- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 00/11] Backport Introduce __mt_dup() to improve the performance of fork()
by Peng Zhang 23 Mar '24

23 Mar '24

From: ZhangPeng <zhangpeng362(a)huawei.com> This series introduces __mt_dup() to improve the performance of fork(). Also backport a bugfix to avoid conflicts. Liam R. Howlett (1): radix tree test suite: fix allocation calculation in kmem_cache_alloc_bulk() Peng Zhang (10): maple_tree: add mt_free_one() and mt_attr() helpers maple_tree: introduce {mtree,mas}_lock_nested() maple_tree: introduce interfaces __mt_dup() and mtree_dup() radix tree test suite: align kmem_cache_alloc_bulk() with kernel behavior. maple_tree: add test for mtree_dup() maple_tree: update the documentation of maple tree maple_tree: skip other tests when BENCH is enabled maple_tree: update check_forking() and bench_forking() maple_tree: preserve the tree attributes when destroying maple tree fork: use __mt_dup() to duplicate maple tree in dup_mmap() Documentation/core-api/maple_tree.rst | 4 + include/linux/maple_tree.h | 7 + include/linux/mm.h | 11 + kernel/fork.c | 40 ++- lib/maple_tree.c | 288 +++++++++++++++++++- lib/test_maple_tree.c | 123 +++++---- mm/internal.h | 11 - mm/memory.c | 7 +- mm/mmap.c | 9 +- tools/include/linux/rwsem.h | 4 + tools/include/linux/spinlock.h | 1 + tools/testing/radix-tree/linux.c | 49 +++- tools/testing/radix-tree/maple.c | 363 ++++++++++++++++++++++++++ 13 files changed, 813 insertions(+), 104 deletions(-) -- 2.25.1

2 12

[PATCH OLK-5.10] mm/sparsemem: fix race in accessing memory_section->usage
by Peng Zhang 23 Mar '24

23 Mar '24

From: Charan Teja Kalla <quic_charante(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit 5ec8e8ea8b7783fab150cf86404fc38cb4db8800 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NHX CVE: CVE-2023-52489 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are such that [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since normal zone start and end pfn contains the device memory PFN's as well, the compaction triggered will try on the device memory PFN's too though they end up in NOP(because pfn_to_online_page() returns NULL for ZONE_DEVICE memory sections). When from other core, the section mappings are being removed for the ZONE_DEVICE region, that the PFN in question belongs to, on which compaction is currently being operated is resulting into the kernel crash with CONFIG_SPASEMEM_VMEMAP enabled. The crash logs can be seen at [1]. compact_zone() memunmap_pages ------------- --------------- __pageblock_pfn_to_page ...... (a)pfn_valid(): valid_section()//return true (b)__remove_pages()-> sparse_remove_section()-> section_deactivate(): [Free the array ms->usage and set ms->usage = NULL] pfn_section_valid() [Access ms->usage which is NULL] NOTE: From the above it can be said that the race is reduced to between the pfn_valid()/pfn_section_valid() and the section deactivate with SPASEMEM_VMEMAP enabled. The commit b943f045a9af("mm/sparse: fix kernel crash with pfn_section_valid check") tried to address the same problem by clearing the SECTION_HAS_MEM_MAP with the expectation of valid_section() returns false thus ms->usage is not accessed. Fix this issue by the below steps: a) Clear SECTION_HAS_MEM_MAP before freeing the ->usage. b) RCU protected read side critical section will either return NULL when SECTION_HAS_MEM_MAP is cleared or can successfully access ->usage. c) Free the ->usage with kfree_rcu() and set ms->usage = NULL. No attempt will be made to access ->usage after this as the SECTION_HAS_MEM_MAP is cleared thus valid_section() return false. Thanks to David/Pavan for their inputs on this patch. [1] https://lore.kernel.org/linux-mm/994410bb-89aa-d987-1f50-f514903c55aa@quici… On Snapdragon SoC, with the mentioned memory configuration of PFN's as [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of issues daily while testing on a device farm. For this particular issue below is the log. Though the below log is not directly pointing to the pfn_section_valid(){ ms->usage;}, when we loaded this dump on T32 lauterbach tool, it is pointing. [ 540.578056] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 540.578068] Mem abort info: [ 540.578070] ESR = 0x0000000096000005 [ 540.578073] EC = 0x25: DABT (current EL), IL = 32 bits [ 540.578077] SET = 0, FnV = 0 [ 540.578080] EA = 0, S1PTW = 0 [ 540.578082] FSC = 0x05: level 1 translation fault [ 540.578085] Data abort info: [ 540.578086] ISV = 0, ISS = 0x00000005 [ 540.578088] CM = 0, WnR = 0 [ 540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBSBTYPE=--) [ 540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c [ 540.579454] lr : compact_zone+0x994/0x1058 [ 540.579460] sp : ffffffc03579b510 [ 540.579463] x29: ffffffc03579b510 x28: 0000000000235800 x27:000000000000000c [ 540.579470] x26: 0000000000235c00 x25: 0000000000000068 x24:ffffffc03579b640 [ 540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000 [ 540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140 [ 540.579489] x17: 00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff [ 540.579495] x14: 0000008000000000 x13: 0000000000000000 x12:0000000000000001 [ 540.579501] x11: 0000000000000000 x10: 0000000000000000 x9 :ffffff897d2cd440 [ 540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4 [ 540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000001 [ 540.579518] x2 : ffffffdebf7e3940 x1 : 0000000000235c00 x0 :0000000000235800 [ 540.579524] Call trace: [ 540.579527] __pageblock_pfn_to_page+0x6c/0x14c [ 540.579533] compact_zone+0x994/0x1058 [ 540.579536] try_to_compact_pages+0x128/0x378 [ 540.579540] __alloc_pages_direct_compact+0x80/0x2b0 [ 540.579544] __alloc_pages_slowpath+0x5c0/0xe10 [ 540.579547] __alloc_pages+0x250/0x2d0 [ 540.579550] __iommu_dma_alloc_noncontiguous+0x13c/0x3fc [ 540.579561] iommu_dma_alloc+0xa0/0x320 [ 540.579565] dma_alloc_attrs+0xd4/0x108 [quic_charante(a)quicinc.com: use kfree_rcu() in place of synchronize_rcu(), per David] Link: https://lkml.kernel.org/r/1698403778-20938-1-git-send-email-quic_charante@q… Link: https://lkml.kernel.org/r/1697202267-23600-1-git-send-email-quic_charante@q… Fixes: f46edbd1b151 ("mm/sparsemem: add helpers track active portions of a section at boot") Signed-off-by: Charan Teja Kalla <quic_charante(a)quicinc.com> Cc: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/mmzone.h Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- include/linux/mmzone.h | 15 ++++++++++++--- mm/sparse.c | 17 +++++++++-------- 2 files changed, 21 insertions(+), 11 deletions(-) diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h index 0a70b4bdd236..5398656315e1 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h @@ -1229,6 +1229,7 @@ struct mem_section_usage { #ifdef CONFIG_SPARSEMEM_VMEMMAP DECLARE_BITMAP(subsection_map, SUBSECTIONS_PER_SECTION); #endif + KABI_EXTEND(struct rcu_head rcu) /* See declaration of similar field in struct zone */ unsigned long pageblock_flags[0]; }; @@ -1391,7 +1392,7 @@ static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) { int idx = subsection_map_index(pfn); - return test_bit(idx, ms->usage->subsection_map); + return test_bit(idx, READ_ONCE(ms->usage)->subsection_map); } #else static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) @@ -1404,17 +1405,25 @@ static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) static inline int pfn_valid(unsigned long pfn) { struct mem_section *ms; + int ret; if (pfn_to_section_nr(pfn) >= NR_MEM_SECTIONS) return 0; ms = __nr_to_section(pfn_to_section_nr(pfn)); - if (!valid_section(ms)) + rcu_read_lock(); + if (!valid_section(ms)) { + rcu_read_unlock(); return 0; + } + /* * Traditionally early sections always returned pfn_valid() for * the entire section-sized span. */ - return early_section(ms) || pfn_section_valid(ms, pfn); + ret = early_section(ms) || pfn_section_valid(ms, pfn); + rcu_read_unlock(); + + return ret; } #endif diff --git a/mm/sparse.c b/mm/sparse.c index d92a29000d66..45b3571091a8 100644 --- a/mm/sparse.c +++ b/mm/sparse.c @@ -809,6 +809,13 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, if (empty) { unsigned long section_nr = pfn_to_section_nr(pfn); + /* + * Mark the section invalid so that valid_section() + * return false. This prevents code from dereferencing + * ms->usage array. + */ + ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; + /* * When removing an early section, the usage map is kept (as the * usage maps of other sections fall into the same page). It @@ -817,16 +824,10 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, * was allocated during boot. */ if (!PageReserved(virt_to_page(ms->usage))) { - kfree(ms->usage); - ms->usage = NULL; + kfree_rcu(ms->usage, rcu); + WRITE_ONCE(ms->usage, NULL); } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); - /* - * Mark the section invalid so that valid_section() - * return false. This prevents code from dereferencing - * ms->usage array. - */ - ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; } /* -- 2.25.1

2 1

[openeuler:OLK-5.10 21053/30000] drivers/net/ethernet/nebula-matrix/m1600/debug.c:564:39: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size 9
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 459341c4b4845b283c7a884e6a0dc4bd8cdb89e6 commit: 01e6e2075c432fde7fb5a66202b41bbd469de620 [21053/30000] Net: m1600: Add m1600-driver for nebula-matrix m1600 series smart NIC. config: x86_64-randconfig-075-20240323 (https://download.01.org/0day-ci/archive/20240323/202403231156.PXmnaRGK-lkp@…) compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403231156.PXmnaRGK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403231156.PXmnaRGK-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/nebula-matrix/m1600/debug.c:18:0: drivers/net/ethernet/nebula-matrix/m1600/ethtool.h:131:19: warning: 'nbl_priv_flags' defined but not used [-Wunused-const-variable=] static const char nbl_priv_flags[][ETH_GSTRING_LEN] = { ^~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/ethtool.h:116:19: warning: 'nbl_gstrings_test' defined but not used [-Wunused-const-variable=] static const char nbl_gstrings_test[][ETH_GSTRING_LEN] = { ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/ethtool.h:57:39: warning: 'nbl_gstrings_stats' defined but not used [-Wunused-const-variable=] static const struct nbl_ethtool_stats nbl_gstrings_stats[] = { ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/ethtool.h:13:18: warning: 'nbl_regs_dump_list' defined but not used [-Wunused-const-variable=] static const u32 nbl_regs_dump_list[] = { ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/debug.c: In function 'nbl_debugfs_hw_init': >> drivers/net/ethernet/nebula-matrix/m1600/debug.c:564:39: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size 9 [-Wformat-truncation=] snprintf(buf, sizeof(buf), "txring-%d", i); ^~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:564:31: note: directive argument in the range [0, 2147483646] snprintf(buf, sizeof(buf), "txring-%d", i); ^~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:564:4: note: 'snprintf' output between 9 and 18 bytes into a destination of size 16 snprintf(buf, sizeof(buf), "txring-%d", i); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:573:39: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size 9 [-Wformat-truncation=] snprintf(buf, sizeof(buf), "rxring-%d", i); ^~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:573:31: note: directive argument in the range [0, 2147483646] snprintf(buf, sizeof(buf), "rxring-%d", i); ^~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:573:4: note: 'snprintf' output between 9 and 18 bytes into a destination of size 16 snprintf(buf, sizeof(buf), "rxring-%d", i); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +564 drivers/net/ethernet/nebula-matrix/m1600/debug.c 534 535 /* function init and cleanup */ 536 void nbl_debugfs_hw_init(struct nbl_hw *hw) 537 { 538 int i; 539 char buf[16]; 540 struct nbl_adapter *adapter; 541 542 adapter = (struct nbl_adapter *)hw->back; 543 544 if (!nblx4_debug_root) 545 return; 546 547 snprintf(buf, sizeof(buf), "%04x:%02x:%02x.%x", 548 pci_domain_nr(adapter->pdev->bus), hw->bus, hw->devid, hw->function); 549 hw->nbl_debug_root = debugfs_create_dir(buf, nblx4_debug_root); 550 551 if (is_af(hw)) { 552 debugfs_create_file("dvn", 0444, 553 hw->nbl_debug_root, hw, &dvn_fops); 554 debugfs_create_file("uvn", 0644, 555 hw->nbl_debug_root, hw, &uvn_fops); 556 debugfs_create_file("nic-statistics", 0444, 557 hw->nbl_debug_root, hw, &nic_statistics_fops); 558 debugfs_create_file("tables", 0644, 559 hw->nbl_debug_root, hw, &tables_fops); 560 } 561 562 if (adapter->num_txq) { 563 for (i = 0; i < adapter->num_txq; i++) { > 564 snprintf(buf, sizeof(buf), "txring-%d", i); 565 debugfs_create_file(buf, 0444, 566 hw->nbl_debug_root, 567 adapter->tx_rings[i], &ring_fops); 568 } 569 } 570 571 if (adapter->num_rxq) { 572 for (i = 0; i < adapter->num_rxq; i++) { 573 snprintf(buf, sizeof(buf), "rxring-%d", i); 574 debugfs_create_file(buf, 0444, 575 hw->nbl_debug_root, 576 adapter->rx_rings[i], &ring_fops); 577 } 578 } 579 580 debugfs_create_file("bar", 0444, hw->nbl_debug_root, hw, &bar_fops); 581 582 hw->debugfs_reg_bar = 0; 583 hw->debugfs_reg_offset = 0; 584 hw->debugfs_reg_length = 8; 585 debugfs_create_file("reg", 0444, hw->nbl_debug_root, hw, &reg_fops); 586 } 587 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] llc: make llc_ui_sendmsg() more robust against bonding changes
by Liu Jian 23 Mar '24

23 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit 04f2a74b562f3a7498be0399309669f342793d8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JVI CVE: CVE-2024-26636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit dad555c816a50c6a6a8a86be1f9177673918c647 ] syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ethernet header [1] Like some others, llc_ui_sendmsg() releases the socket lock before calling sock_alloc_send_skb(). Then it acquires it again, but does not redo all the sanity checks that were performed. This fix: - Uses LL_RESERVED_SPACE() to reserve space. - Check all conditions again after socket lock is held again. - Do not account Ethernet header for mtu limitation. [1] skbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0 kernel BUG at net/core/skbuff.c:193 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:189 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 lr : skb_panic net/core/skbuff.c:189 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 sp : ffff800096f97000 x29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000 x26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2 x23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0 x20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce x17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001 x14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400 x8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089 Call trace: skb_panic net/core/skbuff.c:189 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 skb_push+0xf0/0x108 net/core/skbuff.c:2451 eth_header+0x44/0x1f8 net/ethernet/eth.c:83 dev_hard_header include/linux/netdevice.h:3188 [inline] llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33 llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85 llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline] llc_sap_next_state net/llc/llc_sap.c:182 [inline] llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209 llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270 llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_sendmsg+0x194/0x274 net/socket.c:767 splice_to_socket+0x7cc/0xd58 fs/splice.c:881 do_splice_from fs/splice.c:933 [inline] direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142 splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088 do_splice_direct+0x20c/0x348 fs/splice.c:1194 do_sendfile+0x4bc/0xc70 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1322 [inline] __se_sys_sendfile64 fs/read_write.c:1308 [inline] __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595 Code: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+2a7024e9502df538e8ef(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240118183625.4007013-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/llc/af_llc.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index 90a32864401c..dae978badd26 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -929,14 +929,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, */ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) { + DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); struct sock *sk = sock->sk; struct llc_sock *llc = llc_sk(sk); - DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); int flags = msg->msg_flags; int noblock = flags & MSG_DONTWAIT; + int rc = -EINVAL, copied = 0, hdrlen, hh_len; struct sk_buff *skb = NULL; + struct net_device *dev; size_t size = 0; - int rc = -EINVAL, copied = 0, hdrlen; dprintk("%s: sending from %02X to %02X\n", __func__, llc->laddr.lsap, llc->daddr.lsap); @@ -956,22 +957,29 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) if (rc) goto out; } - hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr); + dev = llc->dev; + hh_len = LL_RESERVED_SPACE(dev); + hdrlen = llc_ui_header_len(sk, addr); size = hdrlen + len; - if (size > llc->dev->mtu) - size = llc->dev->mtu; + size = min_t(size_t, size, READ_ONCE(dev->mtu)); copied = size - hdrlen; rc = -EINVAL; if (copied < 0) goto out; release_sock(sk); - skb = sock_alloc_send_skb(sk, size, noblock, &rc); + skb = sock_alloc_send_skb(sk, hh_len + size, noblock, &rc); lock_sock(sk); if (!skb) goto out; - skb->dev = llc->dev; + if (sock_flag(sk, SOCK_ZAPPED) || + llc->dev != dev || + hdrlen != llc_ui_header_len(sk, addr) || + hh_len != LL_RESERVED_SPACE(dev) || + size > READ_ONCE(dev->mtu)) + goto out; + skb->dev = dev; skb->protocol = llc_proto_type(addr->sllc_arphrd); - skb_reserve(skb, hdrlen); + skb_reserve(skb, hh_len + hdrlen); rc = memcpy_from_msg(skb_put(skb, copied), msg, copied); if (rc) goto out; -- 2.34.1

2 1

[PATCH OLK-5.10] llc: Drop support for ETH_P_TR_802_2.
by Liu Jian 23 Mar '24

23 Mar '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v5.10.210 commit 9ccdef19cf9497c2803b005369668feb91cacdfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JSA CVE: CVE-2024-26635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit e3f9bed9bee261e3347131764e42aeedf1ffea61 ] syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Fixes: 211ed865108e ("net: delete all instances of special processing for token ring") Reported-by: syzbot+b5ad66046b913bc04c6f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ad66046b913bc04c6f Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240119015515.61898-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/llc_pdu.h | 6 ++---- net/llc/llc_core.c | 7 ------- 2 files changed, 2 insertions(+), 11 deletions(-) diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h index 49aa79c7b278..581cd37aa98b 100644 --- a/include/net/llc_pdu.h +++ b/include/net/llc_pdu.h @@ -262,8 +262,7 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, */ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); + memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); } /** @@ -275,8 +274,7 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) */ static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); + memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); } /** diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c index 64d4bef04e73..4900a27b5176 100644 --- a/net/llc/llc_core.c +++ b/net/llc/llc_core.c @@ -135,22 +135,15 @@ static struct packet_type llc_packet_type __read_mostly = { .func = llc_rcv, }; -static struct packet_type llc_tr_packet_type __read_mostly = { - .type = cpu_to_be16(ETH_P_TR_802_2), - .func = llc_rcv, -}; - static int __init llc_init(void) { dev_add_pack(&llc_packet_type); - dev_add_pack(&llc_tr_packet_type); return 0; } static void __exit llc_exit(void) { dev_remove_pack(&llc_packet_type); - dev_remove_pack(&llc_tr_packet_type); } module_init(llc_init); -- 2.34.1

2 1

[PATCH OLK-5.10] llc: Drop support for ETH_P_TR_802_2.
by Liu Jian 23 Mar '24

23 Mar '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v5.10.210 commit 9ccdef19cf9497c2803b005369668feb91cacdfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JSA CVE: CVE-2024-26635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit e3f9bed9bee261e3347131764e42aeedf1ffea61 ] syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Fixes: 211ed865108e ("net: delete all instances of special processing for token ring") Reported-by: syzbot+b5ad66046b913bc04c6f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ad66046b913bc04c6f Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240119015515.61898-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/llc_pdu.h | 6 ++---- net/llc/llc_core.c | 7 ------- 2 files changed, 2 insertions(+), 11 deletions(-) diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h index 49aa79c7b278..581cd37aa98b 100644 --- a/include/net/llc_pdu.h +++ b/include/net/llc_pdu.h @@ -262,8 +262,7 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, */ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); + memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); } /** @@ -275,8 +274,7 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) */ static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); + memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); } /** diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c index 64d4bef04e73..4900a27b5176 100644 --- a/net/llc/llc_core.c +++ b/net/llc/llc_core.c @@ -135,22 +135,15 @@ static struct packet_type llc_packet_type __read_mostly = { .func = llc_rcv, }; -static struct packet_type llc_tr_packet_type __read_mostly = { - .type = cpu_to_be16(ETH_P_TR_802_2), - .func = llc_rcv, -}; - static int __init llc_init(void) { dev_add_pack(&llc_packet_type); - dev_add_pack(&llc_tr_packet_type); return 0; } static void __exit llc_exit(void) { dev_remove_pack(&llc_packet_type); - dev_remove_pack(&llc_tr_packet_type); } module_init(llc_init); -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] llc: Drop support for ETH_P_TR_802_2.
by Liu Jian 23 Mar '24

23 Mar '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v4.19.307 commit 165ad1e22779685c3ed3dd349c6c4c632309cc62 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JSA CVE: CVE-2024-26635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit e3f9bed9bee261e3347131764e42aeedf1ffea61 ] syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Fixes: 211ed865108e ("net: delete all instances of special processing for token ring") Reported-by: syzbot+b5ad66046b913bc04c6f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ad66046b913bc04c6f Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240119015515.61898-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/llc_pdu.h | 6 ++---- net/llc/llc_core.c | 7 ------- 2 files changed, 2 insertions(+), 11 deletions(-) diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h index c0f0a13ed818..663351ca00e1 100644 --- a/include/net/llc_pdu.h +++ b/include/net/llc_pdu.h @@ -250,8 +250,7 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, */ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); + memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); } /** @@ -263,8 +262,7 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) */ static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); + memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); } /** diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c index 64d4bef04e73..4900a27b5176 100644 --- a/net/llc/llc_core.c +++ b/net/llc/llc_core.c @@ -135,22 +135,15 @@ static struct packet_type llc_packet_type __read_mostly = { .func = llc_rcv, }; -static struct packet_type llc_tr_packet_type __read_mostly = { - .type = cpu_to_be16(ETH_P_TR_802_2), - .func = llc_rcv, -}; - static int __init llc_init(void) { dev_add_pack(&llc_packet_type); - dev_add_pack(&llc_tr_packet_type); return 0; } static void __exit llc_exit(void) { dev_remove_pack(&llc_packet_type); - dev_remove_pack(&llc_tr_packet_type); } module_init(llc_init); -- 2.34.1

2 5

[openeuler:OLK-6.6 3947/6857] drivers/crypto/montage/tsse/tsse_ipc.c:18: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 1b4212c630731d88b07d5b6e28ecaff1a76d3839 commit: 7795623241fe9eb57352a09b27d06b5d4ff07071 [3947/6857] add firmware update function for Mont-TSSE config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240323/202403230839.j7ODqH5Y-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403230839.j7ODqH5Y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403230839.j7ODqH5Y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/montage/tsse/tsse_ipc.c:18: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Create ipc_msg and read message from BAR. drivers/crypto/montage/tsse/tsse_ipc.c:83: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Enable main2host interrupt, cleanup interrupt set value in host2main and main2host. -- >> drivers/crypto/montage/tsse/tsse_fw_service.c:55: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Get version information from firmware drivers/crypto/montage/tsse/tsse_fw_service.c:106: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Firmware service to handle IPC message from mainCPU. drivers/crypto/montage/tsse/tsse_fw_service.c:155: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Load firmware from /lib/firmware -- >> drivers/crypto/montage/tsse/tsse_dev_drv.c:118: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * This function will be called when user writes string to /sys/bus/pci/devices/.../tsse_image_load. vim +18 drivers/crypto/montage/tsse/tsse_ipc.c 16 17 /** > 18 * Create ipc_msg and read message from BAR. 19 * Return the pointer to ipc_msg, the caller is responsible for free it. 20 */ 21 static struct ipc_msg *get_msginf(void __iomem *d2h) 22 { 23 uint32_t u_len = 0; 24 struct ipc_msg *msg = NULL; 25 26 uint8_t *device_msg_data = NULL; 27 struct ipc_header *ipc_info = (struct ipc_header *)d2h; 28 29 // The memory layout in d2h should at least contains: 30 // ipc_header, msg_info and fw_load (message body) 31 if (ipc_info->i_len < sizeof(struct ipc_header) + 32 sizeof(struct msg_info) + sizeof(struct fw_load)) { 33 pr_info("%s(): msg format error\n", __func__); 34 return NULL; 35 } 36 u_len = ipc_info->i_len - sizeof(struct ipc_header); 37 msg = (struct ipc_msg *)(kzalloc(sizeof(struct ipc_msg) + u_len, 38 GFP_ATOMIC)); 39 if (!msg) { 40 pr_info("%s(): ipc_msg kzalloc failed\n", __func__); 41 return NULL; 42 } 43 44 msg->header.inst_id = ipc_info->inst_id; 45 msg->header.tgid = ipc_info->tgid; 46 msg->header.i_len = ipc_info->i_len; 47 48 device_msg_data = (uint8_t *)(d2h + sizeof(struct ipc_header)); 49 memcpy_fromio((uint8_t *)msg->i_data, device_msg_data, u_len); 50 51 return msg; 52 } 53 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 24372/30000] drivers/gpu/drm/inspur/inspur_drm_drv.c:30:13: warning: no previous prototype for 'inspur_drm_interrupt'
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 459341c4b4845b283c7a884e6a0dc4bd8cdb89e6 commit: b9d65551a3adfa87a7c5d33391187ee60a1b501d [24372/30000] drm: add inspur drm driver support config: x86_64-randconfig-006-20240323 (https://download.01.org/0day-ci/archive/20240323/202403230614.AetkQYPg-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403230614.AetkQYPg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403230614.AetkQYPg-lkp@intel.com/ All error/warnings (new ones prefixed by >>): ld: mm/vmscan.o: in function `kernel_swap_check': >> mm/vmscan.c:3481: undefined reference to `kernel_swap_enabled' >> ld: mm/vmscan.c:3481: undefined reference to `kernel_swap_enabled' >> ld: mm/vmscan.c:3481: undefined reference to `kernel_swap_enabled' ld: drivers/video/fbdev/ls2k500sfb.o: in function `ls2k500sfb_events_fn': >> drivers/video/fbdev/ls2k500sfb.c:246: undefined reference to `fg_console' >> ld: drivers/video/fbdev/ls2k500sfb.c:246: undefined reference to `fg_console' >> ld: drivers/video/fbdev/ls2k500sfb.c:246: undefined reference to `fg_console' -- >> drivers/gpu/drm/inspur/inspur_drm_drv.c:30:13: warning: no previous prototype for 'inspur_drm_interrupt' [-Wmissing-prototypes] 30 | irqreturn_t inspur_drm_interrupt(int irq, void *arg) | ^~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/inspur/inspur_drm_drv.c: In function 'inspur_pci_probe': drivers/gpu/drm/inspur/inspur_drm_drv.c:379:36: warning: unused variable 'priv' [-Wunused-variable] 379 | struct inspur_drm_private *priv; | ^~~~ vim +/inspur_drm_interrupt +30 drivers/gpu/drm/inspur/inspur_drm_drv.c 27 28 29 DEFINE_DRM_GEM_FOPS(inspur_fops); > 30 irqreturn_t inspur_drm_interrupt(int irq, void *arg) 31 { 32 struct drm_device *dev = (struct drm_device *)arg; 33 struct inspur_drm_private *priv = 34 (struct inspur_drm_private *)dev->dev_private; 35 u32 status; 36 37 status = readl(priv->mmio + INSPUR_RAW_INTERRUPT); 38 39 if (status & INSPUR_RAW_INTERRUPT_VBLANK(1)) { 40 writel(INSPUR_RAW_INTERRUPT_VBLANK(1), 41 priv->mmio + INSPUR_RAW_INTERRUPT); 42 drm_handle_vblank(dev, 0); 43 } 44 45 return IRQ_HANDLED; 46 } 47 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 1b4212c630731d88b07d5b6e28ecaff1a76d3839
by kernel test robot 23 Mar '24

