symsearch.c b/scripts/mod/symsearch.c new file mode 100644 index 000000000000..aa4ed51f9960 --- /dev/null +++ b/scripts/mod/symsearch.c @@ -0,0 +1,199 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Helper functions for finding the symbol in an ELF which is "nearest" + * to a given address. + */ + +#include "modpost.h" + +struct syminfo { + unsigned int symbol_index; + unsigned int section_index; + Elf_Addr addr; +}; + +/* + * Container used to hold an entire binary search table. + * Entries in table are ascending, sorted first by section_index, + * then by addr, and last by symbol_index. The sorting by + * symbol_index is used to ensure predictable behavior when + * multiple symbols are present with the same address; all + * symbols past the first are effectively ignored, by eliding + * them in symsearch_fixup(). + */ +struct symsearch { + unsigned int table_size; + struct syminfo table[]; +}; + +static int syminfo_compare(const void *s1, const void *s2) +{ + const struct syminfo *sym1 = s1; + const struct syminfo *sym2 = s2; + + if (sym1->section_index > sym2->section_index) + return 1; + if (sym1->section_index < sym2->section_index) + return -1; + if (sym1->addr > sym2->addr) + return 1; + if (sym1->addr < sym2->addr) + return -1; + if (sym1->symbol_index > sym2->symbol_index) + return 1; + if (sym1->symbol_index < sym2->symbol_index) + return -1; + return 0; +} + +static unsigned int symbol_count(struct elf_info *elf) +{ + unsigned int result = 0; + + for (Elf_Sym *sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (is_valid_name(elf, sym)) + result++; + } + return result; +} + +/* + * Populate the search array that we just allocated. + * Be slightly paranoid here. The ELF file is mmap'd and could + * conceivably change between symbol_count() and symsearch_populate(). + * If we notice any difference, bail out rather than potentially + * propagating errors or crashing. + */ +static void symsearch_populate(struct elf_info *elf, + struct syminfo *table, + unsigned int table_size) +{ + bool is_arm = (elf->hdr->e_machine == EM_ARM); + + for (Elf_Sym *sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (is_valid_name(elf, sym)) { + if (table_size-- == 0) + fatal("%s: size mismatch\n", __func__); + table->symbol_index = sym - elf->symtab_start; + table->section_index = get_secindex(elf, sym); + table->addr = sym->st_value; + + /* + * For ARM Thumb instruction, the bit 0 of st_value is + * set if the symbol is STT_FUNC type. Mask it to get + * the address. + */ + if (is_arm && ELF_ST_TYPE(sym->st_info) == STT_FUNC) + table->addr &= ~1; + + table++; + } + } + + if (table_size != 0) + fatal("%s: size mismatch\n", __func__); +} + +/* + * Do any fixups on the table after sorting. + * For now, this just finds adjacent entries which have + * the same section_index and addr, and it propagates + * the first symbol_index over the subsequent entries, + * so that only one symbol_index is seen for any given + * section_index and addr. This ensures that whether + * we're looking at an address from "above" or "below" + * that we see the same symbol_index. + * This does leave some duplicate entries in the table; + * in practice, these are a small fraction of the + * total number of entries, and they are harmless to + * the binary search algorithm other than a few occasional + * unnecessary comparisons. + */ +static void symsearch_fixup(struct syminfo *table, unsigned int table_size) +{ + /* Don't look at index 0, it will never change. */ + for (unsigned int i = 1; i < table_size; i++) { + if (table[i].addr == table[i - 1].addr && + table[i].section_index == table[i - 1].section_index) { + table[i].symbol_index = table[i - 1].symbol_index; + } + } +} + +void symsearch_init(struct elf_info *elf) +{ + unsigned int table_size = symbol_count(elf); + + elf->symsearch = NOFAIL(malloc(sizeof(struct symsearch) + + sizeof(struct syminfo) * table_size)); + elf->symsearch->table_size = table_size; + + symsearch_populate(elf, elf->symsearch->table, table_size); + qsort(elf->symsearch->table, table_size, + sizeof(struct syminfo), syminfo_compare); + + symsearch_fixup(elf->symsearch->table, table_size); +} + +void symsearch_finish(struct elf_info *elf) +{ + free(elf->symsearch); + elf->symsearch = NULL; +} + +/* + * Find the syminfo which is in secndx and "nearest" to addr. + * allow_negative: allow returning a symbol whose address is > addr. + * min_distance: ignore symbols which are further away than this. + * + * Returns a pointer into the symbol table for success. + * Returns NULL if no legal symbol is found within the requested range. + */ +Elf_Sym *symsearch_find_nearest(struct elf_info *elf, Elf_Addr addr, + unsigned int secndx, bool allow_negative, + Elf_Addr min_distance) +{ + unsigned int hi = elf->symsearch->table_size; + unsigned int lo = 0; + struct syminfo *table = elf->symsearch->table; + struct syminfo target; + + target.addr = addr; + target.section_index = secndx; + target.symbol_index = ~0; /* compares greater than any actual index */ + while (hi > lo) { + unsigned int mid = lo + (hi - lo) / 2; /* Avoids overflow */ + + if (syminfo_compare(&table[mid], &target) > 0) + hi = mid; + else + lo = mid + 1; + } + + /* + * table[hi], if it exists, is the first entry in the array which + * lies beyond target. table[hi - 1], if it exists, is the last + * entry in the array which comes before target, including the + * case where it perfectly matches the section and the address. + * + * Note -- if the address we're looking up falls perfectly + * in the middle of two symbols, this is written to always + * prefer the symbol with the lower address. + */ + Elf_Sym *result = NULL; + + if (allow_negative && + hi < elf->symsearch->table_size && + table[hi].section_index == secndx && + table[hi].addr - addr <= min_distance) { + min_distance = table[hi].addr - addr; + result = &elf->symtab_start[table[hi].symbol_index]; + } + if (hi > 0 && + table[hi - 1].section_index == secndx && + addr - table[hi - 1].addr <= min_distance) { + result = &elf->symtab_start[table[hi - 1].symbol_index]; + } + return result; +} -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46926
by Liu Mingrui 11 Mar '24

11 Mar '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller Pierre-Louis Bossart (1): soundwire: intel: filter SoundWire controller device search drivers/soundwire/intel_init.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46926
by Liu Mingrui 11 Mar '24

11 Mar '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller Pierre-Louis Bossart (1): soundwire: intel: filter SoundWire controller device search drivers/soundwire/intel_init.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6 00/19] net: hns3: provides some customized interfaces for storage devices
by Jijie Shao 11 Mar '24

11 Mar '24

From: Jiantao Xiao <xiaojiantao1(a)h-partners.com> Hao Chen (2): net: hns3: add support to get/set 1d torus param net: hns3: add support modified tx timeout Jian Shen (2): net: hns3: add extend interface support for read and write phy register net: hns3: add input parameters checking Jie Wang (1): net: hns3: add support PF provides customized interfaces to detect port faults. shaojijie (13): net: hns3: add support customized exception handling interfaces. net: hns3: add supports pfc storm detection and suppression net: hns3: add supports fast reporting of faulty nodes net: hns3: add support clear mac statistics net: hns3: add support configuring function-level interrupt affinity net: hns3: add support query port ext information net: hns3: add support query the presence of optical module net: hns3: add supports configure optical module enable net: hns3: add support config and query serdes lane status net: hns3: add support disable nic clock net: hns3: support set pfc pause trans time net: hns3: add support detect port wire type net: hns3: add support set led wangpeiyang (1): net: hns3: add support set mac state drivers/net/ethernet/hisilicon/hns3/Makefile | 3 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 7 + .../net/ethernet/hisilicon/hns3/hnae3_ext.h | 121 ++ .../hns3/hns3_common/hclge_comm_cmd.c | 1 + .../hns3/hns3_common/hclge_comm_cmd.h | 1 + .../net/ethernet/hisilicon/hns3/hns3_enet.c | 7 +- .../net/ethernet/hisilicon/hns3/hns3_ext.c | 543 ++++++ .../net/ethernet/hisilicon/hns3/hns3_ext.h | 67 + .../hisilicon/hns3/hns3pf/hclge_cmd.h | 14 +- .../hisilicon/hns3/hns3pf/hclge_ext.c | 1490 +++++++++++++++++ .../hisilicon/hns3/hns3pf/hclge_ext.h | 180 ++ .../hisilicon/hns3/hns3pf/hclge_main.c | 58 +- .../hisilicon/hns3/hns3pf/hclge_main.h | 12 +- .../hisilicon/hns3/hns3pf/hclge_mbx.c | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 7 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 2 + 16 files changed, 2488 insertions(+), 27 deletions(-) create mode 100644 drivers/net/ethernet/hisilicon/hns3/hnae3_ext.h create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_ext.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_ext.h create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ext.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ext.h -- 2.30.0

2 20

[PATCH openEuler-1.0-LTS] crypto: scomp - fix req->dst buffer overflow
by GUO Zihua 11 Mar '24

11 Mar '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v4.19.306 commit 1142d65c5b881590962ad763f94505b6dd67d2fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I970CO CVE: NA Reference: https://github.com/gregkh/linux/commit/1142d65c5b881590962ad763f94505b6dd67… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: crypto/scompress.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 15641c96ff99..5f3fb6cbf531 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -149,6 +149,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) const int cpu = get_cpu(); u8 *scratch_src = *per_cpu_ptr(scomp_src_scratches, cpu); u8 *scratch_dst = *per_cpu_ptr(scomp_dst_scratches, cpu); + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) { @@ -164,6 +165,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scatterwalk_map_and_copy(scratch_src, req->src, 0, req->slen, 0); if (dir) ret = crypto_scomp_compress(scomp, scratch_src, req->slen, @@ -178,6 +181,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch_dst, req->dst, 0, req->dlen, 1); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 13375/21829] include/linux/uaccess.h:112:17: warning: 'kbrep' may be used uninitialized
by kernel test robot 11 Mar '24

