- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] btrfs: fix use-after-free when COWing tree bock and tracing is enabled
by Yifan Qiao 08 Jan '25

08 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc5 commit 44f52bbe96dfdbe4aca3818a2534520082a07040 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PK CVE: CVE-2024-56759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there. Reported-by: syzbot+8517da8635307182c8a5(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/6759a9b9.050a0220.1ac542.000d.GAE@googl… CC: stable(a)vger.kernel.org # 5.4+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/ctree.c [__btrfs_cow_block did not rename to btrfs_force_cow_block yet.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ctree.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index 55896280b2dd..21b5c0f12beb 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -1127,6 +1127,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, btrfs_free_tree_block(trans, root, buf, parent_start, last_ref); } + + trace_btrfs_cow_block(root, buf, cow); if (unlock_orig) btrfs_tree_unlock(buf); free_extent_buffer_stale(buf); @@ -1493,7 +1495,6 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, { struct btrfs_fs_info *fs_info = root->fs_info; u64 search_start; - int ret; if (test_bit(BTRFS_ROOT_DELETING, &root->state)) btrfs_err(fs_info, @@ -1527,12 +1528,8 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, * Also We don't care about the error, as it's handled internally. */ btrfs_qgroup_trace_subtree_after_cow(trans, root, buf); - ret = __btrfs_cow_block(trans, root, buf, parent, + return __btrfs_cow_block(trans, root, buf, parent, parent_slot, cow_ret, search_start, 0, nest); - - trace_btrfs_cow_block(root, buf, *cow_ret); - - return ret; } /* -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: fix use-after-free when COWing tree bock and tracing is enabled
by Yifan Qiao 08 Jan '25

08 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc5 commit 44f52bbe96dfdbe4aca3818a2534520082a07040 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PK CVE: CVE-2024-56759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there. Reported-by: syzbot+8517da8635307182c8a5(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/6759a9b9.050a0220.1ac542.000d.GAE@googl… CC: stable(a)vger.kernel.org # 5.4+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/ctree.c [__btrfs_cow_block did not rename to btrfs_force_cow_block yet.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ctree.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index f88c443cffea..ebc4fff273a6 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -1127,6 +1127,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, btrfs_free_tree_block(trans, root, buf, parent_start, last_ref); } + + trace_btrfs_cow_block(root, buf, cow); if (unlock_orig) btrfs_tree_unlock(buf); free_extent_buffer_stale(buf); @@ -1493,7 +1495,6 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, { struct btrfs_fs_info *fs_info = root->fs_info; u64 search_start; - int ret; if (test_bit(BTRFS_ROOT_DELETING, &root->state)) btrfs_err(fs_info, @@ -1527,12 +1528,8 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, * Also We don't care about the error, as it's handled internally. */ btrfs_qgroup_trace_subtree_after_cow(trans, root, buf); - ret = __btrfs_cow_block(trans, root, buf, parent, + return __btrfs_cow_block(trans, root, buf, parent, parent_slot, cow_ret, search_start, 0, nest); - - trace_btrfs_cow_block(root, buf, *cow_ret); - - return ret; } /* -- 2.39.2

2 1

[PATCH OLK-5.10] jfs: fix shift-out-of-bounds in dbSplit
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> stable inclusion from stable-v5.10.231 commit df7c76636952670b31bd6c12b3aed3c502122273 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOT CVE: CVE-2024-56597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d ] When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. Reported-by: syzbot+b5ca8a249162c4b9a7d0(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index bf1f3d4d23f2..54298823d8ad 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1888,6 +1888,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results) return -EIO; dp = (struct dmap *) mp->data; + if (dp->tree.budmin < 0) + return -EIO; + /* try to allocate the blocks. */ rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results); -- 2.25.1

2 1

[PATCH OLK-6.6] jfs: fix shift-out-of-bounds in dbSplit
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> stable inclusion from stable-v6.6.66 commit c56245baf3fd1f79145dd7408e3ead034b74255c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOT CVE: CVE-2024-56597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d ] When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. Reported-by: syzbot+b5ca8a249162c4b9a7d0(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 3ab410059dc2..39957361a7ee 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1820,6 +1820,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results) return -EIO; dp = (struct dmap *) mp->data; + if (dp->tree.budmin < 0) + return -EIO; + /* try to allocate the blocks. */ rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results); -- 2.25.1

2 1

[PATCH OLK-6.6] scsi: ufs: core: sysfs: Prevent div by zero
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Gwendal Grignou <gwendal(a)chromium.org> stable inclusion from stable-v6.6.66 commit 0069928727c2e95ca26c738fbe6e4b241aeaaf08 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOG CVE: CVE-2024-56622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit eb48e9fc0028bed94a40a9352d065909f19e333c upstream. Prevent a division by 0 when monitoring is not enabled. Fixes: 1d8613a23f3c ("scsi: ufs: core: Introduce HBA performance monitor sysfs nodes") Cc: stable(a)vger.kernel.org Signed-off-by: Gwendal Grignou <gwendal(a)chromium.org> Link: https://lore.kernel.org/r/20241120062522.917157-1-gwendal@chromium.org Reviewed-by: Can Guo <quic_cang(a)quicinc.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/ufs/core/ufs-sysfs.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c index c95906443d5f..3692b39b35e7 100644 --- a/drivers/ufs/core/ufs-sysfs.c +++ b/drivers/ufs/core/ufs-sysfs.c @@ -485,6 +485,9 @@ static ssize_t read_req_latency_avg_show(struct device *dev, struct ufs_hba *hba = dev_get_drvdata(dev); struct ufs_hba_monitor *m = &hba->monitor; + if (!m->nr_req[READ]) + return sysfs_emit(buf, "0\n"); + return sysfs_emit(buf, "%llu\n", div_u64(ktime_to_us(m->lat_sum[READ]), m->nr_req[READ])); } @@ -552,6 +555,9 @@ static ssize_t write_req_latency_avg_show(struct device *dev, struct ufs_hba *hba = dev_get_drvdata(dev); struct ufs_hba_monitor *m = &hba->monitor; + if (!m->nr_req[WRITE]) + return sysfs_emit(buf, "0\n"); + return sysfs_emit(buf, "%llu\n", div_u64(ktime_to_us(m->lat_sum[WRITE]), m->nr_req[WRITE])); } -- 2.25.1