23 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 1b4212c630731d88b07d5b6e28ecaff1a76d3839 !5412 [OLK-6.6] perf/x86/amd: Miscellaneous fixes Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-001-20240323 | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-poll_free_mdio | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_get_pauseparam | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_set_pauseparam | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_addr_list_itr | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_check_mac_link_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_clean_link_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_driver_status_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clear_rar_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clear_vmdq_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_all_layer2_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_all_tuple5_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_layer2_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_mc_addr_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_tuple5_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_vfta_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_layer2_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_rar_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_rss_hfunc_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_rx_skip_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_tcp_sync_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_tuple5_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_vfta_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_vmdq_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_update_mc_addr_list_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_update_rss_key_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_update_rss_table_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_lldp_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_lpi_status_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_ncsi_mac_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_ncsi_vlan_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_permtion_mac_addr_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_init_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_layer2_pritologic_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_check_link_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_fc_mode_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_mdio_read_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_mdio_write_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_pmt_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_set_eee_timer_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_set_mac_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mdio_read | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_phy_read_reg_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_phy_write_reg_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_reset_eee_mode_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_reset_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_eee_mode_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_eee_pls_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_eee_timer_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_ethtool_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_lldp_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_vf_vlan_mode_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_setup_eee_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_setup_mac_link_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_setup_wol_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_start_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_tuple5_pritologic_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_common.h:warning:suggest-braces-around-empty-body-in-an-if-statement | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_lib.c:warning:no-previous-prototype-for-rnpgbe_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_lib.c:warning:no-previous-prototype-for-update_ring_count | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-print_status | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_disable_eee_mode | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_eee_init | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_phy_init_eee | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_reinit_locked | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:suggest-braces-around-empty-body-in-an-if-statement | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_fw_reg_read | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_fw_send_cmd_wait | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_link_stat_mark_disable | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_link_stat_mark_reset | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_mbx_fw_post_req | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_mbx_get_link | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_mbx_write_posted_locked | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-to_mac_type | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_ptp.c:warning:no-previous-prototype-for-rnpgbe_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_sriov.c:warning:no-previous-prototype-for-check_ari_mode | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_sriov.c:warning:no-previous-prototype-for-rnpgbe_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_sysfs.c:warning:no-previous-prototype-for-n500_exchange_share_ram | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_layer2_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping_tcam | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-clean_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-control_mac_rx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_can_rpu_start | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_check_mc_addr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_fix_queue_number | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_event_schedule | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_task | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_write_eitr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring_temp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-update_pf_vlan | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-wait_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_get_capablity | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_reg_read | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_send_cmd_wait | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_get_port_stats2 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_link_stat_mark_disable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_fw_post_req | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_pluginout_evt_en | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_write_posted_locked | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-rnpm_reset_pipeline_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-rnpm_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:suggest-braces-around-empty-body-in-an-if-statement | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-rnpm_mbx_get_pn_sn | |-- drivers-net-ethernet-mucse-rnpm-rnpm_tc_u32_parse.h:warning:rnpm_ipv4_parser-defined-but-not-used | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo `-- loongarch-randconfig-001-20240323 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-003-20240323 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- arm64-randconfig-004-20240323 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-allyesconfig |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used |-- ld.lld:error:duplicate-symbol:__cfi_check_ari_mode |-- ld.lld:error:duplicate-symbol:__cfi_mbx_cookie_zalloc |-- ld.lld:error:duplicate-symbol:check_ari_mode |-- ld.lld:error:duplicate-symbol:mbx_cookie_zalloc |-- ld.lld:error:duplicate-symbol:rnp10_netdev_ops |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true elapsed time: 720m configs tested: 16 configs skipped: 144 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240323 gcc arm64 randconfig-002-20240323 gcc arm64 randconfig-003-20240323 clang arm64 randconfig-004-20240323 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240323 gcc loongarch randconfig-002-20240323 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 459341c4b4845b283c7a884e6a0dc4bd8cdb89e6
by kernel test robot 23 Mar '24

23 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 459341c4b4845b283c7a884e6a0dc4bd8cdb89e6 !5316 v2 iomap: add support to track dirty state of sub pages Error/Warning: (recently discovered and may have been fixed) mm/share_pool.c:4227:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240312 `-- mm-share_pool.c:error:HUGETLB_ALLOC_BUDDY-undeclared-(first-use-in-this-function) clang_recent_errors `-- x86_64-allyesconfig |-- drivers-infiniband-hw-xsc-mem.c:warning:no-previous-prototype-for-function-xsc_find_chunk_cont_0 |-- drivers-infiniband-hw-xsc-mr.c:warning:variable-using_peer_mem-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-eecd-description-in-rnpm_lower_eeprom_clk |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hash_value-description-in-rnpm_set_mta |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hw-description-in-rnpm_mta_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-pf-description-in-rnpm_set_vlan_anti_spoofing |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-count-not-described-in-rnpm_shift_in_eeprom_bits |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-eec-not-described-in-rnpm_lower_eeprom_clk |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mc_addr-not-described-in-rnpm_set_mta |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mode-not-described-in-rnpm_mta_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-vf-not-described-in-rnpm_set_vlan_anti_spoofing |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnpm_dbg_adapter_exit |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_dbg_adapter_exit |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_get_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ee-description-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-flags-description-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_set_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_info |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_rxnfc |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-pf-description-in-rnpm_get_rss_hash_opts |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_get_rss_hash_opts |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_info |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_rxnfc |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-eeprom-not-described-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_set_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_get_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-priv_flags-not-described-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-autoneg_changed-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-dma_ch-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-duplex_changed-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-v_count-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_layer2_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping_tcam |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-ent-description-in-rnpm_probe |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-hw-description-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-link_speed-description-in-rnpm_watchdog_update_link |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-maxrate-description-in-rnpm_tx_maxrate_own |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_setup_tc |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_tx_maxrate_own |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-pb-description-in-rnpm_lpbthresh |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-queue-description-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-skb-description-in-rnpm_is_non_eop |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_rx_resources |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_tx_resources |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_tx_maxrate_own |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_setup_tc |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-id-not-described-in-rnpm_probe |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-is_rxframe-not-described-in-rnpm_write_eitr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnpm_clean_tx_irq |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_msix_vector-not-described-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_queue-not-described-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnpm_tx_timeout |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-clean_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-control_mac_rx |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_can_rpu_start |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_check_mc_addr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_clear_udp_tunnel_port |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_fix_queue_number |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_event_schedule |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_task |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_vlan_stags_flag |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_write_eitr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring_temp |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-update_pf_vlan |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-wait_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-hw-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-packets-is-used-uninitialized-whenever-if-condition-is-false |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-xdp_xmit-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_ack_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_msg_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_read_mbx_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_ack_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_msg_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_read_mbx_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-mbx_cookie_zalloc |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_get_capablity |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_reg_read |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_send_cmd_wait |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_get_port_stats2 |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_link_stat_mark_disable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_fw_post_req |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_pluginout_evt_en |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_write_posted_locked |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-is-uninitialized-when-used-here |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-hw-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-value-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-atr_input-description-in-rnpm_atr_compute_perfect_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-stream-description-in-rnpm_atr_compute_sig_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-common-not-described-in-rnpm_atr_compute_sig_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_perfect_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_sig_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-function-rnpm_reset_pipeline_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:variable-status-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-eeprom_data-description-in-rnpm_read_i2c_sff8472_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_i2c_data |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_phy_type_from_id |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-autoneg_wait_to_complete-not-described-in-rnpm_setup_phy_link_speed_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_read_i2c_byte_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_write_i2c_byte_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-device_type-not-described-in-rnpm_read_phy_reg_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-link_up-not-described-in-rnpm_check_phy_link_tnx |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-phy_id-not-described-in-rnpm_get_phy_type_from_id |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-sff8472_data-not-described-in-rnpm_read_i2c_sff8472_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-speed-not-described-in-rnpm_check_phy_link_tnx |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-function-rnpm_ptp_setup_ptp |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:variable-target-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-function-rnpm_mbx_get_pn_sn |-- drivers-net-ethernet-yunsilicon-xsc-common-xsc_core.h:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_eth_change_link_status |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_get_vf_config |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_get_linear_frag_sz |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_is_linear_skb |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_select_queue |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:variable-txq_ix-is-uninitialized-when-used-here |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-buffer_size-set-but-not-used |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-curr_pfc_en-is-uninitialized-when-used-here |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-prio2buffer-set-but-not-used |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_devid_to_pcie_no |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-find_kallsyms_lookup_name |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-noop_pre |-- drivers-net-ethernet-yusur-k2-..-platform-ys_intr.c:warning:overlapping-comparisons-always-evaluate-to-false |-- drivers-net-ethernet-yusur-k2-ys_k2_tx.c:warning:variable-clean_tail_ptr-set-but-not-used |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 737m configs tested: 11 configs skipped: 133 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240322 clang arm64 randconfig-002-20240322 gcc arm64 randconfig-003-20240322 gcc arm64 randconfig-004-20240322 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] nfsd: fix use-after-free due to delegation race
by Li Lingfeng 22 Mar '24

22 Mar '24

From: "J. Bruce Fields" <bfields(a)redhat.com> stable inclusion from stable-v4.19.222 commit 2becaa990b93cbd2928292c0b669d3abb6cf06d4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I99EU2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 548ec0805c399c65ed66c6641be467f717833ab5 upstream. A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning. Cc: stable(a)vger.kernel.org Signed-off-by: J. Bruce Fields <bfields(a)redhat.com> [Salvatore Bonaccorso: Backport for context changes to versions which do not have 20b7d86f29d3 ("nfsd: use boottime for lease expiry calculation")] Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index c8ce128e0054..d5d40aefd0a6 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -971,6 +971,11 @@ hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp) return 0; } +static bool delegation_hashed(struct nfs4_delegation *dp) +{ + return !(list_empty(&dp->dl_perfile)); +} + static bool unhash_delegation_locked(struct nfs4_delegation *dp) { @@ -978,7 +983,7 @@ unhash_delegation_locked(struct nfs4_delegation *dp) lockdep_assert_held(&state_lock); - if (list_empty(&dp->dl_perfile)) + if (!delegation_hashed(dp)) return false; dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID; @@ -3901,7 +3906,7 @@ static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb) * queued for a lease break. Don't queue it again. */ spin_lock(&state_lock); - if (dp->dl_time == 0) { + if (delegation_hashed(dp) && dp->dl_time == 0) { dp->dl_time = get_seconds(); list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru); } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 22 Mar '24

22 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v4.19.307 commit 3d3898b4d72c677d47fe3cb554449f2df5c12555 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 8f856e0a85a6..0c10dd93cb74 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -76,10 +76,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2144,7 +2144,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2230,7 +2230,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2270,7 +2270,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2377,7 +2377,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2410,7 +2410,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2562,14 +2562,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2598,7 +2598,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2608,9 +2608,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2658,7 +2658,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2680,7 +2680,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2692,7 +2692,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2723,7 +2723,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2774,7 +2774,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2802,7 +2802,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2857,12 +2857,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2875,7 +2875,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2896,21 +2896,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] jfs: fix cve-2023-52600
by Long Li 22 Mar '24

22 Mar '24

This patch set fix cve-2023-52600 Dongliang Mu (1): JFS: fix memleak in jfs_mount Edward Adam Davis (1): jfs: fix uaf in jfs_evict_inode fs/jfs/jfs_mount.c | 57 ++++++++++++++++++++-------------------------- 1 file changed, 25 insertions(+), 32 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS] jfs: fix array-index-out-of-bounds in diNewExt
by Long Li 22 Mar '24

22 Mar '24

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v4.19.273 commit f423528488e4f9606cef858eceea210bf1163f41 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G7F CVE: CVE-2023-52599 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 49f9637aafa6e63ba686c13cb8549bf5e6920402 ] [Syz report] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2 index -878706688 is out of range for type 'struct iagctl[128]' CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360 diAllocExt fs/jfs/jfs_imap.c:1949 [inline] diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666 diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587 ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56 jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225 vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106 do_mkdirat+0x264/0x3a0 fs/namei.c:4129 __do_sys_mkdir fs/namei.c:4149 [inline] __se_sys_mkdir fs/namei.c:4147 [inline] __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fcb7e6a0b57 Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57 RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140 RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [Analysis] When the agstart is too large, it can cause agno overflow. [Fix] After obtaining agno, if the value is invalid, exit the subsequent process. Reported-and-tested-by: syzbot+553d90297e6d2f50dbc7(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next report by kernel test robot (Dan Carpenter). Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/jfs/jfs_imap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c index 93e8c590ff5c..49fb0e088606 100644 --- a/fs/jfs/jfs_imap.c +++ b/fs/jfs/jfs_imap.c @@ -2190,6 +2190,9 @@ static int diNewExt(struct inomap * imap, struct iag * iagp, int extno) /* get the ag and iag numbers for this iag. */ agno = BLKTOAG(le64_to_cpu(iagp->agstart), sbi); + if (agno >= MAXAG || agno < 0) + return -EIO; + iagno = le32_to_cpu(iagp->iagnum); /* check if this is the last free extent within the -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 0/1] Fixed CVE-2021-47112
by Zheng Zengkai 22 Mar '24

22 Mar '24

According to https://www.cve.org/CVERecord/?id=CVE-2021-47112 and https://lore.kernel.org/linux-cve-announce/2024031507-CVE-2021-47112-339c@g… openEuler-1.0-LTS is also affected by CVE-2021-47112, backport patch suggested by https://nvd.nist.gov/vuln/detail/CVE-2021-47112 to fix it. Vitaly Kuznetsov (1): x86/kvm: Teardown PV features on boot CPU as well arch/x86/kernel/kvm.c | 57 +++++++++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 16 deletions(-) -- 2.20.1

2 2

[PATCH] KVM: arm64: Translate logic cluster id to physical cluster id when updating lsudvmbm
by chenxiang 22 Mar '24

22 Mar '24

From: Xiang Chen <chenxiang66(a)hisilicon.com> virt inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I99TYA ----------------------------------------------------------------- For dvmbm feature, MN requires physical cluster id while it is filled with logic cluster id right now. In some situations which physical cluster id is not equal to logic cluster id such as in PG boards, it will cause issues when enabling dvmbm. To avoid the issue, translate logic cluster id to physical cluster id when updating lsudvmbm. Signed-off-by: Xiang Chen <chenxiang66(a)hisilicon.com> Signed-off-by: Yanan Wang <wangyanan55(a)huawei.com> Signed-off-by: caijian <caijian11(a)h-partners.com> --- arch/arm64/kvm/arm.c | 3 + arch/arm64/kvm/hisilicon/hisi_virt.c | 151 +++++++++++++++++++++++++-- arch/arm64/kvm/hisilicon/hisi_virt.h | 16 +++ 3 files changed, 163 insertions(+), 7 deletions(-) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 859689e80ec4..bf2c482b4e65 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -2547,6 +2547,9 @@ static __init int kvm_arm_init(void) kvm_info("KVM ncsnp %s\n", kvm_ncsnp_support ? "enabled" : "disabled"); kvm_info("KVM dvmbm %s\n", kvm_dvmbm_support ? "enabled" : "disabled"); + if (kvm_dvmbm_support) + kvm_get_pg_cfg(); + in_hyp_mode = is_kernel_in_hyp_mode(); if (cpus_have_final_cap(ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE) || diff --git a/arch/arm64/kvm/hisilicon/hisi_virt.c b/arch/arm64/kvm/hisilicon/hisi_virt.c index 662ddf5b124b..68809f10e8d7 100644 --- a/arch/arm64/kvm/hisilicon/hisi_virt.c +++ b/arch/arm64/kvm/hisilicon/hisi_virt.c @@ -234,12 +234,97 @@ static int kvm_dvmbm_get_dies_info(struct kvm *kvm, u64 *vm_aff3s, int size) return num; } +static u32 socket_num, die_num; + +static u32 kvm_get_socket_num(void) +{ + int socket_id[MAX_PG_CFG_SOCKETS], cpu; + u32 num = 0; + + for_each_cpu(cpu, cpu_possible_mask) { + bool found = false; + u64 aff3, socket; + int i; + + aff3 = MPIDR_AFFINITY_LEVEL(cpu_logical_map(cpu), 3); + /* aff3[7:3]: socket ID */ + socket = (aff3 & SOCKET_ID_MASK) >> SOCKET_ID_SHIFT; + for (i = 0; i < num; i++) { + if (socket_id[i] == socket) { + found = true; + break; + } + } + if (!found) + socket_id[num++] = socket; + } + return num; +} + +static u32 kvm_get_die_num(void) +{ + int die_id[MAX_DIES_PER_SOCKET], cpu; + u32 num = 0; + + for_each_cpu(cpu, cpu_possible_mask) { + bool found = false; + u64 aff3, die; + int i; + + aff3 = MPIDR_AFFINITY_LEVEL(cpu_logical_map(cpu), 3); + /* aff3[2:0]: die ID */ + die = aff3 & DIE_ID_MASK; + for (i = 0; i < num; i++) { + if (die_id[i] == die) { + found = true; + break; + } + } + if (!found) + die_id[num++] = die; + } + return num; +} + +static u32 g_die_pg[MAX_PG_CFG_SOCKETS * MAX_DIES_PER_SOCKET][MAX_CLUSTERS_PER_DIE]; + +static void kvm_get_die_pg(unsigned long pg_cfg, int socket_id, int die_id) +{ + u32 pg_num = 0, i, j; + u32 pg_flag[MAX_CLUSTERS_PER_DIE]; + u32 die_tmp = socket_id * die_num + die_id; + + for (i = 0; i < MAX_CLUSTERS_PER_DIE; i++) { + if (test_bit(i, &pg_cfg)) + pg_num++; + g_die_pg[die_tmp][i] = i; + pg_flag[i] = 0; + } + + for (i = 0; i < MAX_CLUSTERS_PER_DIE - pg_num; i++) { + if (test_bit(i, &pg_cfg)) { + for (j = 0; j < pg_num; j++) { + u32 cluster_bak = MAX_CLUSTERS_PER_DIE - pg_num + j; + + if (!test_bit(cluster_bak, &pg_cfg) && + !pg_flag[cluster_bak]) { + pg_flag[cluster_bak] = 1; + g_die_pg[die_tmp][i] = cluster_bak; + g_die_pg[die_tmp][cluster_bak] = i; + break; + } + } + } + } +} + static void kvm_update_vm_lsudvmbm(struct kvm *kvm) { - u64 mpidr, aff3, aff2, aff1; + u64 mpidr, aff3, aff2, aff1, phy_aff2; u64 vm_aff3s[DVMBM_MAX_DIES]; u64 val; int cpu, nr_dies; + u32 socket_id, die_id; nr_dies = kvm_dvmbm_get_dies_info(kvm, vm_aff3s, DVMBM_MAX_DIES); if (nr_dies > 2) { @@ -254,10 +339,18 @@ static void kvm_update_vm_lsudvmbm(struct kvm *kvm) /* fulfill bits [52:0] */ for_each_cpu(cpu, kvm->arch.sched_cpus) { mpidr = cpu_logical_map(cpu); + aff3 = MPIDR_AFFINITY_LEVEL(mpidr, 3); aff2 = MPIDR_AFFINITY_LEVEL(mpidr, 2); aff1 = MPIDR_AFFINITY_LEVEL(mpidr, 1); - - val |= 1ULL << (aff2 * 4 + aff1); + socket_id = (aff3 & SOCKET_ID_MASK) >> SOCKET_ID_SHIFT; + die_id = (aff3 & DIE_ID_MASK) >> DIE_ID_SHIFT; + if (die_id == TOTEM_B_ID) + die_id = 0; + else + die_id = 1; + + phy_aff2 = g_die_pg[socket_id * die_num + die_id][aff2]; + val |= 1ULL << (phy_aff2 * 4 + aff1); } goto out_update; @@ -274,11 +367,20 @@ static void kvm_update_vm_lsudvmbm(struct kvm *kvm) mpidr = cpu_logical_map(cpu); aff3 = MPIDR_AFFINITY_LEVEL(mpidr, 3); aff2 = MPIDR_AFFINITY_LEVEL(mpidr, 2); - - if (aff3 == vm_aff3s[0]) - val |= 1ULL << (aff2 + DVMBM_DIE1_CLUSTER_SHIFT); + socket_id = (aff3 & SOCKET_ID_MASK) >> SOCKET_ID_SHIFT; + die_id = (aff3 & DIE_ID_MASK) >> DIE_ID_SHIFT; + if (die_id == TOTEM_B_ID) + die_id = 0; else - val |= 1ULL << (aff2 + DVMBM_DIE2_CLUSTER_SHIFT); + die_id = 1; + + if (aff3 == vm_aff3s[0]) { + phy_aff2 = g_die_pg[socket_id * die_num + die_id][aff2]; + val |= 1ULL << (phy_aff2 + DVMBM_DIE1_CLUSTER_SHIFT); + } else { + phy_aff2 = g_die_pg[socket_id * die_num + die_id][aff2]; + val |= 1ULL << (phy_aff2 + DVMBM_DIE2_CLUSTER_SHIFT); + } } out_update: @@ -345,6 +447,41 @@ void kvm_tlbi_dvmbm_vcpu_put(struct kvm_vcpu *vcpu) cpumask_copy(vcpu->arch.pre_sched_cpus, vcpu->arch.sched_cpus); } +void kvm_get_pg_cfg(void) +{ + void __iomem *mn_base; + u32 i, j; + u32 pg_cfgs[MAX_PG_CFG_SOCKETS * MAX_DIES_PER_SOCKET]; + u64 mn_phy_base; + u32 val; + + socket_num = kvm_get_socket_num(); + die_num = kvm_get_die_num(); + + for (i = 0; i < socket_num; i++) { + for (j = 0; j < die_num; j++) { + + /* + * totem B means the first CPU DIE within a SOCKET, + * totem A means the second one. + */ + mn_phy_base = (j == 0) ? TB_MN_BASE : TA_MN_BASE; + mn_phy_base += CHIP_ADDR_OFFSET(i); + mn_phy_base += MN_ECO0_OFFSET; + + mn_base = ioremap(mn_phy_base, 4); + if (!mn_base) { + kvm_info("MN base addr ioremap failed\n"); + return; + } + val = readl_relaxed(mn_base); + pg_cfgs[j + i * die_num] = val & 0xff; + kvm_get_die_pg(pg_cfgs[j + i * die_num], i, j); + iounmap(mn_base); + } + } +} + int kvm_sched_affinity_vm_init(struct kvm *kvm) { if (!kvm_dvmbm_support) diff --git a/arch/arm64/kvm/hisilicon/hisi_virt.h b/arch/arm64/kvm/hisilicon/hisi_virt.h index 4e162b7f6688..e2f521d8fe10 100644 --- a/arch/arm64/kvm/hisilicon/hisi_virt.h +++ b/arch/arm64/kvm/hisilicon/hisi_virt.h @@ -20,6 +20,21 @@ enum hisi_cpu_type { #define SYS_LSUDVM_CTRL_EL2 sys_reg(3, 4, 15, 7, 4) #define LSUDVM_CTLR_EL2_MASK BIT_ULL(0) +#define MAX_CLUSTERS_PER_DIE 8 +#define TB_MN_BASE 0x00C6067f0000 +#define TA_MN_BASE 0x0046067F0000 +#define CHIP_ADDR_OFFSET(_chip) (((((_chip) >> 3) & 0x1) * 0x80000000000) + \ + ((((_chip) >> 2) & 0x1) * (0x100000000000)) + \ + (((_chip) & 0x3) * 0x200000000000)) +#define MAX_PG_CFG_SOCKETS 4 +#define MAX_DIES_PER_SOCKET 2 +#define MN_ECO0_OFFSET 0xc00 +#define SOCKET_ID_MASK 0xf8 +#define SOCKET_ID_SHIFT 3 +#define DIE_ID_MASK 0x7 +#define DIE_ID_SHIFT 0 +#define TOTEM_B_ID 3 + /* * MPIDR_EL1 layout on HIP09 * @@ -50,6 +65,7 @@ enum hisi_cpu_type { void probe_hisi_cpu_type(void); bool hisi_ncsnp_supported(void); bool hisi_dvmbm_supported(void); +void kvm_get_pg_cfg(void); int kvm_sched_affinity_vcpu_init(struct kvm_vcpu *vcpu); void kvm_sched_affinity_vcpu_destroy(struct kvm_vcpu *vcpu); -- 2.30.0

1 0

[PATCH openEuler-1.0-LTS v4 0/5] CVE-2021-47131
by Ziyang Xuan 22 Mar '24

22 Mar '24

Patchset for CVE-2021-47131. v4: - Resend for PR create failed. v3: - Delete "Reference" head comment. v2: - Add bugfix patches for CVE patch. Maxim Mikityanskiy (5): net/tls: Replace TLS_RX_SYNC_RUNNING with RCU net/tls: Fix use-after-free after the TLS device goes down and up tls: Fix context leak on tls_device_down net/tls: Remove the context from the list in tls_device_down net/tls: Use RCU API to access tls_ctx->netdev include/net/tls.h | 13 ++++- net/tls/tls_device.c | 89 ++++++++++++++++++++++++++++------- net/tls/tls_device_fallback.c | 9 +++- net/tls/tls_main.c | 1 + 4 files changed, 93 insertions(+), 19 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-22.03-LTS-SP1] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 22 Mar '24

22 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 23e51992c964..6f42aed070dc 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2138,7 +2138,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2224,7 +2224,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2264,7 +2264,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2371,7 +2371,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2404,7 +2404,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2556,14 +2556,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2592,7 +2592,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2602,9 +2602,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2652,7 +2652,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2674,7 +2674,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2717,7 +2717,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2768,7 +2768,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2796,7 +2796,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2851,12 +2851,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2869,7 +2869,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2890,21 +2890,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 22 Mar '24

22 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v4.19.307 commit 3d3898b4d72c677d47fe3cb554449f2df5c12555 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 8f856e0a85a6..0c10dd93cb74 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -76,10 +76,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2144,7 +2144,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2230,7 +2230,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2270,7 +2270,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2377,7 +2377,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2410,7 +2410,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2562,14 +2562,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2598,7 +2598,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2608,9 +2608,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2658,7 +2658,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2680,7 +2680,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2692,7 +2692,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2723,7 +2723,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2774,7 +2774,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2802,7 +2802,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2857,12 +2857,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2875,7 +2875,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2896,21 +2896,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH OLK-5.10] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 22 Mar '24

22 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index cb31ea51a54d..a8092fcd67e8 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2164,7 +2164,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2250,7 +2250,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2290,7 +2290,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2397,7 +2397,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2430,7 +2430,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2582,14 +2582,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2618,7 +2618,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2628,9 +2628,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2678,7 +2678,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2700,7 +2700,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2712,7 +2712,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2743,7 +2743,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2794,7 +2794,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2822,7 +2822,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2877,12 +2877,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2895,7 +2895,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2916,21 +2916,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP2] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 22 Mar '24

22 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 72dae2623f05..c94c95e1c332 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2153,7 +2153,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2239,7 +2239,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2279,7 +2279,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2386,7 +2386,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2419,7 +2419,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2571,14 +2571,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2607,7 +2607,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2617,9 +2617,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2667,7 +2667,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2689,7 +2689,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2701,7 +2701,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2732,7 +2732,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2783,7 +2783,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2811,7 +2811,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2866,12 +2866,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2884,7 +2884,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2905,21 +2905,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 6

[PATCH openEuler-22.03-LTS] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 22 Mar '24

22 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 23e51992c964..6f42aed070dc 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2138,7 +2138,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2224,7 +2224,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2264,7 +2264,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2371,7 +2371,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2404,7 +2404,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2556,14 +2556,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2592,7 +2592,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2602,9 +2602,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2652,7 +2652,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2674,7 +2674,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2717,7 +2717,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2768,7 +2768,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2796,7 +2796,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2851,12 +2851,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2869,7 +2869,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2890,21 +2890,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 6

[openeuler:OLK-6.6] BUILD REGRESSION c62a9941197918c1d03b99495e3a9d5d6884c0c8
by kernel test robot 22 Mar '24