11 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf1b7dd5d431b4248d92755c06e76094bbe2b7b4 commit: c20f651cb5a90254b561f218b967e04ff626853e [13375/21829] vt: vt_ioctl: remove unnecessary console allocation checks config: arm64-randconfig-003-20240308 (https://download.01.org/0day-ci/archive/20240311/202403110630.3gj4ph83-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240311/202403110630.3gj4ph83-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403110630.3gj4ph83-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/asm-generic/termios.h:6, from ./arch/arm64/include/generated/uapi/asm/termios.h:1, from include/uapi/linux/termios.h:6, from include/linux/tty.h:7, from drivers/tty/vt/vt_ioctl.c:15: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_event_wait_ioctl' at drivers/tty/vt/vt_ioctl.c:187:6: include/linux/uaccess.h:112:17: warning: 'vw' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/linux/kernel.h:10, from include/linux/list.h:9, from include/linux/rculist.h:10, from include/linux/sched/signal.h:6, from drivers/tty/vt/vt_ioctl.c:14: include/linux/kasan-checks.h: In function 'vt_event_wait_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:185:30: note: 'vw' declared here 185 | struct vt_event_wait vw; | ^~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:450:7: >> include/linux/uaccess.h:112:17: warning: 'kbrep' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:445:35: note: 'kbrep' declared here 445 | struct kbd_repeat kbrep; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:605:7: include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:601:32: note: 'tmp' declared here 601 | struct vt_mode tmp; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:703:7: >> include/linux/uaccess.h:112:17: warning: 'vsa' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:698:39: note: 'vsa' declared here 698 | struct vt_setactivate vsa; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:859:7: include/linux/uaccess.h:112:17: warning: 'v' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:856:35: note: 'v' declared here 856 | struct vt_consize v; | ^ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'do_fontx_ioctl' at drivers/tty/vt/vt_ioctl.c:246:6, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:936:9: include/linux/uaccess.h:112:17: warning: 'cfdarg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:243:32: note: 'cfdarg' declared here 243 | struct consolefontdesc cfdarg; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:965:7: include/linux/uaccess.h:112:17: warning: 'op' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:352:32: note: 'op' declared here 352 | struct console_font_op op; /* used in multiple places here */ | ^~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'do_unimap_ioctl' at drivers/tty/vt/vt_ioctl.c:285:6, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:1009:9: include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:283:27: note: 'tmp' declared here 283 | struct unimapdesc tmp; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_fontx_ioctl' at drivers/tty/vt/vt_ioctl.c:1090:6, inlined from 'vt_compat_ioctl' at drivers/tty/vt/vt_ioctl.c:1202:9: include/linux/uaccess.h:112:17: warning: 'cfdarg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_compat_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:1087:39: note: 'cfdarg' declared here 1087 | struct compat_consolefontdesc cfdarg; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_kdfontop_ioctl' at drivers/tty/vt/vt_ioctl.c:1137:6, inlined from 'vt_compat_ioctl' at drivers/tty/vt/vt_ioctl.c:1206:9: include/linux/uaccess.h:112:17: warning: 'op' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_compat_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:1183:32: note: 'op' declared here 1183 | struct console_font_op op; /* used in multiple places here */ | ^~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_unimap_ioctl' at drivers/tty/vt/vt_ioctl.c:1163:6, inlined from 'vt_compat_ioctl' at drivers/tty/vt/vt_ioctl.c:1211:9: include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_compat_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here vim +/kbrep +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] fix CVE-2023-52527
by Zhengchao Shao 10 Mar '24

10 Mar '24

fix CVE-2023-52527. David Howells (1): ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Tom Parkin (1): l2tp: pass correct message length to ip6_append_data net/l2tp/l2tp_ip6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
by Zhengchao Shao 10 Mar '24

10 Mar '24

From: David Howells <dhowells(a)redhat.com> stable inclusion from stable-v5.10.198 commit 96b2e1090397217839fcd6c9b6d8f5d439e705ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2G CVE: CVE-2023-52527 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9d4c75800f61e5d75c1659ba201b6c0c7ead3070 ] Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happened previously) when appending to an IPv4 or IPv6 packet as we don't want to repeat the transport header or account for it twice. This can happen under some circumstances, such as splicing into an L2TP socket. The symptom observed is a warning in __ip6_append_data(): WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800 that occurs when MSG_SPLICE_PAGES is used to append more data to an already partially occupied skbuff. The warning occurs when 'copy' is larger than the amount of data in the message iterator. This is because the requested length includes the transport header length when it shouldn't. This can be triggered by, for example: sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP); bind(sfd, ...); // ::1 connect(sfd, ...); // ::1 port 7 send(sfd, buffer, 4100, MSG_MORE); sendfile(sfd, dfd, NULL, 1024); Fix this by only adding transhdrlen into the length if the write queue is empty in l2tp_ip6_sendmsg(), analogously to how UDP does things. l2tp_ip_sendmsg() looks like it won't suffer from this problem as it builds the UDP packet itself. Fixes: a32e0eec7042 ("l2tp: introduce L2TPv3 IP encapsulation support for IPv6") Reported-by: syzbot+62cbf263225ae13ff153(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/r/0000000000001c12b30605378ce8@google.com/ Suggested-by: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> Signed-off-by: David Howells <dhowells(a)redhat.com> cc: Eric Dumazet <edumazet(a)google.com> cc: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> cc: "David S. Miller" <davem(a)davemloft.net> cc: David Ahern <dsahern(a)kernel.org> cc: Paolo Abeni <pabeni(a)redhat.com> cc: Jakub Kicinski <kuba(a)kernel.org> cc: netdev(a)vger.kernel.org cc: bpf(a)vger.kernel.org cc: syzkaller-bugs(a)googlegroups.com Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/l2tp/l2tp_ip6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c index 382124d6f764..9746c624a550 100644 --- a/net/l2tp/l2tp_ip6.c +++ b/net/l2tp/l2tp_ip6.c @@ -508,7 +508,6 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) */ if (len > INT_MAX - transhdrlen) return -EMSGSIZE; - ulen = len + transhdrlen; /* Mirror BSD error message compatibility */ if (msg->msg_flags & MSG_OOB) @@ -629,6 +628,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) back_from_confirm: lock_sock(sk); + ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0; err = ip6_append_data(sk, ip_generic_getfrag, msg, ulen, transhdrlen, &ipc6, &fl6, (struct rt6_info *)dst, -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION bf1b7dd5d431b4248d92755c06e76094bbe2b7b4
by kernel test robot 10 Mar '24

10 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: bf1b7dd5d431b4248d92755c06e76094bbe2b7b4 !5092 wifi: mac80211: fix potential key use-after-free Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- x86_64-buildonly-randconfig-005-20240309 |-- drivers-char-hw_random-zhaoxin-rng.o:warning:objtool:missing-symbol-for-section-.init.text `-- net-can-j1939-main.o:warning:objtool:missing-symbol-for-section-.init.text clang_recent_errors `-- x86_64-buildonly-randconfig-003-20240309 `-- drivers-scsi-scsi_logging.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 730m configs tested: 35 configs skipped: 150 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 gcc arm64 randconfig-003-20240309 gcc arm64 randconfig-004-20240309 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240309 clang x86_64 buildonly-randconfig-002-20240309 gcc x86_64 buildonly-randconfig-003-20240309 clang x86_64 buildonly-randconfig-004-20240309 gcc x86_64 buildonly-randconfig-005-20240309 gcc x86_64 buildonly-randconfig-006-20240309 clang x86_64 defconfig gcc x86_64 randconfig-001-20240309 gcc x86_64 randconfig-002-20240309 clang x86_64 randconfig-003-20240309 clang x86_64 randconfig-004-20240309 gcc x86_64 randconfig-005-20240309 clang x86_64 randconfig-006-20240309 gcc x86_64 randconfig-011-20240309 clang x86_64 randconfig-012-20240309 clang x86_64 randconfig-013-20240309 clang x86_64 randconfig-014-20240309 gcc x86_64 randconfig-015-20240309 gcc x86_64 randconfig-016-20240309 gcc x86_64 randconfig-071-20240309 gcc x86_64 randconfig-072-20240309 gcc x86_64 randconfig-073-20240309 gcc x86_64 randconfig-074-20240309 gcc x86_64 randconfig-075-20240309 gcc x86_64 randconfig-076-20240309 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 2915e2435fc93e9142e018ee932a37d762aa5d2d
by kernel test robot 10 Mar '24

10 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2915e2435fc93e9142e018ee932a37d762aa5d2d !5063 dccp: fix dccp_v4_err()/dccp_v6_err() again Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 725m configs tested: 35 configs skipped: 150 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 clang arm64 randconfig-003-20240309 clang arm64 randconfig-004-20240309 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240309 clang x86_64 buildonly-randconfig-002-20240309 gcc x86_64 buildonly-randconfig-003-20240309 clang x86_64 buildonly-randconfig-004-20240309 gcc x86_64 buildonly-randconfig-005-20240309 gcc x86_64 buildonly-randconfig-006-20240309 clang x86_64 defconfig gcc x86_64 randconfig-001-20240309 gcc x86_64 randconfig-002-20240309 clang x86_64 randconfig-003-20240309 clang x86_64 randconfig-004-20240309 gcc x86_64 randconfig-005-20240309 clang x86_64 randconfig-006-20240309 gcc x86_64 randconfig-011-20240309 clang x86_64 randconfig-012-20240309 clang x86_64 randconfig-013-20240309 clang x86_64 randconfig-014-20240309 gcc x86_64 randconfig-015-20240309 gcc x86_64 randconfig-016-20240309 gcc x86_64 randconfig-071-20240309 gcc x86_64 randconfig-072-20240309 gcc x86_64 randconfig-073-20240309 gcc x86_64 randconfig-074-20240309 gcc x86_64 randconfig-075-20240309 gcc x86_64 randconfig-076-20240309 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION d34411e46747fbc3ea6a9f6d8a299c46fd6334b0
by kernel test robot 10 Mar '24

