- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 20812/22089] include/linux/compiler.h:271:34: warning: array subscript <unknown> is outside array bounds of 'const u32[0]' {aka 'const unsigned int[]'}
by kernel test robot 14 Apr '24

14 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ab9b23cd7b3e05b3fc38df24e070593493e1d8e2 commit: f26f5f07f639bba2e12d72fb1cac16f5d1d18efc [20812/22089] rfs: annotate lockless accesses to RFS sock flow table config: x86_64-randconfig-102-20240413 (https://download.01.org/0day-ci/archive/20240414/202404141254.h8C8BQzT-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404141254.h8C8BQzT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404141254.h8C8BQzT-lkp@intel.com/ All warnings (new ones prefixed by >>): net/core/dev.c:2287:49: warning: array subscript i is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2287 | new_map->queues[i] = map->queues[i]; | ~~~~~~~~~~~^~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c:2287:32: warning: array subscript i is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2287 | new_map->queues[i] = map->queues[i]; | ~~~~~~~~~~~~~~~^~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ In file included from net/core/dev.c:137: In function 'cpu_rmap_lookup_index', inlined from 'set_rps_cpu' at net/core/dev.c:3989:15: include/linux/cpu_rmap.h:47:26: warning: array subscript <unknown> is outside array bounds of 'struct <anonymous>[0]' [-Warray-bounds=] 47 | return rmap->near[cpu].index; | ~~~~~~~~~~^~~~~ include/linux/cpu_rmap.h: In function 'set_rps_cpu': include/linux/cpu_rmap.h:34:25: note: while referencing 'near' 34 | } near[0]; | ^~~~ net/core/dev.c:4003:25: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4003 | rflow = &flow_table->flows[flow_id]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4003:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4003 | rflow = &flow_table->flows[flow_id]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ In file included from arch/x86/include/asm/current.h:5, from include/linux/sched.h:12, from include/linux/uaccess.h:5, from net/core/dev.c:75: net/core/dev.c: In function '__get_xps_queue_idx': include/linux/compiler.h:271:34: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=] 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^~~~ include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE' 277 | #define READ_ONCE(x) __READ_ONCE(x, 1) | ^~~~~~~~~~~ include/linux/rcupdate.h:347:55: note: in expansion of macro 'READ_ONCE' 347 | typeof(*p) *________p1 = (typeof(*p) *__force)READ_ONCE(p); \ | ^~~~~~~~~ include/linux/rcupdate.h:502:9: note: in expansion of macro '__rcu_dereference_check' 502 | __rcu_dereference_check((p), (c) || rcu_read_lock_held(), __rcu) | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/rcupdate.h:560:28: note: in expansion of macro 'rcu_dereference_check' 560 | #define rcu_dereference(p) rcu_dereference_check(p, 0) | ^~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:3618:15: note: in expansion of macro 'rcu_dereference' 3618 | map = rcu_dereference(dev_maps->attr_map[tci]); | ^~~~~~~~~~~~~~~ include/linux/netdevice.h:781:31: note: while referencing 'attr_map' 781 | struct xps_map __rcu *attr_map[0]; /* Either CPUs map or RXQs map */ | ^~~~~~~~ net/core/dev.c:3623:50: warning: array subscript <unknown> is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 3623 | queue_index = map->queues[reciprocal_scale( | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~ 3624 | skb_get_hash(skb), map->len)]; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c:3621:50: warning: array subscript 0 is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 3621 | queue_index = map->queues[0]; | ~~~~~~~~~~~^~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c: In function 'rps_may_expire_flow': net/core/dev.c:4144:25: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4144 | rflow = &flow_table->flows[flow_id]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4144:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4144 | rflow = &flow_table->flows[flow_id]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4144:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4144 | rflow = &flow_table->flows[flow_id]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4144:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4144 | rflow = &flow_table->flows[flow_id]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c: In function 'get_rps_cpu': >> include/linux/compiler.h:271:34: warning: array subscript <unknown> is outside array bounds of 'const u32[0]' {aka 'const unsigned int[]'} [-Warray-bounds=] 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^~~~ include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE' 277 | #define READ_ONCE(x) __READ_ONCE(x, 1) | ^~~~~~~~~~~ net/core/dev.c:4067:25: note: in expansion of macro 'READ_ONCE' 4067 | ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]); | ^~~~~~~~~ include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ net/core/dev.c:4067:56: warning: array subscript <unknown> is outside array bounds of 'const u32[0]' {aka 'const unsigned int[]'} [-Warray-bounds=] 4067 | ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]); include/linux/compiler.h:271:36: note: in definition of macro '__READ_ONCE' 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^ net/core/dev.c:4067:25: note: in expansion of macro 'READ_ONCE' 4067 | ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]); | ^~~~~~~~~ include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ net/core/dev.c:4076:25: warning: array subscript <unknown> is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4076 | rflow = &flow_table->flows[hash & flow_table->mask]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4076:43: warning: array subscript <unknown> is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4076 | rflow = &flow_table->flows[hash & flow_table->mask]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4076:43: warning: array subscript <unknown> is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4076 | rflow = &flow_table->flows[hash & flow_table->mask]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4108:33: warning: array subscript <unknown> is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 4108 | tcpu = map->cpus[reciprocal_scale(hash, map->len)]; | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:658:13: note: while referencing 'cpus' 658 | u16 cpus[0]; | ^~~~ In file included from include/linux/rculist.h:11, from include/linux/pid.h:5, from include/linux/sched.h:14: net/core/dev.c: In function 'remove_xps_queue': include/linux/rcupdate.h:356:10: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=] 356 | ((typeof(*p) __force __kernel *)(p)); \ | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/rcupdate.h:551:9: note: in expansion of macro '__rcu_dereference_protected' 551 | __rcu_dereference_protected((p), (c), __rcu) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:2123:9: note: in expansion of macro 'rcu_dereference_protected' 2123 | rcu_dereference_protected((P), lockdep_is_held(&xps_map_mutex)) | ^~~~~~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:2132:23: note: in expansion of macro 'xmap_dereference' 2132 | map = xmap_dereference(dev_maps->attr_map[tci]); | ^~~~~~~~~~~~~~~~ include/linux/netdevice.h:781:31: note: while referencing 'attr_map' 781 | struct xps_map __rcu *attr_map[0]; /* Either CPUs map or RXQs map */ | ^~~~~~~~ net/core/dev.c:2137:32: warning: array subscript pos is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2137 | if (map->queues[pos] != index) | ~~~~~~~~~~~^~~~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c:2141:55: warning: array subscript <unknown> is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2141 | map->queues[pos] = map->queues[--map->len]; | ~~~~~~~~~~~^~~~~~~~~~~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c:2141:36: warning: array subscript pos is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2141 | map->queues[pos] = map->queues[--map->len]; | ~~~~~~~~~~~^~~~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c: In function '__netif_set_xps_queue': include/linux/rcupdate.h:356:10: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=] 356 | ((typeof(*p) __force __kernel *)(p)); \ | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/rcupdate.h:551:9: note: in expansion of macro '__rcu_dereference_protected' 551 | __rcu_dereference_protected((p), (c), __rcu) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:2123:9: note: in expansion of macro 'rcu_dereference_protected' 2123 | rcu_dereference_protected((P), lockdep_is_held(&xps_map_mutex)) | ^~~~~~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:2430:35: note: in expansion of macro 'xmap_dereference' 2430 | new_map = xmap_dereference(new_dev_maps->attr_map[tci]); | ^~~~~~~~~~~~~~~~ include/linux/netdevice.h:781:31: note: while referencing 'attr_map' 781 | struct xps_map __rcu *attr_map[0]; /* Either CPUs map or RXQs map */ | ^~~~~~~~ include/linux/rcupdate.h:356:10: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=] -- In file included from arch/x86/include/asm/atomic.h:5, from include/linux/atomic.h:7, from include/linux/crypto.h:20, from include/crypto/hash.h:16, from net/ipv4/tcp.c:250: In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_splice_read' at net/ipv4/tcp.c:803:2: >> include/linux/compiler.h:271:34: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^~~~ include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE' 277 | #define READ_ONCE(x) __READ_ONCE(x, 1) | ^~~~~~~~~~~ include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE' 720 | if (READ_ONCE(table->ents[index]) != val) | ^~~~~~~~~ In file included from include/net/inet_sock.h:23, from include/net/ip.h:31, from include/linux/errqueue.h:6, from net/ipv4/tcp.c:272: include/linux/netdevice.h: In function 'tcp_splice_read': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_splice_read' at net/ipv4/tcp.c:803:2: include/linux/netdevice.h:720:42: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 720 | if (READ_ONCE(table->ents[index]) != val) include/linux/compiler.h:271:36: note: in definition of macro '__READ_ONCE' 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE' 720 | if (READ_ONCE(table->ents[index]) != val) | ^~~~~~~~~ include/linux/netdevice.h: In function 'tcp_splice_read': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_splice_read' at net/ipv4/tcp.c:803:2: include/linux/netdevice.h:721:47: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 721 | WRITE_ONCE(table->ents[index], val); include/linux/compiler.h:296:29: note: in definition of macro 'WRITE_ONCE' 296 | __write_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/netdevice.h: In function 'tcp_splice_read': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_zerocopy_receive' at net/ipv4/tcp.c:1791:2: >> include/linux/compiler.h:271:34: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^~~~ include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE' 277 | #define READ_ONCE(x) __READ_ONCE(x, 1) | ^~~~~~~~~~~ include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE' 720 | if (READ_ONCE(table->ents[index]) != val) | ^~~~~~~~~ include/linux/netdevice.h: In function 'tcp_zerocopy_receive': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_zerocopy_receive' at net/ipv4/tcp.c:1791:2: include/linux/netdevice.h:720:42: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 720 | if (READ_ONCE(table->ents[index]) != val) include/linux/compiler.h:271:36: note: in definition of macro '__READ_ONCE' 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE' 720 | if (READ_ONCE(table->ents[index]) != val) | ^~~~~~~~~ include/linux/netdevice.h: In function 'tcp_zerocopy_receive': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_zerocopy_receive' at net/ipv4/tcp.c:1791:2: include/linux/netdevice.h:721:47: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 721 | WRITE_ONCE(table->ents[index], val); include/linux/compiler.h:296:29: note: in definition of macro 'WRITE_ONCE' 296 | __write_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/netdevice.h: In function 'tcp_zerocopy_receive': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ .. vim +271 include/linux/compiler.h 230fa253df6352 Christian Borntraeger 2014-11-25 266 d976441f44bc5d Andrey Ryabinin 2015-10-19 267 #define __READ_ONCE(x, check) \ d976441f44bc5d Andrey Ryabinin 2015-10-19 268 ({ \ d976441f44bc5d Andrey Ryabinin 2015-10-19 269 union { typeof(x) __val; char __c[1]; } __u; \ d976441f44bc5d Andrey Ryabinin 2015-10-19 270 if (check) \ d976441f44bc5d Andrey Ryabinin 2015-10-19 @271 __read_once_size(&(x), __u.__c, sizeof(x)); \ d976441f44bc5d Andrey Ryabinin 2015-10-19 272 else \ d976441f44bc5d Andrey Ryabinin 2015-10-19 273 __read_once_size_nocheck(&(x), __u.__c, sizeof(x)); \ 76ebbe78f7390a Will Deacon 2017-10-24 274 smp_read_barrier_depends(); /* Enforce dependency ordering from x */ \ d976441f44bc5d Andrey Ryabinin 2015-10-19 275 __u.__val; \ d976441f44bc5d Andrey Ryabinin 2015-10-19 276 }) d976441f44bc5d Andrey Ryabinin 2015-10-19 277 #define READ_ONCE(x) __READ_ONCE(x, 1) d976441f44bc5d Andrey Ryabinin 2015-10-19 278 :::::: The code at line 271 was first introduced by commit :::::: d976441f44bc5d48635d081d277aa76556ffbf8b compiler, atomics, kasan: Provide READ_ONCE_NOCHECK() :::::: TO: Andrey Ryabinin <aryabinin(a)virtuozzo.com> :::::: CC: Ingo Molnar <mingo(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
by Zhengchao Shao 14 Apr '24