22 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: c62a9941197918c1d03b99495e3a9d5d6884c0c8 !5451 arm64: Delete macro in the scsnp feature Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead `-- loongarch-allmodconfig |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-poll_free_mdio |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_get_link_ksettings |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_get_pauseparam |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_set_link_ksettings |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_set_pauseparam |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_addr_list_itr |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_check_mac_link_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_clean_link_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_driver_status_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clear_rar_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clear_vmdq_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_all_layer2_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_all_tuple5_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_layer2_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_mc_addr_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_tuple5_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_vfta_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_layer2_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_rar_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_rss_hfunc_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_rx_skip_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_tcp_sync_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_tuple5_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_vfta_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_vmdq_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_update_mc_addr_list_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_update_rss_key_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_update_rss_table_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_lldp_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_lpi_status_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_ncsi_mac_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_ncsi_vlan_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_permtion_mac_addr_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_init_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_layer2_pritologic_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_check_link_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_fc_mode_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_mdio_read_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_mdio_write_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_pmt_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_set_eee_timer_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_set_mac_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mdio_read |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_phy_read_reg_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_phy_write_reg_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_reset_eee_mode_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_reset_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_eee_mode_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_eee_pls_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_eee_timer_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_ethtool_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_lldp_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_vf_vlan_mode_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_setup_eee_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_setup_mac_link_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_setup_wol_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_start_hw_ops_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_tuple5_pritologic_n500 |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_common.h:warning:suggest-braces-around-empty-body-in-an-if-statement |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_lib.c:warning:no-previous-prototype-for-rnpgbe_acquire_msix_vectors |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_lib.c:warning:no-previous-prototype-for-update_ring_count |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-print_status |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_disable_eee_mode |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_eee_init |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_phy_init_eee |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_reinit_locked |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_vlan_stags_flag |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_write_eitr_rx |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_xmit_nop_frame_ring |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:suggest-braces-around-empty-body-in-an-if-statement |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_fw_reg_read |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_fw_send_cmd_wait |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_link_stat_mark_disable |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_link_stat_mark_reset |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_mbx_fw_post_req |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_mbx_get_link |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_mbx_write_posted_locked |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-to_mac_type |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_ptp.c:warning:no-previous-prototype-for-rnpgbe_ptp_setup_ptp |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_sriov.c:warning:no-previous-prototype-for-check_ari_mode |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_sriov.c:warning:no-previous-prototype-for-rnpgbe_msg_post_status_signle_link |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_sysfs.c:warning:no-previous-prototype-for-n500_exchange_share_ram |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-rnpm_get_phy_statistics |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_layer2_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping_tcam |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-clean_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-control_mac_rx |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_can_rpu_start |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_check_mc_addr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_clear_udp_tunnel_port |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_fix_queue_number |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_event_schedule |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_task |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_vlan_stags_flag |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_write_eitr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring_temp |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-update_pf_vlan |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-wait_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_get_capablity |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_reg_read |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_send_cmd_wait |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_get_port_stats2 |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_link_stat_mark_disable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_fw_post_req |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_pluginout_evt_en |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_write_posted_locked |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-rnpm_reset_pipeline_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-rnpm_ptp_setup_ptp |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:suggest-braces-around-empty-body-in-an-if-statement |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_get_vf_ringnum |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_setup_ring_maxrate |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-rnpm_mbx_get_pn_sn |-- drivers-net-ethernet-mucse-rnpm-rnpm_tc_u32_parse.h:warning:rnpm_ipv4_parser-defined-but-not-used |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-allmodconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-allyesconfig |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used |-- ld.lld:error:duplicate-symbol:__cfi_check_ari_mode |-- ld.lld:error:duplicate-symbol:__cfi_mbx_cookie_zalloc |-- ld.lld:error:duplicate-symbol:check_ari_mode |-- ld.lld:error:duplicate-symbol:mbx_cookie_zalloc |-- ld.lld:error:duplicate-symbol:rnp10_netdev_ops |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true elapsed time: 1114m configs tested: 10 configs skipped: 94 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 22 Mar '24

22 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 23e51992c964..6f42aed070dc 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2138,7 +2138,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2224,7 +2224,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2264,7 +2264,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2371,7 +2371,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2404,7 +2404,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2556,14 +2556,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2592,7 +2592,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2602,9 +2602,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2652,7 +2652,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2674,7 +2674,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2717,7 +2717,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2768,7 +2768,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2796,7 +2796,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2851,12 +2851,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2869,7 +2869,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2890,21 +2890,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 6

[PATCH openEuler-1.0-LTS v3 0/5] CVE-2021-47131
by Ziyang Xuan 22 Mar '24

22 Mar '24

Patchset for CVE-2021-47131. v3: - Delete "Reference" head comment. v2: - Add bugfix patches for CVE patch. Maxim Mikityanskiy (5): net/tls: Replace TLS_RX_SYNC_RUNNING with RCU net/tls: Fix use-after-free after the TLS device goes down and up tls: Fix context leak on tls_device_down net/tls: Remove the context from the list in tls_device_down net/tls: Use RCU API to access tls_ctx->netdev include/net/tls.h | 13 ++++- net/tls/tls_device.c | 89 ++++++++++++++++++++++++++++------- net/tls/tls_device_fallback.c | 9 +++- net/tls/tls_main.c | 1 + 4 files changed, 93 insertions(+), 19 deletions(-) -- 2.25.1

2 24

[openeuler:openEuler-1.0-LTS 13350/21917] ERROR: "netlink_kernel_release" [fs/ext4/ext4.ko] undefined!
by kernel test robot 22 Mar '24

22 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7875dd004c18a516e18108ebd879dd1f5c62d753 commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [13350/21917] ext4: report error to userspace by netlink config: x86_64-buildonly-randconfig-003-20240319 (https://download.01.org/0day-ci/archive/20240322/202403220708.c9s8I4tC-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240322/202403220708.c9s8I4tC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403220708.c9s8I4tC-lkp@intel.com/ All errors (new ones prefixed by >>): >> ERROR: "netlink_kernel_release" [fs/ext4/ext4.ko] undefined! >> ERROR: "__netlink_kernel_create" [fs/ext4/ext4.ko] undefined! >> ERROR: "init_net" [fs/ext4/ext4.ko] undefined! >> ERROR: "netlink_broadcast" [fs/ext4/ext4.ko] undefined! >> ERROR: "__nlmsg_put" [fs/ext4/ext4.ko] undefined! >> ERROR: "kfree_skb" [fs/ext4/ext4.ko] undefined! >> ERROR: "__alloc_skb" [fs/ext4/ext4.ko] undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] wifi: iwlwifi: fix a memory corruption
by Guo Mengqi 21 Mar '24

21 Mar '24

From: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> stable inclusion from stable-v5.10.210 commit 05dd9facfb9a1e056752c0901c6e86416037d15a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NI6 CVE: CVE-2024-26610 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d upstream. iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in bytes, we'll write past the buffer. Cc: stable(a)vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218233 Fixes: cf29c5b66b9f ("iwlwifi: dbg_ini: implement time point handling") Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://msgid.link/20240111150610.2d2b8b870194.I14ed76505a5cf87304e0c9cc05c… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c index fdf2c6ea41d9..bcaec8a184cd 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c @@ -876,7 +876,7 @@ static int iwl_dbg_tlv_override_trig_node(struct iwl_fw_runtime *fwrt, node_trig = (void *)node_tlv->data; } - memcpy(node_trig->data + offset, trig->data, trig_data_len); + memcpy((u8 *)node_trig->data + offset, trig->data, trig_data_len); node_tlv->length = cpu_to_le32(size); if (policy & IWL_FW_INI_APPLY_POLICY_OVERRIDE_CFG) { -- 2.17.1

2 1

[PATCH OLK-5.10] media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
by Guo Mengqi 21 Mar '24

21 Mar '24

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v5.10.210 commit 43872f44eee6c6781fea1348b38885d8e78face9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NHC CVE: CVE-2023-52491 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 206c857dd17d4d026de85866f1b5f0969f2a109e ] In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. In mtk_jpeg_dec_device_run, if error happens in mtk_jpeg_set_dec_dst, it will finally start the worker while mark the job as finished by invoking v4l2_m2m_job_finish. There are two methods to trigger the bug. If we remove the module, it which will call mtk_jpeg_remove to make cleanup. The possible sequence is as follows, which will cause a use-after-free bug. CPU0 CPU1 mtk_jpeg_dec_... | start worker | |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use If we close the file descriptor, which will call mtk_jpeg_release, it will have a similar sequence. Fix this bug by starting timeout worker only if started jpegdec worker successfully. Then v4l2_m2m_job_finish will only be called in either mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run. Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Cc: stable(a)vger.kernel.org Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c index 88a23bce569d..95271871dbf7 100644 --- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c +++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c @@ -977,13 +977,13 @@ static void mtk_jpeg_dec_device_run(void *priv) if (ret < 0) goto dec_end; - schedule_delayed_work(&jpeg->job_timeout_work, - msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); - mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs); if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb)) goto dec_end; + schedule_delayed_work(&jpeg->job_timeout_work, + msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); + spin_lock_irqsave(&jpeg->hw_lock, flags); mtk_jpeg_dec_reset(jpeg->reg_base); mtk_jpeg_dec_set_config(jpeg->reg_base, -- 2.17.1

2 1

[PATCH OLK-5.10] wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
by Guo Mengqi 21 Mar '24

21 Mar '24

From: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> stable inclusion from stable-v5.10.210 commit 84770a996ad8d7f121ff2fb5a8d149aad52d64c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G7W CVE: CVE-2023-52594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2adc886244dff60f948497b59affb6c6ebb3c348 ] Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case. Found by a modified version of syzkaller. UBSAN: array-index-out-of-bounds in htc_drv_txrx.c index 13 is out of range for type '__wmi_event_txstatus [12]' Call Trace: ath9k_htc_txstatus ath9k_wmi_event_tasklet tasklet_action_common __do_softirq irq_exit_rxu sysvec_apic_timer_interrupt Signed-off-by: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20231113065756.1491991-1-linuxlovemin@yonsei.ac.kr Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index 622fc7f17040..5037142c5a82 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -647,9 +647,10 @@ void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event) struct ath9k_htc_tx_event *tx_pend; int i; - for (i = 0; i < txs->cnt; i++) { - WARN_ON(txs->cnt > HTC_MAX_TX_STATUS); + if (WARN_ON_ONCE(txs->cnt > HTC_MAX_TX_STATUS)) + return; + for (i = 0; i < txs->cnt; i++) { __txs = &txs->txstatus[i]; skb = ath9k_htc_tx_get_packet(priv, __txs); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
by Guo Mengqi 21 Mar '24

21 Mar '24

From: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> stable inclusion from stable-v4.19.307 commit f44f073c78112ff921a220d01b86d09f2ace59bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G7W CVE: CVE-2023-52594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2adc886244dff60f948497b59affb6c6ebb3c348 ] Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case. Found by a modified version of syzkaller. UBSAN: array-index-out-of-bounds in htc_drv_txrx.c index 13 is out of range for type '__wmi_event_txstatus [12]' Call Trace: ath9k_htc_txstatus ath9k_wmi_event_tasklet tasklet_action_common __do_softirq irq_exit_rxu sysvec_apic_timer_interrupt Signed-off-by: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20231113065756.1491991-1-linuxlovemin@yonsei.ac.kr Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index b5d7ef4da17f..d128fca530e6 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -647,9 +647,10 @@ void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event) struct ath9k_htc_tx_event *tx_pend; int i; - for (i = 0; i < txs->cnt; i++) { - WARN_ON(txs->cnt > HTC_MAX_TX_STATUS); + if (WARN_ON_ONCE(txs->cnt > HTC_MAX_TX_STATUS)) + return; + for (i = 0; i < txs->cnt; i++) { __txs = &txs->txstatus[i]; skb = ath9k_htc_tx_get_packet(priv, __txs); -- 2.17.1

2 1

[PATCH OLK-6.6 V2 00/25] net: hns3: some feature driver inclusion
by Jijie Shao 21 Mar '24

21 Mar '24

From: Jiantao Xiao <xiaojiantao1(a)h-partners.com> Some feature driver inclusion Guangbin Huang (2): net: ethtool: add VxLAN to the NFC API net: hns3: support set/get VxLAN rule of rx flow director by ethtool Hao Chen (2): net: hns3: correct the logic of hclge_sync_vf_qb_mode() net: hns3: add support to query scc version by devlink info Hao Lan (3): net: hns3: add command queue trace for hns3 net: sfp: Synchronize some CMIS transceiver modules from ethtool net: hns3: Add support for some CMIS transceiver modules Jian Shen (5): net: hns3: add support for queue bonding mode of flow director net: hns3: add queue bonding mode support for VF net: hns3: allocate fd counter for queue bonding net: hns3: add support for page_pool_get_stats net: hns3: default select PAGE_POOL_STATS Ke Chen (5): net: hns3: add ROH MAC type definitions and support query MAC type net: hns3: add support handling tx dhcp packets for ROH net: hns3: HNAE3 framework add support for ROH client net: hns3: fix bug for init roh client instance net: hns3: add support for ROH ras Peiyang Wang (5): net: hns3: dump more reg info based on ras mod net: hns3: support tc command with max rate parameter net: hns3: support tc limit rate net: hns3: add arp proxy switch in ethtool net: hns3: support arp proxy Yonglong Liu (1): net: hns3: add support for Hisilicon ptp sync device liaoguojia (2): net: hns3: refactor the debugfs for dumping FD tcam net: hns3: add support for FD counter MAINTAINERS | 5 + arch/arm64/configs/openeuler_defconfig | 3 +- drivers/net/ethernet/hisilicon/Kconfig | 1 + drivers/net/ethernet/hisilicon/hns3/Makefile | 2 +- .../net/ethernet/hisilicon/hns3/hclge_mbx.h | 8 + drivers/net/ethernet/hisilicon/hns3/hnae3.c | 10 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 56 + .../hns3/hns3_common/hclge_comm_cmd.c | 19 + .../hns3/hns3_common/hclge_comm_cmd.h | 25 +- .../ethernet/hisilicon/hns3/hns3_debugfs.c | 4 +- .../net/ethernet/hisilicon/hns3/hns3_enet.c | 286 ++++- .../net/ethernet/hisilicon/hns3/hns3_enet.h | 77 +- .../ethernet/hisilicon/hns3/hns3_ethtool.c | 67 +- .../ethernet/hisilicon/hns3/hns3_ethtool.h | 2 + .../net/ethernet/hisilicon/hns3/hns3_roh.c | 174 +++ .../net/ethernet/hisilicon/hns3/hns3_roh.h | 26 + .../hisilicon/hns3/hns3pf/hclge_cmd.h | 31 +- .../hisilicon/hns3/hns3pf/hclge_dcb.c | 52 +- .../hisilicon/hns3/hns3pf/hclge_debugfs.c | 139 ++- .../hisilicon/hns3/hns3pf/hclge_debugfs.h | 8 +- .../hisilicon/hns3/hns3pf/hclge_devlink.c | 44 +- .../hisilicon/hns3/hns3pf/hclge_devlink.h | 2 + .../hisilicon/hns3/hns3pf/hclge_err.c | 448 ++++++- .../hisilicon/hns3/hns3pf/hclge_err.h | 46 +- .../hisilicon/hns3/hns3pf/hclge_main.c | 691 ++++++++++- .../hisilicon/hns3/hns3pf/hclge_main.h | 14 + .../hisilicon/hns3/hns3pf/hclge_mbx.c | 37 + .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 53 + .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 9 + .../hisilicon/hns3/hns3pf/hclge_trace.h | 94 ++ .../hisilicon/hns3/hns3vf/hclgevf_main.c | 114 ++ .../hisilicon/hns3/hns3vf/hclgevf_main.h | 6 + .../hisilicon/hns3/hns3vf/hclgevf_mbx.c | 17 + .../hisilicon/hns3/hns3vf/hclgevf_trace.h | 50 + drivers/ptp/Kconfig | 11 + drivers/ptp/Makefile | 1 + drivers/ptp/ptp_hisi.c | 1027 +++++++++++++++++ include/linux/sfp.h | 12 + include/uapi/linux/ethtool.h | 48 + 39 files changed, 3647 insertions(+), 72 deletions(-) create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_roh.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_roh.h create mode 100644 drivers/ptp/ptp_hisi.c -- 2.30.0

2 26

[PATCH openEuler-22.03-LTS-SP2] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 21 Mar '24

21 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 72dae2623f05..c94c95e1c332 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2153,7 +2153,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2239,7 +2239,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2279,7 +2279,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2386,7 +2386,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2419,7 +2419,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2571,14 +2571,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2607,7 +2607,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2617,9 +2617,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2667,7 +2667,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2689,7 +2689,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2701,7 +2701,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2732,7 +2732,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2783,7 +2783,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2811,7 +2811,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2866,12 +2866,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2884,7 +2884,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2905,21 +2905,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 21 Mar '24

21 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 23e51992c964..6f42aed070dc 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2138,7 +2138,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2224,7 +2224,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2264,7 +2264,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2371,7 +2371,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2404,7 +2404,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2556,14 +2556,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2592,7 +2592,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2602,9 +2602,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2652,7 +2652,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2674,7 +2674,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2717,7 +2717,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2768,7 +2768,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2796,7 +2796,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2851,12 +2851,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2869,7 +2869,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2890,21 +2890,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 21 Mar '24

21 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 23e51992c964..6f42aed070dc 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2138,7 +2138,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2224,7 +2224,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2264,7 +2264,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2371,7 +2371,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2404,7 +2404,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2556,14 +2556,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2592,7 +2592,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2602,9 +2602,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2652,7 +2652,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2674,7 +2674,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2717,7 +2717,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2768,7 +2768,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2796,7 +2796,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2851,12 +2851,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2869,7 +2869,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2890,21 +2890,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 1

[PATCH OLK-5.10] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 21 Mar '24

21 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index cb31ea51a54d..a8092fcd67e8 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2164,7 +2164,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2250,7 +2250,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2290,7 +2290,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2397,7 +2397,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2430,7 +2430,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2582,14 +2582,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2618,7 +2618,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2628,9 +2628,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2678,7 +2678,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2700,7 +2700,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2712,7 +2712,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2743,7 +2743,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2794,7 +2794,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2822,7 +2822,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2877,12 +2877,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2895,7 +2895,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2916,21 +2916,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 1

[PATCH v2 OLK-6.6] crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
by felix 21 Mar '24

21 Mar '24

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> stable inclusion from stable-v6.6.15 commit 7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JP7 CVE: CVE-2023-52616 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ba3c5574203034781ac4231acf117da917efcd2a upstream. When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately. Fixes: d58bb7e55a8a ("lib/mpi: Introduce ec implementation to MPI library") Cc: stable(a)vger.kernel.org # v6.5 Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- lib/crypto/mpi/ec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/crypto/mpi/ec.c b/lib/crypto/mpi/ec.c index 40f5908e57a4..e16dca1e23d5 100644 --- a/lib/crypto/mpi/ec.c +++ b/lib/crypto/mpi/ec.c @@ -584,6 +584,9 @@ void mpi_ec_init(struct mpi_ec_ctx *ctx, enum gcry_mpi_ec_models model, ctx->a = mpi_copy(a); ctx->b = mpi_copy(b); + ctx->d = NULL; + ctx->t.two_inv_p = NULL; + ctx->t.p_barrett = use_barrett > 0 ? mpi_barrett_init(ctx->p, 0) : NULL; mpi_ec_get_reset(ctx); -- 2.34.1

2 1

[PATCH v2 OLK-5.10] crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
by felix 21 Mar '24

21 Mar '24

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> stable inclusion from stable-v5.10.210 commit 0c3687822259a7628c85cd21a3445cbe3c367165 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JP7 CVE: CVE-2023-52616 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ba3c5574203034781ac4231acf117da917efcd2a ] When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately. Fixes: d58bb7e55a8a ("lib/mpi: Introduce ec implementation to MPI library") Cc: stable(a)vger.kernel.org # v6.5 Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- lib/mpi/ec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/mpi/ec.c b/lib/mpi/ec.c index c21470122dfc..941ba0b0067e 100644 --- a/lib/mpi/ec.c +++ b/lib/mpi/ec.c @@ -584,6 +584,9 @@ void mpi_ec_init(struct mpi_ec_ctx *ctx, enum gcry_mpi_ec_models model, ctx->a = mpi_copy(a); ctx->b = mpi_copy(b); + ctx->d = NULL; + ctx->t.two_inv_p = NULL; + ctx->t.p_barrett = use_barrett > 0 ? mpi_barrett_init(ctx->p, 0) : NULL; mpi_ec_get_reset(ctx); -- 2.34.1

2 1

[PATCH OLK-5.10] crypto: scomp - fix req->dst buffer overflow
by felix 21 Mar '24

21 Mar '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v5.10.209 commit 4518dc468cdd796757190515a9be7408adc8911e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K14 CVE: CVE-2023-52612 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 738f4f8f0f41..4d6366a44400 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) struct crypto_scomp *scomp = *tfm_ctx; void **ctx = acomp_request_ctx(req); struct scomp_scratch *scratch; + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) @@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scratch = raw_cpu_ptr(&scomp_scratch); spin_lock(&scratch->lock); @@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, 1); -- 2.34.1

2 1

[PATCH v2 OLK-6.6] crypto: scomp - fix req->dst buffer overflow
by felix 21 Mar '24

21 Mar '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v6.6.14 commit 7d9e5bed036a7f9e2062a137e97e3c1e77fb8759 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K14 CVE: CVE-2023-52612 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 442a82c9de7d..b108a30a7600 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -117,6 +117,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) struct crypto_scomp *scomp = *tfm_ctx; void **ctx = acomp_request_ctx(req); struct scomp_scratch *scratch; + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) @@ -128,6 +129,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scratch = raw_cpu_ptr(&scomp_scratch); spin_lock(&scratch->lock); @@ -145,6 +148,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, 1); -- 2.34.1

2 1

[PATCH OLK-6.6] crypto: scomp - fix req->dst buffer overflow
by felix 21 Mar '24

21 Mar '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v5.10.209 commit 4518dc468cdd796757190515a9be7408adc8911e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K14 CVE: CVE-2023-52612 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 738f4f8f0f41..4d6366a44400 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) struct crypto_scomp *scomp = *tfm_ctx; void **ctx = acomp_request_ctx(req); struct scomp_scratch *scratch; + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) @@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scratch = raw_cpu_ptr(&scomp_scratch); spin_lock(&scratch->lock); @@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, 1); -- 2.34.1

2 1

[PATCH OLK-6.6] crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
by felix 21 Mar '24

21 Mar '24

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> stable inclusion from stable-v6.6.15 commit 7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JP7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ba3c5574203034781ac4231acf117da917efcd2a upstream. When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately. Fixes: d58bb7e55a8a ("lib/mpi: Introduce ec implementation to MPI library") Cc: stable(a)vger.kernel.org # v6.5 Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- lib/crypto/mpi/ec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/crypto/mpi/ec.c b/lib/crypto/mpi/ec.c index 40f5908e57a4..e16dca1e23d5 100644 --- a/lib/crypto/mpi/ec.c +++ b/lib/crypto/mpi/ec.c @@ -584,6 +584,9 @@ void mpi_ec_init(struct mpi_ec_ctx *ctx, enum gcry_mpi_ec_models model, ctx->a = mpi_copy(a); ctx->b = mpi_copy(b); + ctx->d = NULL; + ctx->t.two_inv_p = NULL; + ctx->t.p_barrett = use_barrett > 0 ? mpi_barrett_init(ctx->p, 0) : NULL; mpi_ec_get_reset(ctx); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47114
by Yifan Qiao 21 Mar '24

21 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH OLK-5.10] crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
by felix 21 Mar '24

21 Mar '24

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> stable inclusion from stable-v5.10.210 commit 0c3687822259a7628c85cd21a3445cbe3c367165 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JP7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ba3c5574203034781ac4231acf117da917efcd2a ] When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately. Fixes: d58bb7e55a8a ("lib/mpi: Introduce ec implementation to MPI library") Cc: stable(a)vger.kernel.org # v6.5 Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- lib/mpi/ec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/mpi/ec.c b/lib/mpi/ec.c index c21470122dfc..941ba0b0067e 100644 --- a/lib/mpi/ec.c +++ b/lib/mpi/ec.c @@ -584,6 +584,9 @@ void mpi_ec_init(struct mpi_ec_ctx *ctx, enum gcry_mpi_ec_models model, ctx->a = mpi_copy(a); ctx->b = mpi_copy(b); + ctx->d = NULL; + ctx->t.two_inv_p = NULL; + ctx->t.p_barrett = use_barrett > 0 ? mpi_barrett_init(ctx->p, 0) : NULL; mpi_ec_get_reset(ctx); -- 2.34.1

2 1

[openeuler:OLK-6.6 4225/4226] ld.lld: error: duplicate symbol: rnp10_netdev_ops
by kernel test robot 21 Mar '24

21 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 1fbfc27b811b42bafdbe80c46f1fd2d9dfb1e976 commit: eba3cbcfeafedc65b74eea8faf68aae00aebd5b6 [4225/4226] drivers: initial support for rnpgbe drivers from Mucse Technology config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240321/202403211514.7Z9ZUvEW-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240321/202403211514.7Z9ZUvEW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403211514.7Z9ZUvEW-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: duplicate symbol: rnp10_netdev_ops >>> defined at rnp_main.c >>> drivers/net/ethernet/mucse/rnp/rnp_main.o:(rnp10_netdev_ops) in archive vmlinux.a >>> defined at rnpgbe_main.c >>> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.o:(.rodata+0x1B8) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: mbx_cookie_zalloc >>> defined at rnpm_mbx_fw.c >>> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.o:(mbx_cookie_zalloc) in archive vmlinux.a >>> defined at rnpgbe_mbx_fw.c >>> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.o:(.text+0x40) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: __cfi_mbx_cookie_zalloc >>> defined at rnpm_mbx_fw.c >>> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.o:(__cfi_mbx_cookie_zalloc) in archive vmlinux.a >>> defined at rnpgbe_mbx_fw.c >>> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.o:(.text+0x0) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: check_ari_mode >>> defined at rnp_sriov.c >>> drivers/net/ethernet/mucse/rnp/rnp_sriov.o:(check_ari_mode) in archive vmlinux.a >>> defined at rnpgbe_sriov.c >>> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_sriov.o:(.text+0x1500) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: __cfi_check_ari_mode >>> defined at rnp_sriov.c >>> drivers/net/ethernet/mucse/rnp/rnp_sriov.o:(__cfi_check_ari_mode) in archive vmlinux.a >>> defined at rnpgbe_sriov.c >>> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_sriov.o:(.text+0x14C0) in archive vmlinux.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP2] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 21 Mar '24

21 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 72dae2623f05..c94c95e1c332 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2153,7 +2153,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2239,7 +2239,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2279,7 +2279,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2386,7 +2386,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2419,7 +2419,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2571,14 +2571,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2607,7 +2607,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2617,9 +2617,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2667,7 +2667,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2689,7 +2689,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2701,7 +2701,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2732,7 +2732,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2783,7 +2783,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2811,7 +2811,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2866,12 +2866,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2884,7 +2884,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2905,21 +2905,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 21 Mar '24

21 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 23e51992c964..6f42aed070dc 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2138,7 +2138,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2224,7 +2224,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2264,7 +2264,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2371,7 +2371,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2404,7 +2404,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2556,14 +2556,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2592,7 +2592,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2602,9 +2602,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2652,7 +2652,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2674,7 +2674,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2717,7 +2717,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2768,7 +2768,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2796,7 +2796,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2851,12 +2851,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2869,7 +2869,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2890,21 +2890,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 21 Mar '24

21 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 23e51992c964..6f42aed070dc 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2138,7 +2138,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2224,7 +2224,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2264,7 +2264,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2371,7 +2371,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2404,7 +2404,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2556,14 +2556,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2592,7 +2592,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2602,9 +2602,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2652,7 +2652,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2674,7 +2674,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2717,7 +2717,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2768,7 +2768,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2796,7 +2796,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2851,12 +2851,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2869,7 +2869,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2890,21 +2890,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.34.3

2 1

[PATCH OLK-5.10] jfs: fix array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 21 Mar '24

21 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GQ3 CVE: CVE-2023-52601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ] Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e… Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index cb31ea51a54d..a8092fcd67e8 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -63,10 +63,10 @@ */ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, int nblocks); -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval); -static int dbBackSplit(dmtree_t * tp, int leafno); -static int dbJoin(dmtree_t * tp, int leafno, int newval); -static void dbAdjTree(dmtree_t * tp, int leafno, int newval); +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl); +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl); +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl); +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl); static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level); static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results); @@ -2164,7 +2164,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, * system. */ if (dp->tree.stree[word] == NOFREE) - dbBackSplit((dmtree_t *) & dp->tree, word); + dbBackSplit((dmtree_t *)&dp->tree, word, false); dbAllocBits(bmp, dp, blkno, nblocks); } @@ -2250,7 +2250,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * the binary system of the leaves if need be. */ dbSplit(tp, word, BUDMIN, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); word += 1; } else { @@ -2290,7 +2290,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, * system of the leaves to reflect the current * allocation (size). */ - dbSplit(tp, word, size, NOFREE); + dbSplit(tp, word, size, NOFREE, false); /* get the number of dmap words handled */ nw = BUDSIZE(size, BUDMIN); @@ -2397,7 +2397,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf for this dmap word. */ rc = dbJoin(tp, word, - dbMaxBud((u8 *) & dp->wmap[word])); + dbMaxBud((u8 *)&dp->wmap[word]), false); if (rc) return rc; @@ -2430,7 +2430,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, /* update the leaf. */ - rc = dbJoin(tp, word, size); + rc = dbJoin(tp, word, size, false); if (rc) return rc; @@ -2582,14 +2582,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * that it is at the front of a binary buddy system. */ if (oldval == NOFREE) { - rc = dbBackSplit((dmtree_t *) dcp, leafno); + rc = dbBackSplit((dmtree_t *)dcp, leafno, true); if (rc) return rc; oldval = dcp->stree[ti]; } - dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval); + dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); } else { - rc = dbJoin((dmtree_t *) dcp, leafno, newval); + rc = dbJoin((dmtree_t *) dcp, leafno, newval, true); if (rc) return rc; } @@ -2618,7 +2618,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (alloc) { dbJoin((dmtree_t *) dcp, leafno, - oldval); + oldval, true); } else { /* the dbJoin() above might have * caused a larger binary buddy system @@ -2628,9 +2628,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) */ if (dcp->stree[ti] == NOFREE) dbBackSplit((dmtree_t *) - dcp, leafno); + dcp, leafno, true); dbSplit((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); } /* release the buffer and return the error. @@ -2678,7 +2678,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl) { int budsz; int cursz; @@ -2700,7 +2700,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) while (cursz >= splitsz) { /* update the buddy's leaf with its new value. */ - dbAdjTree(tp, leafno ^ budsz, cursz); + dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl); /* on to the next size and buddy. */ @@ -2712,7 +2712,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) /* adjust the dmap tree to reflect the specified leaf's new * value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); } @@ -2743,7 +2743,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) * * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit(dmtree_t * tp, int leafno) +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl) { int budsz, bud, w, bsz, size; int cursz; @@ -2794,7 +2794,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * system in two. */ cursz = leaf[bud] - 1; - dbSplit(tp, bud, cursz, cursz); + dbSplit(tp, bud, cursz, cursz, is_ctl); break; } } @@ -2822,7 +2822,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) * * RETURN VALUES: none */ -static int dbJoin(dmtree_t * tp, int leafno, int newval) +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int budsz, buddy; s8 *leaf; @@ -2877,12 +2877,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) if (leafno < buddy) { /* leafno is the left buddy. */ - dbAdjTree(tp, buddy, NOFREE); + dbAdjTree(tp, buddy, NOFREE, is_ctl); } else { /* buddy is the left buddy and becomes * leafno. */ - dbAdjTree(tp, leafno, NOFREE); + dbAdjTree(tp, leafno, NOFREE, is_ctl); leafno = buddy; } @@ -2895,7 +2895,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) /* update the leaf value. */ - dbAdjTree(tp, leafno, newval); + dbAdjTree(tp, leafno, newval, is_ctl); return 0; } @@ -2916,21 +2916,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) * * RETURN VALUES: none */ -static void dbAdjTree(dmtree_t * tp, int leafno, int newval) +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) { int lp, pp, k; - int max; + int max, size; + + size = is_ctl ? CTLTREESIZE : TREESIZE; /* pick up the index of the leaf for this leafno. */ lp = leafno + le32_to_cpu(tp->dmt_leafidx); + if (WARN_ON_ONCE(lp >= size || lp < 0)) + return; + /* is the current value the same as the old value ? if so, * there is nothing to do. */ - if (WARN_ON_ONCE(lp >= CTLTREESIZE)) - return; - if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v3 0/2] fix CVE-2023-52587
by Yu Liao 21 Mar '24