10 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: d34411e46747fbc3ea6a9f6d8a299c46fd6334b0 !5059 dm: limit the number of targets and parameter size area Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-001-20240309 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- x86_64-buildonly-randconfig-004-20240309 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-buildonly-randconfig-005-20240309 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-002-20240309 | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-003-20240309 | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-is-invalid-in-C99-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-is-invalid-in-C99-Werror-Wimplicit-function-declaration |-- arm64-randconfig-004-20240309 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-allyesconfig |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true elapsed time: 721m configs tested: 40 configs skipped: 128 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 clang arm64 randconfig-003-20240309 clang arm64 randconfig-004-20240309 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240309 gcc loongarch randconfig-002-20240309 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240309 clang x86_64 buildonly-randconfig-002-20240309 gcc x86_64 buildonly-randconfig-003-20240309 clang x86_64 buildonly-randconfig-004-20240309 gcc x86_64 buildonly-randconfig-005-20240309 gcc x86_64 buildonly-randconfig-006-20240309 clang x86_64 defconfig gcc x86_64 randconfig-001-20240309 gcc x86_64 randconfig-002-20240309 clang x86_64 randconfig-003-20240309 clang x86_64 randconfig-004-20240309 gcc x86_64 randconfig-005-20240309 clang x86_64 randconfig-006-20240309 gcc x86_64 randconfig-011-20240309 clang x86_64 randconfig-012-20240309 clang x86_64 randconfig-013-20240309 clang x86_64 randconfig-014-20240309 gcc x86_64 randconfig-015-20240309 gcc x86_64 randconfig-016-20240309 gcc x86_64 randconfig-071-20240309 gcc x86_64 randconfig-072-20240309 gcc x86_64 randconfig-073-20240309 gcc x86_64 randconfig-074-20240309 gcc x86_64 randconfig-075-20240309 gcc x86_64 randconfig-076-20240309 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 38 ++++++++++++++++++++++++++++++++++++++ include/net/dst.h | 5 ++--- net/bridge/br_forward.c | 4 ++-- net/bridge/br_input.c | 4 ++-- net/core/dev.c | 14 +++----------- 5 files changed, 47 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP2 0/6] CVE-2024-26586
by Liu Jian 09 Mar '24

09 Mar '24

CVE-2024-26586 sync from PR4690 Amit Cohen (1): mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure Christophe JAILLET (1): mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable Ido Schimmel (4): mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() mlxsw: spectrum_acl_tcam: Make fini symmetric to init mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations mlxsw: spectrum_acl_tcam: Fix stack corruption .../mellanox/mlxsw/spectrum_acl_atcam.c | 8 +- .../mellanox/mlxsw/spectrum_acl_erp.c | 8 +- .../mellanox/mlxsw/spectrum_acl_tcam.c | 131 +++++++++--------- .../ethernet/mellanox/mlxsw/spectrum_cnt.c | 9 +- .../mellanox/mlxsw/spectrum_switchdev.c | 11 +- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 106 +++++++++++++- 6 files changed, 187 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH openEuler-22.03-LTS-SP2] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 92a7628560cc..a6697954fd68 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1768,6 +1768,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 4409f56fc37e..488893962708 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -733,7 +736,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1172,7 +1179,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1193,7 +1201,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1372,7 +1380,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1389,7 +1398,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1509,13 +1518,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1545,7 +1556,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1563,7 +1575,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 196285b0fe46..cb50b1c91aa6 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1765,6 +1765,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index b137006f0fd2..d209f989bb70 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -728,7 +731,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -882,7 +886,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -981,6 +985,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1171,7 +1178,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1192,7 +1200,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1373,7 +1381,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1390,7 +1399,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1512,13 +1521,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1548,7 +1559,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1566,7 +1578,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 196285b0fe46..cb50b1c91aa6 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1765,6 +1765,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 503a0056b60f..e1e21bbb07eb 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -732,7 +735,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -886,7 +890,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -985,6 +989,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1175,7 +1182,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1196,7 +1204,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1377,7 +1385,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1394,7 +1403,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1516,13 +1525,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1552,7 +1563,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1570,7 +1582,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 92a7628560cc..a6697954fd68 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1768,6 +1768,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 4409f56fc37e..488893962708 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -733,7 +736,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1172,7 +1179,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1193,7 +1201,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1372,7 +1380,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1389,7 +1398,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1509,13 +1518,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1545,7 +1556,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1563,7 +1575,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c fs/cifs/connect.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 3 ++- fs/cifs/transport.c | 30 ++++++++++++++++++++---------- 3 files changed, 23 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 71c2dd0c7f03..f9abe37c549c 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1597,6 +1597,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 4ca6fd66df03..684dbd580a27 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1079,7 +1079,8 @@ cifs_demultiplex_thread(void *p) if (mids[i] != NULL) { mids[i]->resp_buf_size = server->pdu_size; if ((mids[i]->mid_flags & MID_WAIT_CANCELLED) && - mids[i]->mid_state == MID_RESPONSE_RECEIVED && + (mids[i]->mid_state == MID_RESPONSE_RECEIVED || + mids[i]->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid( mids[i]->resp_buf, diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index eb76f7a59e50..fa83799b3ec0 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -46,6 +46,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -561,7 +563,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -699,7 +702,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -790,6 +793,8 @@ cifs_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst) static void cifs_noop_callback(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } int @@ -912,7 +917,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, midQ[i]->mid); send_cancel(ses->server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->mid_flags |= MID_WAIT_CANCELLED; midQ[i]->callback = DeleteMidQEntry; cancelled_mid[i] = true; @@ -938,7 +944,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1118,7 +1124,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1135,7 +1142,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1254,13 +1261,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(ses->server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((ses->server->tcpStatus != CifsGood) && (ses->server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((ses->server->tcpStatus == CifsGood) || (ses->server->tcpStatus == CifsNew))) { @@ -1290,7 +1299,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1308,7 +1318,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] EDAC/thunderx: Fix possible out-of-bounds string access
by Lu Jialin 09 Mar '24

09 Mar '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v4.19.306 commit 71c17ee02538802ceafc830f0736aa35b564e601 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW CVE: CVE-2023-52464 -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 34be60fe6892..0fffb393415b 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] EDAC/thunderx: Fix possible out-of-bounds string access
by Lu Jialin 09 Mar '24

09 Mar '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v4.19.306 commit 1c17ee02538802ceafc830f0736aa35b564e601 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW CVE: CVE-2023-52464 -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 34be60fe6892..0fffb393415b 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
by Yongqiang Liu 09 Mar '24

09 Mar '24

From: Pin-yen Lin <treapking(a)chromium.org> stable inclusion from stable-v5.10.198 commit 10a18c8bac7f60d32b7af22da03b66f350beee38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXH CVE: CVE-2023-52525 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aef7a0300047e7b4707ea0411dc9597cba108fc8 ] Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc1042 headers. Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Pin-yen Lin <treapking(a)chromium.org> Acked-by: Brian Norris <briannorris(a)chromium.org> Reviewed-by: Matthew Wang <matthewmwang(a)chromium.org> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/wireless/marvell/mwifiex/sta_rx.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c index 3c555946cb2c..5b16e330014a 100644 --- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c @@ -98,7 +98,8 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length); rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off; - if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) { + if (sizeof(rx_pkt_hdr->eth803_hdr) + sizeof(rfc1042_header) + + rx_pkt_off > skb->len) { mwifiex_dbg(priv->adapter, ERROR, "wrong rx packet offset: len=%d, rx_pkt_off=%d\n", skb->len, rx_pkt_off); @@ -107,12 +108,13 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, return -1; } - if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, - sizeof(bridge_tunnel_header))) || - (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, - sizeof(rfc1042_header)) && - ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP && - ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX)) { + if (sizeof(*rx_pkt_hdr) + rx_pkt_off <= skb->len && + ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, + sizeof(bridge_tunnel_header))) || + (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, + sizeof(rfc1042_header)) && + ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP && + ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX))) { /* * Replace the 803 header and rfc1042 header (llc/snap) with an * EthernetII header, keep the src/dst and snap_type -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 13425/21785] drivers/net/ethernet/huawei/hinic/hinic_main.c:249:23: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'?
by kernel test robot 09 Mar '24