14 Apr '24

From: Ryosuke Yasuoka <ryasuoka(a)redhat.com> stable inclusion from stable-v4.19.309 commit ec343a55b687a452f5e87f3b52bf9f155864df65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E46W CVE: CVE-2024-26805 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd ] syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data size is specified as `len` and passed to skb_put_data(). This `len` is based on `skb->end` that is not data offset but buffer offset. The `skb->end` contains data and tailroom. Since the tailroom is not initialized when the new `skb` created, KMSAN detects uninitialized memory area when copying the data. This patch resolved this issue by correct the len from `skb->end` to `skb->len`, which is the actual data offset. BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg net/socket.c:1066 [inline] sock_read_iter+0x467/0x580 net/socket.c:1136 call_read_iter include/linux/fs.h:2014 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x8f6/0xe00 fs/read_write.c:470 ksys_read+0x20f/0x4c0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x93/0xd0 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was stored to memory at: skb_put_data include/linux/skbuff.h:2622 [inline] netlink_to_full_skb net/netlink/af_netlink.c:181 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline] __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 [inline] netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: free_pages_prepare mm/page_alloc.c:1087 [inline] free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347 free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533 release_pages+0x23d3/0x2410 mm/swap.c:1042 free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316 tlb_batch_pages_flush mm/mmu_gather.c:98 [inline] tlb_flush_mmu_free mm/mmu_gather.c:293 [inline] tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300 tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392 exit_mmap+0x49e/0xd30 mm/mmap.c:3321 __mmput+0x13f/0x530 kernel/fork.c:1349 mmput+0x8a/0xa0 kernel/fork.c:1371 exit_mm+0x1b8/0x360 kernel/exit.c:567 do_exit+0xd57/0x4080 kernel/exit.c:858 do_group_exit+0x2fd/0x390 kernel/exit.c:1021 __do_sys_exit_group kernel/exit.c:1032 [inline] __se_sys_exit_group kernel/exit.c:1030 [inline] __x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Bytes 3852-3903 of 3904 are uninitialized Memory access of size 3904 starts at ffff88812ea1e000 Data copied to user address 0000000020003280 CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps") Reported-and-tested-by: syzbot+34ad5fab48f7bf510349(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=34ad5fab48f7bf510349 [1] Signed-off-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240221074053.1794118-1-ryasuoka@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index fd0fa4c37a3b..766096493494 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -160,7 +160,7 @@ static inline u32 netlink_group_mask(u32 group) static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb, gfp_t gfp_mask) { - unsigned int len = skb_end_offset(skb); + unsigned int len = skb->len; struct sk_buff *new; new = alloc_skb(len, gfp_mask); -- 2.34.1

2 1

[PATCH OLK-5.10] netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
by Zhengchao Shao 14 Apr '24