21 Mar '24

fix CVE-2023-52587 Daniel Vacek (1): IB/ipoib: Fix mcast list locking Jack Wang (1): RDMA/IPoIB: Fix error code return in ipoib_mcast_join drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/1] arm64: Delete macro in the scsnp feature
by lishusen 21 Mar '24

21 Mar '24

The macro in the scsnp feature is deleted to rectify the compilation problem. lishusen (1): arm64: Delete macro in the scsnp feature arch/arm64/kernel/image-vars.h | 2 -- 1 file changed, 2 deletions(-) -- 2.33.0

2 2

[PATCH openEuler-1.0-LTS v2 0/5] CVE-2021-47131
by Ziyang Xuan 21 Mar '24

21 Mar '24

Patchset for CVE-2021-47131. v2: - Add bugfix patches for CVE patch. Maxim Mikityanskiy (5): net/tls: Replace TLS_RX_SYNC_RUNNING with RCU net/tls: Fix use-after-free after the TLS device goes down and up tls: Fix context leak on tls_device_down net/tls: Remove the context from the list in tls_device_down net/tls: Use RCU API to access tls_ctx->netdev include/net/tls.h | 13 ++++- net/tls/tls_device.c | 89 ++++++++++++++++++++++++++++------- net/tls/tls_device_fallback.c | 9 +++- net/tls/tls_main.c | 1 + 4 files changed, 93 insertions(+), 19 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-1.0-LTS v2 0/2] fix CVE-2023-52587
by Yu Liao 21 Mar '24

21 Mar '24

fix CVE-2023-52587 Daniel Vacek (1): IB/ipoib: Fix mcast list locking Jack Wang (1): RDMA/IPoIB: Fix error code return in ipoib_mcast_join drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] ima: fix deadlock when traversing "ima_default_rules".
by GUO Zihua 21 Mar '24

21 Mar '24

From: liqiong <liqiong(a)nfschina.com> mainline inclusion from mainline-v5.16-rc1 commit eb0782bbdfd0d7c4786216659277c3fd585afc0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9AAM6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The current IMA ruleset is identified by the variable "ima_rules" that default to "&ima_default_rules". When loading a custom policy for the first time, the variable is updated to "&ima_policy_rules" instead. That update isn't RCU-safe, and deadlocks are possible. Indeed, some functions like ima_match_policy() may loop indefinitely when traversing "ima_default_rules" with list_for_each_entry_rcu(). When iterating over the default ruleset back to head, if the list head is "ima_default_rules", and "ima_rules" have been updated to "&ima_policy_rules", the loop condition (&entry->list != ima_rules) stays always true, traversing won't terminate, causing a soft lockup and RCU stalls. Introduce a temporary value for "ima_rules" when iterating over the ruleset to avoid the deadlocks. Signed-off-by: liqiong <liqiong(a)nfschina.com> Reviewed-by: THOBY Simon <Simon.THOBY(a)viveris.fr> Fixes: 38d859f991f3 ("IMA: policy can now be updated multiple times") Reported-by: kernel test robot <lkp(a)intel.com> (Fix sparse: incompatible types in comparison expression.) Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Conflicts: security/integrity/ima/ima_policy.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- security/integrity/ima/ima_policy.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index f0bbd65e3e9d..a0b0008efc91 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -245,7 +245,7 @@ static struct ima_rule_entry *arch_policy_entry __ro_after_init; static LIST_HEAD(ima_default_rules); static LIST_HEAD(ima_policy_rules); static LIST_HEAD(ima_temp_rules); -static struct list_head *ima_rules = &ima_default_rules; +static struct list_head __rcu *ima_rules = (struct list_head __rcu *)(&ima_default_rules); static int ima_policy __initdata; @@ -702,12 +702,14 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, { struct ima_rule_entry *entry; int action = 0, actmask = flags | (flags << 1); + struct list_head *ima_rules_tmp; if (template_desc) *template_desc = ima_template_desc_current(); rcu_read_lock(); - list_for_each_entry_rcu(entry, ima_rules, list) { + ima_rules_tmp = rcu_dereference(ima_rules); + list_for_each_entry_rcu(entry, ima_rules_tmp, list) { if (!(entry->action & actmask)) continue; @@ -755,8 +757,10 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, void ima_update_policy_flag(void) { struct ima_rule_entry *entry; + struct list_head *ima_rules_tmp; - list_for_each_entry(entry, ima_rules, list) { + ima_rules_tmp = rcu_dereference(ima_rules); + list_for_each_entry_rcu(entry, ima_rules_tmp, list) { if (entry->action & IMA_DO_MASK) ima_policy_flag |= entry->action; } @@ -1019,10 +1023,10 @@ void ima_update_policy(void) list_splice_tail_init_rcu(&ima_temp_rules, policy, synchronize_rcu); - if (ima_rules != policy) { + if (ima_rules != (struct list_head __rcu *)policy) { ima_policy_flag = 0; - ima_rules = policy; + rcu_assign_pointer(ima_rules, policy); /* * IMA architecture specific policy rules are specified * as strings and converted to an array of ima_entry_rules @@ -1117,7 +1121,7 @@ static int ima_lsm_rule_init(struct ima_rule_entry *entry, pr_warn("rule for LSM \'%s\' is undefined\n", entry->lsm[lsm_rule].args_p); - if (ima_rules == &ima_default_rules) { + if (ima_rules == (struct list_head __rcu *)(&ima_default_rules)) { kfree(entry->lsm[lsm_rule].args_p); entry->lsm[lsm_rule].args_p = NULL; result = -EINVAL; @@ -1764,9 +1768,11 @@ void *ima_policy_start(struct seq_file *m, loff_t *pos) { loff_t l = *pos; struct ima_rule_entry *entry; + struct list_head *ima_rules_tmp; rcu_read_lock(); - list_for_each_entry_rcu(entry, ima_rules, list) { + ima_rules_tmp = rcu_dereference(ima_rules); + list_for_each_entry_rcu(entry, ima_rules_tmp, list) { if (!l--) { rcu_read_unlock(); return entry; @@ -1785,7 +1791,8 @@ void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos) rcu_read_unlock(); (*pos)++; - return (&entry->list == ima_rules) ? NULL : entry; + return (&entry->list == &ima_default_rules || + &entry->list == &ima_policy_rules) ? NULL : entry; } void ima_policy_stop(struct seq_file *m, void *v) @@ -1998,6 +2005,7 @@ bool ima_appraise_signature(enum kernel_read_file_id id) struct ima_rule_entry *entry; bool found = false; enum ima_hooks func; + struct list_head *ima_rules_tmp; if (id >= READING_MAX_ID) return false; @@ -2009,7 +2017,8 @@ bool ima_appraise_signature(enum kernel_read_file_id id) func = read_idmap[id] ?: FILE_CHECK; rcu_read_lock(); - list_for_each_entry_rcu(entry, ima_rules, list) { + ima_rules_tmp = rcu_dereference(ima_rules); + list_for_each_entry_rcu(entry, ima_rules_tmp, list) { if (entry->action != APPRAISE) continue; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] fix CVE-2023-52612
by felix 21 Mar '24

21 Mar '24

From: Felix Fu <fuzhen5(a)huawei.com> *** BLURB HERE *** Chengming Zhou (1): crypto: scomp - fix req->dst buffer overflow Sebastian Andrzej Siewior (2): crypto: scompress - return proper error code for allocation failure crypto: scompress - Use per-CPU struct instead multiple variables crypto/scompress.c | 135 +++++++++++++++++++++------------------------ 1 file changed, 63 insertions(+), 72 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS 1/3] crypto: scompress - return proper error code for allocation failure
by felix 21 Mar '24

21 Mar '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> stable inclusion from stable-v4.19.306 commit 1915874d67287ba1ab71825ae6a4efbb2a0e2b11 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K14 CVE: CVE-2023-52612 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6a4d1b18ef00a7b182740b7b4d8a0fcd317368f8 ] If scomp_acomp_comp_decomp() fails to allocate memory for the destination then we never copy back the data we compressed. It is probably best to return an error code instead 0 in case of failure. I haven't found any user that is using acomp_request_set_params() without the `dst' buffer so there is probably no harm. Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Stable-dep-of: 744e1885922a ("crypto: scomp - fix req->dst buffer overflow") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- crypto/scompress.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/crypto/scompress.c b/crypto/scompress.c index 968bbcf65c94..15641c96ff99 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -174,8 +174,10 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!ret) { if (!req->dst) { req->dst = sgl_alloc(req->dlen, GFP_ATOMIC, NULL); - if (!req->dst) + if (!req->dst) { + ret = -ENOMEM; goto out; + } } scatterwalk_map_and_copy(scratch_dst, req->dst, 0, req->dlen, 1); -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS 0/2] Fix CVE-2021-47094
by Liu Shixin 21 Mar '24

21 Mar '24

The first patch is a cleanup patch and no functional change. The second patch is bugfix for CVE-2021-47094. Ben Gardon (1): KVM: x86/mmu: Factor out tdp_iter_return_to_root Sean Christopherson (1): KVM: x86/mmu: Don't advance iterator after restart due to yielding arch/x86/kvm/mmu/tdp_iter.c | 30 +++++++++++++++++++++++------- arch/x86/kvm/mmu/tdp_iter.h | 7 +++++++ arch/x86/kvm/mmu/tdp_mmu.c | 28 ++++++++++++++-------------- 3 files changed, 44 insertions(+), 21 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] keys: safe concurrent user->{session,uid}_keyring access
by GUO Zihua 21 Mar '24

21 Mar '24

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v5.2-rc1 commit 0b9dc6c9f01c4a726558b82a3b6082a89d264eb5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9355O CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The current code can perform concurrent updates and reads on user->session_keyring and user->uid_keyring. Add a comment to struct user_struct to document the nontrivial locking semantics, and use READ_ONCE() for unlocked readers and smp_store_release() for writers to prevent memory ordering issues. Fixes: 69664cf16af4 ("keys: don't generate user and user session keyrings unless they're accessed") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: James Morris <james.morris(a)microsoft.com> Conflicts: security/keys/process_keys.c security/keys/request_key.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- include/linux/sched/user.h | 7 +++++++ security/keys/process_keys.c | 31 +++++++++++++++++-------------- security/keys/request_key.c | 5 +++-- 3 files changed, 27 insertions(+), 16 deletions(-) diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h index 02c3b646bd07..38d3606ff09b 100644 --- a/include/linux/sched/user.h +++ b/include/linux/sched/user.h @@ -32,6 +32,13 @@ struct user_struct { atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */ #ifdef CONFIG_KEYS + /* + * These pointers can only change from NULL to a non-NULL value once. + * Writes are protected by key_user_keyring_mutex. + * Unlocked readers should use READ_ONCE() unless they know that + * install_user_keyrings() has been called successfully (which sets + * these members to non-NULL values, preventing further modifications). + */ struct key *uid_keyring; /* UID specific keyring */ struct key *session_keyring; /* UID's default session keyring */ #endif diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c index d776d2114651..b5a8202af128 100644 --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -59,7 +59,7 @@ int install_user_keyrings(void) kenter("%p{%u}", user, uid); - if (user->uid_keyring && user->session_keyring) { + if (READ_ONCE(user->uid_keyring) && READ_ONCE(user->session_keyring)) { kleave(" = 0 [exist]"); return 0; } @@ -112,8 +112,10 @@ int install_user_keyrings(void) } /* install the keyrings */ - user->uid_keyring = uid_keyring; - user->session_keyring = session_keyring; + /* paired with READ_ONCE() */ + smp_store_release(&user->uid_keyring, uid_keyring); + /* paired with READ_ONCE() */ + smp_store_release(&user->session_keyring, session_keyring); } mutex_unlock(&key_user_keyring_mutex); @@ -340,6 +342,7 @@ void key_fsgid_changed(struct task_struct *tsk) key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) { key_ref_t key_ref, ret, err; + const struct cred *cred = ctx->cred; /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were * searchable, but we failed to find a key or we found a negative key; @@ -353,9 +356,9 @@ key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) err = ERR_PTR(-EAGAIN); /* search the thread keyring first */ - if (ctx->cred->thread_keyring) { + if (cred->thread_keyring) { key_ref = keyring_search_aux( - make_key_ref(ctx->cred->thread_keyring, 1), ctx); + make_key_ref(cred->thread_keyring, 1), ctx); if (!IS_ERR(key_ref)) goto found; @@ -371,9 +374,9 @@ key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) } /* search the process keyring second */ - if (ctx->cred->process_keyring) { + if (cred->process_keyring) { key_ref = keyring_search_aux( - make_key_ref(ctx->cred->process_keyring, 1), ctx); + make_key_ref(cred->process_keyring, 1), ctx); if (!IS_ERR(key_ref)) goto found; @@ -391,10 +394,10 @@ key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) } /* search the session keyring */ - if (ctx->cred->session_keyring) { + if (cred->session_keyring) { rcu_read_lock(); key_ref = keyring_search_aux( - make_key_ref(rcu_dereference(ctx->cred->session_keyring), 1), + make_key_ref(rcu_dereference(cred->session_keyring), 1), ctx); rcu_read_unlock(); @@ -414,9 +417,9 @@ key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) } } /* or search the user-session keyring */ - else if (ctx->cred->user->session_keyring) { + else if (READ_ONCE(cred->user->session_keyring)) { key_ref = keyring_search_aux( - make_key_ref(ctx->cred->user->session_keyring, 1), + make_key_ref(READ_ONCE(cred->user->session_keyring), 1), ctx); if (!IS_ERR(key_ref)) goto found; @@ -602,7 +605,7 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, goto error; goto reget_creds; } else if (ctx.cred->session_keyring == - ctx.cred->user->session_keyring && + READ_ONCE(ctx.cred->user->session_keyring) && lflags & KEY_LOOKUP_CREATE) { ret = join_session_keyring(NULL); if (ret < 0) @@ -618,7 +621,7 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, break; case KEY_SPEC_USER_KEYRING: - if (!ctx.cred->user->uid_keyring) { + if (!READ_ONCE(ctx.cred->user->uid_keyring)) { ret = install_user_keyrings(); if (ret < 0) goto error; @@ -630,7 +633,7 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, break; case KEY_SPEC_USER_SESSION_KEYRING: - if (!ctx.cred->user->session_keyring) { + if (!READ_ONCE(ctx.cred->user->session_keyring)) { ret = install_user_keyrings(); if (ret < 0) goto error; diff --git a/security/keys/request_key.c b/security/keys/request_key.c index 1a547cec8385..f62bb12bca41 100644 --- a/security/keys/request_key.c +++ b/security/keys/request_key.c @@ -294,11 +294,12 @@ static int construct_get_dest_keyring(struct key **_dest_keyring) case KEY_REQKEY_DEFL_USER_SESSION_KEYRING: dest_keyring = - key_get(cred->user->session_keyring); + key_get(READ_ONCE(cred->user->session_keyring)); break; case KEY_REQKEY_DEFL_USER_KEYRING: - dest_keyring = key_get(cred->user->uid_keyring); + dest_keyring = + key_get(READ_ONCE(cred->user->uid_keyring)); break; case KEY_REQKEY_DEFL_GROUP_KEYRING: -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: x86/mmu: Don't advance iterator after restart due to yielding
by Liu Shixin 21 Mar '24

21 Mar '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v5.16-rc7 commit 3a0f64de479cae75effb630a2e0a237ca0d0623c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95REM CVE: CVE-2021-47094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After dropping mmu_lock in the TDP MMU, restart the iterator during tdp_iter_next() and do not advance the iterator. Advancing the iterator results in skipping the top-level SPTE and all its children, which is fatal if any of the skipped SPTEs were not visited before yielding. When zapping all SPTEs, i.e. when min_level == root_level, restarting the iter and then invoking tdp_iter_next() is always fatal if the current gfn has as a valid SPTE, as advancing the iterator results in try_step_side() skipping the current gfn, which wasn't visited before yielding. Sprinkle WARNs on iter->yielded being true in various helpers that are often used in conjunction with yielding, and tag the helper with __must_check to reduce the probabily of improper usage. Failing to zap a top-level SPTE manifests in one of two ways. If a valid SPTE is skipped by both kvm_tdp_mmu_zap_all() and kvm_tdp_mmu_put_root(), the shadow page will be leaked and KVM will WARN accordingly. WARNING: CPU: 1 PID: 3509 at arch/x86/kvm/mmu/tdp_mmu.c:46 [kvm] RIP: 0010:kvm_mmu_uninit_tdp_mmu+0x3e/0x50 [kvm] Call Trace: <TASK> kvm_arch_destroy_vm+0x130/0x1b0 [kvm] kvm_destroy_vm+0x162/0x2a0 [kvm] kvm_vcpu_release+0x34/0x60 [kvm] __fput+0x82/0x240 task_work_run+0x5c/0x90 do_exit+0x364/0xa10 ? futex_unqueue+0x38/0x60 do_group_exit+0x33/0xa0 get_signal+0x155/0x850 arch_do_signal_or_restart+0xed/0x750 exit_to_user_mode_prepare+0xc5/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae If kvm_tdp_mmu_zap_all() skips a gfn/SPTE but that SPTE is then zapped by kvm_tdp_mmu_put_root(), KVM triggers a use-after-free in the form of marking a struct page as dirty/accessed after it has been put back on the free list. This directly triggers a WARN due to encountering a page with page_count() == 0, but it can also lead to data corruption and additional errors in the kernel. WARNING: CPU: 7 PID: 1995658 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:171 RIP: 0010:kvm_is_zone_device_pfn.part.0+0x9e/0xd0 [kvm] Call Trace: <TASK> kvm_set_pfn_dirty+0x120/0x1d0 [kvm] __handle_changed_spte+0x92e/0xca0 [kvm] __handle_changed_spte+0x63c/0xca0 [kvm] __handle_changed_spte+0x63c/0xca0 [kvm] __handle_changed_spte+0x63c/0xca0 [kvm] zap_gfn_range+0x549/0x620 [kvm] kvm_tdp_mmu_put_root+0x1b6/0x270 [kvm] mmu_free_root_page+0x219/0x2c0 [kvm] kvm_mmu_free_roots+0x1b4/0x4e0 [kvm] kvm_mmu_unload+0x1c/0xa0 [kvm] kvm_arch_destroy_vm+0x1f2/0x5c0 [kvm] kvm_put_kvm+0x3b1/0x8b0 [kvm] kvm_vcpu_release+0x4e/0x70 [kvm] __fput+0x1f7/0x8c0 task_work_run+0xf8/0x1a0 do_exit+0x97b/0x2230 do_group_exit+0xda/0x2a0 get_signal+0x3be/0x1e50 arch_do_signal_or_restart+0x244/0x17f0 exit_to_user_mode_prepare+0xcb/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x4d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae Note, the underlying bug existed even before commit 1af4a96025b3 ("KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed") moved calls to tdp_mmu_iter_cond_resched() to the beginning of loops, as KVM could still incorrectly advance past a top-level entry when yielding on a lower-level entry. But with respect to leaking shadow pages, the bug was introduced by yielding before processing the current gfn. Alternatively, tdp_mmu_iter_cond_resched() could simply fall through, or callers could jump to their "retry" label. The downside of that approach is that tdp_mmu_iter_cond_resched() _must_ be called before anything else in the loop, and there's no easy way to enfornce that requirement. Ideally, KVM would handling the cond_resched() fully within the iterator macro (the code is actually quite clean) and avoid this entire class of bugs, but that is extremely difficult do while also supporting yielding after tdp_mmu_set_spte_atomic() fails. Yielding after failing to set a SPTE is very desirable as the "owner" of the REMOVED_SPTE isn't strictly bounded, e.g. if it's zapping a high-level shadow page, the REMOVED_SPTE may block operations on the SPTE for a significant amount of time. Fixes: faaf05b00aec ("kvm: x86/mmu: Support zapping SPTEs in the TDP MMU") Fixes: 1af4a96025b3 ("KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed") Reported-by: Ignat Korchagin <ignat(a)cloudflare.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20211214033528.123268-1-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- arch/x86/kvm/mmu/tdp_iter.c | 6 ++++++ arch/x86/kvm/mmu/tdp_iter.h | 6 ++++++ arch/x86/kvm/mmu/tdp_mmu.c | 29 ++++++++++++++++------------- 3 files changed, 28 insertions(+), 13 deletions(-) diff --git a/arch/x86/kvm/mmu/tdp_iter.c b/arch/x86/kvm/mmu/tdp_iter.c index b3ed302c1a35..caa96c270b95 100644 --- a/arch/x86/kvm/mmu/tdp_iter.c +++ b/arch/x86/kvm/mmu/tdp_iter.c @@ -26,6 +26,7 @@ static gfn_t round_gfn_for_level(gfn_t gfn, int level) */ void tdp_iter_restart(struct tdp_iter *iter) { + iter->yielded = false; iter->yielded_gfn = iter->next_last_level_gfn; iter->level = iter->root_level; @@ -160,6 +161,11 @@ static bool try_step_up(struct tdp_iter *iter) */ void tdp_iter_next(struct tdp_iter *iter) { + if (iter->yielded) { + tdp_iter_restart(iter); + return; + } + if (try_step_down(iter)) return; diff --git a/arch/x86/kvm/mmu/tdp_iter.h b/arch/x86/kvm/mmu/tdp_iter.h index b1748b988d3a..e19cabbcb65c 100644 --- a/arch/x86/kvm/mmu/tdp_iter.h +++ b/arch/x86/kvm/mmu/tdp_iter.h @@ -45,6 +45,12 @@ struct tdp_iter { * iterator walks off the end of the paging structure. */ bool valid; + /* + * True if KVM dropped mmu_lock and yielded in the middle of a walk, in + * which case tdp_iter_next() needs to restart the walk at the root + * level instead of advancing to the next entry. + */ + bool yielded; }; /* diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c index 27e18b82f8d5..1af891ff7a2b 100644 --- a/arch/x86/kvm/mmu/tdp_mmu.c +++ b/arch/x86/kvm/mmu/tdp_mmu.c @@ -516,6 +516,8 @@ static inline bool tdp_mmu_set_spte_atomic_no_dirty_log(struct kvm *kvm, struct tdp_iter *iter, u64 new_spte) { + WARN_ON_ONCE(iter->yielded); + lockdep_assert_held_read(&kvm->mmu_lock); /* @@ -601,6 +603,8 @@ static inline void __tdp_mmu_set_spte(struct kvm *kvm, struct tdp_iter *iter, u64 new_spte, bool record_acc_track, bool record_dirty_log) { + WARN_ON_ONCE(iter->yielded); + lockdep_assert_held_write(&kvm->mmu_lock); /* @@ -666,18 +670,19 @@ static inline void tdp_mmu_set_spte_no_dirty_log(struct kvm *kvm, * If this function should yield and flush is set, it will perform a remote * TLB flush before yielding. * - * If this function yields, it will also reset the tdp_iter's walk over the - * paging structure and the calling function should skip to the next - * iteration to allow the iterator to continue its traversal from the - * paging structure root. + * If this function yields, iter->yielded is set and the caller must skip to + * the next iteration, where tdp_iter_next() will reset the tdp_iter's walk + * over the paging structures to allow the iterator to continue its traversal + * from the paging structure root. * - * Return true if this function yielded and the iterator's traversal was reset. - * Return false if a yield was not needed. + * Returns true if this function yielded. */ -static inline bool tdp_mmu_iter_cond_resched(struct kvm *kvm, - struct tdp_iter *iter, bool flush, - bool shared) +static inline bool __must_check tdp_mmu_iter_cond_resched(struct kvm *kvm, + struct tdp_iter *iter, + bool flush, bool shared) { + WARN_ON(iter->yielded); + /* Ensure forward progress has been made before yielding. */ if (iter->next_last_level_gfn == iter->yielded_gfn) return false; @@ -697,12 +702,10 @@ static inline bool tdp_mmu_iter_cond_resched(struct kvm *kvm, WARN_ON(iter->gfn > iter->next_last_level_gfn); - tdp_iter_restart(iter); - - return true; + iter->yielded = true; } - return false; + return iter->yielded; } /* -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-52587
by Yu Liao 21 Mar '24

21 Mar '24

fix CVE-2023-52587 Daniel Vacek (1): IB/ipoib: Fix mcast list locking Jack Wang (1): RDMA/IPoIB: Fix error code return in ipoib_mcast_join drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH] keys: safe concurrent user->{session,uid}_keyring access
by GUO Zihua 21 Mar '24