09 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3d10c870b322e5d1a4f8fb923b879a0b73246157 commit: 90f09a01314abe26de1a722d1b51c351d84e1f5b [13425/21785] net/hinic: Add support for X86 Arch config: x86_64-randconfig-015-20240308 (https://download.01.org/0day-ci/archive/20240309/202403091438.ZbJbSAui-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240309/202403091438.ZbJbSAui-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403091438.ZbJbSAui-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/huawei/hinic/hinic_main.c: In function 'hinic_netdev_event': >> drivers/net/ethernet/huawei/hinic/hinic_main.c:249:23: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'? [-Werror=implicit-function-declaration] 249 | ret = vlan_dev_priv(ndev)->real_dev; | ^~~~~~~~~~~~~ | netdev_priv >> drivers/net/ethernet/huawei/hinic/hinic_main.c:249:42: error: invalid type argument of '->' (have 'int') 249 | ret = vlan_dev_priv(ndev)->real_dev; | ^~ drivers/net/ethernet/huawei/hinic/hinic_main.c:251:49: error: invalid type argument of '->' (have 'int') 251 | ret = vlan_dev_priv(ret)->real_dev; | ^~ drivers/net/ethernet/huawei/hinic/hinic_main.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_main.c:3294:6: warning: no previous prototype for 'nic_event' [-Wmissing-prototypes] 3294 | void nic_event(struct hinic_lld_dev *lld_dev, void *adapter, | ^~~~~~~~~ cc1: some warnings being treated as errors vim +249 drivers/net/ethernet/huawei/hinic/hinic_main.c edd384f682cc29 Aviad Krawczyk 2017-08-21 221 6cb2e756917d12 Xue 2019-01-31 222 #define HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT 2 6cb2e756917d12 Xue 2019-01-31 223 #define HINIC_VLAN_CLEAR_OFFLOAD (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \ 6cb2e756917d12 Xue 2019-01-31 224 NETIF_F_SCTP_CRC | NETIF_F_RXCSUM | \ 6cb2e756917d12 Xue 2019-01-31 225 NETIF_F_ALL_TSO) edd384f682cc29 Aviad Krawczyk 2017-08-21 226 6cb2e756917d12 Xue 2019-01-31 227 int hinic_netdev_event(struct notifier_block *notifier, 6cb2e756917d12 Xue 2019-01-31 228 unsigned long event, void *ptr) edd384f682cc29 Aviad Krawczyk 2017-08-21 229 { 6cb2e756917d12 Xue 2019-01-31 230 struct net_device *ndev = netdev_notifier_info_to_dev(ptr); 6cb2e756917d12 Xue 2019-01-31 231 struct net_device *real_dev, *ret; 6cb2e756917d12 Xue 2019-01-31 232 struct hinic_nic_dev *nic_dev; 6cb2e756917d12 Xue 2019-01-31 233 u16 vlan_depth; 6cb2e756917d12 Xue 2019-01-31 234 6cb2e756917d12 Xue 2019-01-31 235 if (!is_vlan_dev(ndev)) 6cb2e756917d12 Xue 2019-01-31 236 return NOTIFY_DONE; 6cb2e756917d12 Xue 2019-01-31 237 6cb2e756917d12 Xue 2019-01-31 238 dev_hold(ndev); 6cb2e756917d12 Xue 2019-01-31 239 6cb2e756917d12 Xue 2019-01-31 240 switch (event) { 6cb2e756917d12 Xue 2019-01-31 241 case NETDEV_REGISTER: 6cb2e756917d12 Xue 2019-01-31 242 real_dev = vlan_dev_real_dev(ndev); 6cb2e756917d12 Xue 2019-01-31 243 nic_dev = hinic_get_uld_dev_by_ifname(real_dev->name, 6cb2e756917d12 Xue 2019-01-31 244 SERVICE_T_NIC); 6cb2e756917d12 Xue 2019-01-31 245 if (!nic_dev) 6cb2e756917d12 Xue 2019-01-31 246 goto out; 6cb2e756917d12 Xue 2019-01-31 247 6cb2e756917d12 Xue 2019-01-31 248 vlan_depth = 1; 6cb2e756917d12 Xue 2019-01-31 @249 ret = vlan_dev_priv(ndev)->real_dev; 6cb2e756917d12 Xue 2019-01-31 250 while (is_vlan_dev(ret)) { 6cb2e756917d12 Xue 2019-01-31 251 ret = vlan_dev_priv(ret)->real_dev; 6cb2e756917d12 Xue 2019-01-31 252 vlan_depth++; 6cb2e756917d12 Xue 2019-01-31 253 } 6cb2e756917d12 Xue 2019-01-31 254 6cb2e756917d12 Xue 2019-01-31 255 if (vlan_depth == HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT) { 6cb2e756917d12 Xue 2019-01-31 256 ndev->vlan_features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 6cb2e756917d12 Xue 2019-01-31 257 } else if (vlan_depth > HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT) { 6cb2e756917d12 Xue 2019-01-31 258 #ifdef HAVE_NDO_SET_FEATURES 6cb2e756917d12 Xue 2019-01-31 259 #ifdef HAVE_RHEL6_NET_DEVICE_OPS_EXT 6cb2e756917d12 Xue 2019-01-31 260 set_netdev_hw_features(ndev, 6cb2e756917d12 Xue 2019-01-31 261 get_netdev_hw_features(ndev) & 6cb2e756917d12 Xue 2019-01-31 262 (~HINIC_VLAN_CLEAR_OFFLOAD)); 6cb2e756917d12 Xue 2019-01-31 263 #else 6cb2e756917d12 Xue 2019-01-31 264 ndev->hw_features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 6cb2e756917d12 Xue 2019-01-31 265 #endif 6cb2e756917d12 Xue 2019-01-31 266 #endif 6cb2e756917d12 Xue 2019-01-31 267 ndev->features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 6cb2e756917d12 Xue 2019-01-31 268 } edd384f682cc29 Aviad Krawczyk 2017-08-21 269 6cb2e756917d12 Xue 2019-01-31 270 break; edd384f682cc29 Aviad Krawczyk 2017-08-21 271 6cb2e756917d12 Xue 2019-01-31 272 default: 6cb2e756917d12 Xue 2019-01-31 273 break; 6cb2e756917d12 Xue 2019-01-31 274 }; edd384f682cc29 Aviad Krawczyk 2017-08-21 275 6cb2e756917d12 Xue 2019-01-31 276 out: 6cb2e756917d12 Xue 2019-01-31 277 dev_put(ndev); edd384f682cc29 Aviad Krawczyk 2017-08-21 278 6cb2e756917d12 Xue 2019-01-31 279 return NOTIFY_DONE; edd384f682cc29 Aviad Krawczyk 2017-08-21 280 } 6cb2e756917d12 Xue 2019-01-31 281 #endif edd384f682cc29 Aviad Krawczyk 2017-08-21 282 :::::: The code at line 249 was first introduced by commit :::::: 6cb2e756917d122560e0c52f350682760d004eec net: hinic: Add NIC Layer :::::: TO: Xue <xuechaojing(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
by Li Huafei 09 Mar '24

09 Mar '24

From: Hans de Goede <hdegoede(a)redhat.com> stable inclusion from stable-v4.19.297 commit 44481b244fcaa2b895a53081d6204c574720c38c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P85 CVE: CVE-2023-52478 --------------------------- commit dac501397b9d81e4782232c39f94f4307b137452 upstream. hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races when it races with itself. hidpp_connect_event() primarily runs from a workqueue but it also runs on probe() and if a "device-connected" packet is received by the hw when the thread running hidpp_connect_event() from probe() is waiting on the hw, then a second thread running hidpp_connect_event() will be started from the workqueue. This opens the following races (note the below code is simplified): 1. Retrieving + printing the protocol (harmless race): if (!hidpp->protocol_major) { hidpp_root_get_protocol_version() hidpp->protocol_major = response.rap.params[0]; } We can actually see this race hit in the dmesg in the abrt output attached to rhbz#2227968: [ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. [ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. Testing with extra logging added has shown that after this the 2 threads take turn grabbing the hw access mutex (send_mutex) so they ping-pong through all the other TOCTOU cases managing to hit all of them: 2. Updating the name to the HIDPP name (harmless race): if (hidpp->name == hdev->name) { ... hidpp->name = new_name; } 3. Initializing the power_supply class for the battery (problematic!): hidpp_initialize_battery() { if (hidpp->battery.ps) return 0; probe_battery(); /* Blocks, threads take turns executing this */ hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); } 4. Creating delayed input_device (potentially problematic): if (hidpp->delayed_input) return; hidpp->delayed_input = hidpp_allocate_input(hdev); The really big problem here is 3. Hitting the race leads to the following sequence: hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); ... hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); So now we have registered 2 power supplies for the same battery, which looks a bit weird from userspace's pov but this is not even the really big problem. Notice how: 1. This is all devm-maganaged 2. The hidpp->battery.desc struct is shared between the 2 power supplies 3. hidpp->battery.desc.properties points to the result from the second devm_kmemdup() This causes a use after free scenario on USB disconnect of the receiver: 1. The last registered power supply class device gets unregistered 2. The memory from the last devm_kmemdup() call gets freed, hidpp->battery.desc.properties now points to freed memory 3. The first registered power supply class device gets unregistered, this involves sending a remove uevent to userspace which invokes power_supply_uevent() to fill the uevent data 4. power_supply_uevent() uses hidpp->battery.desc.properties which now points to freed memory leading to backtraces like this one: Sep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08 ... Sep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event Sep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0 ... Sep 22 20:01:35 eric kernel: ? asm_exc_page_fault+0x26/0x30 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0xee/0x1d0 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0x10d/0x1d0 Sep 22 20:01:35 eric kernel: dev_uevent+0x10f/0x2d0 Sep 22 20:01:35 eric kernel: kobject_uevent_env+0x291/0x680 Sep 22 20:01:35 eric kernel: power_supply_unregister+0x8e/0xa0 Sep 22 20:01:35 eric kernel: release_nodes+0x3d/0xb0 Sep 22 20:01:35 eric kernel: devres_release_group+0xfc/0x130 Sep 22 20:01:35 eric kernel: hid_device_remove+0x56/0xa0 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440 Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60 Sep 22 20:01:35 eric kernel: logi_dj_remove+0x9a/0x100 [hid_logitech_dj 5c91534a0ead2b65e04dd799a0437e3b99b21bc4] Sep 22 20:01:35 eric kernel: hid_device_remove+0x44/0xa0 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440 Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60 Sep 22 20:01:35 eric kernel: usbhid_disconnect+0x47/0x60 [usbhid 727dcc1c0b94e6b4418727a468398ac3bca492f3] Sep 22 20:01:35 eric kernel: usb_unbind_interface+0x90/0x270 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? kobject_put+0xa0/0x1d0 Sep 22 20:01:35 eric kernel: usb_disable_device+0xcd/0x1e0 Sep 22 20:01:35 eric kernel: usb_disconnect+0xde/0x2c0 Sep 22 20:01:35 eric kernel: usb_disconnect+0xc3/0x2c0 Sep 22 20:01:35 eric kernel: hub_event+0xe80/0x1c10 There have been quite a few bug reports (see Link tags) about this crash. Fix all the TOCTOU issues, including the really bad power-supply related system crash on USB disconnect, by making probe() use the workqueue for running hidpp_connect_event() too, so that it can never run more then once. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227221 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2242189 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217412#c58 Cc: stable(a)vger.kernel.org Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20231005182638.3776-1-hdegoede@redhat.com Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/hid/hid-logitech-hidpp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c index 504e8917b06f..eda8833b8c7f 100644 --- a/drivers/hid/hid-logitech-hidpp.c +++ b/drivers/hid/hid-logitech-hidpp.c @@ -3080,7 +3080,8 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) /* Allow incoming packets */ hid_device_io_start(hdev); - hidpp_connect_event(hidpp); + schedule_work(&hidpp->work); + flush_work(&hidpp->work); return ret; -- 2.25.1

2 1

[PATCH OLK-5.10] wifi: mac80211: fix potential key use-after-free
by Dong Chenchen 09 Mar '24