14 Apr '24

From: Ryosuke Yasuoka <ryasuoka(a)redhat.com> stable inclusion from stable-v5.10.212 commit f19d1f98e60e68b11fc60839105dd02a30ec0d77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E46W CVE: CVE-2024-26805 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd ] syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data size is specified as `len` and passed to skb_put_data(). This `len` is based on `skb->end` that is not data offset but buffer offset. The `skb->end` contains data and tailroom. Since the tailroom is not initialized when the new `skb` created, KMSAN detects uninitialized memory area when copying the data. This patch resolved this issue by correct the len from `skb->end` to `skb->len`, which is the actual data offset. BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg net/socket.c:1066 [inline] sock_read_iter+0x467/0x580 net/socket.c:1136 call_read_iter include/linux/fs.h:2014 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x8f6/0xe00 fs/read_write.c:470 ksys_read+0x20f/0x4c0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x93/0xd0 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was stored to memory at: skb_put_data include/linux/skbuff.h:2622 [inline] netlink_to_full_skb net/netlink/af_netlink.c:181 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline] __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 [inline] netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: free_pages_prepare mm/page_alloc.c:1087 [inline] free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347 free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533 release_pages+0x23d3/0x2410 mm/swap.c:1042 free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316 tlb_batch_pages_flush mm/mmu_gather.c:98 [inline] tlb_flush_mmu_free mm/mmu_gather.c:293 [inline] tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300 tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392 exit_mmap+0x49e/0xd30 mm/mmap.c:3321 __mmput+0x13f/0x530 kernel/fork.c:1349 mmput+0x8a/0xa0 kernel/fork.c:1371 exit_mm+0x1b8/0x360 kernel/exit.c:567 do_exit+0xd57/0x4080 kernel/exit.c:858 do_group_exit+0x2fd/0x390 kernel/exit.c:1021 __do_sys_exit_group kernel/exit.c:1032 [inline] __se_sys_exit_group kernel/exit.c:1030 [inline] __x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Bytes 3852-3903 of 3904 are uninitialized Memory access of size 3904 starts at ffff88812ea1e000 Data copied to user address 0000000020003280 CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps") Reported-and-tested-by: syzbot+34ad5fab48f7bf510349(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=34ad5fab48f7bf510349 [1] Signed-off-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240221074053.1794118-1-ryasuoka@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index e3f34dccc97a..b1e2d3fa522e 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -157,7 +157,7 @@ static inline u32 netlink_group_mask(u32 group) static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb, gfp_t gfp_mask) { - unsigned int len = skb_end_offset(skb); + unsigned int len = skb->len; struct sk_buff *new; new = alloc_skb(len, gfp_mask); -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
by Zhengchao Shao 14 Apr '24

14 Apr '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.210 commit 9489e214ea8f2a90345516016aa51f2db3a8cc2f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E49K CVE: CVE-2024-26808 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01acb2e8666a6529697141a6017edbf206921913 upstream. Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER event is reported, otherwise a stale reference to netdevice remains in the hook list. Fixes: 60a3815da702 ("netfilter: add inet ingress support") Cc: stable(a)vger.kernel.org Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nft_chain_filter.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c index 7a9aa57b195b..a18582a4ecf3 100644 --- a/net/netfilter/nft_chain_filter.c +++ b/net/netfilter/nft_chain_filter.c @@ -358,9 +358,10 @@ static int nf_tables_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) { struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct nft_base_chain *basechain; struct nftables_pernet *nft_net; - struct nft_table *table; struct nft_chain *chain, *nr; + struct nft_table *table; struct nft_ctx ctx = { .net = dev_net(dev), }; @@ -372,7 +373,8 @@ static int nf_tables_netdev_event(struct notifier_block *this, nft_net = net_generic(ctx.net, nf_tables_net_id); mutex_lock(&nft_net->commit_mutex); list_for_each_entry(table, &nft_net->tables, list) { - if (table->family != NFPROTO_NETDEV) + if (table->family != NFPROTO_NETDEV && + table->family != NFPROTO_INET) continue; ctx.family = table->family; @@ -381,6 +383,11 @@ static int nf_tables_netdev_event(struct notifier_block *this, if (!nft_is_base_chain(chain)) continue; + basechain = nft_base_chain(chain); + if (table->family == NFPROTO_INET && + basechain->ops.hooknum != NF_INET_INGRESS) + continue; + ctx.chain = chain; nft_netdev_event(event, dev, &ctx); } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 2211/22089] mm/swapfile.c:970:81: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]'
by kernel test robot 14 Apr '24