21 Mar '24

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v5.2-rc1 commit 0b9dc6c9f01c4a726558b82a3b6082a89d264eb5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9355O CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The current code can perform concurrent updates and reads on user->session_keyring and user->uid_keyring. Add a comment to struct user_struct to document the nontrivial locking semantics, and use READ_ONCE() for unlocked readers and smp_store_release() for writers to prevent memory ordering issues. Fixes: 69664cf16af4 ("keys: don't generate user and user session keyrings unless they're accessed") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: James Morris <james.morris(a)microsoft.com> Conflicts: security/keys/process_keys.c security/keys/request_key.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- include/linux/sched/user.h | 7 +++++++ security/keys/process_keys.c | 31 +++++++++++++++++-------------- security/keys/request_key.c | 5 +++-- 3 files changed, 27 insertions(+), 16 deletions(-) diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h index 02c3b646bd07..38d3606ff09b 100644 --- a/include/linux/sched/user.h +++ b/include/linux/sched/user.h @@ -32,6 +32,13 @@ struct user_struct { atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */ #ifdef CONFIG_KEYS + /* + * These pointers can only change from NULL to a non-NULL value once. + * Writes are protected by key_user_keyring_mutex. + * Unlocked readers should use READ_ONCE() unless they know that + * install_user_keyrings() has been called successfully (which sets + * these members to non-NULL values, preventing further modifications). + */ struct key *uid_keyring; /* UID specific keyring */ struct key *session_keyring; /* UID's default session keyring */ #endif diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c index d776d2114651..b5a8202af128 100644 --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -59,7 +59,7 @@ int install_user_keyrings(void) kenter("%p{%u}", user, uid); - if (user->uid_keyring && user->session_keyring) { + if (READ_ONCE(user->uid_keyring) && READ_ONCE(user->session_keyring)) { kleave(" = 0 [exist]"); return 0; } @@ -112,8 +112,10 @@ int install_user_keyrings(void) } /* install the keyrings */ - user->uid_keyring = uid_keyring; - user->session_keyring = session_keyring; + /* paired with READ_ONCE() */ + smp_store_release(&user->uid_keyring, uid_keyring); + /* paired with READ_ONCE() */ + smp_store_release(&user->session_keyring, session_keyring); } mutex_unlock(&key_user_keyring_mutex); @@ -340,6 +342,7 @@ void key_fsgid_changed(struct task_struct *tsk) key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) { key_ref_t key_ref, ret, err; + const struct cred *cred = ctx->cred; /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were * searchable, but we failed to find a key or we found a negative key; @@ -353,9 +356,9 @@ key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) err = ERR_PTR(-EAGAIN); /* search the thread keyring first */ - if (ctx->cred->thread_keyring) { + if (cred->thread_keyring) { key_ref = keyring_search_aux( - make_key_ref(ctx->cred->thread_keyring, 1), ctx); + make_key_ref(cred->thread_keyring, 1), ctx); if (!IS_ERR(key_ref)) goto found; @@ -371,9 +374,9 @@ key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) } /* search the process keyring second */ - if (ctx->cred->process_keyring) { + if (cred->process_keyring) { key_ref = keyring_search_aux( - make_key_ref(ctx->cred->process_keyring, 1), ctx); + make_key_ref(cred->process_keyring, 1), ctx); if (!IS_ERR(key_ref)) goto found; @@ -391,10 +394,10 @@ key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) } /* search the session keyring */ - if (ctx->cred->session_keyring) { + if (cred->session_keyring) { rcu_read_lock(); key_ref = keyring_search_aux( - make_key_ref(rcu_dereference(ctx->cred->session_keyring), 1), + make_key_ref(rcu_dereference(cred->session_keyring), 1), ctx); rcu_read_unlock(); @@ -414,9 +417,9 @@ key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) } } /* or search the user-session keyring */ - else if (ctx->cred->user->session_keyring) { + else if (READ_ONCE(cred->user->session_keyring)) { key_ref = keyring_search_aux( - make_key_ref(ctx->cred->user->session_keyring, 1), + make_key_ref(READ_ONCE(cred->user->session_keyring), 1), ctx); if (!IS_ERR(key_ref)) goto found; @@ -602,7 +605,7 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, goto error; goto reget_creds; } else if (ctx.cred->session_keyring == - ctx.cred->user->session_keyring && + READ_ONCE(ctx.cred->user->session_keyring) && lflags & KEY_LOOKUP_CREATE) { ret = join_session_keyring(NULL); if (ret < 0) @@ -618,7 +621,7 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, break; case KEY_SPEC_USER_KEYRING: - if (!ctx.cred->user->uid_keyring) { + if (!READ_ONCE(ctx.cred->user->uid_keyring)) { ret = install_user_keyrings(); if (ret < 0) goto error; @@ -630,7 +633,7 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, break; case KEY_SPEC_USER_SESSION_KEYRING: - if (!ctx.cred->user->session_keyring) { + if (!READ_ONCE(ctx.cred->user->session_keyring)) { ret = install_user_keyrings(); if (ret < 0) goto error; diff --git a/security/keys/request_key.c b/security/keys/request_key.c index 1a547cec8385..f62bb12bca41 100644 --- a/security/keys/request_key.c +++ b/security/keys/request_key.c @@ -294,11 +294,12 @@ static int construct_get_dest_keyring(struct key **_dest_keyring) case KEY_REQKEY_DEFL_USER_SESSION_KEYRING: dest_keyring = - key_get(cred->user->session_keyring); + key_get(READ_ONCE(cred->user->session_keyring)); break; case KEY_REQKEY_DEFL_USER_KEYRING: - dest_keyring = key_get(cred->user->uid_keyring); + dest_keyring = + key_get(READ_ONCE(cred->user->uid_keyring)); break; case KEY_REQKEY_DEFL_GROUP_KEYRING: -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47114
by Yifan Qiao 21 Mar '24

21 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS v4 0/2] CVE-2021-47110
by liwei 21 Mar '24

21 Mar '24

CVE-2021-47110 Kirill A. Shutemov (1): x86/kvm: Do not try to disable kvmclock if it was not enabled Vitaly Kuznetsov (1): x86/kvm: Disable kvmclock on all CPUs on shutdown arch/x86/include/asm/kvm_para.h | 4 ++-- arch/x86/kernel/kvm.c | 1 + arch/x86/kernel/kvmclock.c | 17 +++++++++-------- 3 files changed, 12 insertions(+), 10 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] net/sched: act_ct: fix skb leak and crash on ooo frags
by Zhengchao Shao 21 Mar '24

21 Mar '24

From: Tao Liu <taoliu828(a)163.com> mainline inclusion from mainline-v6.8-rc1 commit 3f14b377d01d8357eba032b4cabc8c1149b458b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JTC CVE: CVE-2023-52610 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prepare skb_morph which is not straightforward. However when frags arrive out of order, nobody unref the last frag, and all frags are leaked. The situation is even worse, as initiating packet capture can lead to a crash[0] when skb has been cloned and shared at the same time. Fix the issue by removing skb_get() before defragmentation. act_ct returns TC_ACT_CONSUMED when defrag failed or in progress. [0]: [ 843.804823] ------------[ cut here ]------------ [ 843.809659] kernel BUG at net/core/skbuff.c:2091! [ 843.814516] invalid opcode: 0000 [#1] PREEMPT SMP [ 843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2 [ 843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022 [ 843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300 [ 843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89 [ 843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202 [ 843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820 [ 843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00 [ 843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000 [ 843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880 [ 843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900 [ 843.871680] FS: 0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000 [ 843.876242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0 [ 843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 843.894229] PKRU: 55555554 [ 843.898539] Call Trace: [ 843.902772] <IRQ> [ 843.906922] ? __die_body+0x1e/0x60 [ 843.911032] ? die+0x3c/0x60 [ 843.915037] ? do_trap+0xe2/0x110 [ 843.918911] ? pskb_expand_head+0x2ac/0x300 [ 843.922687] ? do_error_trap+0x65/0x80 [ 843.926342] ? pskb_expand_head+0x2ac/0x300 [ 843.929905] ? exc_invalid_op+0x50/0x60 [ 843.933398] ? pskb_expand_head+0x2ac/0x300 [ 843.936835] ? asm_exc_invalid_op+0x1a/0x20 [ 843.940226] ? pskb_expand_head+0x2ac/0x300 [ 843.943580] inet_frag_reasm_prepare+0xd1/0x240 [ 843.946904] ip_defrag+0x5d4/0x870 [ 843.950132] nf_ct_handle_fragments+0xec/0x130 [nf_conntrack] [ 843.953334] tcf_ct_act+0x252/0xd90 [act_ct] [ 843.956473] ? tcf_mirred_act+0x516/0x5a0 [act_mirred] [ 843.959657] tcf_action_exec+0xa1/0x160 [ 843.962823] fl_classify+0x1db/0x1f0 [cls_flower] [ 843.966010] ? skb_clone+0x53/0xc0 [ 843.969173] tcf_classify+0x24d/0x420 [ 843.972333] tc_run+0x8f/0xf0 [ 843.975465] __netif_receive_skb_core+0x67a/0x1080 [ 843.978634] ? dev_gro_receive+0x249/0x730 [ 843.981759] __netif_receive_skb_list_core+0x12d/0x260 [ 843.984869] netif_receive_skb_list_internal+0x1cb/0x2f0 [ 843.987957] ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core] [ 843.991170] napi_complete_done+0x72/0x1a0 [ 843.994305] mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core] [ 843.997501] __napi_poll+0x25/0x1b0 [ 844.000627] net_rx_action+0x256/0x330 [ 844.003705] __do_softirq+0xb3/0x29b [ 844.006718] irq_exit_rcu+0x9e/0xc0 [ 844.009672] common_interrupt+0x86/0xa0 [ 844.012537] </IRQ> [ 844.015285] <TASK> [ 844.017937] asm_common_interrupt+0x26/0x40 [ 844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20 [ 844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb f4 <fa> c3 0f 1f 00 89 fa ec 48 8b 05 ee 88 ed 00 a9 00 00 00 80 75 11 [ 844.028900] RSP: 0018:ffffc90000533e70 EFLAGS: 00000246 [ 844.031725] RAX: 0000000000004000 RBX: 0000000000000001 RCX: 0000000000000000 [ 844.034553] RDX: ffff889ffffc0000 RSI: ffffffff828b7f20 RDI: ffff88a090f45c64 [ 844.037368] RBP: ffff88a0901a2800 R08: ffff88a090f45c00 R09: 00000000000317c0 [ 844.040155] R10: 00ec812281150475 R11: ffff889fffff0e04 R12: ffffffff828b7fa0 [ 844.042962] R13: ffffffff828b7f20 R14: 0000000000000001 R15: 0000000000000000 [ 844.045819] acpi_idle_enter+0x7b/0xc0 [ 844.048621] cpuidle_enter_state+0x7f/0x430 [ 844.051451] cpuidle_enter+0x2d/0x40 [ 844.054279] do_idle+0x1d4/0x240 [ 844.057096] cpu_startup_entry+0x2a/0x30 [ 844.059934] start_secondary+0x104/0x130 [ 844.062787] secondary_startup_64_no_verify+0x16b/0x16b [ 844.065674] </TASK> Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") Signed-off-by: Tao Liu <taoliu828(a)163.com> Link: https://lore.kernel.org/r/20231228081457.936732-1-taoliu828@163.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/act_ct.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_ct.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 35668ce0b4a8..e7c7b92ff37b 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -699,7 +699,6 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, if (err || !frag) return err; - skb_get(skb); cb = *qdisc_skb_cb(skb); if (family == NFPROTO_IPV4) { @@ -973,12 +972,8 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, nh_ofs = skb_network_offset(skb); skb_pull_rcsum(skb, nh_ofs); err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); - if (err == -EINPROGRESS) { - retval = TC_ACT_STOLEN; - goto out; - } if (err) - goto drop; + goto out_frag; err = tcf_ct_skb_network_trim(skb, family); if (err) @@ -1046,6 +1041,11 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, qdisc_skb_cb(skb)->pkt_len = skb->len; return retval; +out_frag: + if (err != -EINPROGRESS) + tcf_action_inc_drop_qstats(&c->common); + return TC_ACT_CONSUMED; + drop: tcf_action_inc_drop_qstats(&c->common); return TC_ACT_SHOT; -- 2.34.1

2 8

[PATCH 0/1] arm64: Delete macro in the scsnp feature
by lishusen 21 Mar '24

21 Mar '24

The macro in the scsnp feature is deleted to rectify the compilation problem. lishusen (1): arm64: Delete macro in the scsnp feature arch/arm64/kernel/image-vars.h | 2 -- 1 file changed, 2 deletions(-) -- 2.33.0

1 1

openEuler Kernel SIG双周例会
by openEuler conference 21 Mar '24

21 Mar '24

您好！ Kernel 邀请您参加 2024-03-22 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可直接填写至例会纪要看板申报）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/989029425 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-03-22 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可直接填写至例会纪要看板申报） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/989029425. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 1fbfc27b811b42bafdbe80c46f1fd2d9dfb1e976
by kernel test robot 21 Mar '24

21 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 1fbfc27b811b42bafdbe80c46f1fd2d9dfb1e976 !5037 [OLK-6.6] Add support for Mucse Network Adapter(N500/N210) Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403210049.GByOQrbb-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1001:5: warning: no previous prototype for 'rnpgbe_init_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1014:5: warning: no previous prototype for 'rnpgbe_get_permtion_mac_addr_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1027:5: warning: no previous prototype for 'rnpgbe_reset_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1099:5: warning: no previous prototype for 'rnpgbe_start_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:160:5: warning: no previous prototype for 'rnpgbe_eth_set_rar_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1856:5: warning: no previous prototype for 'rnpgbe_check_mac_link_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1888:5: warning: no previous prototype for 'rnpgbe_setup_mac_link_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1897:6: warning: no previous prototype for 'rnpgbe_clean_link_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1956:5: warning: no previous prototype for 'rnpgbe_phy_read_reg_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1969:5: warning: no previous prototype for 'rnpgbe_phy_write_reg_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1980:6: warning: no previous prototype for 'rnpgbe_setup_wol_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1987:6: warning: no previous prototype for 'rnpgbe_setup_eee_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1998:6: warning: no previous prototype for 'rnpgbe_set_eee_mode_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2006:6: warning: no previous prototype for 'rnpgbe_reset_eee_mode_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2013:6: warning: no previous prototype for 'rnpgbe_set_eee_pls_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2020:5: warning: no previous prototype for 'rnpgbe_get_lpi_status_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2027:5: warning: no previous prototype for 'rnpgbe_get_ncsi_mac_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2050:5: warning: no previous prototype for 'rnpgbe_get_ncsi_vlan_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2066:6: warning: no previous prototype for 'rnpgbe_set_lldp_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2071:6: warning: no previous prototype for 'rnpgbe_get_lldp_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2075:6: warning: no previous prototype for 'rnpgbe_set_eee_timer_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2082:6: warning: no previous prototype for 'rnpgbe_set_vf_vlan_mode_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2092:6: warning: no previous prototype for 'rnpgbe_driver_status_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:212:5: warning: no previous prototype for 'rnpgbe_eth_clear_rar_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2256:5: warning: no previous prototype for 'rnp500_get_link_ksettings' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2381:5: warning: no previous prototype for 'rnp500_set_link_ksettings' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:246:5: warning: no previous prototype for 'rnpgbe_eth_set_vmdq_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2550:6: warning: no previous prototype for 'rnp500_get_pauseparam' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2574:5: warning: no previous prototype for 'rnp500_set_pauseparam' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:267:5: warning: no previous prototype for 'rnpgbe_eth_clear_vmdq_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3265:6: warning: no previous prototype for 'rnpgbe_set_ethtool_hw_ops_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3395:5: warning: no previous prototype for 'rnpgbe_mac_fc_mode_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3454:6: warning: no previous prototype for 'poll_free_mdio' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3468:5: warning: no previous prototype for 'rnpgbe_mdio_read' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3499:6: warning: no previous prototype for 'rnpgbe_mac_check_link_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3545:6: warning: no previous prototype for 'rnpgbe_mac_set_mac_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3556:5: warning: no previous prototype for 'rnpgbe_mac_mdio_read_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3586:5: warning: no previous prototype for 'rnpgbe_mac_mdio_write_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3613:6: warning: no previous prototype for 'rnpgbe_mac_pmt_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3657:6: warning: no previous prototype for 'rnpgbe_mac_set_eee_timer_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:366:5: warning: no previous prototype for 'rnpgbe_addr_list_itr' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:394:5: warning: no previous prototype for 'rnpgbe_eth_update_mc_addr_list_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:477:6: warning: no previous prototype for 'rnpgbe_eth_clr_mc_addr_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:492:5: warning: no previous prototype for 'rnpgbe_eth_set_rss_hfunc_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:522:6: warning: no previous prototype for 'rnpgbe_eth_update_rss_key_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:556:6: warning: no previous prototype for 'rnpgbe_eth_update_rss_table_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:583:5: warning: no previous prototype for 'rnpgbe_eth_set_vfta_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:624:6: warning: no previous prototype for 'rnpgbe_eth_clr_vfta_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:680:5: warning: no previous prototype for 'rnpgbe_layer2_pritologic_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:685:6: warning: no previous prototype for 'rnpgbe_eth_set_layer2_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:712:6: warning: no previous prototype for 'rnpgbe_eth_clr_layer2_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:720:6: warning: no previous prototype for 'rnpgbe_eth_clr_all_layer2_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:728:5: warning: no previous prototype for 'rnpgbe_tuple5_pritologic_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:733:6: warning: no previous prototype for 'rnpgbe_eth_set_tuple5_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:814:6: warning: no previous prototype for 'rnpgbe_eth_clr_tuple5_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:822:6: warning: no previous prototype for 'rnpgbe_eth_clr_all_tuple5_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:830:6: warning: no previous prototype for 'rnpgbe_eth_set_tcp_sync_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:846:6: warning: no previous prototype for 'rnpgbe_eth_set_rx_skip_n500' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:311:36: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_lib.c:308:5: warning: no previous prototype for 'rnpgbe_acquire_msix_vectors' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_lib.c:719:6: warning: no previous prototype for 'update_ring_count' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:2170:6: warning: no previous prototype for 'rnpgbe_write_eitr_rx' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:2484:43: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:271:6: warning: no previous prototype for 'rnpgbe_disable_eee_mode' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:2727:62: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:3209:6: warning: no previous prototype for 'rnpgbe_vlan_stags_flag' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:3314:6: warning: no previous prototype for 'rnpgbe_reinit_locked' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:3487:5: warning: no previous prototype for 'rnpgbe_xmit_nop_frame_ring' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:3503:6: warning: no previous prototype for 'print_status' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:4624:6: warning: no previous prototype for 'rnpgbe_eee_init' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:4651:5: warning: no previous prototype for 'rnpgbe_phy_init_eee' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:6132:6: warning: no previous prototype for 'rnpgbe_assign_netdev_ops' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:730:5: warning: no previous prototype for 'rnpgbe_rx_ring_reinit' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:1262:5: warning: no previous prototype for 'rnpgbe_fw_reg_read' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:131:5: warning: no previous prototype for 'rnpgbe_fw_send_cmd_wait' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:15:24: warning: no previous prototype for 'mbx_cookie_zalloc' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:185:5: warning: no previous prototype for 'rnpgbe_mbx_get_link' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:29:5: warning: no previous prototype for 'rnpgbe_mbx_write_posted_locked' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:564:9: warning: 'build_writereg_req' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:66:6: warning: no previous prototype for 'rnpgbe_link_stat_mark_reset' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:71:6: warning: no previous prototype for 'rnpgbe_link_stat_mark_disable' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:76:5: warning: no previous prototype for 'rnpgbe_mbx_fw_post_req' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:930:5: warning: no previous prototype for 'to_mac_type' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_ptp.c:272:5: warning: no previous prototype for 'rnpgbe_ptp_setup_ptp' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_sriov.c:1132:5: warning: no previous prototype for 'rnpgbe_msg_post_status_signle_link' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_sriov.c:301:6: warning: no previous prototype for 'check_ari_mode' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_sysfs.c:213:6: warning: no previous prototype for 'n500_exchange_share_ram' [-Wmissing-prototypes] Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-002-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-poll_free_mdio | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_get_pauseparam | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnp500_set_pauseparam | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_addr_list_itr | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_check_mac_link_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_clean_link_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_driver_status_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clear_rar_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clear_vmdq_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_all_layer2_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_all_tuple5_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_layer2_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_mc_addr_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_tuple5_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_clr_vfta_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_layer2_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_rar_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_rss_hfunc_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_rx_skip_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_tcp_sync_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_tuple5_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_vfta_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_set_vmdq_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_update_mc_addr_list_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_update_rss_key_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_eth_update_rss_table_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_lldp_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_lpi_status_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_ncsi_mac_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_ncsi_vlan_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_get_permtion_mac_addr_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_init_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_layer2_pritologic_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_check_link_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_fc_mode_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_mdio_read_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_mdio_write_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_pmt_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_set_eee_timer_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mac_set_mac_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_mdio_read | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_phy_read_reg_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_phy_write_reg_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_reset_eee_mode_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_reset_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_eee_mode_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_eee_pls_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_eee_timer_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_ethtool_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_lldp_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_set_vf_vlan_mode_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_setup_eee_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_setup_mac_link_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_setup_wol_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_start_hw_ops_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_chip.c:warning:no-previous-prototype-for-rnpgbe_tuple5_pritologic_n500 | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_common.h:warning:suggest-braces-around-empty-body-in-an-if-statement | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_lib.c:warning:no-previous-prototype-for-rnpgbe_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_lib.c:warning:no-previous-prototype-for-update_ring_count | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-print_status | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_disable_eee_mode | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_eee_init | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_phy_init_eee | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_reinit_locked | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:no-previous-prototype-for-rnpgbe_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:suggest-braces-around-empty-body-in-an-if-statement | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_fw_reg_read | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_fw_send_cmd_wait | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_link_stat_mark_disable | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_link_stat_mark_reset | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_mbx_fw_post_req | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_mbx_get_link | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-rnpgbe_mbx_write_posted_locked | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.c:warning:no-previous-prototype-for-to_mac_type | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_ptp.c:warning:no-previous-prototype-for-rnpgbe_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_sriov.c:warning:no-previous-prototype-for-check_ari_mode | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_sriov.c:warning:no-previous-prototype-for-rnpgbe_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_sysfs.c:warning:no-previous-prototype-for-n500_exchange_share_ram | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_layer2_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping_tcam | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-clean_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-control_mac_rx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_can_rpu_start | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_check_mc_addr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_fix_queue_number | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_event_schedule | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_task | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_write_eitr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring_temp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-update_pf_vlan | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-wait_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_get_capablity | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_reg_read | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_send_cmd_wait | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_get_port_stats2 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_link_stat_mark_disable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_fw_post_req | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_pluginout_evt_en | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_write_posted_locked | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-rnpm_reset_pipeline_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-rnpm_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:suggest-braces-around-empty-body-in-an-if-statement | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-rnpm_mbx_get_pn_sn | |-- drivers-net-ethernet-mucse-rnpm-rnpm_tc_u32_parse.h:warning:rnpm_ipv4_parser-defined-but-not-used | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-001-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-buildonly-randconfig-001-20240320 | `-- (.text):undefined-reference-to-lockdep_is_cpus_held `-- x86_64-buildonly-randconfig-005-20240320 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-001-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- arm64-randconfig-004-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-buildonly-randconfig-002-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-buildonly-randconfig-003-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-buildonly-randconfig-004-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-buildonly-randconfig-006-20240320 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead elapsed time: 733m configs tested: 40 configs skipped: 142 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240320 clang arm64 randconfig-002-20240320 gcc arm64 randconfig-003-20240320 clang arm64 randconfig-004-20240320 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240320 gcc loongarch randconfig-002-20240320 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240320 gcc x86_64 buildonly-randconfig-002-20240320 clang x86_64 buildonly-randconfig-003-20240320 clang x86_64 buildonly-randconfig-004-20240320 clang x86_64 buildonly-randconfig-005-20240320 gcc x86_64 buildonly-randconfig-006-20240320 clang x86_64 defconfig gcc x86_64 randconfig-001-20240320 clang x86_64 randconfig-002-20240320 clang x86_64 randconfig-003-20240320 gcc x86_64 randconfig-004-20240320 clang x86_64 randconfig-005-20240320 clang x86_64 randconfig-006-20240320 clang x86_64 randconfig-011-20240320 gcc x86_64 randconfig-012-20240320 gcc x86_64 randconfig-013-20240320 gcc x86_64 randconfig-014-20240320 gcc x86_64 randconfig-015-20240320 clang x86_64 randconfig-016-20240320 gcc x86_64 randconfig-071-20240320 clang x86_64 randconfig-072-20240320 gcc x86_64 randconfig-073-20240320 clang x86_64 randconfig-074-20240320 gcc x86_64 randconfig-075-20240320 gcc x86_64 randconfig-076-20240320 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 471243f27e5b9c72aec23faa8d5badde456cf3c3
by kernel test robot 21 Mar '24

21 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 471243f27e5b9c72aec23faa8d5badde456cf3c3 !5359 CVE-2021-47121 and CVE-2021-47122 Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-defconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized `-- x86_64-buildonly-randconfig-005-20240320 |-- drivers-powercap-intel_rapl_common.o:warning:objtool:missing-symbol-for-section-.init.text `-- drivers-powercap-intel_rapl_msr.o:warning:objtool:missing-symbol-for-section-.init.text elapsed time: 741m configs tested: 35 configs skipped: 147 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240320 gcc arm64 randconfig-002-20240320 gcc arm64 randconfig-003-20240320 gcc arm64 randconfig-004-20240320 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240320 gcc x86_64 buildonly-randconfig-002-20240320 clang x86_64 buildonly-randconfig-003-20240320 clang x86_64 buildonly-randconfig-004-20240320 clang x86_64 buildonly-randconfig-005-20240320 gcc x86_64 buildonly-randconfig-006-20240320 clang x86_64 defconfig gcc x86_64 randconfig-001-20240320 clang x86_64 randconfig-002-20240320 clang x86_64 randconfig-003-20240320 gcc x86_64 randconfig-004-20240320 clang x86_64 randconfig-005-20240320 clang x86_64 randconfig-006-20240320 clang x86_64 randconfig-011-20240320 gcc x86_64 randconfig-012-20240320 gcc x86_64 randconfig-013-20240320 gcc x86_64 randconfig-014-20240320 gcc x86_64 randconfig-015-20240320 clang x86_64 randconfig-016-20240320 gcc x86_64 randconfig-071-20240320 clang x86_64 randconfig-072-20240320 gcc x86_64 randconfig-073-20240320 clang x86_64 randconfig-074-20240320 gcc x86_64 randconfig-075-20240320 gcc x86_64 randconfig-076-20240320 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING c2bdc9e940917e2417306e19f6b4683ae55de78a
by kernel test robot 21 Mar '24

21 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c2bdc9e940917e2417306e19f6b4683ae55de78a !5348 s390/ptrace: handle setting of fpc register correctly Warning: (recently discovered and may have been fixed) mm/share_pool.c:2573:7: warning: no previous prototype for '__mg_sp_alloc_nodemask' [-Wmissing-prototypes] Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240312 `-- mm-share_pool.c:warning:no-previous-prototype-for-__mg_sp_alloc_nodemask clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-infiniband-hw-xsc-mem.c:warning:no-previous-prototype-for-function-xsc_find_chunk_cont_0 | |-- drivers-infiniband-hw-xsc-mr.c:warning:variable-using_peer_mem-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-eecd-description-in-rnpm_lower_eeprom_clk | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hash_value-description-in-rnpm_set_mta | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hw-description-in-rnpm_mta_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-pf-description-in-rnpm_set_vlan_anti_spoofing | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-count-not-described-in-rnpm_shift_in_eeprom_bits | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-eec-not-described-in-rnpm_lower_eeprom_clk | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mc_addr-not-described-in-rnpm_set_mta | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mode-not-described-in-rnpm_mta_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-vf-not-described-in-rnpm_set_vlan_anti_spoofing | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnpm_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_get_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ee-description-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-flags-description-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_set_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_info | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_rxnfc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-pf-description-in-rnpm_get_rss_hash_opts | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_get_rss_hash_opts | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_info | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_rxnfc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-eeprom-not-described-in-rnpm_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_get_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_set_coalesce | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_get_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-priv_flags-not-described-in-rnpm_set_priv_flags | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-v_count-description-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnpm_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnpm_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_layer2_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping_tcam | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-ent-description-in-rnpm_probe | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-hw-description-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-link_speed-description-in-rnpm_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-maxrate-description-in-rnpm_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_setup_tc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-pb-description-in-rnpm_lpbthresh | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-queue-description-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-skb-description-in-rnpm_is_non_eop | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_setup_tc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-id-not-described-in-rnpm_probe | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-is_rxframe-not-described-in-rnpm_write_eitr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnpm_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_msix_vector-not-described-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_queue-not-described-in-rnpm_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnpm_wol_supported | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnpm_tx_timeout | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-clean_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-control_mac_rx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_can_rpu_start | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_check_mc_addr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_fix_queue_number | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_event_schedule | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_task | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_service_timer | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_write_eitr | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring_temp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-update_pf_vlan | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-wait_all_port_resetting | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-hw-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-packets-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-mbx_cookie_zalloc | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_get_capablity | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_reg_read | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_send_cmd_wait | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_get_port_stats2 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_link_stat_mark_disable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_fw_post_req | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_pluginout_evt_en | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_write_posted_locked | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-is-uninitialized-when-used-here | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-hw-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-atr_input-description-in-rnpm_atr_compute_perfect_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-stream-description-in-rnpm_atr_compute_sig_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-common-not-described-in-rnpm_atr_compute_sig_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_perfect_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_sig_hash_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-function-rnpm_reset_pipeline_n10 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:variable-status-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-eeprom_data-description-in-rnpm_read_i2c_sff8472_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_i2c_data | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_phy_type_from_id | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-autoneg_wait_to_complete-not-described-in-rnpm_setup_phy_link_speed_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_read_i2c_byte_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_write_i2c_byte_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-device_type-not-described-in-rnpm_read_phy_reg_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-link_up-not-described-in-rnpm_check_phy_link_tnx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-phy_id-not-described-in-rnpm_get_phy_type_from_id | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-sff8472_data-not-described-in-rnpm_read_i2c_sff8472_generic | |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-speed-not-described-in-rnpm_check_phy_link_tnx | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-function-rnpm_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:variable-target-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-function-rnpm_mbx_get_pn_sn | |-- drivers-net-ethernet-yunsilicon-xsc-common-xsc_core.h:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_eth_change_link_status | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_get_vf_config | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_get_linear_frag_sz | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_is_linear_skb | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_select_queue | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:variable-txq_ix-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-buffer_size-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-curr_pfc_en-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-prio2buffer-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_devid_to_pcie_no | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-find_kallsyms_lookup_name | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-noop_pre | |-- drivers-net-ethernet-yusur-k2-..-platform-ys_intr.c:warning:overlapping-comparisons-always-evaluate-to-false | |-- drivers-net-ethernet-yusur-k2-ys_k2_tx.c:warning:variable-clean_tail_ptr-set-but-not-used | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns | `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode `-- x86_64-randconfig-073-20240320 `-- drivers-scsi-qedi-qedi_main.o:warning:objtool:__qedi_probe-falls-through-to-next-function-qedi_setup_int() elapsed time: 723m configs tested: 35 configs skipped: 150 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240320 clang arm64 randconfig-002-20240320 gcc arm64 randconfig-003-20240320 clang arm64 randconfig-004-20240320 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240320 gcc x86_64 buildonly-randconfig-002-20240320 clang x86_64 buildonly-randconfig-003-20240320 clang x86_64 buildonly-randconfig-004-20240320 clang x86_64 buildonly-randconfig-005-20240320 gcc x86_64 buildonly-randconfig-006-20240320 clang x86_64 defconfig gcc x86_64 randconfig-001-20240320 clang x86_64 randconfig-002-20240320 clang x86_64 randconfig-003-20240320 gcc x86_64 randconfig-004-20240320 clang x86_64 randconfig-005-20240320 clang x86_64 randconfig-006-20240320 clang x86_64 randconfig-011-20240320 gcc x86_64 randconfig-012-20240320 gcc x86_64 randconfig-013-20240320 gcc x86_64 randconfig-014-20240320 gcc x86_64 randconfig-015-20240320 clang x86_64 randconfig-016-20240320 gcc x86_64 randconfig-071-20240320 clang x86_64 randconfig-072-20240320 gcc x86_64 randconfig-073-20240320 clang x86_64 randconfig-074-20240320 gcc x86_64 randconfig-075-20240320 gcc x86_64 randconfig-076-20240320 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 4225/4226] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:311:36: warning: suggest braces around empty body in an 'if' statement
by kernel test robot 21 Mar '24