09 Mar '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v5.12-rc6 commit 31db78a4923ef5e2008f2eed321811ca79e7f71b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ASP CVE: CVE-2023-52530 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will still return a pointer into the key, in a potential use-after-free. This normally doesn't happen since it's only called by iwlwifi in case of WoWLAN rekey offload which has its own KRACK protection, but still better to fix, do that by returning an error code and converting that to success on the cfg80211 boundary only, leaving the error for bad callers of ieee80211_gtk_rekey_add(). Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Fixes: fdf7cb4185b6 ("mac80211: accept key reinstall without changing anything") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/cfg.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/mac80211/cfg.c | 3 +++ net/mac80211/key.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index c6a7f1c99abc..70126518ad16 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -509,6 +509,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, sta->cipher_scheme = cs; err = ieee80211_key_link(key, sdata, sta); + /* KRACK protection, shouldn't happen but just silently accept key */ + if (err == -EALREADY) + err = 0; out_unlock: mutex_unlock(&local->sta_mtx); diff --git a/net/mac80211/key.c b/net/mac80211/key.c index 6a72c33679ba..6b089594a9f3 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c @@ -843,7 +843,7 @@ int ieee80211_key_link(struct ieee80211_key *key, */ if (ieee80211_key_identical(sdata, old_key, key)) { ieee80211_key_free_unused(key); - ret = 0; + ret = -EALREADY; goto out; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] wifi: mac80211: fix potential key use-after-free
by Dong Chenchen 09 Mar '24

09 Mar '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v5.12-rc6 commit 31db78a4923ef5e2008f2eed321811ca79e7f71b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ASP CVE: CVE-2023-52530 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will still return a pointer into the key, in a potential use-after-free. This normally doesn't happen since it's only called by iwlwifi in case of WoWLAN rekey offload which has its own KRACK protection, but still better to fix, do that by returning an error code and converting that to success on the cfg80211 boundary only, leaving the error for bad callers of ieee80211_gtk_rekey_add(). Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Fixes: fdf7cb4185b6 ("mac80211: accept key reinstall without changing anything") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/cfg.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/mac80211/cfg.c | 3 +++ net/mac80211/key.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index e46944500cfa..2201923238ed 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -457,6 +457,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, sta->cipher_scheme = cs; err = ieee80211_key_link(key, sdata, sta); + /* KRACK protection, shouldn't happen but just silently accept key */ + if (err == -EALREADY) + err = 0; out_unlock: mutex_unlock(&local->sta_mtx); diff --git a/net/mac80211/key.c b/net/mac80211/key.c index 6775d6cb7d3d..017a9d2b5cec 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c @@ -681,7 +681,7 @@ int ieee80211_key_link(struct ieee80211_key *key, */ if (ieee80211_key_identical(sdata, old_key, key)) { ieee80211_key_free_unused(key); - ret = 0; + ret = -EALREADY; goto out; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v1 0/6] Fix CVE-2023-52514
by Wei Li 09 Mar '24

09 Mar '24

This series is meant to fix CVE-2023-52514, with 5 LTS patches which are depended on but not backported before. Sean Christopherson (6): x86/reboot: Force all cpus to exit VMX root if VMX is supported x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/reboot: Disable virtualization in an emergency if SVM is supported x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/reboot: VMCLEAR active VMCSes before emergency reboot arch/x86/include/asm/kexec.h | 2 - arch/x86/include/asm/reboot.h | 4 ++ arch/x86/include/asm/virtext.h | 16 ++++- arch/x86/kernel/crash.c | 47 +------------ arch/x86/kernel/reboot.c | 121 ++++++++++++++++++++++++--------- arch/x86/kernel/smp.c | 6 +- arch/x86/kvm/vmx.c | 12 +--- 7 files changed, 112 insertions(+), 96 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS] drm: bridge/panel: Cleanup connector on bridge detach
by Guo Mengqi 09 Mar '24

09 Mar '24

From: Paul Cercueil <paul(a)crapouillou.net> stable inclusion from stable-v5.10.37 commit ce450934a00cf896e648fde08d0bd1426653d7a2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOL CVE: CVE-2021-47063 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 upstream. If we don't call drm_connector_cleanup() manually in panel_bridge_detach(), the connector will be cleaned up with the other DRM objects in the call to drm_mode_config_cleanup(). However, since our drm_connector is devm-allocated, by the time drm_mode_config_cleanup() will be called, our connector will be long gone. Therefore, the connector must be cleaned up when the bridge is detached to avoid use-after-free conditions. v2: Cleanup connector only if it was created v3: Add FIXME v4: (Use connector->dev) directly in if() block Fixes: 13dfc0540a57 ("drm/bridge: Refactor out the panel wrapper from the lvds-encoder bridge.") Cc: <stable(a)vger.kernel.org> # 4.12+ Cc: Andrzej Hajda <a.hajda(a)samsung.com> Cc: Neil Armstrong <narmstrong(a)baylibre.com> Cc: Laurent Pinchart <Laurent.pinchart(a)ideasonboard.com> Cc: Jonas Karlman <jonas(a)kwiboo.se> Cc: Jernej Skrabec <jernej.skrabec(a)siol.net> Signed-off-by: Paul Cercueil <paul(a)crapouillou.net> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210327115742.18986-2-paul@c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: drivers/gpu/drm/bridge/panel.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/bridge/panel.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c index 7cbaba213ef6..dbeaf1257668 100644 --- a/drivers/gpu/drm/bridge/panel.c +++ b/drivers/gpu/drm/bridge/panel.c @@ -92,6 +92,17 @@ static int panel_bridge_attach(struct drm_bridge *bridge) static void panel_bridge_detach(struct drm_bridge *bridge) { struct panel_bridge *panel_bridge = drm_bridge_to_panel_bridge(bridge); + struct drm_connector *connector = &panel_bridge->connector; + + /* + * Cleanup the connector if we know it was initialized. + * + * FIXME: This wouldn't be needed if the panel_bridge structure was + * allocated with drmm_kzalloc(). This might be tricky since the + * drm_device pointer can only be retrieved when the bridge is attached. + */ + if (connector->dev) + drm_connector_cleanup(connector); drm_panel_detach(panel_bridge->panel); } -- 2.17.1

2 1

[PATCH OLK-5.10 0/3] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() include/linux/netdevice.h | 58 +++++++++++++++++++++++---------------- include/net/dst.h | 5 ++-- net/bridge/br_forward.c | 4 +-- net/bridge/br_input.c | 4 +-- net/core/dev.c | 14 ++-------- 5 files changed, 44 insertions(+), 41 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS] uio_hv_generic: Fix a memory leak in error handling paths
by Guo Mengqi 09 Mar '24

09 Mar '24

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> stable inclusion from stable-v5.10.40 commit d84b5e912212b05f6b5bde9f682046accfbe0354 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956GH CVE: CVE-2021-47071 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3ee098f96b8b6c1a98f7f97915f8873164e6af9d upstream. If 'vmbus_establish_gpadl()' fails, the (recv|send)_gpadl will not be updated and 'hv_uio_cleanup()' in the error handling path will not be able to free the corresponding buffer. In such a case, we need to free the buffer explicitly. Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Link: https://lore.kernel.org/r/4fdaff557deef6f0475d02ba7922ddbaa1ab08a6.16205440… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio_hv_generic.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c index 170fa1f8f00e..b58e7c582d3f 100644 --- a/drivers/uio/uio_hv_generic.c +++ b/drivers/uio/uio_hv_generic.c @@ -250,8 +250,10 @@ hv_uio_probe(struct hv_device *dev, ret = vmbus_establish_gpadl(dev->channel, pdata->recv_buf, RECV_BUFFER_SIZE, &pdata->recv_gpadl); - if (ret) + if (ret) { + vfree(pdata->recv_buf); goto fail_close; + } /* put Global Physical Address Label in name */ snprintf(pdata->recv_name, sizeof(pdata->recv_name), @@ -271,8 +273,10 @@ hv_uio_probe(struct hv_device *dev, ret = vmbus_establish_gpadl(dev->channel, pdata->send_buf, SEND_BUFFER_SIZE, &pdata->send_gpadl); - if (ret) + if (ret) { + vfree(pdata->send_buf); goto fail_close; + } snprintf(pdata->send_name, sizeof(pdata->send_name), "send:%u", pdata->send_gpadl); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 0/3] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

Fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() include/linux/netdevice.h | 58 +++++++++++++++++++++++---------------- include/net/dst.h | 5 ++-- net/bridge/br_forward.c | 4 +-- net/bridge/br_input.c | 4 +-- net/core/dev.c | 14 ++-------- 5 files changed, 44 insertions(+), 41 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] RDMA/rxe: Return CQE error if invalid lkey was supplied
by Liu Jian 09 Mar '24

09 Mar '24

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v5.13-rc3 commit dc07628bd2bbc1da768e265192c28ebd301f509d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956FT CVE: CVE-2021-47076 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- RXE is missing update of WQE status in LOCAL_WRITE failures. This caused the following kernel panic if someone sent an atomic operation with an explicitly wrong lkey. [leonro@vm ~]$ mkt test test_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ... WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff RSP: 0018:ffff8880158af090 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652 RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210 RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8 R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c FS: 00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0xb11/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_responder+0x5532/0x7620 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0x9c8/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_requester+0x1efd/0x58c0 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_post_send+0x998/0x1860 [rdma_rxe] ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs] ib_uverbs_write+0x847/0xc80 [ib_uverbs] vfs_write+0x1c5/0x840 ksys_write+0x176/0x1d0 do_syscall_64+0x3f/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/11e7b553f3a6f5371c6bb3f57c494bb52b88af99.16207117… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Acked-by: Zhu Yanjun <zyjzyj2000(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/sw/rxe/rxe_comp.c --- drivers/infiniband/sw/rxe/rxe_comp.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c index 0a1e6393250b..aa73a54ea070 100644 --- a/drivers/infiniband/sw/rxe/rxe_comp.c +++ b/drivers/infiniband/sw/rxe/rxe_comp.c @@ -346,13 +346,15 @@ static inline enum comp_state do_read(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, payload_addr(pkt), payload_size(pkt), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; + } if (wqe->dma.resid == 0 && (pkt->mask & RXE_END_MASK)) return COMPST_COMP_ACK; - else - return COMPST_UPDATE_COMP; + + return COMPST_UPDATE_COMP; } static inline enum comp_state do_atomic(struct rxe_qp *qp, @@ -366,10 +368,12 @@ static inline enum comp_state do_atomic(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, &atomic_orig, sizeof(u64), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; - else - return COMPST_COMP_ACK; + } + + return COMPST_COMP_ACK; } static void make_send_cqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/rxe: Return CQE error if invalid lkey was supplied
by Liu Jian 09 Mar '24