14 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ab9b23cd7b3e05b3fc38df24e070593493e1d8e2 commit: 08c9196f65d268e1f8dccde138d4644c427bde76 [2211/22089] mm/swap: use nr_node_ids for avail_lists in swap_info_struct config: x86_64-randconfig-102-20240413 (https://download.01.org/0day-ci/archive/20240414/202404140751.A9FJ6Yan-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404140751.A9FJ6Yan-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404140751.A9FJ6Yan-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/swapfile.c: In function '__del_from_avail_list': mm/swapfile.c:615:17: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 615 | plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/swapfile.c:15: include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from arch/x86/include/asm/bug.h:83, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/mm.h:9, from mm/swapfile.c:8: mm/swapfile.c: In function 'add_to_avail_list': mm/swapfile.c:648:43: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 648 | WARN_ON(!plist_node_empty(&p->avail_lists[nid])); | ^~~~~~~~~~~~~~~~~~~~ include/asm-generic/bug.h:122:32: note: in definition of macro 'WARN_ON' 122 | int __ret_warn_on = !!(condition); \ | ^~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/linux/sched.h:19, from include/linux/ioprio.h:5, from include/linux/fs.h:39, from include/linux/huge_mm.h:8, from include/linux/mm.h:499: In function 'plist_node_empty', inlined from 'add_to_avail_list' at mm/swapfile.c:648:3: include/linux/plist.h:223:16: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 223 | return list_empty(&node->node_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'add_to_avail_list': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c: In function '_enable_swap_info': mm/swapfile.c:2460:47: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2460 | p->avail_lists[i].prio = -p->prio; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2458:47: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2458 | p->avail_lists[i].prio = 1; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2455:39: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2455 | p->avail_lists[i].prio = -p->prio; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c: In function 'alloc_swap_info': mm/swapfile.c:2860:17: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2860 | plist_node_init(&p->avail_lists[i], 0); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2860:48: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2860 | plist_node_init(&p->avail_lists[i], 0); | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'plist_node_init', inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3: include/linux/plist.h:137:9: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 137 | INIT_LIST_HEAD(&node->prio_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'alloc_swap_info': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'plist_node_init', inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3: include/linux/plist.h:138:9: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 138 | INIT_LIST_HEAD(&node->node_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'alloc_swap_info': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/asm-generic/bug.h:18: mm/swapfile.c: In function 'get_swap_pages': >> mm/swapfile.c:970:81: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { include/linux/kernel.h:996:33: note: in definition of macro 'container_of' 996 | void *__mptr = (void *)(ptr); \ | ^~~ include/linux/list.h:440:9: note: in expansion of macro 'list_entry' 440 | list_entry((pos)->member.next, typeof(*(pos)), member) | ^~~~~~~~~~ include/linux/list.h:582:21: note: in expansion of macro 'list_next_entry' 582 | n = list_next_entry(pos, member); \ | ^~~~~~~~~~~~~~~ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/linux/preempt.h:11, from include/linux/spinlock.h:51, from include/linux/mmzone.h:8, from include/linux/gfp.h:6, from include/linux/mm.h:10: >> include/linux/list.h:583:14: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 583 | &pos->member != (head); \ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:972:17: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 972 | plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:1016:38: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 1016 | if (plist_node_empty(&next->avail_lists[node])) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'plist_node_empty', inlined from 'get_swap_pages' at mm/swapfile.c:1016:7: >> include/linux/plist.h:223:16: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 223 | return list_empty(&node->node_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'get_swap_pages': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ >> mm/swapfile.c:970:81: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { include/linux/kernel.h:996:33: note: in definition of macro 'container_of' 996 | void *__mptr = (void *)(ptr); \ | ^~~ include/linux/list.h:440:9: note: in expansion of macro 'list_entry' 440 | list_entry((pos)->member.next, typeof(*(pos)), member) | ^~~~~~~~~~ include/linux/list.h:584:27: note: in expansion of macro 'list_next_entry' 584 | pos = n, n = list_next_entry(n, member)) | ^~~~~~~~~~~~~~~ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__do_sys_swapoff', inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:2576:52: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2576 | if (si->avail_lists[nid].prio != 1) | ~~~~~~~~~~~~~~~^~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__do_sys_swapoff', inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:2577:56: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2577 | si->avail_lists[nid].prio--; | ~~~~~~~~~~~~~~~^~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.o: warning: objtool: __swap_info_get()+0x97: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: _swap_info_get()+0xe4: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: __swap_duplicate()+0x92: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: unuse_vma()+0xfe: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: get_swap_pages()+0x55: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: setup_swap_map_and_extents()+0x641: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: read_swap_header()+0x196: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: __se_sys_swapon()+0x6cb: sibling call from callable instruction with modified stack frame vim +970 mm/swapfile.c ^1da177e4c3f41 Linus Torvalds 2005-04-16 942 5d5e8f19544a35 Huang Ying 2018-08-21 943 int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_size) ^1da177e4c3f41 Linus Torvalds 2005-04-16 944 { 5d5e8f19544a35 Huang Ying 2018-08-21 945 unsigned long size = swap_entry_size(entry_size); adfab836f4908d Dan Streetman 2014-06-04 946 struct swap_info_struct *si, *next; 36005bae205da3 Tim Chen 2017-02-22 947 long avail_pgs; 36005bae205da3 Tim Chen 2017-02-22 948 int n_ret = 0; a2468cc9bfdff6 Aaron Lu 2017-09-06 949 int node; ^1da177e4c3f41 Linus Torvalds 2005-04-16 950 38d8b4e6bdc872 Huang Ying 2017-07-06 951 /* Only single cluster request supported */ 5d5e8f19544a35 Huang Ying 2018-08-21 952 WARN_ON_ONCE(n_goal > 1 && size == SWAPFILE_CLUSTER); 38d8b4e6bdc872 Huang Ying 2017-07-06 953 5d5e8f19544a35 Huang Ying 2018-08-21 954 avail_pgs = atomic_long_read(&nr_swap_pages) / size; 36005bae205da3 Tim Chen 2017-02-22 955 if (avail_pgs <= 0) fb4f88dcabdc71 Hugh Dickins 2005-09-03 956 goto noswap; 36005bae205da3 Tim Chen 2017-02-22 957 36005bae205da3 Tim Chen 2017-02-22 958 if (n_goal > SWAP_BATCH) 36005bae205da3 Tim Chen 2017-02-22 959 n_goal = SWAP_BATCH; 36005bae205da3 Tim Chen 2017-02-22 960 36005bae205da3 Tim Chen 2017-02-22 961 if (n_goal > avail_pgs) 36005bae205da3 Tim Chen 2017-02-22 962 n_goal = avail_pgs; 36005bae205da3 Tim Chen 2017-02-22 963 5d5e8f19544a35 Huang Ying 2018-08-21 964 atomic_long_sub(n_goal * size, &nr_swap_pages); ^1da177e4c3f41 Linus Torvalds 2005-04-16 965 18ab4d4ced0817 Dan Streetman 2014-06-04 966 spin_lock(&swap_avail_lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 967 18ab4d4ced0817 Dan Streetman 2014-06-04 968 start_over: a2468cc9bfdff6 Aaron Lu 2017-09-06 969 node = numa_node_id(); a2468cc9bfdff6 Aaron Lu 2017-09-06 @970 plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { 18ab4d4ced0817 Dan Streetman 2014-06-04 971 /* requeue si to after same-priority siblings */ a2468cc9bfdff6 Aaron Lu 2017-09-06 972 plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]); 18ab4d4ced0817 Dan Streetman 2014-06-04 973 spin_unlock(&swap_avail_lock); ec8acf20afb853 Shaohua Li 2013-02-22 974 spin_lock(&si->lock); adfab836f4908d Dan Streetman 2014-06-04 975 if (!si->highest_bit || !(si->flags & SWP_WRITEOK)) { 18ab4d4ced0817 Dan Streetman 2014-06-04 976 spin_lock(&swap_avail_lock); a2468cc9bfdff6 Aaron Lu 2017-09-06 977 if (plist_node_empty(&si->avail_lists[node])) { ec8acf20afb853 Shaohua Li 2013-02-22 978 spin_unlock(&si->lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 979 goto nextsi; 18ab4d4ced0817 Dan Streetman 2014-06-04 980 } 18ab4d4ced0817 Dan Streetman 2014-06-04 981 WARN(!si->highest_bit, 18ab4d4ced0817 Dan Streetman 2014-06-04 982 "swap_info %d in list but !highest_bit\n", 18ab4d4ced0817 Dan Streetman 2014-06-04 983 si->type); 18ab4d4ced0817 Dan Streetman 2014-06-04 984 WARN(!(si->flags & SWP_WRITEOK), 18ab4d4ced0817 Dan Streetman 2014-06-04 985 "swap_info %d in list but !SWP_WRITEOK\n", 18ab4d4ced0817 Dan Streetman 2014-06-04 986 si->type); a2468cc9bfdff6 Aaron Lu 2017-09-06 987 __del_from_avail_list(si); 18ab4d4ced0817 Dan Streetman 2014-06-04 988 spin_unlock(&si->lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 989 goto nextsi; adfab836f4908d Dan Streetman 2014-06-04 990 } 5d5e8f19544a35 Huang Ying 2018-08-21 991 if (size == SWAPFILE_CLUSTER) { f0eea189e8e969 Huang Ying 2017-09-06 992 if (!(si->flags & SWP_FILE)) 38d8b4e6bdc872 Huang Ying 2017-07-06 993 n_ret = swap_alloc_cluster(si, swp_entries); f0eea189e8e969 Huang Ying 2017-09-06 994 } else 36005bae205da3 Tim Chen 2017-02-22 995 n_ret = scan_swap_map_slots(si, SWAP_HAS_CACHE, 36005bae205da3 Tim Chen 2017-02-22 996 n_goal, swp_entries); ec8acf20afb853 Shaohua Li 2013-02-22 997 spin_unlock(&si->lock); 5d5e8f19544a35 Huang Ying 2018-08-21 998 if (n_ret || size == SWAPFILE_CLUSTER) 36005bae205da3 Tim Chen 2017-02-22 999 goto check_out; 18ab4d4ced0817 Dan Streetman 2014-06-04 1000 pr_debug("scan_swap_map of si %d failed to find offset\n", 18ab4d4ced0817 Dan Streetman 2014-06-04 1001 si->type); 36005bae205da3 Tim Chen 2017-02-22 1002 18ab4d4ced0817 Dan Streetman 2014-06-04 1003 spin_lock(&swap_avail_lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 1004 nextsi: adfab836f4908d Dan Streetman 2014-06-04 1005 /* adfab836f4908d Dan Streetman 2014-06-04 1006 * if we got here, it's likely that si was almost full before, adfab836f4908d Dan Streetman 2014-06-04 1007 * and since scan_swap_map() can drop the si->lock, multiple adfab836f4908d Dan Streetman 2014-06-04 1008 * callers probably all tried to get a page from the same si 18ab4d4ced0817 Dan Streetman 2014-06-04 1009 * and it filled up before we could get one; or, the si filled 18ab4d4ced0817 Dan Streetman 2014-06-04 1010 * up between us dropping swap_avail_lock and taking si->lock. 18ab4d4ced0817 Dan Streetman 2014-06-04 1011 * Since we dropped the swap_avail_lock, the swap_avail_head 18ab4d4ced0817 Dan Streetman 2014-06-04 1012 * list may have been modified; so if next is still in the 36005bae205da3 Tim Chen 2017-02-22 1013 * swap_avail_head list then try it, otherwise start over 36005bae205da3 Tim Chen 2017-02-22 1014 * if we have not gotten any slots. adfab836f4908d Dan Streetman 2014-06-04 1015 */ a2468cc9bfdff6 Aaron Lu 2017-09-06 1016 if (plist_node_empty(&next->avail_lists[node])) 18ab4d4ced0817 Dan Streetman 2014-06-04 1017 goto start_over; ^1da177e4c3f41 Linus Torvalds 2005-04-16 1018 } fb4f88dcabdc71 Hugh Dickins 2005-09-03 1019 18ab4d4ced0817 Dan Streetman 2014-06-04 1020 spin_unlock(&swap_avail_lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 1021 36005bae205da3 Tim Chen 2017-02-22 1022 check_out: 36005bae205da3 Tim Chen 2017-02-22 1023 if (n_ret < n_goal) 5d5e8f19544a35 Huang Ying 2018-08-21 1024 atomic_long_add((long)(n_goal - n_ret) * size, 38d8b4e6bdc872 Huang Ying 2017-07-06 1025 &nr_swap_pages); fb4f88dcabdc71 Hugh Dickins 2005-09-03 1026 noswap: 36005bae205da3 Tim Chen 2017-02-22 1027 return n_ret; 36005bae205da3 Tim Chen 2017-02-22 1028 } 36005bae205da3 Tim Chen 2017-02-22 1029 :::::: The code at line 970 was first introduced by commit :::::: a2468cc9bfdff6139f59ca896671e5819ff5f94a swap: choose swap device according to numa node :::::: TO: Aaron Lu <aaron.lu(a)intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 6341/30000] drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:51:28: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 14 Apr '24