21 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 1fbfc27b811b42bafdbe80c46f1fd2d9dfb1e976 commit: eba3cbcfeafedc65b74eea8faf68aae00aebd5b6 [4225/4226] drivers: initial support for rnpgbe drivers from Mucse Technology config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240321/202403210049.GByOQrbb-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240321/202403210049.GByOQrbb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403210049.GByOQrbb-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:35: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h: In function '_rnpgbe_skb_dump': >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:311:36: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 311 | &dev->features); | ^ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:23: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:13: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:23: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:14: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c: At top level: >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:271:6: warning: no previous prototype for 'rnpgbe_disable_eee_mode' [-Wmissing-prototypes] 271 | void rnpgbe_disable_eee_mode(struct rnpgbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:730:5: warning: no previous prototype for 'rnpgbe_rx_ring_reinit' [-Wmissing-prototypes] 730 | int rnpgbe_rx_ring_reinit(struct rnpgbe_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c: In function 'rnpgbe_clean_rx_irq': drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:1933:14: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1933 | bool xdp_xmit = false; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c: At top level: >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:2170:6: warning: no previous prototype for 'rnpgbe_write_eitr_rx' [-Wmissing-prototypes] 2170 | void rnpgbe_write_eitr_rx(struct rnpgbe_q_vector *q_vector) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c: In function 'rnpgbe_configure_tx_ring': >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:2727:62: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 2727 | rnpgbe_dbg("wait tx ready timeout\n"); | ^ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c: At top level: >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:3209:6: warning: no previous prototype for 'rnpgbe_vlan_stags_flag' [-Wmissing-prototypes] 3209 | void rnpgbe_vlan_stags_flag(struct rnpgbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:3314:6: warning: no previous prototype for 'rnpgbe_reinit_locked' [-Wmissing-prototypes] 3314 | void rnpgbe_reinit_locked(struct rnpgbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:3487:5: warning: no previous prototype for 'rnpgbe_xmit_nop_frame_ring' [-Wmissing-prototypes] 3487 | int rnpgbe_xmit_nop_frame_ring(struct rnpgbe_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:3503:6: warning: no previous prototype for 'print_status' [-Wmissing-prototypes] 3503 | void print_status(struct rnpgbe_adapter *adapter) | ^~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:4624:6: warning: no previous prototype for 'rnpgbe_eee_init' [-Wmissing-prototypes] 4624 | bool rnpgbe_eee_init(struct rnpgbe_adapter *adapter) | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:4651:5: warning: no previous prototype for 'rnpgbe_phy_init_eee' [-Wmissing-prototypes] 4651 | int rnpgbe_phy_init_eee(struct rnpgbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:6132:6: warning: no previous prototype for 'rnpgbe_assign_netdev_ops' [-Wmissing-prototypes] 6132 | void rnpgbe_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c: In function 'rnpgbe_request_msix_irqs': >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:2484:43: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] 2484 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ^ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c:2483:25: note: 'snprintf' output between 10 and 37 bytes into a destination of size 24 2483 | snprintf(q_vector->name, sizeof(q_vector->name) - 1, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2484 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2485 | q_vector->v_idx); | ~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/mucse/rnpgbe/rnpgbe.h:21, from drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.c:9: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h: In function '_rnpgbe_skb_dump': >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:311:36: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 311 | &dev->features); | ^ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:23: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:13: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:23: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:14: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~ -- In file included from drivers/net/ethernet/mucse/rnpgbe/rnpgbe.h:21, from drivers/net/ethernet/mucse/rnpgbe/rnpgbe_lib.c:4: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h: In function '_rnpgbe_skb_dump': >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:311:36: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 311 | &dev->features); | ^ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:23: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:13: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:23: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:14: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_lib.c: At top level: >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_lib.c:308:5: warning: no previous prototype for 'rnpgbe_acquire_msix_vectors' [-Wmissing-prototypes] 308 | int rnpgbe_acquire_msix_vectors(struct rnpgbe_adapter *adapter, int vectors) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_lib.c:719:6: warning: no previous prototype for 'update_ring_count' [-Wmissing-prototypes] 719 | void update_ring_count(struct rnpgbe_adapter *adapter) | ^~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/mucse/rnpgbe/rnpgbe.h:21, from drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:8: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h: In function '_rnpgbe_skb_dump': >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:311:36: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 311 | &dev->features); | ^ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:23: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:13: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:23: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:14: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c: At top level: >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:160:5: warning: no previous prototype for 'rnpgbe_eth_set_rar_n500' [-Wmissing-prototypes] 160 | s32 rnpgbe_eth_set_rar_n500(struct rnpgbe_eth_info *eth, u32 index, u8 *addr, | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:212:5: warning: no previous prototype for 'rnpgbe_eth_clear_rar_n500' [-Wmissing-prototypes] 212 | s32 rnpgbe_eth_clear_rar_n500(struct rnpgbe_eth_info *eth, u32 index) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:246:5: warning: no previous prototype for 'rnpgbe_eth_set_vmdq_n500' [-Wmissing-prototypes] 246 | s32 rnpgbe_eth_set_vmdq_n500(struct rnpgbe_eth_info *eth, u32 rar, u32 vmdq) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:267:5: warning: no previous prototype for 'rnpgbe_eth_clear_vmdq_n500' [-Wmissing-prototypes] 267 | s32 rnpgbe_eth_clear_vmdq_n500(struct rnpgbe_eth_info *eth, u32 rar, u32 vmdq) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:366:5: warning: no previous prototype for 'rnpgbe_addr_list_itr' [-Wmissing-prototypes] 366 | u8 *rnpgbe_addr_list_itr(struct rnpgbe_hw __maybe_unused *hw, u8 **mc_addr_ptr) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:394:5: warning: no previous prototype for 'rnpgbe_eth_update_mc_addr_list_n500' [-Wmissing-prototypes] 394 | s32 rnpgbe_eth_update_mc_addr_list_n500(struct rnpgbe_eth_info *eth, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:477:6: warning: no previous prototype for 'rnpgbe_eth_clr_mc_addr_n500' [-Wmissing-prototypes] 477 | void rnpgbe_eth_clr_mc_addr_n500(struct rnpgbe_eth_info *eth) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:492:5: warning: no previous prototype for 'rnpgbe_eth_set_rss_hfunc_n500' [-Wmissing-prototypes] 492 | int rnpgbe_eth_set_rss_hfunc_n500(struct rnpgbe_eth_info *eth, int hfunc) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:522:6: warning: no previous prototype for 'rnpgbe_eth_update_rss_key_n500' [-Wmissing-prototypes] 522 | void rnpgbe_eth_update_rss_key_n500(struct rnpgbe_eth_info *eth, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:556:6: warning: no previous prototype for 'rnpgbe_eth_update_rss_table_n500' [-Wmissing-prototypes] 556 | void rnpgbe_eth_update_rss_table_n500(struct rnpgbe_eth_info *eth) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:583:5: warning: no previous prototype for 'rnpgbe_eth_set_vfta_n500' [-Wmissing-prototypes] 583 | s32 rnpgbe_eth_set_vfta_n500(struct rnpgbe_eth_info *eth, u32 vlan, | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:624:6: warning: no previous prototype for 'rnpgbe_eth_clr_vfta_n500' [-Wmissing-prototypes] 624 | void rnpgbe_eth_clr_vfta_n500(struct rnpgbe_eth_info *eth) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:680:5: warning: no previous prototype for 'rnpgbe_layer2_pritologic_n500' [-Wmissing-prototypes] 680 | u16 rnpgbe_layer2_pritologic_n500(u16 hw_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:685:6: warning: no previous prototype for 'rnpgbe_eth_set_layer2_n500' [-Wmissing-prototypes] 685 | void rnpgbe_eth_set_layer2_n500(struct rnpgbe_eth_info *eth, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:712:6: warning: no previous prototype for 'rnpgbe_eth_clr_layer2_n500' [-Wmissing-prototypes] 712 | void rnpgbe_eth_clr_layer2_n500(struct rnpgbe_eth_info *eth, u16 pri_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:720:6: warning: no previous prototype for 'rnpgbe_eth_clr_all_layer2_n500' [-Wmissing-prototypes] 720 | void rnpgbe_eth_clr_all_layer2_n500(struct rnpgbe_eth_info *eth) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:728:5: warning: no previous prototype for 'rnpgbe_tuple5_pritologic_n500' [-Wmissing-prototypes] 728 | u16 rnpgbe_tuple5_pritologic_n500(u16 hw_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:733:6: warning: no previous prototype for 'rnpgbe_eth_set_tuple5_n500' [-Wmissing-prototypes] 733 | void rnpgbe_eth_set_tuple5_n500(struct rnpgbe_eth_info *eth, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:814:6: warning: no previous prototype for 'rnpgbe_eth_clr_tuple5_n500' [-Wmissing-prototypes] 814 | void rnpgbe_eth_clr_tuple5_n500(struct rnpgbe_eth_info *eth, u16 pri_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:822:6: warning: no previous prototype for 'rnpgbe_eth_clr_all_tuple5_n500' [-Wmissing-prototypes] 822 | void rnpgbe_eth_clr_all_tuple5_n500(struct rnpgbe_eth_info *eth) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:830:6: warning: no previous prototype for 'rnpgbe_eth_set_tcp_sync_n500' [-Wmissing-prototypes] 830 | void rnpgbe_eth_set_tcp_sync_n500(struct rnpgbe_eth_info *eth, int queue, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:846:6: warning: no previous prototype for 'rnpgbe_eth_set_rx_skip_n500' [-Wmissing-prototypes] 846 | void rnpgbe_eth_set_rx_skip_n500(struct rnpgbe_eth_info *eth, int count, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1001:5: warning: no previous prototype for 'rnpgbe_init_hw_ops_n500' [-Wmissing-prototypes] 1001 | s32 rnpgbe_init_hw_ops_n500(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1014:5: warning: no previous prototype for 'rnpgbe_get_permtion_mac_addr_n500' [-Wmissing-prototypes] 1014 | s32 rnpgbe_get_permtion_mac_addr_n500(struct rnpgbe_hw *hw, u8 *mac_addr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1027:5: warning: no previous prototype for 'rnpgbe_reset_hw_ops_n500' [-Wmissing-prototypes] 1027 | s32 rnpgbe_reset_hw_ops_n500(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1099:5: warning: no previous prototype for 'rnpgbe_start_hw_ops_n500' [-Wmissing-prototypes] 1099 | s32 rnpgbe_start_hw_ops_n500(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1856:5: warning: no previous prototype for 'rnpgbe_check_mac_link_hw_ops_n500' [-Wmissing-prototypes] 1856 | s32 rnpgbe_check_mac_link_hw_ops_n500(struct rnpgbe_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1888:5: warning: no previous prototype for 'rnpgbe_setup_mac_link_hw_ops_n500' [-Wmissing-prototypes] 1888 | s32 rnpgbe_setup_mac_link_hw_ops_n500(struct rnpgbe_hw *hw, u32 adv, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1897:6: warning: no previous prototype for 'rnpgbe_clean_link_hw_ops_n500' [-Wmissing-prototypes] 1897 | void rnpgbe_clean_link_hw_ops_n500(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1956:5: warning: no previous prototype for 'rnpgbe_phy_read_reg_hw_ops_n500' [-Wmissing-prototypes] 1956 | s32 rnpgbe_phy_read_reg_hw_ops_n500(struct rnpgbe_hw *hw, u32 reg_addr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1969:5: warning: no previous prototype for 'rnpgbe_phy_write_reg_hw_ops_n500' [-Wmissing-prototypes] 1969 | s32 rnpgbe_phy_write_reg_hw_ops_n500(struct rnpgbe_hw *hw, u32 reg_addr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1980:6: warning: no previous prototype for 'rnpgbe_setup_wol_hw_ops_n500' [-Wmissing-prototypes] 1980 | void rnpgbe_setup_wol_hw_ops_n500(struct rnpgbe_hw *hw, u32 mode) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1987:6: warning: no previous prototype for 'rnpgbe_setup_eee_hw_ops_n500' [-Wmissing-prototypes] 1987 | void rnpgbe_setup_eee_hw_ops_n500(struct rnpgbe_hw *hw, int ls, int tw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:1998:6: warning: no previous prototype for 'rnpgbe_set_eee_mode_hw_ops_n500' [-Wmissing-prototypes] 1998 | void rnpgbe_set_eee_mode_hw_ops_n500(struct rnpgbe_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2006:6: warning: no previous prototype for 'rnpgbe_reset_eee_mode_hw_ops_n500' [-Wmissing-prototypes] 2006 | void rnpgbe_reset_eee_mode_hw_ops_n500(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2013:6: warning: no previous prototype for 'rnpgbe_set_eee_pls_hw_ops_n500' [-Wmissing-prototypes] 2013 | void rnpgbe_set_eee_pls_hw_ops_n500(struct rnpgbe_hw *hw, int link) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2020:5: warning: no previous prototype for 'rnpgbe_get_lpi_status_hw_ops_n500' [-Wmissing-prototypes] 2020 | u32 rnpgbe_get_lpi_status_hw_ops_n500(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2027:5: warning: no previous prototype for 'rnpgbe_get_ncsi_mac_hw_ops_n500' [-Wmissing-prototypes] 2027 | int rnpgbe_get_ncsi_mac_hw_ops_n500(struct rnpgbe_hw *hw, u8 *addr, int idx) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2050:5: warning: no previous prototype for 'rnpgbe_get_ncsi_vlan_hw_ops_n500' [-Wmissing-prototypes] 2050 | int rnpgbe_get_ncsi_vlan_hw_ops_n500(struct rnpgbe_hw *hw, u16 *vlan, int idx) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2066:6: warning: no previous prototype for 'rnpgbe_set_lldp_hw_ops_n500' [-Wmissing-prototypes] 2066 | void rnpgbe_set_lldp_hw_ops_n500(struct rnpgbe_hw *hw, bool enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2071:6: warning: no previous prototype for 'rnpgbe_get_lldp_hw_ops_n500' [-Wmissing-prototypes] 2071 | void rnpgbe_get_lldp_hw_ops_n500(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2075:6: warning: no previous prototype for 'rnpgbe_set_eee_timer_hw_ops_n500' [-Wmissing-prototypes] 2075 | void rnpgbe_set_eee_timer_hw_ops_n500(struct rnpgbe_hw *hw, int ls, int tw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2082:6: warning: no previous prototype for 'rnpgbe_set_vf_vlan_mode_hw_ops_n500' [-Wmissing-prototypes] 2082 | void rnpgbe_set_vf_vlan_mode_hw_ops_n500(struct rnpgbe_hw *hw, u16 vlan, int vf, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2092:6: warning: no previous prototype for 'rnpgbe_driver_status_hw_ops_n500' [-Wmissing-prototypes] 2092 | void rnpgbe_driver_status_hw_ops_n500(struct rnpgbe_hw *hw, bool enable, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2256:5: warning: no previous prototype for 'rnp500_get_link_ksettings' [-Wmissing-prototypes] 2256 | int rnp500_get_link_ksettings(struct net_device *netdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2381:5: warning: no previous prototype for 'rnp500_set_link_ksettings' [-Wmissing-prototypes] 2381 | int rnp500_set_link_ksettings(struct net_device *netdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2550:6: warning: no previous prototype for 'rnp500_get_pauseparam' [-Wmissing-prototypes] 2550 | void rnp500_get_pauseparam(struct net_device *netdev, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2574:5: warning: no previous prototype for 'rnp500_set_pauseparam' [-Wmissing-prototypes] 2574 | int rnp500_set_pauseparam(struct net_device *netdev, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c: In function 'rnp500_get_strings': drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:2624:13: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2624 | u32 dma_ch; | ^~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c: In function 'rnp500_get_ethtool_stats': drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3075:21: warning: variable 'idx' set but not used [-Wunused-but-set-variable] 3075 | int idx; | ^~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c: At top level: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_chip.c:3265:6: warning: no previous prototype for 'rnpgbe_set_ethtool_hw_ops_n500' [-Wmissing-prototypes] 3265 | void rnpgbe_set_ethtool_hw_ops_n500(struct net_device *netdev) -- In file included from drivers/net/ethernet/mucse/rnpgbe/rnpgbe.h:21, from drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:9: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h: In function '_rnpgbe_skb_dump': >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:311:36: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 311 | &dev->features); | ^ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:23: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:276:13: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 276 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:23: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h:275:14: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 275 | bool has_mac, has_trans; | ^~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c: At top level: >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:15:24: warning: no previous prototype for 'mbx_cookie_zalloc' [-Wmissing-prototypes] 15 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:29:5: warning: no previous prototype for 'rnpgbe_mbx_write_posted_locked' [-Wmissing-prototypes] 29 | int rnpgbe_mbx_write_posted_locked(struct rnpgbe_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:66:6: warning: no previous prototype for 'rnpgbe_link_stat_mark_reset' [-Wmissing-prototypes] 66 | void rnpgbe_link_stat_mark_reset(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:71:6: warning: no previous prototype for 'rnpgbe_link_stat_mark_disable' [-Wmissing-prototypes] 71 | void rnpgbe_link_stat_mark_disable(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:76:5: warning: no previous prototype for 'rnpgbe_mbx_fw_post_req' [-Wmissing-prototypes] 76 | int rnpgbe_mbx_fw_post_req(struct rnpgbe_hw *hw, struct mbx_fw_cmd_req *req, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:131:5: warning: no previous prototype for 'rnpgbe_fw_send_cmd_wait' [-Wmissing-prototypes] 131 | int rnpgbe_fw_send_cmd_wait(struct rnpgbe_hw *hw, struct mbx_fw_cmd_req *req, | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:185:5: warning: no previous prototype for 'rnpgbe_mbx_get_link' [-Wmissing-prototypes] 185 | int rnpgbe_mbx_get_link(struct rnpgbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:930:5: warning: no previous prototype for 'to_mac_type' [-Wmissing-prototypes] 930 | int to_mac_type(struct phy_abilities *ability) | ^~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c: In function 'rnpgbe_mbx_phy_eee_set': drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:1145:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1145 | int err; | ^~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c: In function 'rnpgbe_mbx_get_temp': drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:1229:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1229 | int err; | ^~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c: At top level: >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:1262:5: warning: no previous prototype for 'rnpgbe_fw_reg_read' [-Wmissing-prototypes] 1262 | int rnpgbe_fw_reg_read(struct rnpgbe_hw *hw, int addr, int sz) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c: In function 'rnpgbe_fw_reg_read': drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:1266:13: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1266 | int value; | ^~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c: In function 'rnpgbe_mbx_reg_write': >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:564:9: warning: 'build_writereg_req' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=] 564 | build_writereg_req(&req, NULL, fw_reg, 4, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.c:564:9: note: referencing argument 5 of type 'int[4]' In file included from drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx.h:8, from drivers/net/ethernet/mucse/rnpgbe/rnpgbe_type.h:1025, from drivers/net/ethernet/mucse/rnpgbe/rnpgbe.h:20: drivers/net/ethernet/mucse/rnpgbe/rnpgbe_mbx_fw.h:817:20: note: in a call to function 'build_writereg_req' 817 | static inline void build_writereg_req(struct mbx_fw_cmd_req *req, void *cookie, | ^~~~~~~~~~~~~~~~~~ .. vim +/if +311 drivers/net/ethernet/mucse/rnpgbe/rnpgbe_common.h 264 265 #ifndef NO_SKB_DUMP 266 static inline void _rnpgbe_skb_dump(const struct sk_buff *skb, bool full_pkt) 267 { 268 static atomic_t can_dump_full = ATOMIC_INIT(5); 269 #ifdef DEBUG 270 struct skb_shared_info *sh = skb_shinfo(skb); 271 #endif 272 struct net_device *dev = skb->dev; 273 //struct sock *sk = skb->sk; 274 struct sk_buff *list_skb; 275 bool has_mac, has_trans; 276 int headroom, tailroom; 277 int i, len, seg_len; 278 const char *level = KERN_WARNING; 279 280 if (full_pkt) 281 full_pkt = atomic_dec_if_positive(&can_dump_full) >= 0; 282 283 if (full_pkt) 284 len = skb->len; 285 else 286 len = min_t(int, skb->len, MAX_HEADER + 128); 287 288 headroom = skb_headroom(skb); 289 tailroom = skb_tailroom(skb); 290 291 has_mac = skb_mac_header_was_set(skb); 292 has_trans = skb_transport_header_was_set(skb); 293 294 dbg("%sskb len=%u headroom=%u headlen=%u tailroom=%u\n" 295 "mac=(%d,%d) net=(%d,%d) trans=%d\n" 296 "shinfo(txflags=%u nr_frags=%u gso(size=%hu type=%u segs=%hu))\n" 297 "csum(0x%x ip_summed=%u complete_sw=%u valid=%u level=%u)\n" 298 "hash(0x%x sw=%u l4=%u) proto=0x%04x pkttype=%u iif=%d\n", 299 level, skb->len, headroom, skb_headlen(skb), tailroom, 300 has_mac ? skb->mac_header : -1, 301 has_mac ? (skb->network_header - skb->mac_header) : -1, 302 skb->network_header, has_trans ? skb_network_header_len(skb) : -1, 303 has_trans ? skb->transport_header : -1, sh->tx_flags, sh->nr_frags, 304 sh->gso_size, sh->gso_type, sh->gso_segs, skb->csum, skb->ip_summed, 305 skb->csum_complete_sw, skb->csum_valid, skb->csum_level, skb->hash, 306 skb->sw_hash, skb->l4_hash, ntohs(skb->protocol), skb->pkt_type, 307 skb->skb_iif); 308 309 if (dev) 310 dbg("%sdev name=%s feat=0x%pNF\n", level, dev->name, > 311 &dev->features); 312 313 seg_len = min_t(int, skb_headlen(skb), len); 314 if (seg_len) 315 print_hex_dump(level, "skb linear: ", DUMP_PREFIX_OFFSET, 16, 316 1, skb->data, seg_len, false); 317 len -= seg_len; 318 319 for (i = 0; len && i < skb_shinfo(skb)->nr_frags; i++) { 320 skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; 321 u32 p_len; 322 struct page *p; 323 u8 *vaddr; 324 325 p = skb_frag_address(frag); 326 p_len = skb_frag_size(frag); 327 seg_len = min_t(int, p_len, len); 328 vaddr = kmap_atomic(p); 329 print_hex_dump(level, "skb frag: ", DUMP_PREFIX_OFFSET, 16, 330 1, vaddr, seg_len, false); 331 kunmap_atomic(vaddr); 332 len -= seg_len; 333 if (!len) 334 break; 335 } 336 337 if (full_pkt && skb_has_frag_list(skb)) { 338 dbg("skb fraglist:\n"); 339 skb_walk_frags(skb, list_skb) _rnpgbe_skb_dump(list_skb, true); 340 } 341 } 342 #endif 343 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] block/rnbd-srv: Check for unlikely string overflow
by Li Lingfeng 20 Mar '24

20 Mar '24

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.8-rc1 commit 9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K1F CVE: CVE-2023-52618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning: drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra': drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~ In function 'rnbd_srv_get_full_path', inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | dev_search_path, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~ To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present). Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202312100355.lHoJPgKy-lkp@intel.com/ Cc: Md. Haris Iqbal <haris.iqbal(a)ionos.com> Cc: Jack Wang <jinpu.wang(a)ionos.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: <linux-block(a)vger.kernel.org> Signed-off-by: Kees Cook <keescook(a)chromium.org> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Link: https://lore.kernel.org/r/20231212214738.work.169-kees@kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/block/rnbd/rnbd-srv.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c index e1bc8b4cd592..9c5d52335e17 100644 --- a/drivers/block/rnbd/rnbd-srv.c +++ b/drivers/block/rnbd/rnbd-srv.c @@ -591,6 +591,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, { char *full_path; char *a, *b; + int len; full_path = kmalloc(PATH_MAX, GFP_KERNEL); if (!full_path) @@ -602,19 +603,19 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, */ a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path)); if (a) { - int len = a - dev_search_path; + len = a - dev_search_path; len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len, dev_search_path, srv_sess->sessname, dev_name); - if (len >= PATH_MAX) { - pr_err("Too long path: %s, %s, %s\n", - dev_search_path, srv_sess->sessname, dev_name); - kfree(full_path); - return ERR_PTR(-EINVAL); - } } else { - snprintf(full_path, PATH_MAX, "%s/%s", - dev_search_path, dev_name); + len = snprintf(full_path, PATH_MAX, "%s/%s", + dev_search_path, dev_name); + } + if (len >= PATH_MAX) { + pr_err("Too long path: %s, %s, %s\n", + dev_search_path, srv_sess->sessname, dev_name); + kfree(full_path); + return ERR_PTR(-EINVAL); } /* eliminitate duplicated slashes */ -- 2.31.1

2 1

[PATCH OLK-6.6] block/rnbd-srv: Check for unlikely string overflow
by Li Lingfeng 20 Mar '24

20 Mar '24

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.8-rc1 commit 9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K1F CVE: CVE-2023-52618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning: drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra': drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~ In function 'rnbd_srv_get_full_path', inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | dev_search_path, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~ To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present). Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202312100355.lHoJPgKy-lkp@intel.com/ Cc: Md. Haris Iqbal <haris.iqbal(a)ionos.com> Cc: Jack Wang <jinpu.wang(a)ionos.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: <linux-block(a)vger.kernel.org> Signed-off-by: Kees Cook <keescook(a)chromium.org> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Link: https://lore.kernel.org/r/20231212214738.work.169-kees@kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/block/rnbd/rnbd-srv.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c index 65de51f3dfd9..ab78eab97d98 100644 --- a/drivers/block/rnbd/rnbd-srv.c +++ b/drivers/block/rnbd/rnbd-srv.c @@ -585,6 +585,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, { char *full_path; char *a, *b; + int len; full_path = kmalloc(PATH_MAX, GFP_KERNEL); if (!full_path) @@ -596,19 +597,19 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, */ a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path)); if (a) { - int len = a - dev_search_path; + len = a - dev_search_path; len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len, dev_search_path, srv_sess->sessname, dev_name); - if (len >= PATH_MAX) { - pr_err("Too long path: %s, %s, %s\n", - dev_search_path, srv_sess->sessname, dev_name); - kfree(full_path); - return ERR_PTR(-EINVAL); - } } else { - snprintf(full_path, PATH_MAX, "%s/%s", - dev_search_path, dev_name); + len = snprintf(full_path, PATH_MAX, "%s/%s", + dev_search_path, dev_name); + } + if (len >= PATH_MAX) { + pr_err("Too long path: %s, %s, %s\n", + dev_search_path, srv_sess->sessname, dev_name); + kfree(full_path); + return ERR_PTR(-EINVAL); } /* eliminitate duplicated slashes */ -- 2.31.1

2 1

[PATCH 1/4] libhns: Add support for thread domain and parent domain
by Chengchang Tang 20 Mar '24