09 Mar '24

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v5.13-rc3 commit dc07628bd2bbc1da768e265192c28ebd301f509d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956FT CVE: CVE-2021-47076 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- RXE is missing update of WQE status in LOCAL_WRITE failures. This caused the following kernel panic if someone sent an atomic operation with an explicitly wrong lkey. [leonro@vm ~]$ mkt test test_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ... WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff RSP: 0018:ffff8880158af090 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652 RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210 RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8 R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c FS: 00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0xb11/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_responder+0x5532/0x7620 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0x9c8/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_requester+0x1efd/0x58c0 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_post_send+0x998/0x1860 [rdma_rxe] ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs] ib_uverbs_write+0x847/0xc80 [ib_uverbs] vfs_write+0x1c5/0x840 ksys_write+0x176/0x1d0 do_syscall_64+0x3f/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/11e7b553f3a6f5371c6bb3f57c494bb52b88af99.16207117… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Acked-by: Zhu Yanjun <zyjzyj2000(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/sw/rxe/rxe_comp.c --- drivers/infiniband/sw/rxe/rxe_comp.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c index ea089cb091ad..5c2bc22bc9d6 100644 --- a/drivers/infiniband/sw/rxe/rxe_comp.c +++ b/drivers/infiniband/sw/rxe/rxe_comp.c @@ -373,13 +373,15 @@ static inline enum comp_state do_read(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, payload_addr(pkt), payload_size(pkt), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; + } if (wqe->dma.resid == 0 && (pkt->mask & RXE_END_MASK)) return COMPST_COMP_ACK; - else - return COMPST_UPDATE_COMP; + + return COMPST_UPDATE_COMP; } static inline enum comp_state do_atomic(struct rxe_qp *qp, @@ -393,10 +395,12 @@ static inline enum comp_state do_atomic(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, &atomic_orig, sizeof(u64), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; - else - return COMPST_COMP_ACK; + } + + return COMPST_COMP_ACK; } static void make_send_cqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v3 0/2] CVE-2021-47074
by Li Nan 09 Mar '24

09 Mar '24

v3: change bugzilla url. v2: add CVE tag to first patch. Chaitanya Kulkarni (1): nvme-loop: don't put ctrl on nvme_init_ctrl error Wu Bo (1): nvme-loop: fix memory leak in nvme_loop_create_ctrl() drivers/nvme/target/loop.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] x86/reboot: VMCLEAR active VMCSes before emergency reboot
by Wei Li 09 Mar '24

09 Mar '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v6.6-rc1 commit b23c83ad2c638420ec0608a9de354507c41bec29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2J CVE: CVE-2023-52514 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- VMCLEAR active VMCSes before any emergency reboot, not just if the kernel may kexec into a new kernel after a crash. Per Intel's SDM, the VMX architecture doesn't require the CPU to flush the VMCS cache on INIT. If an emergency reboot doesn't RESET CPUs, cached VMCSes could theoretically be kept and only be written back to memory after the new kernel is booted, i.e. could effectively corrupt memory after reboot. Opportunistically remove the setting of the global pointer to NULL to make checkpatch happy. Cc: Andrew Cooper <Andrew.Cooper3(a)citrix.com> Link: https://lore.kernel.org/r/20230721201859.2307736-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Wei Li <liwei391(a)huawei.com> --- arch/x86/include/asm/kexec.h | 2 -- arch/x86/include/asm/reboot.h | 2 ++ arch/x86/kernel/crash.c | 31 ------------------------------- arch/x86/kernel/reboot.c | 22 ++++++++++++++++++++++ arch/x86/kvm/vmx/vmx.c | 9 ++------- 5 files changed, 26 insertions(+), 40 deletions(-) diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h index 3533ede83b42..5f5b83bdaa3e 100644 --- a/arch/x86/include/asm/kexec.h +++ b/arch/x86/include/asm/kexec.h @@ -209,8 +209,6 @@ extern void arch_kexec_pre_free_pages(void *vaddr, unsigned int pages); #endif -typedef void crash_vmclear_fn(void); -extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; extern void kdump_nmi_shootdown_cpus(void); #ifdef CONFIG_KEXEC_CORE diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h index bc5b4d788c08..2551baec927d 100644 --- a/arch/x86/include/asm/reboot.h +++ b/arch/x86/include/asm/reboot.h @@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type); #define MRR_BIOS 0 #define MRR_APM 1 +typedef void crash_vmclear_fn(void); +extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; void cpu_emergency_disable_virtualization(void); typedef void (*nmi_shootdown_cb)(int, struct pt_regs*); diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c index bd4b566ec917..1247cdafe353 100644 --- a/arch/x86/kernel/crash.c +++ b/arch/x86/kernel/crash.c @@ -48,27 +48,6 @@ struct crash_memmap_data { unsigned int type; }; -/* - * This is used to VMCLEAR all VMCSs loaded on the - * processor. And when loading kvm_intel module, the - * callback function pointer will be assigned. - * - * protected by rcu. - */ -crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss = NULL; -EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss); - -static inline void cpu_crash_vmclear_loaded_vmcss(void) -{ - crash_vmclear_fn *do_vmclear_operation = NULL; - - rcu_read_lock(); - do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss); - if (do_vmclear_operation) - do_vmclear_operation(); - rcu_read_unlock(); -} - /* * When the crashkernel option is specified, only use the low * 1M for the real mode trampoline. @@ -88,11 +67,6 @@ static void kdump_nmi_callback(int cpu, struct pt_regs *regs) { crash_save_cpu(regs, cpu); - /* - * VMCLEAR VMCSs loaded on all cpus if needed. - */ - cpu_crash_vmclear_loaded_vmcss(); - /* * Disable Intel PT to stop its logging */ @@ -146,11 +120,6 @@ void native_machine_crash_shutdown(struct pt_regs *regs) crash_smp_send_stop(); - /* - * VMCLEAR VMCSs loaded on this cpu if needed. - */ - cpu_crash_vmclear_loaded_vmcss(); - cpu_emergency_disable_virtualization(); /* diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c index 52c77932c4d2..970296f4403b 100644 --- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c @@ -787,6 +787,26 @@ void machine_crash_shutdown(struct pt_regs *regs) } #endif +/* + * This is used to VMCLEAR all VMCSs loaded on the + * processor. And when loading kvm_intel module, the + * callback function pointer will be assigned. + * + * protected by rcu. + */ +crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; +EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss); + +static inline void cpu_crash_vmclear_loaded_vmcss(void) +{ + crash_vmclear_fn *do_vmclear_operation = NULL; + + rcu_read_lock(); + do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss); + if (do_vmclear_operation) + do_vmclear_operation(); + rcu_read_unlock(); +} /* This is the CPU performing the emergency shutdown work. */ int crashing_cpu = -1; @@ -798,6 +818,8 @@ int crashing_cpu = -1; */ void cpu_emergency_disable_virtualization(void) { + cpu_crash_vmclear_loaded_vmcss(); + cpu_emergency_vmxoff(); cpu_emergency_svm_disable(); } diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 74a717ca46e7..ff783fed0fd0 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -40,7 +40,7 @@ #include <asm/idtentry.h> #include <asm/io.h> #include <asm/irq_remapping.h> -#include <asm/kexec.h> +#include <asm/reboot.h> #include <asm/perf_event.h> #include <asm/mce.h> #include <asm/mmu_context.h> @@ -780,7 +780,6 @@ static int vmx_set_guest_uret_msr(struct vcpu_vmx *vmx, return ret; } -#ifdef CONFIG_KEXEC_CORE static void crash_vmclear_local_loaded_vmcss(void) { int cpu = raw_smp_processor_id(); @@ -790,7 +789,6 @@ static void crash_vmclear_local_loaded_vmcss(void) loaded_vmcss_on_cpu_link) vmcs_clear(v->vmcs); } -#endif /* CONFIG_KEXEC_CORE */ static void __loaded_vmcs_clear(void *arg) { @@ -8514,10 +8512,8 @@ static void vmx_cleanup_l1d_flush(void) static void vmx_exit(void) { -#ifdef CONFIG_KEXEC_CORE RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL); synchronize_rcu(); -#endif kvm_exit(); @@ -8612,10 +8608,9 @@ static int __init vmx_init(void) pi_init_cpu(cpu); } -#ifdef CONFIG_KEXEC_CORE rcu_assign_pointer(crash_vmclear_loaded_vmcss, crash_vmclear_local_loaded_vmcss); -#endif + vmx_check_vmcs12_offsets(); /* -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

Fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() include/linux/netdevice.h | 58 +++++++++++++++++++++++---------------- include/net/dst.h | 5 ++-- net/bridge/br_forward.c | 4 +-- net/bridge/br_input.c | 4 +-- net/core/dev.c | 14 ++-------- 5 files changed, 44 insertions(+), 41 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/rxe: Clear all QP fields if creation failed
by Liu Jian 09 Mar '24