14 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6 commit: a5b9149cc6ef0e581c7289b01bf2bf3c2ad98248 [6341/30000] Huawei BMA: Adding Huawei BMA driver: host_kbox_drv config: x86_64-randconfig-122-20240413 (https://download.01.org/0day-ci/archive/20240414/202404140648.3413VbmQ-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404140648.3413VbmQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404140648.3413VbmQ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:51:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:42:6: sparse: sparse: symbol 'kbox_write_to_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:120:27: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:111:6: sparse: sparse: symbol 'kbox_read_from_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:179:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:172:6: sparse: sparse: symbol 'kbox_memset_pci' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char *user_buf @@ got char [noderef] __user *data @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: expected char *user_buf drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: got char [noderef] __user *data >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got char *user_buf @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: got char *user_buf >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const *user_buf @@ got char const [noderef] __user *data @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: expected char const *user_buf drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: got char const [noderef] __user *data >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got char const *user_buf @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: got char const *user_buf vim +/__iomem +51 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c 41 42 void kbox_write_to_pci(void __iomem *dest, const void *src, int len, 43 unsigned long offset) 44 { 45 union char_int_transfer_u transfer = { }; 46 int idx = 0; 47 int j = 0; 48 int four_byte_len = 0; 49 int left_len = 0; 50 char *src_temp = (char *)src; > 51 char *dest_temp = (char *)dest; 52 int first_write_num = 0; 53 54 if ((offset % KBOX_RW_UNIT) != 0) { 55 transfer.data_int = 56 *(int *)(dest_temp + offset - (offset % KBOX_RW_UNIT)); 57 58 rmb();/* memory barriers. */ 59 first_write_num = 60 ((len + (offset % KBOX_RW_UNIT)) > 61 KBOX_RW_UNIT) ? (KBOX_RW_UNIT - 62 (offset % KBOX_RW_UNIT)) : len; 63 for (idx = (int)(offset % KBOX_RW_UNIT); 64 idx < (int)(first_write_num + (offset % KBOX_RW_UNIT)); 65 idx++) { 66 if (!src_temp) 67 return; 68 69 transfer.data_char[idx] = *src_temp; 70 src_temp++; 71 } 72 *(int *)(dest_temp + offset - (offset % KBOX_RW_UNIT)) = 73 transfer.data_int; 74 wmb();/* memory barriers. */ 75 len -= first_write_num; 76 offset += first_write_num; 77 } 78 79 four_byte_len = (len / KBOX_RW_UNIT); 80 left_len = (len % KBOX_RW_UNIT); 81 for (idx = 0; idx < four_byte_len; idx++) { 82 for (j = 0; j < KBOX_RW_UNIT; j++) { 83 if (!src_temp) 84 return; 85 86 transfer.data_char[j] = *src_temp; 87 src_temp++; 88 } 89 *(int *)(dest_temp + offset) = transfer.data_int; 90 wmb();/* memory barriers. */ 91 offset += KBOX_RW_UNIT; 92 } 93 94 if (left_len != 0) { 95 transfer.data_int = *(int *)(dest_temp + offset); 96 rmb();/* memory barriers. */ 97 for (idx = 0; idx < left_len; idx++) { 98 if (!src_temp) 99 return; 100 101 transfer.data_char[idx] = *src_temp; 102 src_temp++; 103 } 104 *(int *)(dest_temp + offset) = transfer.data_int; 105 wmb();/* memory barriers. */ 106 } 107 108 udelay(1); 109 } 110 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 4134526a9cfd552230ec7a66a1738a9066d9a0c6
by kernel test robot 14 Apr '24