20 Mar '24

From: zzry <1245464216(a)qq.com> Add support for thread domain (TD) and parent domain (PAD). Extend the orginal hns_roce_pd struct to hns_roce_pad by adding the new hns_roce_td struct. When a parent domain holds a thread domain, the associated data path will be set to lock-free mode to improve performance. --- providers/hns/hns_roce_u.c | 5 +- providers/hns/hns_roce_u.h | 69 +++++++++++++- providers/hns/hns_roce_u_verbs.c | 156 ++++++++++++++++++++++++++++--- 3 files changed, 215 insertions(+), 15 deletions(-) diff --git a/providers/hns/hns_roce_u.c b/providers/hns/hns_roce_u.c index 266e73e..e3c72bb 100644 --- a/providers/hns/hns_roce_u.c +++ b/providers/hns/hns_roce_u.c @@ -67,7 +67,7 @@ static const struct verbs_context_ops hns_common_ops = { .create_qp = hns_roce_u_create_qp, .create_qp_ex = hns_roce_u_create_qp_ex, .dealloc_mw = hns_roce_u_dealloc_mw, - .dealloc_pd = hns_roce_u_free_pd, + .dealloc_pd = hns_roce_u_dealloc_pd, .dereg_mr = hns_roce_u_dereg_mr, .destroy_cq = hns_roce_u_destroy_cq, .modify_cq = hns_roce_u_modify_cq, @@ -88,6 +88,9 @@ static const struct verbs_context_ops hns_common_ops = { .close_xrcd = hns_roce_u_close_xrcd, .open_qp = hns_roce_u_open_qp, .get_srq_num = hns_roce_u_get_srq_num, + .alloc_td = hns_roce_u_alloc_td, + .dealloc_td = hns_roce_u_dealloc_td, + .alloc_parent_domain = hns_roce_u_alloc_pad, }; static uint32_t calc_table_shift(uint32_t entry_count, uint32_t size_shift) diff --git a/providers/hns/hns_roce_u.h b/providers/hns/hns_roce_u.h index afb68fe..338f162 100644 --- a/providers/hns/hns_roce_u.h +++ b/providers/hns/hns_roce_u.h @@ -190,6 +190,11 @@ struct hns_roce_db_page { unsigned long *bitmap; }; +struct hns_roce_spinlock { + pthread_spinlock_t lock; + int need_lock; +}; + struct hns_roce_context { struct verbs_context ibv_ctx; void *uar; @@ -224,9 +229,21 @@ struct hns_roce_context { unsigned int max_inline_data; }; +struct hns_roce_td { + struct ibv_td ibv_td; + atomic_int refcount; +}; + struct hns_roce_pd { struct ibv_pd ibv_pd; unsigned int pdn; + atomic_int refcount; + struct hns_roce_pd *protection_domain; +}; + +struct hns_roce_pad { + struct hns_roce_pd pd; + struct hns_roce_td *td; }; struct hns_roce_cq { @@ -398,9 +415,35 @@ static inline struct hns_roce_context *to_hr_ctx(struct ibv_context *ibv_ctx) return container_of(ibv_ctx, struct hns_roce_context, ibv_ctx.context); } +static inline struct hns_roce_td *to_hr_td(struct ibv_td *ibv_td) +{ + return container_of(ibv_td, struct hns_roce_td, ibv_td); +} + +/* to_hr_pd always returns the real hns_roce_pd obj. */ static inline struct hns_roce_pd *to_hr_pd(struct ibv_pd *ibv_pd) { - return container_of(ibv_pd, struct hns_roce_pd, ibv_pd); + struct hns_roce_pd *pd = + container_of(ibv_pd, struct hns_roce_pd, ibv_pd); + + if (pd->protection_domain) + return pd->protection_domain; + + return pd; +} + +static inline struct hns_roce_pad *to_hr_pad(struct ibv_pd *ibv_pd) +{ + struct hns_roce_pad *pad = + ibv_pd ? + container_of(ibv_pd, struct hns_roce_pad, pd.ibv_pd) : + NULL; + + if (pad && pad->pd.protection_domain) + return pad; + + /* Otherwise ibv_pd isn't a parent_domain */ + return NULL; } static inline struct hns_roce_cq *to_hr_cq(struct ibv_cq *ibv_cq) @@ -423,14 +466,35 @@ static inline struct hns_roce_ah *to_hr_ah(struct ibv_ah *ibv_ah) return container_of(ibv_ah, struct hns_roce_ah, ibv_ah); } +static inline int hns_roce_spin_lock(struct hns_roce_spinlock *hr_lock) +{ + if (hr_lock->need_lock) + return pthread_spin_lock(&hr_lock->lock); + + return 0; +} + +static inline int hns_roce_spin_unlock(struct hns_roce_spinlock *hr_lock) +{ + if (hr_lock->need_lock) + return pthread_spin_unlock(&hr_lock->lock); + + return 0; +} + int hns_roce_u_query_device(struct ibv_context *context, const struct ibv_query_device_ex_input *input, struct ibv_device_attr_ex *attr, size_t attr_size); int hns_roce_u_query_port(struct ibv_context *context, uint8_t port, struct ibv_port_attr *attr); +struct ibv_td *hns_roce_u_alloc_td(struct ibv_context *context, + struct ibv_td_init_attr *attr); +int hns_roce_u_dealloc_td(struct ibv_td *ibv_td); +struct ibv_pd *hns_roce_u_alloc_pad(struct ibv_context *context, + struct ibv_parent_domain_init_attr *attr); struct ibv_pd *hns_roce_u_alloc_pd(struct ibv_context *context); -int hns_roce_u_free_pd(struct ibv_pd *pd); +int hns_roce_u_dealloc_pd(struct ibv_pd *pd); struct ibv_mr *hns_roce_u_reg_mr(struct ibv_pd *pd, void *addr, size_t length, uint64_t hca_va, int access); @@ -489,6 +553,7 @@ int hns_roce_u_close_xrcd(struct ibv_xrcd *ibv_xrcd); int hns_roce_alloc_buf(struct hns_roce_buf *buf, unsigned int size, int page_size); void hns_roce_free_buf(struct hns_roce_buf *buf); +void hns_roce_qp_spinlock_destroy(struct hns_roce_qp *qp); void hns_roce_free_qp_buf(struct hns_roce_qp *qp, struct hns_roce_context *ctx); diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index 34f7ee4..89114f3 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -33,6 +33,7 @@ #include <stdio.h> #include <stdlib.h> #include <string.h> +#include <math.h> #include <errno.h> #include <pthread.h> #include <sys/mman.h> @@ -42,6 +43,37 @@ #include "hns_roce_u_db.h" #include "hns_roce_u_hw_v2.h" +static bool hns_roce_whether_need_lock(struct ibv_pd *pd) +{ + struct hns_roce_pad *pad; + + pad = to_hr_pad(pd); + if (pad && pad->td) + return false; + + return true; +} + +static int hns_roce_spinlock_init(struct hns_roce_spinlock *hr_lock, + bool need_lock) +{ + hr_lock->need_lock = need_lock; + + if (need_lock) + return pthread_spin_init(&hr_lock->lock, + PTHREAD_PROCESS_PRIVATE); + + return 0; +} + +static int hns_roce_spinlock_destroy(struct hns_roce_spinlock *hr_lock) +{ + if (hr_lock->need_lock) + return pthread_spin_destroy(&hr_lock->lock); + + return 0; +} + void hns_roce_init_qp_indices(struct hns_roce_qp *qp) { qp->sq.head = 0; @@ -85,38 +117,138 @@ int hns_roce_u_query_port(struct ibv_context *context, uint8_t port, return ibv_cmd_query_port(context, port, attr, &cmd, sizeof(cmd)); } +struct ibv_td *hns_roce_u_alloc_td(struct ibv_context *context, + struct ibv_td_init_attr *attr) +{ + struct hns_roce_td *td; + + if (attr->comp_mask) { + errno = EOPNOTSUPP; + return NULL; + } + + td = calloc(1, sizeof(*td)); + if (!td) { + errno = ENOMEM; + return NULL; + } + + td->ibv_td.context = context; + atomic_init(&td->refcount, 1); + + return &td->ibv_td; +} + +int hns_roce_u_dealloc_td(struct ibv_td *ibv_td) +{ + struct hns_roce_td *td; + + td = to_hr_td(ibv_td); + if (atomic_load(&td->refcount) > 1) + return EBUSY; + + free(td); + + return 0; +} + struct ibv_pd *hns_roce_u_alloc_pd(struct ibv_context *context) { + struct hns_roce_alloc_pd_resp resp = {}; struct ibv_alloc_pd cmd; struct hns_roce_pd *pd; - struct hns_roce_alloc_pd_resp resp = {}; - - pd = malloc(sizeof(*pd)); - if (!pd) - return NULL; - if (ibv_cmd_alloc_pd(context, &pd->ibv_pd, &cmd, sizeof(cmd), - &resp.ibv_resp, sizeof(resp))) { - free(pd); + pd = calloc(1, sizeof(*pd)); + if (!pd) { + errno = ENOMEM; return NULL; } + errno = ibv_cmd_alloc_pd(context, &pd->ibv_pd, &cmd, sizeof(cmd), + &resp.ibv_resp, sizeof(resp)); + if (errno) + goto err; + + atomic_init(&pd->refcount, 1); pd->pdn = resp.pdn; return &pd->ibv_pd; + +err: + free(pd); + return NULL; +} + +struct ibv_pd *hns_roce_u_alloc_pad(struct ibv_context *context, + struct ibv_parent_domain_init_attr *attr) +{ + struct hns_roce_pad *pad; + + if (ibv_check_alloc_parent_domain(attr)) + return NULL; + + if (attr->comp_mask) { + errno = EOPNOTSUPP; + return NULL; + } + + pad = calloc(1, sizeof(*pad)); + if (!pad) { + errno = ENOMEM; + return NULL; + } + + if (attr->td) { + pad->td = to_hr_td(attr->td); + atomic_fetch_add(&pad->td->refcount, 1); + } + + pad->pd.protection_domain = to_hr_pd(attr->pd); + atomic_fetch_add(&pad->pd.protection_domain->refcount, 1); + + atomic_init(&pad->pd.refcount, 1); + ibv_initialize_parent_domain(&pad->pd.ibv_pd, + &pad->pd.protection_domain->ibv_pd); + + return &pad->pd.ibv_pd; +} + +static void hns_roce_free_pad(struct hns_roce_pad *pad) +{ + atomic_fetch_sub(&pad->pd.protection_domain->refcount, 1); + + if (pad->td) + atomic_fetch_sub(&pad->td->refcount, 1); + + free(pad); } -int hns_roce_u_free_pd(struct ibv_pd *pd) +static int hns_roce_free_pd(struct hns_roce_pd *pd) { int ret; - ret = ibv_cmd_dealloc_pd(pd); + if (atomic_load(&pd->refcount) > 1) + return EBUSY; + + ret = ibv_cmd_dealloc_pd(&pd->ibv_pd); if (ret) return ret; - free(to_hr_pd(pd)); + free(pd); + return 0; +} - return ret; +int hns_roce_u_dealloc_pd(struct ibv_pd *ibv_pd) +{ + struct hns_roce_pad *pad = to_hr_pad(ibv_pd); + struct hns_roce_pd *pd = to_hr_pd(ibv_pd); + + if (pad) { + hns_roce_free_pad(pad); + return 0; + } + + return hns_roce_free_pd(pd); } struct ibv_xrcd *hns_roce_u_open_xrcd(struct ibv_context *context, -- 2.30.0

1 3

[PATCH v2 openEuler-22.03-LTS-SP1 5/5] scsi: mpt3sas: Fix loop logic
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.202 commit 697bc325b9775d355942f1c6687f99dafd597566 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 3c978492c333f0c08248a8d51cecbe5eb5f617c9 upstream. The retry loop continues to iterate until the count reaches 30, even after receiving the correct value. Exit loop when a non-zero value is read. Fixes: 4ca10f3e3174 ("scsi: mpt3sas: Perform additional retries if doorbell read returns 0") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20231020105849.6350-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 06cb2addac31..df90335ba3a6 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -216,8 +216,8 @@ _base_readl_ext_retry(const volatile void __iomem *addr) for (i = 0 ; i < 30 ; i++) { ret_val = readl(addr); - if (ret_val == 0) - continue; + if (ret_val != 0) + break; } return ret_val; -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 4/5] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..06cb2addac31 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5661,7 +5678,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5806,7 +5823,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5846,7 +5863,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5983,7 +6000,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6032,7 +6049,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6040,7 +6057,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6051,10 +6068,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6900,7 +6917,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6920,7 +6937,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7307,10 +7324,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 3/5] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 2/5] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 20 Mar '24

20 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 1/5] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 0/5] mpt3sas bugfix
by Baogen Shang 20 Mar '24

20 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. v2: fix checkdepend fail Ranjan Kumar (2): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 scsi: mpt3sas: Fix loop logic Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 49 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++++- 3 files changed, 51 insertions(+), 15 deletions(-) -- 2.33.0

1 0

[openeuler:OLK-6.6 4026/4224] drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:3246:6: warning: no previous prototype for function 'rnpm_get_phy_statistics'
by kernel test robot 20 Mar '24

20 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b61688dbd28fa5eb9aa4e4109bc38543cd1d596f commit: 5deaf74c4b3edcf88f67f18aa352690deb9dc212 [4026/4224] drivers: initial support for rnpm drivers from Mucse Technology config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240320/202403201844.sT1rPTz4-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240320/202403201844.sT1rPTz4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403201844.sT1rPTz4-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1290:7: warning: variable 'autoneg_changed' set but not used [-Wunused-but-set-variable] 1290 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1290:32: warning: variable 'duplex_changed' set but not used [-Wunused-but-set-variable] 1290 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:2092:6: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2092 | u32 dma_ch; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:3246:6: warning: no previous prototype for function 'rnpm_get_phy_statistics' [-Wmissing-prototypes] 3246 | void rnpm_get_phy_statistics(struct net_device *netdev, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:3246:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3246 | void rnpm_get_phy_statistics(struct net_device *netdev, | ^ | static 4 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:976:5: warning: no previous prototype for function 'rnpm_get_vf_ringnum' [-Wmissing-prototypes] 976 | int rnpm_get_vf_ringnum(int vf, int num) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:976:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 976 | int rnpm_get_vf_ringnum(int vf, int num) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:986:9: warning: variable 'y' set but not used [-Wunused-but-set-variable] 986 | u64 x, y, result; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:983:5: warning: no previous prototype for function 'rnpm_setup_ring_maxrate' [-Wmissing-prototypes] 983 | int rnpm_setup_ring_maxrate(struct rnpm_adapter *adapter, int ring, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:983:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 983 | int rnpm_setup_ring_maxrate(struct rnpm_adapter *adapter, int ring, | ^ | static 3 warnings generated. vim +/rnpm_get_phy_statistics +3246 drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c 3245 > 3246 void rnpm_get_phy_statistics(struct net_device *netdev, 3247 struct ethtool_stats *stats, u64 *data) 3248 { 3249 struct rnpm_adapter *adapter = netdev_priv(netdev); 3250 struct rnpm_hw *hw = &adapter->hw; 3251 struct phy_statistics ps; 3252 3253 if (rnpm_mbx_get_phy_statistics(hw, (u8 *)&ps) != 0) 3254 return; 3255 3256 *data++ = ps.yt.pkg_ib_valid; 3257 *data++ = ps.yt.pkg_ib_os_good; 3258 *data++ = ps.yt.pkg_ib_us_good; 3259 *data++ = ps.yt.pkg_ib_err; 3260 *data++ = ps.yt.pkg_ib_os_bad; 3261 *data++ = ps.yt.pkg_ib_frag; 3262 *data++ = ps.yt.pkg_ib_nosfd; 3263 *data++ = ps.yt.pkg_ob_valid; 3264 *data++ = ps.yt.pkg_ob_os_good; 3265 *data++ = ps.yt.pkg_ob_us_good; 3266 *data++ = ps.yt.pkg_ob_err; 3267 *data++ = ps.yt.pkg_ob_os_bad; 3268 *data++ = ps.yt.pkg_ob_frag; 3269 *data++ = ps.yt.pkg_ob_nosfd; 3270 } 3271 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 4026/4224] drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1257: warning: expecting prototype for rnpm_update_mc_addr_list_generic(). Prototype was for rnpm_update_mutiport_mc_addr_list_generic() instead
by kernel test robot 20 Mar '24

20 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b61688dbd28fa5eb9aa4e4109bc38543cd1d596f commit: 5deaf74c4b3edcf88f67f18aa352690deb9dc212 [4026/4224] drivers: initial support for rnpm drivers from Mucse Technology config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240320/202403201702.oUv4biQv-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240320/202403201702.oUv4biQv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403201702.oUv4biQv-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpm/rnpm_common.c:694: warning: Function parameter or member 'count' not described in 'rnpm_shift_in_eeprom_bits' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:717: warning: Function parameter or member 'eec' not described in 'rnpm_lower_eeprom_clk' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:717: warning: Excess function parameter 'eecd' description in 'rnpm_lower_eeprom_clk' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:933: warning: Function parameter or member 'mc_addr' not described in 'rnpm_set_mta' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:933: warning: Excess function parameter 'hash_value' description in 'rnpm_set_mta' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1182: warning: Function parameter or member 'mode' not described in 'rnpm_mta_vector' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1182: warning: Excess function parameter 'hw' description in 'rnpm_mta_vector' >> drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1257: warning: expecting prototype for rnpm_update_mc_addr_list_generic(). Prototype was for rnpm_update_mutiport_mc_addr_list_generic() instead >> drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1812: warning: expecting prototype for rnpm_enable_rx_buff(). Prototype was for rnpm_enable_rx_buff_generic() instead drivers/net/ethernet/mucse/rnpm/rnpm_common.c:2179: warning: Function parameter or member 'vf' not described in 'rnpm_set_vlan_anti_spoofing' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:2179: warning: Excess function parameter 'pf' description in 'rnpm_set_vlan_anti_spoofing' -- drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c: In function 'rnpm_set_link_ksettings': drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1290:39: warning: variable 'duplex_changed' set but not used [-Wunused-but-set-variable] 1290 | bool autoneg_changed = false, duplex_changed = false; | ^~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1290:14: warning: variable 'autoneg_changed' set but not used [-Wunused-but-set-variable] 1290 | bool autoneg_changed = false, duplex_changed = false; | ^~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c: In function 'rnpm_get_strings': drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:2092:13: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2092 | u32 dma_ch; | ^~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c: At top level: >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:3246:6: warning: no previous prototype for 'rnpm_get_phy_statistics' [-Wmissing-prototypes] 3246 | void rnpm_get_phy_statistics(struct net_device *netdev, | ^~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/mucse/rnpm/rnpm_debugfs.c:260: warning: expecting prototype for rnpm_dbg_reg_ops_write(). Prototype was for rnpm_dbg_phy_ops_write() instead drivers/net/ethernet/mucse/rnpm/rnpm_debugfs.c:367: warning: Function parameter or member 'adapter' not described in 'rnpm_dbg_adapter_exit' drivers/net/ethernet/mucse/rnpm/rnpm_debugfs.c:367: warning: Excess function parameter 'pf' description in 'rnpm_dbg_adapter_exit' -- >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1185:6: warning: no previous prototype for 'rnpm_setup_layer2_remapping' [-Wmissing-prototypes] 1185 | void rnpm_setup_layer2_remapping(struct rnpm_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1209:6: warning: no previous prototype for 'rnpm_setup_tuple5_remapping' [-Wmissing-prototypes] 1209 | void rnpm_setup_tuple5_remapping(struct rnpm_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1280:6: warning: no previous prototype for 'rnpm_setup_tuple5_remapping_tcam' [-Wmissing-prototypes] 1280 | void rnpm_setup_tuple5_remapping_tcam(struct rnpm_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:256:6: warning: no previous prototype for 'rnpm_pf_service_event_schedule' [-Wmissing-prototypes] 256 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1137:5: warning: no previous prototype for 'rnpm_rx_ring_reinit' [-Wmissing-prototypes] 1137 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: In function 'rnpm_clean_rx_irq': drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2015:14: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 2015 | bool xdp_xmit = false; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: At top level: >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2207:6: warning: no previous prototype for 'rnpm_write_eitr' [-Wmissing-prototypes] 2207 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3013:5: warning: no previous prototype for 'rnpm_xmit_nop_frame_ring' [-Wmissing-prototypes] 3013 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3037:5: warning: no previous prototype for 'rnpm_xmit_nop_frame_ring_temp' [-Wmissing-prototypes] 3037 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3909:6: warning: no previous prototype for 'rnpm_vlan_stags_flag' [-Wmissing-prototypes] 3909 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:4031:6: warning: no previous prototype for 'control_mac_rx' [-Wmissing-prototypes] 4031 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5803:6: warning: no previous prototype for 'rnpm_pf_service_timer' [-Wmissing-prototypes] 5803 | void rnpm_pf_service_timer(struct timer_list *t) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5821:6: warning: no previous prototype for 'rnpm_service_timer' [-Wmissing-prototypes] 5821 | void rnpm_service_timer(struct timer_list *t) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5962:21: warning: no previous prototype for 'wait_all_port_resetting' [-Wmissing-prototypes] 5962 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5974:21: warning: no previous prototype for 'clean_all_port_resetting' [-Wmissing-prototypes] 5974 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6185:5: warning: no previous prototype for 'rnpm_check_mc_addr' [-Wmissing-prototypes] 6185 | int rnpm_check_mc_addr(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6211:6: warning: no previous prototype for 'update_pf_vlan' [-Wmissing-prototypes] 6211 | void update_pf_vlan(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6262:6: warning: no previous prototype for 'rnpm_pf_service_task' [-Wmissing-prototypes] 6262 | void rnpm_pf_service_task(struct work_struct *work) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7528:6: warning: no previous prototype for 'rnpm_clear_udp_tunnel_port' [-Wmissing-prototypes] 7528 | void rnpm_clear_udp_tunnel_port(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7692:6: warning: no previous prototype for 'rnpm_assign_netdev_ops' [-Wmissing-prototypes] 7692 | void rnpm_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7785:6: warning: no previous prototype for 'rnpm_fix_queue_number' [-Wmissing-prototypes] 7785 | void rnpm_fix_queue_number(struct rnpm_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8760:5: warning: no previous prototype for 'rnpm_can_rpu_start' [-Wmissing-prototypes] 8760 | int rnpm_can_rpu_start(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: In function 'rnpm_request_msix_irqs': >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2911:43: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] 2911 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2911:34: note: directive argument in the range [0, 65535] 2911 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ^~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2910:25: note: 'snprintf' output between 10 and 31 bytes into a destination of size 24 2910 | snprintf(q_vector->name, sizeof(q_vector->name) - 1, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2911 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2912 | q_vector->v_idx); | ~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/mucse/rnpm/rnpm_main.c:297: warning: Function parameter or member 'rnpm_queue' not described in 'rnpm_set_ring_vector' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:297: warning: Function parameter or member 'rnpm_msix_vector' not described in 'rnpm_set_ring_vector' >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:297: warning: expecting prototype for rnpm_set_ivar(). Prototype was for rnpm_set_ring_vector() instead drivers/net/ethernet/mucse/rnpm/rnpm_main.c:441: warning: Function parameter or member 'napi_budget' not described in 'rnpm_clean_tx_irq' >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:988: warning: expecting prototype for rnp_is_non_eop(). Prototype was for rnpm_is_non_eop() instead drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1138: warning: Function parameter or member 'adapter' not described in 'rnpm_rx_ring_reinit' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2208: warning: Function parameter or member 'is_rxframe' not described in 'rnpm_write_eitr' >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2208: warning: expecting prototype for ixgbe_write_eitr(). Prototype was for rnpm_write_eitr() instead >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2869: warning: expecting prototype for rnp_irq_affinity_notify(). Prototype was for rnpm_irq_affinity_notify() instead >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2885: warning: expecting prototype for rnp_irq_affinity_release(). Prototype was for rnpm_irq_affinity_release() instead drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3070: warning: Function parameter or member 'adapter' not described in 'rnpm_tx_maxrate_own' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3070: warning: Excess function parameter 'netdev' description in 'rnpm_tx_maxrate_own' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3070: warning: Excess function parameter 'maxrate' description in 'rnpm_tx_maxrate_own' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3856: warning: Excess function parameter 'pb' description in 'rnpm_lpbthresh' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:4607: warning: Function parameter or member 'txqueue' not described in 'rnpm_tx_timeout' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:4780: warning: Function parameter or member 'adapter' not described in 'rnpm_setup_tx_resources' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:4878: warning: Function parameter or member 'adapter' not described in 'rnpm_setup_rx_resources' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5560: warning: Excess function parameter 'link_speed' description in 'rnpm_watchdog_update_link' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5804: warning: Function parameter or member 't' not described in 'rnpm_pf_service_timer' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5804: warning: Excess function parameter 'data' description in 'rnpm_pf_service_timer' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5822: warning: Function parameter or member 't' not described in 'rnpm_service_timer' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5822: warning: Excess function parameter 'data' description in 'rnpm_service_timer' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7253: warning: Function parameter or member 'dev' not described in 'rnpm_setup_tc' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7253: warning: Excess function parameter 'netdev' description in 'rnpm_setup_tc' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7711: warning: Function parameter or member 'adapter' not described in 'rnpm_wol_supported' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7711: warning: Function parameter or member 'subdevice_id' not described in 'rnpm_wol_supported' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7711: warning: Excess function parameter 'hw' description in 'rnpm_wol_supported' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7711: warning: Excess function parameter 'subdev_id' description in 'rnpm_wol_supported' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8783: warning: Function parameter or member 'id' not described in 'rnpm_probe' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8783: warning: Excess function parameter 'ent' description in 'rnpm_probe' -- >> drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:446:5: warning: no previous prototype for 'rnpm_reset_pipeline_n10' [-Wmissing-prototypes] 446 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c: In function 'rnpm_reset_hw_n10': drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:501:13: warning: variable 'status' set but not used [-Wunused-but-set-variable] 501 | s32 status = 0; | ^~~~~~ -- drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:223: warning: Function parameter or member 'input' not described in 'rnpm_atr_compute_sig_hash_n10' drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:223: warning: Function parameter or member 'common' not described in 'rnpm_atr_compute_sig_hash_n10' drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:223: warning: Excess function parameter 'stream' description in 'rnpm_atr_compute_sig_hash_n10' >> drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:238: warning: expecting prototype for rnpm_atr_add_signature_filter_n10(). Prototype was for rnpm_fdir_add_signature_filter_n10() instead drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:264: warning: Function parameter or member 'input' not described in 'rnpm_atr_compute_perfect_hash_n10' drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:264: warning: Excess function parameter 'atr_input' description in 'rnpm_atr_compute_perfect_hash_n10' -- >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:15:24: warning: no previous prototype for 'mbx_cookie_zalloc' [-Wmissing-prototypes] 15 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:29:5: warning: no previous prototype for 'rnpm_mbx_write_posted_locked' [-Wmissing-prototypes] 29 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:73:6: warning: no previous prototype for 'rnpm_link_stat_mark_disable' [-Wmissing-prototypes] 73 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:78:5: warning: no previous prototype for 'rnpm_mbx_fw_post_req' [-Wmissing-prototypes] 78 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req, | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:138:5: warning: no previous prototype for 'rnpm_fw_send_cmd_wait' [-Wmissing-prototypes] 138 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:619:5: warning: no previous prototype for 'rnpm_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 619 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:933:5: warning: no previous prototype for 'rnpm_mbx_pluginout_evt_en' [-Wmissing-prototypes] 933 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:962:5: warning: no previous prototype for 'rnpm_fw_get_capablity' [-Wmissing-prototypes] 962 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: In function 'rnpm_mbx_get_temp': drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1146:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1146 | int err; | ^~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: At top level: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1178:5: warning: no previous prototype for 'rnpm_fw_reg_read' [-Wmissing-prototypes] 1178 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: In function 'rnpm_fw_reg_read': drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1182:13: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1182 | int value; | ^~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: In function 'rnpm_mbx_fw_req_handler': drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1250:25: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 1250 | struct rnpm_hw *hw; | ^~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: At top level: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1470:5: warning: no previous prototype for 'rnpm_get_port_stats2' [-Wmissing-prototypes] 1470 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: In function 'rnpm_mbx_reg_write': >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:600:9: warning: 'build_writereg_req' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=] 600 | build_writereg_req(&req, NULL, fw_reg, 4, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:600:9: note: referencing argument 5 of type 'int[4]' In file included from drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:11: drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:805:20: note: in a call to function 'build_writereg_req' 805 | static inline void build_writereg_req(struct mbx_fw_cmd_req *req, void *cookie, | ^~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:782: warning: Cannot understand *@speed : on line 782 - I thought it was a doc line -- >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:976:5: warning: no previous prototype for 'rnpm_get_vf_ringnum' [-Wmissing-prototypes] 976 | int rnpm_get_vf_ringnum(int vf, int num) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:983:5: warning: no previous prototype for 'rnpm_setup_ring_maxrate' [-Wmissing-prototypes] 983 | int rnpm_setup_ring_maxrate(struct rnpm_adapter *adapter, int ring, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c: In function 'rnpm_setup_ring_maxrate': >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:986:16: warning: variable 'y' set but not used [-Wunused-but-set-variable] 986 | u64 x, y, result; | ^ .. vim +1257 drivers/net/ethernet/mucse/rnpm/rnpm_common.c 1244 1245 /** 1246 * rnpm_update_mc_addr_list_generic - Updates MAC list of multicast addresses 1247 * @hw: pointer to hardware structure 1248 * @netdev: pointer to net device structure 1249 * 1250 * The given list replaces any existing list. Clears the MC addrs from receive 1251 * address registers and the multicast table. Uses unused receive address 1252 * registers for the first multicast addresses, and hashes the rest into the 1253 * multicast table. 1254 **/ 1255 s32 rnpm_update_mutiport_mc_addr_list_generic(struct rnpm_hw *hw, 1256 struct net_device *netdev) > 1257 { 1258 #ifdef NETDEV_HW_ADDR_T_MULTICAST 1259 struct netdev_hw_addr *ha; 1260 #endif 1261 struct rnpm_adapter *adapter = (struct rnpm_adapter *)hw->back; 1262 struct rnpm_pf_adapter *pf_adapter = adapter->pf_adapter; 1263 u32 i; 1264 u32 v; 1265 u8 port = adapter->port; 1266 int addr_count = 0; 1267 u8 *addr_list = NULL; 1268 unsigned long flags; 1269 1270 /* Set the new number of MC addresses that we are being requested to 1271 * use. 1272 */ 1273 pf_adapter->num_mc_addrs[port] = netdev_mc_count(netdev); 1274 pf_adapter->mta_in_use[port] = 0; 1275 1276 hw->addr_ctrl.num_mc_addrs = netdev_mc_count(netdev); 1277 hw->addr_ctrl.mta_in_use = 0; 1278 1279 /* Clear share mta_shadow only not in mutiport mode */ 1280 if (!(adapter->flags & RNPM_FLAG_MUTIPORT_ENABLED)) { 1281 hw_dbg(hw, " Clearing MTA(multicast table)\n"); 1282 memset(&pf_adapter->mta_shadow, 0, 1283 sizeof(pf_adapter->mta_shadow)); 1284 } 1285 /* clear own mta_shadow */ 1286 memset(&hw->mac.mta_shadow, 0, sizeof(hw->mac.mta_shadow)); 1287 1288 spin_lock_irqsave(&pf_adapter->mc_setup_lock, flags); 1289 /* Update mta shadow */ 1290 hw_dbg(hw, "port %d Updating MTA..\n", port); 1291 // netdev_for_each_mc_addr(ha, netdev) { 1292 // rnpm_set_mta(hw, ha->addr); 1293 // } 1294 addr_count = netdev_mc_count(netdev); 1295 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47131
by Ziyang Xuan 20 Mar '24