09 Mar '24

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v4.19.192 commit f3783c415bf6d2ead3d7aa2c38802bbe10723646 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956GP CVE: CVE-2021-47078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 67f29896fdc83298eed5a6576ff8f9873f709228 ] rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly created ones, but in case rxe_qp_from_init() failed it was filled with garbage and caused tot the following error. refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Modules linked in: CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6 09 01 e8 ee 74 fb 04 <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55 RSP: 0018:ffffc900097ceba8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff815bb075 RDI: fffff520012f9d67 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815b4eae R11: 0000000000000000 R12: ffff8880322a4800 R13: ffff8880322a4940 R14: ffff888033044e00 R15: 0000000000000000 FS: 00007f6eb2be3700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdbe5d41000 CR3: 000000001d181000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] kref_put include/linux/kref.h:64 [inline] rxe_qp_do_cleanup+0x96f/0xaf0 drivers/infiniband/sw/rxe/rxe_qp.c:805 execute_in_process_context+0x37/0x150 kernel/workqueue.c:3327 rxe_elem_release+0x9f/0x180 drivers/infiniband/sw/rxe/rxe_pool.c:391 kref_put include/linux/kref.h:65 [inline] rxe_create_qp+0x2cd/0x310 drivers/infiniband/sw/rxe/rxe_verbs.c:425 _ib_create_qp drivers/infiniband/core/core_priv.h:331 [inline] ib_create_named_qp+0x2ad/0x1370 drivers/infiniband/core/verbs.c:1231 ib_create_qp include/rdma/ib_verbs.h:3644 [inline] create_mad_qp+0x177/0x2d0 drivers/infiniband/core/mad.c:2920 ib_mad_port_open drivers/infiniband/core/mad.c:3001 [inline] ib_mad_init_device+0xd6f/0x1400 drivers/infiniband/core/mad.c:3092 add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:717 enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1331 ib_register_device drivers/infiniband/core/device.c:1413 [inline] ib_register_device+0x7c7/0xa50 drivers/infiniband/core/device.c:1365 rxe_register_device+0x3d5/0x4a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1147 rxe_add+0x12fe/0x16d0 drivers/infiniband/sw/rxe/rxe.c:247 rxe_net_add+0x8c/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:503 rxe_newlink drivers/infiniband/sw/rxe/rxe.c:269 [inline] rxe_newlink+0xb7/0xe0 drivers/infiniband/sw/rxe/rxe.c:250 nldev_newlink+0x30e/0x550 drivers/infiniband/core/nldev.c:1555 rdma_nl_rcv_msg+0x36d/0x690 drivers/infiniband/core/netlink.c:195 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x2ee/0x430 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/7bf8d548764d406dbbbaf4b574960ebfd5af8387.16207179… Reported-by: syzbot+36a7f280de4e11c6f04e(a)syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Reviewed-by: Zhu Yanjun <zyjzyj2000(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_qp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c index c58452daffc7..4c0caca6da50 100644 --- a/drivers/infiniband/sw/rxe/rxe_qp.c +++ b/drivers/infiniband/sw/rxe/rxe_qp.c @@ -249,6 +249,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, if (err) { kvfree(qp->sq.queue->buf); kfree(qp->sq.queue); + qp->sq.queue = NULL; return err; } @@ -302,6 +303,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, if (err) { kvfree(qp->rq.queue->buf); kfree(qp->rq.queue); + qp->rq.queue = NULL; return err; } } @@ -362,6 +364,11 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd, err2: rxe_queue_cleanup(qp->sq.queue); err1: + qp->pd = NULL; + qp->rcq = NULL; + qp->scq = NULL; + qp->srq = NULL; + if (srq) rxe_drop_ref(srq); rxe_drop_ref(scq); -- 2.34.1

2 1

[PATCH OLK-5.10] net: rds: Fix possible NULL-pointer dereference
by Zhengchao Shao 09 Mar '24

09 Mar '24

From: Artem Chernyshev <artem.chernyshev(a)red-soft.ru> stable inclusion from stable-v5.10.198 commit f515112e833791001aaa8ab886af3ca78503617f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATK CVE: CVE-2023-52573 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f1d95df0f31048f1c59092648997686e3f7d9478 ] In rds_rdma_cm_event_handler_cmn() check, if conn pointer exists before dereferencing it as rdma_set_service_type() argument Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: fd261ce6a30e ("rds: rdma: update rdma transport for tos") Signed-off-by: Artem Chernyshev <artem.chernyshev(a)red-soft.ru> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/rds/rdma_transport.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c index 5f741e51b4ba..bb38124a5d3d 100644 --- a/net/rds/rdma_transport.c +++ b/net/rds/rdma_transport.c @@ -86,10 +86,12 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id, break; case RDMA_CM_EVENT_ADDR_RESOLVED: - rdma_set_service_type(cm_id, conn->c_tos); - /* XXX do we need to clean up if this fails? */ - ret = rdma_resolve_route(cm_id, + if (conn) { + rdma_set_service_type(cm_id, conn->c_tos); + /* XXX do we need to clean up if this fails? */ + ret = rdma_resolve_route(cm_id, RDS_RDMA_RESOLVE_TIMEOUT_MS); + } break; case RDMA_CM_EVENT_ROUTE_RESOLVED: -- 2.34.1

2 1

[PATCH OLK-5.10] dccp: fix dccp_v4_err()/dccp_v6_err() again
by Ziyang Xuan 09 Mar '24

09 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.198 commit 60d73c62e3e4464f375758b6f2459c13d46465b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT6 CVE: CVE-2023-52577 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6af289746a636f71f4c0535a9801774118486c7a ] dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed. We need to make sure the ICMP messages are big enough, using more standard ways (no more assumptions). syzbot reported: BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline] BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867 icmpv6_rcv+0x19d5/0x30d0 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:304 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x83b/0x920 tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Fixes: 977ad86c2a1b ("dccp: Fix out of bounds access in DCCP error handler") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Jann Horn <jannh(a)google.com> Reviewed-by: Jann Horn <jannh(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/dccp/ipv4.c | 9 ++------- net/dccp/ipv6.c | 9 ++------- 2 files changed, 4 insertions(+), 14 deletions(-) diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c index 398dc3e47d0c8..f2a0a4e6dd748 100644 --- a/net/dccp/ipv4.c +++ b/net/dccp/ipv4.c @@ -243,13 +243,8 @@ static int dccp_v4_err(struct sk_buff *skb, u32 info) int err; struct net *net = dev_net(skb->dev); - /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, - * which is in byte 7 of the dccp header. - * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us. - * - * Later on, we want to access the sequence number fields, which are - * beyond 8 bytes, so we have to pskb_may_pull() ourselves. - */ + if (!pskb_may_pull(skb, offset + sizeof(*dh))) + return -EINVAL; dh = (struct dccp_hdr *)(skb->data + offset); if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) return -EINVAL; diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c index bfe11e96af7c9..6d6bbd43a1419 100644 --- a/net/dccp/ipv6.c +++ b/net/dccp/ipv6.c @@ -76,13 +76,8 @@ static int dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, __u64 seq; struct net *net = dev_net(skb->dev); - /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, - * which is in byte 7 of the dccp header. - * Our caller (icmpv6_notify()) already pulled 8 bytes for us. - * - * Later on, we want to access the sequence number fields, which are - * beyond 8 bytes, so we have to pskb_may_pull() ourselves. - */ + if (!pskb_may_pull(skb, offset + sizeof(*dh))) + return -EINVAL; dh = (struct dccp_hdr *)(skb->data + offset); if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) return -EINVAL; -- 2.25.1

2 1

[PATCH OLK-5.10] team: fix null-ptr-deref when team device type is changed
by Ziyang Xuan 09 Mar '24

09 Mar '24

stable inclusion from stable-v5.10.198 commit b44dd92e2afd89eb6e9d27616858e72a67bdc1a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATZ CVE: CVE-2023-52574 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 492032760127251e5540a5716a70996bacf2a3fd ] Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlan_dev_hard_header+0x35/0x140 [8021q] ... Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x150 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? vlan_dev_hard_header+0x35/0x140 [8021q] ? vlan_dev_hard_header+0x8e/0x140 [8021q] neigh_connected_output+0xb2/0x100 ip6_finish_output2+0x1cb/0x520 ? nf_hook_slow+0x43/0xc0 ? ip6_mtu+0x46/0x80 ip6_finish_output+0x2a/0xb0 mld_sendpack+0x18f/0x250 mld_ifc_work+0x39/0x160 process_one_work+0x1e6/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 [1] $ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}' $ ip link add name t-dummy type dummy $ ip link add link t-dummy name t-dummy.100 type vlan id 100 $ ip link add name t-nlmon type nlmon $ ip link set t-nlmon master team0 $ ip link set t-nlmon nomaster $ ip link set t-dummy up $ ip link set team0 up $ ip link set t-dummy.100 down $ ip link set t-dummy.100 master team0 When enslave a vlan device to team device and team device type is changed from non-ether to ether, header_ops of team device is changed to vlan_header_ops. That is incorrect and will trigger null-ptr-deref for vlan->real_dev in vlan_dev_hard_header() because team device is not a vlan device. Cache eth_header_ops in team_setup(), then assign cached header_ops to header_ops of team net device when its type is changed from non-ether to ether to fix the bug. Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Suggested-by: Hangbin Liu <liuhangbin(a)gmail.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20230918123011.1884401-1-william.xuanziyang@huawe… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/net/team/team.c | 10 +++++++++- include/linux/if_team.h | 2 ++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index 721b536ce8861..97a77dabed64c 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -2122,7 +2122,12 @@ static const struct ethtool_ops team_ethtool_ops = { static void team_setup_by_port(struct net_device *dev, struct net_device *port_dev) { - dev->header_ops = port_dev->header_ops; + struct team *team = netdev_priv(dev); + + if (port_dev->type == ARPHRD_ETHER) + dev->header_ops = team->header_ops_cache; + else + dev->header_ops = port_dev->header_ops; dev->type = port_dev->type; dev->hard_header_len = port_dev->hard_header_len; dev->needed_headroom = port_dev->needed_headroom; @@ -2169,8 +2174,11 @@ static int team_dev_type_check_change(struct net_device *dev, static void team_setup(struct net_device *dev) { + struct team *team = netdev_priv(dev); + ether_setup(dev); dev->max_mtu = ETH_MAX_MTU; + team->header_ops_cache = dev->header_ops; dev->netdev_ops = &team_netdev_ops; dev->ethtool_ops = &team_ethtool_ops; diff --git a/include/linux/if_team.h b/include/linux/if_team.h index 5dd1657947b75..762c77d13e7dd 100644 --- a/include/linux/if_team.h +++ b/include/linux/if_team.h @@ -189,6 +189,8 @@ struct team { struct net_device *dev; /* associated netdevice */ struct team_pcpu_stats __percpu *pcpu_stats; + const struct header_ops *header_ops_cache; + struct mutex lock; /* used for overall locking, e.g. port lists write */ /* -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS eac3c6a044aaf481751d9f7fb4b6096ae431e167
by kernel test robot 09 Mar '24