14 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4134526a9cfd552230ec7a66a1738a9066d9a0c6 !5847 ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Warning reports: https://lore.kernel.org/oe-kbuild-all/202404132358.tVVjLv9W-lkp@intel.com Unverified Warning (likely false positive, please contact us if interested): 'items' is not one of ['type', 'description', 'dependencies', 'dependentRequired', 'dependentSchemas', 'properties', 'patternProperties', 'additionalProperties', 'unevaluatedProperties', 'deprecated', 'required', 'not', 'allOf', 'anyOf', 'oneOf', '$ref'] 'minItems' is not one of ['type', 'description', 'dependencies', 'dependentRequired', 'dependentSchemas', 'properties', 'patternProperties', 'additionalProperties', 'unevaluatedProperties', 'deprecated', 'required', 'not', 'allOf', 'anyOf', 'oneOf', '$ref'] Documentation/devicetree/bindings/arm/cpu.yaml: properties:capacity-dmips-mhz: '$ref' should not be valid under {'const': '$ref'} Documentation/devicetree/bindings/arm/cpu.yaml: title: 'ARM CPUs bindings' should not be valid under {'pattern': '([Bb]inding| [Ss]chema)'} Documentation/devicetree/bindings/arm/cpus.yaml: 'maintainers' is a required property Documentation/devicetree/bindings/arm/cpus.yaml: examples: '-| /{ cpus { arm,pbha-performance-only = /bits/ 8 <0x01 0x05 0x09>; arm,pbha-no-aliases = /bits/ 8 <0x02 0x04 0x06 0x08>;ncpu@0 { device_type = "cpu"; compatible = "arm,cortex-a57"; ... };n}; };' is not of type 'array' ['description:Display controller reference clock source'] is not of type 'object', 'boolean' ['description:Display controller reference clock source'] is too short [{'description': 'Offset and length of the memory mapped registers'}] is too short Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-arm-cpu.yaml:properties:capacity-dmips-mhz:ref-should-not-be-valid-under-const:ref | |-- Documentation-devicetree-bindings-arm-cpu.yaml:title:ARM-CPUs-bindings-should-not-be-valid-under-pattern:(-Bb-inding-Ss-chema) | |-- Documentation-devicetree-bindings-arm-cpus.yaml:examples:cpus-arm-pbha-performance-only-bits-arm-pbha-no-aliases-bits-ncpu-device_type-cpu-compatible-arm-cortex-a57-...-n-is-not-of-type-array | |-- Documentation-devicetree-bindings-arm-cpus.yaml:maintainers-is-a-required-property | |-- description:Display-controller-reference-clock-source-is-not-of-type-object-boolean | |-- description:Display-controller-reference-clock-source-is-too-short | |-- description:Offset-and-length-of-the-memory-mapped-registers-is-too-short | |-- items-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneOf-r | `-- minItems-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneO |-- x86_64-allnoconfig | `-- drivers-net-ethernet-mucse-rnpm-rnpm_common.h:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- drivers-infiniband-hw-xsc-mem.c:warning:no-previous-prototype-for-function-xsc_find_chunk_cont_0 | |-- drivers-infiniband-hw-xsc-mr.c:warning:variable-using_peer_mem-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-eecd-description-in-rnpm_lower_eeprom_clk | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hash_value-description-in-rnpm_set_mta | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hw-description-in-rnpm_mta_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-pf-description-in-rnpm_set_vlan_anti_spoofing | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-count-not-described-in-rnpm_shift_in_eeprom_bits | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-eec-not-described-in-rnpm_lower_eeprom_clk | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mc_addr-not-described-in-rnpm_set_mta | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mode-not-described-in-rnpm_mta_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-vf-not-described-in-rnpm_set_vlan_anti_spoofing | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnpm_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_get_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ee-description-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-flags-description-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_set_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_info | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_rxnfc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-pf-description-in-rnpm_get_rss_hash_opts | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_get_rss_hash_opts | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_info | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_rxnfc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-eeprom-not-described-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_set_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_get_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-priv_flags-not-described-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-v_count-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_layer2_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping_tcam | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-ent-description-in-rnpm_probe | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-hw-description-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-link_speed-description-in-rnpm_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-maxrate-description-in-rnpm_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_setup_tc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-pb-description-in-rnpm_lpbthresh | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-queue-description-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-skb-description-in-rnpm_is_non_eop | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_setup_tc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-id-not-described-in-rnpm_probe | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-is_rxframe-not-described-in-rnpm_write_eitr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnpm_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_msix_vector-not-described-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_queue-not-described-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnpm_tx_timeout | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-clean_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-control_mac_rx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_can_rpu_start | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_check_mc_addr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_fix_queue_number | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_event_schedule | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_task | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_write_eitr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring_temp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-update_pf_vlan | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-wait_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-hw-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-packets-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-mbx_cookie_zalloc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_get_capablity | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_reg_read | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_send_cmd_wait | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_get_port_stats2 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_link_stat_mark_disable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_fw_post_req | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_pluginout_evt_en | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_write_posted_locked | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-is-uninitialized-when-used-here | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-hw-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-atr_input-description-in-rnpm_atr_compute_perfect_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-stream-description-in-rnpm_atr_compute_sig_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-common-not-described-in-rnpm_atr_compute_sig_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_perfect_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_sig_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-function-rnpm_reset_pipeline_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:variable-status-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-eeprom_data-description-in-rnpm_read_i2c_sff8472_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_i2c_data | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_phy_type_from_id | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-autoneg_wait_to_complete-not-described-in-rnpm_setup_phy_link_speed_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_read_i2c_byte_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_write_i2c_byte_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-device_type-not-described-in-rnpm_read_phy_reg_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-link_up-not-described-in-rnpm_check_phy_link_tnx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-phy_id-not-described-in-rnpm_get_phy_type_from_id | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-sff8472_data-not-described-in-rnpm_read_i2c_sff8472_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-speed-not-described-in-rnpm_check_phy_link_tnx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-function-rnpm_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:variable-target-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-function-rnpm_mbx_get_pn_sn | |-- drivers-net-ethernet-yunsilicon-xsc-common-xsc_core.h:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_eth_change_link_status | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_get_vf_config | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_get_linear_frag_sz | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_is_linear_skb | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_select_queue | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:variable-txq_ix-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-buffer_size-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-curr_pfc_en-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-prio2buffer-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_devid_to_pcie_no | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-find_kallsyms_lookup_name | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-noop_pre | |-- drivers-net-ethernet-yusur-k2-..-platform-ys_intr.c:warning:overlapping-comparisons-always-evaluate-to-false | `-- drivers-net-ethernet-yusur-k2-ys_k2_tx.c:warning:variable-clean_tail_ptr-set-but-not-used `-- x86_64-randconfig-122-20240413 |-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression |-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-char-const-user_buf |-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-char-user_buf |-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-char-const-user_buf-got-char-const-noderef-__user-data |-- drivers-net-ethernet-huawei-bma-kbox_drv-kbox_ram_op.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-char-user_buf-got-char-noderef-__user-data `-- drivers-net-ethernet-huawei-bma-veth_drv-veth_hb.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression elapsed time: 757m configs tested: 20 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240414 clang x86_64 buildonly-randconfig-002-20240414 clang x86_64 buildonly-randconfig-003-20240414 clang x86_64 buildonly-randconfig-004-20240414 clang x86_64 buildonly-randconfig-005-20240414 gcc x86_64 buildonly-randconfig-006-20240414 clang x86_64 defconfig gcc x86_64 randconfig-001-20240414 gcc x86_64 randconfig-002-20240414 clang x86_64 randconfig-003-20240414 gcc x86_64 randconfig-004-20240414 gcc x86_64 randconfig-005-20240414 clang x86_64 randconfig-006-20240414 clang x86_64 randconfig-011-20240414 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 6340/30000] drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2437:26: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 13 Apr '24

13 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6 commit: 5110b9f48a67483d9b1b0946acb251a3c9fbee73 [6340/30000] Huawei BMA: Adding Huawei BMA driver: host_veth_drv config: x86_64-randconfig-122-20240413 (https://download.01.org/0day-ci/archive/20240413/202404132358.tVVjLv9W-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240413/202404132358.tVVjLv9W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404132358.tVVjLv9W-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:88:23: sparse: sparse: symbol 'g_bspveth_dev' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:394:5: sparse: sparse: symbol 'bspveth_setup_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:443:6: sparse: sparse: symbol 'bspveth_free_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:485:5: sparse: sparse: symbol 'bspveth_setup_all_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:554:6: sparse: sparse: symbol 'bspveth_free_all_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:571:5: sparse: sparse: symbol 'veth_alloc_one_rx_skb' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:616:5: sparse: sparse: symbol 'veth_refill_rxskb' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:654:5: sparse: sparse: symbol 'bspveth_setup_rx_skb' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:685:6: sparse: sparse: symbol 'bspveth_free_rx_skb' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:718:5: sparse: sparse: symbol 'bspveth_setup_all_rx_skb' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:746:6: sparse: sparse: symbol 'bspveth_free_all_rx_skb' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:758:5: sparse: sparse: symbol 'bspveth_setup_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:809:6: sparse: sparse: symbol 'bspveth_free_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:841:5: sparse: sparse: symbol 'bspveth_setup_all_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:908:6: sparse: sparse: symbol 'bspveth_free_all_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:926:5: sparse: sparse: symbol 'bspveth_dev_install' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:961:5: sparse: sparse: symbol 'bspveth_dev_uninstall' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1046:5: sparse: sparse: symbol 'veth_config' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1063:6: sparse: sparse: symbol 'bspveth_initstatis' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1088:5: sparse: sparse: symbol 'veth_ioctl' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1093:25: sparse: sparse: symbol 'veth_stats' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1098:5: sparse: sparse: symbol 'veth_mac_set' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1234:6: sparse: sparse: symbol 'veth_netdev_func_init' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1268:5: sparse: sparse: symbol 'veth_send_one_pkt' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1544:6: sparse: sparse: symbol 'veth_skbtrtimer_do' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1591:6: sparse: sparse: symbol 'veth_netdev_exit' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1628:5: sparse: sparse: symbol 'veth_netdev_init' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1719:6: sparse: sparse: symbol 'veth_dma_tx_timer_do_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1769:5: sparse: sparse: symbol 'dmacmp_err_deal' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1806:5: sparse: sparse: symbol 'veth_check_dma_status' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1834:5: sparse: sparse: symbol '__check_dmacmp_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1906:5: sparse: sparse: symbol '__checkspace_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1987:5: sparse: sparse: symbol '__make_dmalistbd_h2b_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2091:5: sparse: sparse: symbol '__make_dmalistbd_b2h_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2194:5: sparse: sparse: symbol '__start_dmalist_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2240:5: sparse: sparse: symbol 'check_dma_queue_fault' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2388:6: sparse: sparse: symbol 'bspveth_host_exit_H' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2437:26: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2402:5: sparse: sparse: symbol 'bspveth_host_init_H' was not declared. Should it be static? vim +/__iomem +2437 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c 2401 2402 s32 bspveth_host_init_H(void) 2403 { 2404 int ret = 0; 2405 struct bma_priv_data_s *bma_priv = NULL; 2406 2407 ret = bma_intf_register_type(TYPE_VETH, 0, INTR_ENABLE, 2408 (void **)&bma_priv); 2409 if (ret) { 2410 ret = -1; 2411 goto failed; 2412 } 2413 2414 if (!bma_priv) { 2415 VETH_LOG(DLOG_ERROR, "bma_priv is NULL\n"); 2416 return -1; 2417 } 2418 2419 VETH_LOG(DLOG_DEBUG, 2420 "bma_intf_register_type pdev = %p, veth_swap_addr = %p, ", 2421 bma_priv->specific.veth.pdev, 2422 bma_priv->specific.veth.veth_swap_addr); 2423 2424 VETH_LOG(DLOG_DEBUG, 2425 "veth_swap_len = 0x%lx, veth_swap_phy_addr = 0x%lx\n", 2426 bma_priv->specific.veth.veth_swap_len, 2427 bma_priv->specific.veth.veth_swap_phy_addr); 2428 2429 g_bspveth_dev.bma_priv = bma_priv; 2430 g_bspveth_dev.ppcidev = bma_priv->specific.veth.pdev; 2431 2432 /*bspveth_dev.phostrtc_p = (u8 *)bar1_base;*/ 2433 /*bspveth_dev.phostrtc_v = (u8 *)bar1_remap;*/ 2434 g_bspveth_dev.pshmpool_p = 2435 (u8 *)bma_priv->specific.veth.veth_swap_phy_addr; 2436 g_bspveth_dev.pshmpool_v = > 2437 (u8 *)bma_priv->specific.veth.veth_swap_addr; 2438 g_bspveth_dev.shmpoolsize = bma_priv->specific.veth.veth_swap_len; 2439 2440 VETH_LOG(DLOG_DEBUG, "bspveth host init H OK\n"); 2441 2442 return BSP_OK; 2443 2444 failed: 2445 return ret; 2446 } 2447 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
by Zhengchao Shao 13 Apr '24