20 Mar '24

Patchset for CVE-2021-47131. Maxim Mikityanskiy (2): net/tls: Replace TLS_RX_SYNC_RUNNING with RCU net/tls: Fix use-after-free after the TLS device goes down and up include/net/tls.h | 11 ++++++- net/tls/tls_device.c | 61 ++++++++++++++++++++++++++++------- net/tls/tls_device_fallback.c | 7 ++++ net/tls/tls_main.c | 1 + 4 files changed, 68 insertions(+), 12 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] nbd: always initialize struct msghdr completely
by Li Nan 20 Mar '24

20 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit 78fbb92af27d0982634116c7a31065f24d092826 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JST CVE: CVE-2024-26638 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always make sure their values is zero by default. [1] BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 kthread+0x3ed/0x540 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Local variable msg created at: __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: nbd5-recv recv_work Fixes: f94fd25cb0aa ("tcp: pass back data left in socket after receive") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: stable(a)vger.kernel.org Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: linux-block(a)vger.kernel.org Cc: nbd(a)other.debian.org Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240112132657.647112-1-edumazet@google.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/nbd.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 7fce5f3b40df..780a7daf7bbc 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -510,7 +510,7 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, struct iov_iter *iter, int msg_flags, int *sent) { int result; - struct msghdr msg; + struct msghdr msg = {} ; unsigned int noreclaim_flag; if (unlikely(!sock)) { @@ -526,10 +526,6 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, do { sock->sk->sk_allocation = GFP_NOIO | __GFP_MEMALLOC; sock->sk->sk_use_task_frag = false; - msg.msg_name = NULL; - msg.msg_namelen = 0; - msg.msg_control = NULL; - msg.msg_controllen = 0; msg.msg_flags = msg_flags | MSG_NOSIGNAL; if (send) -- 2.39.2

2 1

[PATCH OLK-6.6] block: Fix iterating over an empty bio with bio_for_each_folio_all
by Li Nan 20 Mar '24

20 Mar '24

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> mainline inclusion from mainline-v6.8-rc1 commit 7bed6f3d08b7af27b7015da8dc3acf2b9c1f21d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JYB CVE: CVE-2024-26632 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the bio contains no data, bio_first_folio() calls page_folio() on a NULL pointer and oopses. Move the test that we've reached the end of the bio from bio_next_folio() to bio_first_folio(). Reported-by: syzbot+8b23309d5788a79d3eea(a)syzkaller.appspotmail.com Reported-by: syzbot+004c1e0fced2b4bc3dcc(a)syzkaller.appspotmail.com Fixes: 640d1930bef4 ("block: Add bio_for_each_folio_all()") Cc: stable(a)vger.kernel.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Link: https://lore.kernel.org/r/20240116212959.3413014-1-willy@infradead.org [axboe: add unlikely() to error case] Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Nan <linan122(a)huawei.com> --- include/linux/bio.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/include/linux/bio.h b/include/linux/bio.h index ebb008300489..819e189523f2 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -287,6 +287,11 @@ static inline void bio_first_folio(struct folio_iter *fi, struct bio *bio, { struct bio_vec *bvec = bio_first_bvec_all(bio) + i; + if (unlikely(i >= bio->bi_vcnt)) { + fi->folio = NULL; + return; + } + fi->folio = page_folio(bvec->bv_page); fi->offset = bvec->bv_offset + PAGE_SIZE * (bvec->bv_page - &fi->folio->page); @@ -304,10 +309,8 @@ static inline void bio_next_folio(struct folio_iter *fi, struct bio *bio) fi->offset = 0; fi->length = min(folio_size(fi->folio), fi->_seg_count); fi->_next = folio_next(fi->folio); - } else if (fi->_i + 1 < bio->bi_vcnt) { - bio_first_folio(fi, bio, fi->_i + 1); } else { - fi->folio = NULL; + bio_first_folio(fi, bio, fi->_i + 1); } } -- 2.39.2

2 1

[PATCH OLK-6.6] nbd: always initialize struct msghdr completely
by Li Nan 20 Mar '24

20 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit 78fbb92af27d0982634116c7a31065f24d092826 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JYB CVE: CVE-2024-26632 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always make sure their values is zero by default. [1] BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 kthread+0x3ed/0x540 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Local variable msg created at: __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: nbd5-recv recv_work Fixes: f94fd25cb0aa ("tcp: pass back data left in socket after receive") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: stable(a)vger.kernel.org Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: linux-block(a)vger.kernel.org Cc: nbd(a)other.debian.org Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240112132657.647112-1-edumazet@google.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/nbd.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 7fce5f3b40df..780a7daf7bbc 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -510,7 +510,7 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, struct iov_iter *iter, int msg_flags, int *sent) { int result; - struct msghdr msg; + struct msghdr msg = {} ; unsigned int noreclaim_flag; if (unlikely(!sock)) { @@ -526,10 +526,6 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, do { sock->sk->sk_allocation = GFP_NOIO | __GFP_MEMALLOC; sock->sk->sk_use_task_frag = false; - msg.msg_name = NULL; - msg.msg_namelen = 0; - msg.msg_control = NULL; - msg.msg_controllen = 0; msg.msg_flags = msg_flags | MSG_NOSIGNAL; if (send) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v3 0/2] CVE-2021-47110
by liwei 20 Mar '24

20 Mar '24

CVE-2021-47110 Kirill A. Shutemov (1): x86/kvm: Do not try to disable kvmclock if it was not enabled Vitaly Kuznetsov (1): x86/kvm: Disable kvmclock on all CPUs on shutdown arch/x86/include/asm/kvm_para.h | 4 ++-- arch/x86/kernel/kvm.c | 1 + arch/x86/kernel/kvmclock.c | 17 +++++++++-------- 3 files changed, 12 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH 0/1] Add macro for feature DVMBM
by lishusen 20 Mar '24

20 Mar '24

Add macro for feature DVMBM. lishusen (1): KVM: arm64: Add macro for feature DVMBM arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/include/asm/kvm_mmu.h | 5 +++++ arch/arm64/kvm/arm.c | 12 ++++++++---- arch/arm64/kvm/hisilicon/hisi_virt.c | 21 ++++++++++++--------- arch/arm64/kvm/hyp/pgtable.c | 5 +++++ 5 files changed, 32 insertions(+), 13 deletions(-) -- 2.33.0

1 1

[PATCH v2 openEuler-22.03-LTS-SP1 7/7] scsi: mpt3sas: Fix loop logic
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.202 commit 697bc325b9775d355942f1c6687f99dafd597566 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 3c978492c333f0c08248a8d51cecbe5eb5f617c9 upstream. The retry loop continues to iterate until the count reaches 30, even after receiving the correct value. Exit loop when a non-zero value is read. Fixes: 4ca10f3e3174 ("scsi: mpt3sas: Perform additional retries if doorbell read returns 0") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20231020105849.6350-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 1b9b266b2b54..4bf1ea39d21a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -216,8 +216,8 @@ _base_readl_ext_retry(const volatile void __iomem *addr) for (i = 0 ; i < 30 ; i++) { ret_val = readl(addr); - if (ret_val == 0) - continue; + if (ret_val != 0) + break; } return ret_val; -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 6/7] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 5/7] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 4/7] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 3/7] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 2/7] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 20 Mar '24

20 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 1/7] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 0/7] mpt3sas bugfix
by Baogen Shang 20 Mar '24

20 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. v2: add a patch to fix the check depend fail Ranjan Kumar (2): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 scsi: mpt3sas: Fix loop logic Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0

[PATCH v2 openEuler-1.0-LTS] x86/kvm: Disable kvmclock on all CPUs on shutdown
by liwei 20 Mar '24

20 Mar '24

From: Vitaly Kuznetsov <vkuznets(a)redhat.com> mainline inclusion from mainline-v5.13-rc2 commit c02027b5742b5aa804ef08a4a9db433295533046 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I990A4 CVE: CVE-2021-47110 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currenly, we disable kvmclock from machine_shutdown() hook and this only happens for boot CPU. We need to disable it for all CPUs to guard against memory corruption e.g. on restore from hibernate. Note, writing '0' to kvmclock MSR doesn't clear memory location, it just prevents hypervisor from updating the location so for the short while after write and while CPU is still alive, the clock remains usable and correct so we don't need to switch to some other clocksource. Signed-off-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Message-Id: <20210414123544.1060604-4-vkuznets(a)redhat.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Conflicts: arch/x86/kernel/kvm.c Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/include/asm/kvm_para.h | 4 ++-- arch/x86/kernel/kvm.c | 1 + arch/x86/kernel/kvmclock.c | 5 +---- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h index 4c723632c036..7caaff8c79ad 100644 --- a/arch/x86/include/asm/kvm_para.h +++ b/arch/x86/include/asm/kvm_para.h @@ -6,8 +6,6 @@ #include <asm/alternative.h> #include <uapi/asm/kvm_para.h> -extern void kvmclock_init(void); - #ifdef CONFIG_KVM_GUEST bool kvm_check_and_clear_guest_paused(void); #else @@ -85,6 +83,8 @@ static inline long kvm_hypercall4(unsigned int nr, unsigned long p1, } #ifdef CONFIG_KVM_GUEST +void kvmclock_init(void); +void kvmclock_disable(void); bool kvm_para_available(void); unsigned int kvm_arch_para_features(void); unsigned int kvm_arch_para_hints(void); diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c index d1ccd5bbf623..1c94fdb9207e 100644 --- a/arch/x86/kernel/kvm.c +++ b/arch/x86/kernel/kvm.c @@ -567,6 +567,7 @@ static void kvm_guest_cpu_offline(void) wrmsrl(MSR_KVM_PV_EOI_EN, 0); kvm_pv_disable_apf(); apf_task_wake_all(); + kvmclock_disable(); } static int kvm_cpu_online(unsigned int cpu) diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c index 2ec202cb9dfd..d1672a2b1203 100644 --- a/arch/x86/kernel/kvmclock.c +++ b/arch/x86/kernel/kvmclock.c @@ -227,11 +227,9 @@ static void kvm_crash_shutdown(struct pt_regs *regs) } #endif -static void kvm_shutdown(void) +void kvmclock_disable(void) { native_write_msr(msr_kvm_system_time, 0, 0); - kvm_disable_steal_time(); - native_machine_shutdown(); } static void __init kvmclock_init_mem(void) @@ -359,7 +357,6 @@ void __init kvmclock_init(void) #endif x86_platform.save_sched_clock_state = kvm_save_sched_clock_state; x86_platform.restore_sched_clock_state = kvm_restore_sched_clock_state; - machine_ops.shutdown = kvm_shutdown; #ifdef CONFIG_KEXEC_CORE machine_ops.crash_shutdown = kvm_crash_shutdown; #endif -- 2.25.1

2 1

[PATCH OLK-6.6] tracing: Fix uaf issue when open the hist or hist_debug file
by Zheng Yejian 20 Mar '24

20 Mar '24

stable inclusion from stable-v6.6.13 commit d9a6029ddee5e792379a604f5c72cc8b632d9944 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9A20H CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1cc111b9cddc71ce161cd388f11f0e9048edffdb ] KASAN report following issue. The root cause is when opening 'hist' file of an instance and accessing 'trace_event_file' in hist_show(), but 'trace_event_file' has been freed due to the instance being removed. 'hist_debug' file has the same problem. To fix it, call tracing_{open,release}_file_tr() in file_operations callback to have the ref count and avoid 'trace_event_file' being freed. BUG: KASAN: slab-use-after-free in hist_show+0x11e0/0x1278 Read of size 8 at addr ffff242541e336b8 by task head/190 CPU: 4 PID: 190 Comm: head Not tainted 6.7.0-rc5-g26aff849438c #133 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x98/0xf8 show_stack+0x1c/0x30 dump_stack_lvl+0x44/0x58 print_report+0xf0/0x5a0 kasan_report+0x80/0xc0 __asan_report_load8_noabort+0x1c/0x28 hist_show+0x11e0/0x1278 seq_read_iter+0x344/0xd78 seq_read+0x128/0x1c0 vfs_read+0x198/0x6c8 ksys_read+0xf4/0x1e0 __arm64_sys_read+0x70/0xa8 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Allocated by task 188: kasan_save_stack+0x28/0x50 kasan_set_track+0x28/0x38 kasan_save_alloc_info+0x20/0x30 __kasan_slab_alloc+0x6c/0x80 kmem_cache_alloc+0x15c/0x4a8 trace_create_new_event+0x84/0x348 __trace_add_new_event+0x18/0x88 event_trace_add_tracer+0xc4/0x1a0 trace_array_create_dir+0x6c/0x100 trace_array_create+0x2e8/0x568 instance_mkdir+0x48/0x80 tracefs_syscall_mkdir+0x90/0xe8 vfs_mkdir+0x3c4/0x610 do_mkdirat+0x144/0x200 __arm64_sys_mkdirat+0x8c/0xc0 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Freed by task 191: kasan_save_stack+0x28/0x50 kasan_set_track+0x28/0x38 kasan_save_free_info+0x34/0x58 __kasan_slab_free+0xe4/0x158 kmem_cache_free+0x19c/0x508 event_file_put+0xa0/0x120 remove_event_file_dir+0x180/0x320 event_trace_del_tracer+0xb0/0x180 __remove_instance+0x224/0x508 instance_rmdir+0x44/0x78 tracefs_syscall_rmdir+0xbc/0x140 vfs_rmdir+0x1cc/0x4c8 do_rmdir+0x220/0x2b8 __arm64_sys_unlinkat+0xc0/0x100 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Link: https://lore.kernel.org/linux-trace-kernel/20231214012153.676155-1-zhengyej… Suggested-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace.c | 6 ++++++ kernel/trace/trace.h | 1 + kernel/trace/trace_events_hist.c | 12 ++++++++---- 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 310cfaa9c0f1..85b5bd03c977 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4972,6 +4972,12 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp) return 0; } +int tracing_single_release_file_tr(struct inode *inode, struct file *filp) +{ + tracing_release_file_tr(inode, filp); + return single_release(inode, filp); +} + static int tracing_mark_open(struct inode *inode, struct file *filp) { stream_open(inode, filp); diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 8eebd99cbb89..80f011207359 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -616,6 +616,7 @@ int tracing_open_generic(struct inode *inode, struct file *filp); int tracing_open_generic_tr(struct inode *inode, struct file *filp); int tracing_open_file_tr(struct inode *inode, struct file *filp); int tracing_release_file_tr(struct inode *inode, struct file *filp); +int tracing_single_release_file_tr(struct inode *inode, struct file *filp); bool tracing_is_disabled(void); bool tracer_tracing_is_on(struct trace_array *tr); void tracer_tracing_on(struct trace_array *tr); diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index d06938ae0717..68aaf0bd7a78 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -5630,10 +5630,12 @@ static int event_hist_open(struct inode *inode, struct file *file) { int ret; - ret = security_locked_down(LOCKDOWN_TRACEFS); + ret = tracing_open_file_tr(inode, file); if (ret) return ret; + /* Clear private_data to avoid warning in single_open() */ + file->private_data = NULL; return single_open(file, hist_show, file); } @@ -5641,7 +5643,7 @@ const struct file_operations event_hist_fops = { .open = event_hist_open, .read = seq_read, .llseek = seq_lseek, - .release = single_release, + .release = tracing_single_release_file_tr, }; #ifdef CONFIG_HIST_TRIGGERS_DEBUG @@ -5907,10 +5909,12 @@ static int event_hist_debug_open(struct inode *inode, struct file *file) { int ret; - ret = security_locked_down(LOCKDOWN_TRACEFS); + ret = tracing_open_file_tr(inode, file); if (ret) return ret; + /* Clear private_data to avoid warning in single_open() */ + file->private_data = NULL; return single_open(file, hist_debug_show, file); } @@ -5918,7 +5922,7 @@ const struct file_operations event_hist_debug_fops = { .open = event_hist_debug_open, .read = seq_read, .llseek = seq_lseek, - .release = single_release, + .release = tracing_single_release_file_tr, }; #endif -- 2.25.1

2 4

[PATCH v3 OLK-5.10 0/7] enable arm64_pbha by default
by Wupeng Ma 20 Mar '24

20 Mar '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Enhanced maintenance and test capability for pbha. Enable ARM64_PBHA by default. Changelog since v2: - make PM_PBHA_BIT0 0 if CONFIG_ARM64_PBHA is not enabled Changelog since v1: - let {pte,pmd}_pbha return false if pbha is not enabled Ma Wupeng (7): proc: introduce proc_hide_ents to hide proc files arm64: mm: Cleanup in pbha_bit0_pte_range mm: cpufeature: Make update_pbha_perf_only_bit static arm64: mm: Do not show info during startup if pbha is not enabled arm64: mm: Hide pbha_bit0 in procfs if pbha is not enabled arm64: mm: pagemap: Export pbha bit0 info config: Enable ARM64_PBHA by default Documentation/admin-guide/mm/pagemap.rst | 4 +++- arch/arm64/configs/openeuler_defconfig | 2 +- arch/arm64/kernel/cpufeature.c | 2 +- drivers/soc/hisilicon/pbha.c | 11 +++++------ fs/proc/base.c | 25 ++++++++++++++++++++++-- fs/proc/task_mmu.c | 15 ++++++++++++++ include/linux/pbha.h | 24 +++++++++++++++++++++++ 7 files changed, 72 insertions(+), 11 deletions(-) -- 2.25.1

2 15

[PATCH OLK-6.6] tracing: Fix uaf issue when open the hist or hist_debug file
by Zheng Yejian 20 Mar '24

20 Mar '24

mainline inclusion from mainline-v6.6.13 commit d9a6029ddee5e792379a604f5c72cc8b632d9944 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9A20H CVE: CVE-2023-52593 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit 1cc111b9cddc71ce161cd388f11f0e9048edffdb ] KASAN report following issue. The root cause is when opening 'hist' file of an instance and accessing 'trace_event_file' in hist_show(), but 'trace_event_file' has been freed due to the instance being removed. 'hist_debug' file has the same problem. To fix it, call tracing_{open,release}_file_tr() in file_operations callback to have the ref count and avoid 'trace_event_file' being freed. BUG: KASAN: slab-use-after-free in hist_show+0x11e0/0x1278 Read of size 8 at addr ffff242541e336b8 by task head/190 CPU: 4 PID: 190 Comm: head Not tainted 6.7.0-rc5-g26aff849438c #133 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x98/0xf8 show_stack+0x1c/0x30 dump_stack_lvl+0x44/0x58 print_report+0xf0/0x5a0 kasan_report+0x80/0xc0 __asan_report_load8_noabort+0x1c/0x28 hist_show+0x11e0/0x1278 seq_read_iter+0x344/0xd78 seq_read+0x128/0x1c0 vfs_read+0x198/0x6c8 ksys_read+0xf4/0x1e0 __arm64_sys_read+0x70/0xa8 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Allocated by task 188: kasan_save_stack+0x28/0x50 kasan_set_track+0x28/0x38 kasan_save_alloc_info+0x20/0x30 __kasan_slab_alloc+0x6c/0x80 kmem_cache_alloc+0x15c/0x4a8 trace_create_new_event+0x84/0x348 __trace_add_new_event+0x18/0x88 event_trace_add_tracer+0xc4/0x1a0 trace_array_create_dir+0x6c/0x100 trace_array_create+0x2e8/0x568 instance_mkdir+0x48/0x80 tracefs_syscall_mkdir+0x90/0xe8 vfs_mkdir+0x3c4/0x610 do_mkdirat+0x144/0x200 __arm64_sys_mkdirat+0x8c/0xc0 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Freed by task 191: kasan_save_stack+0x28/0x50 kasan_set_track+0x28/0x38 kasan_save_free_info+0x34/0x58 __kasan_slab_free+0xe4/0x158 kmem_cache_free+0x19c/0x508 event_file_put+0xa0/0x120 remove_event_file_dir+0x180/0x320 event_trace_del_tracer+0xb0/0x180 __remove_instance+0x224/0x508 instance_rmdir+0x44/0x78 tracefs_syscall_rmdir+0xbc/0x140 vfs_rmdir+0x1cc/0x4c8 do_rmdir+0x220/0x2b8 __arm64_sys_unlinkat+0xc0/0x100 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Link: https://lore.kernel.org/linux-trace-kernel/20231214012153.676155-1-zhengyej… Suggested-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace.c | 6 ++++++ kernel/trace/trace.h | 1 + kernel/trace/trace_events_hist.c | 12 ++++++++---- 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 310cfaa9c0f1..85b5bd03c977 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4972,6 +4972,12 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp) return 0; } +int tracing_single_release_file_tr(struct inode *inode, struct file *filp) +{ + tracing_release_file_tr(inode, filp); + return single_release(inode, filp); +} + static int tracing_mark_open(struct inode *inode, struct file *filp) { stream_open(inode, filp); diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 8eebd99cbb89..80f011207359 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -616,6 +616,7 @@ int tracing_open_generic(struct inode *inode, struct file *filp); int tracing_open_generic_tr(struct inode *inode, struct file *filp); int tracing_open_file_tr(struct inode *inode, struct file *filp); int tracing_release_file_tr(struct inode *inode, struct file *filp); +int tracing_single_release_file_tr(struct inode *inode, struct file *filp); bool tracing_is_disabled(void); bool tracer_tracing_is_on(struct trace_array *tr); void tracer_tracing_on(struct trace_array *tr); diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index d06938ae0717..68aaf0bd7a78 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -5630,10 +5630,12 @@ static int event_hist_open(struct inode *inode, struct file *file) { int ret; - ret = security_locked_down(LOCKDOWN_TRACEFS); + ret = tracing_open_file_tr(inode, file); if (ret) return ret; + /* Clear private_data to avoid warning in single_open() */ + file->private_data = NULL; return single_open(file, hist_show, file); } @@ -5641,7 +5643,7 @@ const struct file_operations event_hist_fops = { .open = event_hist_open, .read = seq_read, .llseek = seq_lseek, - .release = single_release, + .release = tracing_single_release_file_tr, }; #ifdef CONFIG_HIST_TRIGGERS_DEBUG @@ -5907,10 +5909,12 @@ static int event_hist_debug_open(struct inode *inode, struct file *file) { int ret; - ret = security_locked_down(LOCKDOWN_TRACEFS); + ret = tracing_open_file_tr(inode, file); if (ret) return ret; + /* Clear private_data to avoid warning in single_open() */ + file->private_data = NULL; return single_open(file, hist_debug_show, file); } @@ -5918,7 +5922,7 @@ const struct file_operations event_hist_debug_fops = { .open = event_hist_debug_open, .read = seq_read, .llseek = seq_lseek, - .release = single_release, + .release = tracing_single_release_file_tr, }; #endif -- 2.25.1

2 9

[PATCH openEuler-1.0-LTS] x86/kvm: Disable kvmclock on all CPUs on shutdown
by liwei 20 Mar '24

20 Mar '24

From: Vitaly Kuznetsov <vkuznets(a)redhat.com> mainline inclusion from mainline-v5.13-rc2 commit c02027b5742b5aa804ef08a4a9db433295533046 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I990A4 CVE: CVE-2021-47110 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currenly, we disable kvmclock from machine_shutdown() hook and this only happens for boot CPU. We need to disable it for all CPUs to guard against memory corruption e.g. on restore from hibernate. Note, writing '0' to kvmclock MSR doesn't clear memory location, it just prevents hypervisor from updating the location so for the short while after write and while CPU is still alive, the clock remains usable and correct so we don't need to switch to some other clocksource. Signed-off-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Message-Id: <20210414123544.1060604-4-vkuznets(a)redhat.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/include/asm/kvm_para.h | 4 ++-- arch/x86/kernel/kvm.c | 1 + arch/x86/kernel/kvmclock.c | 5 +---- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h index 4c723632c036..7caaff8c79ad 100644 --- a/arch/x86/include/asm/kvm_para.h +++ b/arch/x86/include/asm/kvm_para.h @@ -6,8 +6,6 @@ #include <asm/alternative.h> #include <uapi/asm/kvm_para.h> -extern void kvmclock_init(void); - #ifdef CONFIG_KVM_GUEST bool kvm_check_and_clear_guest_paused(void); #else @@ -85,6 +83,8 @@ static inline long kvm_hypercall4(unsigned int nr, unsigned long p1, } #ifdef CONFIG_KVM_GUEST +void kvmclock_init(void); +void kvmclock_disable(void); bool kvm_para_available(void); unsigned int kvm_arch_para_features(void); unsigned int kvm_arch_para_hints(void); diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c index d1ccd5bbf623..1c94fdb9207e 100644 --- a/arch/x86/kernel/kvm.c +++ b/arch/x86/kernel/kvm.c @@ -567,6 +567,7 @@ static void kvm_guest_cpu_offline(void) wrmsrl(MSR_KVM_PV_EOI_EN, 0); kvm_pv_disable_apf(); apf_task_wake_all(); + kvmclock_disable(); } static int kvm_cpu_online(unsigned int cpu) diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c index 2ec202cb9dfd..d1672a2b1203 100644 --- a/arch/x86/kernel/kvmclock.c +++ b/arch/x86/kernel/kvmclock.c @@ -227,11 +227,9 @@ static void kvm_crash_shutdown(struct pt_regs *regs) } #endif -static void kvm_shutdown(void) +void kvmclock_disable(void) { native_write_msr(msr_kvm_system_time, 0, 0); - kvm_disable_steal_time(); - native_machine_shutdown(); } static void __init kvmclock_init_mem(void) @@ -359,7 +357,6 @@ void __init kvmclock_init(void) #endif x86_platform.save_sched_clock_state = kvm_save_sched_clock_state; x86_platform.restore_sched_clock_state = kvm_restore_sched_clock_state; - machine_ops.shutdown = kvm_shutdown; #ifdef CONFIG_KEXEC_CORE machine_ops.crash_shutdown = kvm_crash_shutdown; #endif -- 2.25.1

2 10