09 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: eac3c6a044aaf481751d9f7fb4b6096ae431e167 !5046 usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. Warning reports: https://lore.kernel.org/oe-kbuild-all/202403090244.2pF6BywY-lkp@intel.com Unverified Warning (likely false positive, please contact us if interested): drivers/tty/n_gsm.c:2067:2-8: preceding lock on line 2044 Warning ids grouped by kconfigs: clang_recent_errors |-- x86_64-randconfig-103-20240308 | `-- drivers-tty-n_gsm.c:preceding-lock-on-line `-- x86_64-randconfig-r131-20240304 |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-flags-got-int-flags `-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-initializer-(different-base-types)-expected-int-flags-got-restricted-gfp_t elapsed time: 881m configs tested: 11 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 gcc arm64 randconfig-003-20240309 gcc arm64 randconfig-004-20240309 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15642/21783] kernel/sched/topology.c:1624:32: sparse: sparse: incorrect type in initializer (different base types)
by kernel test robot 09 Mar '24

09 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: eac3c6a044aaf481751d9f7fb4b6096ae431e167 commit: b3cf6ed8fbc01dda9fe93f5d4c1877a68d344678 [15642/21783] sched/topology: Provide cfs_overload_cpus bitmap config: x86_64-randconfig-r131-20240304 (https://download.01.org/0day-ci/archive/20240309/202403090244.2pF6BywY-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240309/202403090244.2pF6BywY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403090244.2pF6BywY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/topology.c:11:15: sparse: sparse: symbol 'sched_domains_tmpmask' was not declared. Should it be static? kernel/sched/topology.c:12:15: sparse: sparse: symbol 'sched_domains_tmpmask2' was not declared. Should it be static? >> kernel/sched/topology.c:1624:32: sparse: sparse: incorrect type in initializer (different base types) @@ expected int flags @@ got restricted gfp_t @@ kernel/sched/topology.c:1624:32: sparse: expected int flags kernel/sched/topology.c:1624:32: sparse: got restricted gfp_t >> kernel/sched/topology.c:1632:61: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted gfp_t [usertype] flags @@ got int flags @@ kernel/sched/topology.c:1632:61: sparse: expected restricted gfp_t [usertype] flags kernel/sched/topology.c:1632:61: sparse: got int flags kernel/sched/topology.c:428:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:428:9: sparse: struct sparsemask [noderef] __rcu * kernel/sched/topology.c:428:9: sparse: struct sparsemask * kernel/sched/topology.c:429:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:429:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:429:9: sparse: struct sched_domain * kernel/sched/topology.c:432:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:432:9: sparse: struct sched_domain_shared [noderef] __rcu * kernel/sched/topology.c:432:9: sparse: struct sched_domain_shared * kernel/sched/topology.c:435:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:435:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:435:9: sparse: struct sched_domain * kernel/sched/topology.c:438:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:438:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:438:9: sparse: struct sched_domain * kernel/sched/topology.c:485:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:485:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:485:9: sparse: struct sched_domain * kernel/sched/topology.c: note: in included file: kernel/sched/sched.h:1206:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:1206:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/sched.h:1206:9: sparse: struct sched_domain * kernel/sched/sched.h:1219:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:1219:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/sched.h:1219:9: sparse: struct sched_domain * kernel/sched/sched.h:1206:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:1206:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/sched.h:1206:9: sparse: struct sched_domain * In file included from kernel/sched/topology.c:5: In file included from kernel/sched/sched.h:39: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/topology.c:5: kernel/sched/sched.h:1169:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1169 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. vim +1624 kernel/sched/topology.c 1618 1619 static int sd_llc_alloc(struct sched_domain *sd) 1620 { 1621 struct sched_domain_shared *sds = sd->shared; 1622 struct cpumask *span = sched_domain_span(sd); 1623 int nid = cpu_to_node(cpumask_first(span)); > 1624 int flags = __GFP_ZERO | GFP_KERNEL; 1625 struct sparsemask *mask; 1626 1627 /* 1628 * Allocate the bitmap if not already allocated. This is called for 1629 * every CPU in the LLC but only allocates once per sd_llc_shared. 1630 */ 1631 if (!sds->cfs_overload_cpus) { > 1632 mask = sparsemask_alloc_node(nr_cpu_ids, 3, flags, nid); 1633 if (!mask) 1634 return 1; 1635 sds->cfs_overload_cpus = mask; 1636 } 1637 1638 return 0; 1639 } 1640 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION bba41c2321f7449ec0a8140042c2ba34a0bef88d
by kernel test robot 09 Mar '24

09 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: bba41c2321f7449ec0a8140042c2ba34a0bef88d !5021 LoongArch: fix some known issue and update defconfig Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-004-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-r111-20240227 | `-- kernel-sched-fair.c:sparse:sparse:symbol-qos_smt_expell_switch-was-not-declared.-Should-it-be-static |-- loongarch-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-defconfig | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-randconfig-002-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-003-20240308 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-buildonly-randconfig-005-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-006-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-randconfig-001-20240308 `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-001-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-002-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-003-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-buildonly-randconfig-001-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-004-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-randconfig-002-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 723m configs tested: 24 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240308 clang arm64 randconfig-002-20240308 clang arm64 randconfig-003-20240308 clang arm64 randconfig-004-20240308 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240308 gcc loongarch randconfig-002-20240308 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240308 clang x86_64 buildonly-randconfig-002-20240308 gcc x86_64 buildonly-randconfig-003-20240308 gcc x86_64 buildonly-randconfig-004-20240308 clang x86_64 buildonly-randconfig-005-20240308 gcc x86_64 buildonly-randconfig-006-20240308 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240308 gcc x86_64 randconfig-002-20240308 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: fix possible store tearing in neigh_periodic_work()
by Zhengchao Shao 08 Mar '24

08 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.6-rc5 commit 25563b581ba3a1f263a00e8c9a97f5e7363be6fd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK CVE: CVE-2023-52522 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/core/neighbour.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/neighbour.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 778be5866d0a..3f1520755282 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -855,7 +855,9 @@ static void neigh_periodic_work(struct work_struct *work) if (refcount_read(&n->refcnt) == 1 && (state == NUD_FAILED || time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { - *np = n->next; + rcu_assign_pointer(*np, + rcu_dereference_protected(n->next, + lockdep_is_held(&tbl->lock))); n->dead = 1; write_unlock(&n->lock); neigh_cleanup_and_release(n); -- 2.34.1

2 1

[PATCH OLK-6.6] dm: limit the number of targets and parameter size area
by Li Lingfeng 08 Mar '24

08 Mar '24

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-v6.8-rc3 commit bd504bcfec41a503b32054da5472904b404341a4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YCAG CVE: CVE-2024-23851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kvmalloc function fails with a warning if the size is larger than INT_MAX. The warning was triggered by a syscall testing robot. In order to avoid the warning, this commit limits the number of targets to 1048576 and the size of the parameter area to 1073741824. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-core.h | 2 ++ drivers/md/dm-ioctl.c | 3 ++- drivers/md/dm-table.c | 9 +++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h index 095b9b49aa82..e6757a30dcca 100644 --- a/drivers/md/dm-core.h +++ b/drivers/md/dm-core.h @@ -22,6 +22,8 @@ #include "dm-ima.h" #define DM_RESERVED_MAX_IOS 1024 +#define DM_MAX_TARGETS 1048576 +#define DM_MAX_TARGET_PARAMS 1024 struct dm_io; diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 5efe0193b2e8..3bda85ad73ec 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1952,7 +1952,8 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern minimum_data_size - sizeof(param_kernel->version))) return -EFAULT; - if (param_kernel->data_size < minimum_data_size) { + if (unlikely(param_kernel->data_size < minimum_data_size) || + unlikely(param_kernel->data_size > DM_MAX_TARGETS * DM_MAX_TARGET_PARAMS)) { DMERR("Invalid data size in the ioctl structure: %u", param_kernel->data_size); return -EINVAL; diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c index 37b48f63ae6a..fd84e06670e8 100644 --- a/drivers/md/dm-table.c +++ b/drivers/md/dm-table.c @@ -129,7 +129,12 @@ static int alloc_targets(struct dm_table *t, unsigned int num) int dm_table_create(struct dm_table **result, blk_mode_t mode, unsigned int num_targets, struct mapped_device *md) { - struct dm_table *t = kzalloc(sizeof(*t), GFP_KERNEL); + struct dm_table *t; + + if (num_targets > DM_MAX_TARGETS) + return -EOVERFLOW; + + t = kzalloc(sizeof(*t), GFP_KERNEL); if (!t) return -ENOMEM; @@ -144,7 +149,7 @@ int dm_table_create(struct dm_table **result, blk_mode_t mode, if (!num_targets) { kfree(t); - return -ENOMEM; + return -EOVERFLOW; } if (alloc_targets(t, num_targets)) { -- 2.31.1

2 1

[PATCH OLK-5.10] net: fix possible store tearing in neigh_periodic_work()
by Zhengchao Shao 08 Mar '24

08 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.198 commit 2ea52a2fb8e87067e26bbab4efb8872639240eb0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK CVE: CVE-2023-52522 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 25563b581ba3a1f263a00e8c9a97f5e7363be6fd ] While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/neighbour.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 3b642c412cf3..15267428c4f8 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -935,7 +935,9 @@ static void neigh_periodic_work(struct work_struct *work) (state == NUD_FAILED || !time_in_range_open(jiffies, n->used, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { - *np = n->next; + rcu_assign_pointer(*np, + rcu_dereference_protected(n->next, + lockdep_is_held(&tbl->lock))); neigh_mark_dead(n); write_unlock(&n->lock); neigh_cleanup_and_release(n); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: fix possible store tearing in neigh_periodic_work()
by Zhengchao Shao 08 Mar '24

08 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.6-rc5 commit 25563b581ba3a1f263a00e8c9a97f5e7363be6fd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK CVE: CVE-2023-52522 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/neighbour.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 778be5866d0a..3f1520755282 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -855,7 +855,9 @@ static void neigh_periodic_work(struct work_struct *work) if (refcount_read(&n->refcnt) == 1 && (state == NUD_FAILED || time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { - *np = n->next; + rcu_assign_pointer(*np, + rcu_dereference_protected(n->next, + lockdep_is_held(&tbl->lock))); n->dead = 1; write_unlock(&n->lock); neigh_cleanup_and_release(n); -- 2.34.1

2 1