13 Apr '24

From: Oleksij Rempel <o.rempel(a)pengutronix.de> mainline inclusion from mainline-v6.8-rc5 commit efe7cf828039aedb297c1f9920b638fffee6aabc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2H0 CVE: CVE-2023-52637 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...) modifies jsk->filters while receiving packets. Following trace was seen on affected system: ================================================================== BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] Read of size 4 at addr ffff888012144014 by task j1939/350 CPU: 0 PID: 350 Comm: j1939 Tainted: G W OE 6.5.0-rc5 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: print_report+0xd3/0x620 ? kasan_complete_mode_report_info+0x7d/0x200 ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] kasan_report+0xc2/0x100 ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] __asan_load4+0x84/0xb0 j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] j1939_sk_recv+0x20b/0x320 [can_j1939] ? __kasan_check_write+0x18/0x20 ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939] ? j1939_simple_recv+0x69/0x280 [can_j1939] ? j1939_ac_recv+0x5e/0x310 [can_j1939] j1939_can_recv+0x43f/0x580 [can_j1939] ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939] ? raw_rcv+0x42/0x3c0 [can_raw] ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939] can_rcv_filter+0x11f/0x350 [can] can_receive+0x12f/0x190 [can] ? __pfx_can_rcv+0x10/0x10 [can] can_rcv+0xdd/0x130 [can] ? __pfx_can_rcv+0x10/0x10 [can] __netif_receive_skb_one_core+0x13d/0x150 ? __pfx___netif_receive_skb_one_core+0x10/0x10 ? __kasan_check_write+0x18/0x20 ? _raw_spin_lock_irq+0x8c/0xe0 __netif_receive_skb+0x23/0xb0 process_backlog+0x107/0x260 __napi_poll+0x69/0x310 net_rx_action+0x2a1/0x580 ? __pfx_net_rx_action+0x10/0x10 ? __pfx__raw_spin_lock+0x10/0x10 ? handle_irq_event+0x7d/0xa0 __do_softirq+0xf3/0x3f8 do_softirq+0x53/0x80 </IRQ> <TASK> __local_bh_enable_ip+0x6e/0x70 netif_rx+0x16b/0x180 can_send+0x32b/0x520 [can] ? __pfx_can_send+0x10/0x10 [can] ? __check_object_size+0x299/0x410 raw_sendmsg+0x572/0x6d0 [can_raw] ? __pfx_raw_sendmsg+0x10/0x10 [can_raw] ? apparmor_socket_sendmsg+0x2f/0x40 ? __pfx_raw_sendmsg+0x10/0x10 [can_raw] sock_sendmsg+0xef/0x100 sock_write_iter+0x162/0x220 ? __pfx_sock_write_iter+0x10/0x10 ? __rtnl_unlock+0x47/0x80 ? security_file_permission+0x54/0x320 vfs_write+0x6ba/0x750 ? __pfx_vfs_write+0x10/0x10 ? __fget_light+0x1ca/0x1f0 ? __rcu_read_unlock+0x5b/0x280 ksys_write+0x143/0x170 ? __pfx_ksys_write+0x10/0x10 ? __kasan_check_read+0x15/0x20 ? fpregs_assert_state_consistent+0x62/0x70 __x64_sys_write+0x47/0x60 do_syscall_64+0x60/0x90 ? do_syscall_64+0x6d/0x90 ? irqentry_exit+0x3f/0x50 ? exc_page_fault+0x79/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Allocated by task 348: kasan_save_stack+0x2a/0x50 kasan_set_track+0x29/0x40 kasan_save_alloc_info+0x1f/0x30 __kasan_kmalloc+0xb5/0xc0 __kmalloc_node_track_caller+0x67/0x160 j1939_sk_setsockopt+0x284/0x450 [can_j1939] __sys_setsockopt+0x15c/0x2f0 __x64_sys_setsockopt+0x6b/0x80 do_syscall_64+0x60/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 349: kasan_save_stack+0x2a/0x50 kasan_set_track+0x29/0x40 kasan_save_free_info+0x2f/0x50 __kasan_slab_free+0x12e/0x1c0 __kmem_cache_free+0x1b9/0x380 kfree+0x7a/0x120 j1939_sk_setsockopt+0x3b2/0x450 [can_j1939] __sys_setsockopt+0x15c/0x2f0 __x64_sys_setsockopt+0x6b/0x80 do_syscall_64+0x60/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol") Reported-by: Sili Luo <rootlab(a)huawei.com> Suggested-by: Sili Luo <rootlab(a)huawei.com> Acked-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Cc: stable(a)vger.kernel.org Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://lore.kernel.org/all/20231020133814.383996-1-o.rempel@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/socket.c | 23 +++++++++++++++++++---- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h index 12369b604ce9..c8f469a7e7d9 100644 --- a/net/can/j1939/j1939-priv.h +++ b/net/can/j1939/j1939-priv.h @@ -297,6 +297,7 @@ struct j1939_sock { int ifindex; struct j1939_addr addr; + spinlock_t filters_lock; struct j1939_filter *filters; int nfilters; pgn_t pgn_rx_filter; diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c index f7587428febd..ebff753076a9 100644 --- a/net/can/j1939/socket.c +++ b/net/can/j1939/socket.c @@ -258,12 +258,17 @@ static bool j1939_sk_match_dst(struct j1939_sock *jsk, static bool j1939_sk_match_filter(struct j1939_sock *jsk, const struct j1939_sk_buff_cb *skcb) { - const struct j1939_filter *f = jsk->filters; - int nfilter = jsk->nfilters; + const struct j1939_filter *f; + int nfilter; + + spin_lock_bh(&jsk->filters_lock); + + f = jsk->filters; + nfilter = jsk->nfilters; if (!nfilter) /* receive all when no filters are assigned */ - return true; + goto filter_match_found; for (; nfilter; ++f, --nfilter) { if ((skcb->addr.pgn & f->pgn_mask) != f->pgn) @@ -272,9 +277,15 @@ static bool j1939_sk_match_filter(struct j1939_sock *jsk, continue; if ((skcb->addr.src_name & f->name_mask) != f->name) continue; - return true; + goto filter_match_found; } + + spin_unlock_bh(&jsk->filters_lock); return false; + +filter_match_found: + spin_unlock_bh(&jsk->filters_lock); + return true; } static bool j1939_sk_recv_match_one(struct j1939_sock *jsk, @@ -399,6 +410,8 @@ static int j1939_sk_init(struct sock *sk) INIT_LIST_HEAD(&jsk->sk_session_queue); sk->sk_destruct = j1939_sk_sock_destruct; + spin_lock_init(&jsk->filters_lock); + return 0; } @@ -682,9 +695,11 @@ static int j1939_sk_setsockopt(struct socket *sock, int level, int optname, } lock_sock(&jsk->sk); + spin_lock_bh(&jsk->filters_lock); ofilters = jsk->filters; jsk->filters = filters; jsk->nfilters = count; + spin_unlock_bh(&jsk->filters_lock); release_sock(&jsk->sk); kfree(ofilters); return 0; -- 2.34.1

2 1

[PATCH OLK-5.10] can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
by Zhengchao Shao 13 Apr '24

13 Apr '24

From: Oleksij Rempel <o.rempel(a)pengutronix.de> stable inclusion from stable-v5.10.210 commit 978e50ef8c38dc71bd14d1b0143d554ff5d188ba category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2H0 CVE: CVE-2023-52637 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit efe7cf828039aedb297c1f9920b638fffee6aabc upstream. Lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...) modifies jsk->filters while receiving packets. Following trace was seen on affected system: ================================================================== BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] Read of size 4 at addr ffff888012144014 by task j1939/350 CPU: 0 PID: 350 Comm: j1939 Tainted: G W OE 6.5.0-rc5 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: print_report+0xd3/0x620 ? kasan_complete_mode_report_info+0x7d/0x200 ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] kasan_report+0xc2/0x100 ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] __asan_load4+0x84/0xb0 j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939] j1939_sk_recv+0x20b/0x320 [can_j1939] ? __kasan_check_write+0x18/0x20 ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939] ? j1939_simple_recv+0x69/0x280 [can_j1939] ? j1939_ac_recv+0x5e/0x310 [can_j1939] j1939_can_recv+0x43f/0x580 [can_j1939] ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939] ? raw_rcv+0x42/0x3c0 [can_raw] ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939] can_rcv_filter+0x11f/0x350 [can] can_receive+0x12f/0x190 [can] ? __pfx_can_rcv+0x10/0x10 [can] can_rcv+0xdd/0x130 [can] ? __pfx_can_rcv+0x10/0x10 [can] __netif_receive_skb_one_core+0x13d/0x150 ? __pfx___netif_receive_skb_one_core+0x10/0x10 ? __kasan_check_write+0x18/0x20 ? _raw_spin_lock_irq+0x8c/0xe0 __netif_receive_skb+0x23/0xb0 process_backlog+0x107/0x260 __napi_poll+0x69/0x310 net_rx_action+0x2a1/0x580 ? __pfx_net_rx_action+0x10/0x10 ? __pfx__raw_spin_lock+0x10/0x10 ? handle_irq_event+0x7d/0xa0 __do_softirq+0xf3/0x3f8 do_softirq+0x53/0x80 </IRQ> <TASK> __local_bh_enable_ip+0x6e/0x70 netif_rx+0x16b/0x180 can_send+0x32b/0x520 [can] ? __pfx_can_send+0x10/0x10 [can] ? __check_object_size+0x299/0x410 raw_sendmsg+0x572/0x6d0 [can_raw] ? __pfx_raw_sendmsg+0x10/0x10 [can_raw] ? apparmor_socket_sendmsg+0x2f/0x40 ? __pfx_raw_sendmsg+0x10/0x10 [can_raw] sock_sendmsg+0xef/0x100 sock_write_iter+0x162/0x220 ? __pfx_sock_write_iter+0x10/0x10 ? __rtnl_unlock+0x47/0x80 ? security_file_permission+0x54/0x320 vfs_write+0x6ba/0x750 ? __pfx_vfs_write+0x10/0x10 ? __fget_light+0x1ca/0x1f0 ? __rcu_read_unlock+0x5b/0x280 ksys_write+0x143/0x170 ? __pfx_ksys_write+0x10/0x10 ? __kasan_check_read+0x15/0x20 ? fpregs_assert_state_consistent+0x62/0x70 __x64_sys_write+0x47/0x60 do_syscall_64+0x60/0x90 ? do_syscall_64+0x6d/0x90 ? irqentry_exit+0x3f/0x50 ? exc_page_fault+0x79/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Allocated by task 348: kasan_save_stack+0x2a/0x50 kasan_set_track+0x29/0x40 kasan_save_alloc_info+0x1f/0x30 __kasan_kmalloc+0xb5/0xc0 __kmalloc_node_track_caller+0x67/0x160 j1939_sk_setsockopt+0x284/0x450 [can_j1939] __sys_setsockopt+0x15c/0x2f0 __x64_sys_setsockopt+0x6b/0x80 do_syscall_64+0x60/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 349: kasan_save_stack+0x2a/0x50 kasan_set_track+0x29/0x40 kasan_save_free_info+0x2f/0x50 __kasan_slab_free+0x12e/0x1c0 __kmem_cache_free+0x1b9/0x380 kfree+0x7a/0x120 j1939_sk_setsockopt+0x3b2/0x450 [can_j1939] __sys_setsockopt+0x15c/0x2f0 __x64_sys_setsockopt+0x6b/0x80 do_syscall_64+0x60/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol") Reported-by: Sili Luo <rootlab(a)huawei.com> Suggested-by: Sili Luo <rootlab(a)huawei.com> Acked-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Cc: stable(a)vger.kernel.org Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://lore.kernel.org/all/20231020133814.383996-1-o.rempel@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/socket.c | 22 ++++++++++++++++++---- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h index cea712fb2a9e..9ac2a10b1826 100644 --- a/net/can/j1939/j1939-priv.h +++ b/net/can/j1939/j1939-priv.h @@ -297,6 +297,7 @@ struct j1939_sock { int ifindex; struct j1939_addr addr; + spinlock_t filters_lock; struct j1939_filter *filters; int nfilters; pgn_t pgn_rx_filter; diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c index 906a08d38c1c..c216c60f572b 100644 --- a/net/can/j1939/socket.c +++ b/net/can/j1939/socket.c @@ -262,12 +262,17 @@ static bool j1939_sk_match_dst(struct j1939_sock *jsk, static bool j1939_sk_match_filter(struct j1939_sock *jsk, const struct j1939_sk_buff_cb *skcb) { - const struct j1939_filter *f = jsk->filters; - int nfilter = jsk->nfilters; + const struct j1939_filter *f; + int nfilter; + + spin_lock_bh(&jsk->filters_lock); + + f = jsk->filters; + nfilter = jsk->nfilters; if (!nfilter) /* receive all when no filters are assigned */ - return true; + goto filter_match_found; for (; nfilter; ++f, --nfilter) { if ((skcb->addr.pgn & f->pgn_mask) != f->pgn) @@ -276,9 +281,15 @@ static bool j1939_sk_match_filter(struct j1939_sock *jsk, continue; if ((skcb->addr.src_name & f->name_mask) != f->name) continue; - return true; + goto filter_match_found; } + + spin_unlock_bh(&jsk->filters_lock); return false; + +filter_match_found: + spin_unlock_bh(&jsk->filters_lock); + return true; } static bool j1939_sk_recv_match_one(struct j1939_sock *jsk, @@ -401,6 +412,7 @@ static int j1939_sk_init(struct sock *sk) atomic_set(&jsk->skb_pending, 0); spin_lock_init(&jsk->sk_session_queue_lock); INIT_LIST_HEAD(&jsk->sk_session_queue); + spin_lock_init(&jsk->filters_lock); /* j1939_sk_sock_destruct() depends on SOCK_RCU_FREE flag */ sock_set_flag(sk, SOCK_RCU_FREE); @@ -703,9 +715,11 @@ static int j1939_sk_setsockopt(struct socket *sock, int level, int optname, } lock_sock(&jsk->sk); + spin_lock_bh(&jsk->filters_lock); ofilters = jsk->filters; jsk->filters = filters; jsk->nfilters = count; + spin_unlock_bh(&jsk->filters_lock); release_sock(&jsk->sk); kfree(ofilters); return 0; -- 2.34.1

2 1