2 1

[PATCH OLK-5.10] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> stable inclusion from stable-v5.10.232 commit 616aa5f3c86e0479bcbb81e41c08c43ff32af637 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMX CVE: CVE-2024-56662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 265e98f72bac6c41a4492d3e30a8e5fd22fe0779 ] Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 The issue occurs in cmd_to_func when the call_pkg->nd_reserved2 array is accessed without verifying that call_pkg points to a buffer that is appropriately sized as a struct nd_cmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space. To address this, a check was added in acpi_nfit_ctl() to ensure that buf is not NULL and that buf_len is less than sizeof(*call_pkg) before accessing it. This ensures safe access to the members of call_pkg, including the nd_reserved2 array. Reported-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7534f060ebda6b8b51b3 Tested-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Fixes: ebe9f6f19d80 ("acpi/nfit: Fix bus command validation") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Reviewed-by: Alison Schofield <alison.schofield(a)intel.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://patch.msgid.link/20241118162609.29063-1-surajsonawane0215@gmail.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/acpi/nfit/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 2306abb09f7f..16857612103e 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -453,8 +453,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, if (cmd_rc) *cmd_rc = -EINVAL; - if (cmd == ND_CMD_CALL) + if (cmd == ND_CMD_CALL) { + if (!buf || buf_len < sizeof(*call_pkg)) + return -EINVAL; + call_pkg = buf; + } + func = cmd_to_func(nfit_mem, cmd, call_pkg, &family); if (func < 0) return func; -- 2.25.1

2 1

[PATCH OLK-6.6] erofs: handle NONHEAD !delta[1] lclusters gracefully
by Zizhi Wo 08 Jan '25

08 Jan '25

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> stable inclusion from stable-v6.6.64 commit f466641debcbea8bdf78d1b63a6270aadf9301bf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAED CVE: CVE-2024-53234 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ] syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. `lclusterbits > 14` is illegal for compact indexes, error out too. Reported-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/67373c0c.050a0220.2a2fcc.0079.GAE@google.com Tested-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Fixes: d95ae5e25326 ("erofs: add support for the full decompressed length") Fixes: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size") Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20241115173651.3339514-1-hsiangkao@linux.alibaba.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/zmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 6bd435a565f6..76566c2cbf63 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -234,7 +234,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, unsigned int amortizedshift; erofs_off_t pos; - if (lcn >= totalidx) + if (lcn >= totalidx || vi->z_logical_clusterbits > 14) return -EINVAL; m->lcn = lcn; @@ -409,7 +409,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits; int err; - do { + while (1) { /* handle the last EOF pcluster (no next HEAD lcluster) */ if ((lcn << lclusterbits) >= inode->i_size) { map->m_llen = inode->i_size - map->m_la; @@ -421,14 +421,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return err; if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) { - DBG_BUGON(!m->delta[1] && - m->clusterofs != 1 << lclusterbits); + /* work around invalid d1 generated by pre-1.0 mkfs */ + if (unlikely(!m->delta[1])) { + m->delta[1] = 1; + DBG_BUGON(1); + } } else if (m->type == Z_EROFS_LCLUSTER_TYPE_PLAIN || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD1 || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD2) { - /* go on until the next HEAD lcluster */ if (lcn != headlcn) - break; + break; /* ends at the next HEAD lcluster */ m->delta[1] = 1; } else { erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu", @@ -437,8 +439,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return -EOPNOTSUPP; } lcn += m->delta[1]; - } while (m->delta[1]); - + } map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la; return 0; } -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> stable inclusion from stable-v5.10.232 commit 616aa5f3c86e0479bcbb81e41c08c43ff32af637 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMX CVE: CVE-2024-56662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 265e98f72bac6c41a4492d3e30a8e5fd22fe0779 ] Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 The issue occurs in cmd_to_func when the call_pkg->nd_reserved2 array is accessed without verifying that call_pkg points to a buffer that is appropriately sized as a struct nd_cmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space. To address this, a check was added in acpi_nfit_ctl() to ensure that buf is not NULL and that buf_len is less than sizeof(*call_pkg) before accessing it. This ensures safe access to the members of call_pkg, including the nd_reserved2 array. Reported-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7534f060ebda6b8b51b3 Tested-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Fixes: ebe9f6f19d80 ("acpi/nfit: Fix bus command validation") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Reviewed-by: Alison Schofield <alison.schofield(a)intel.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://patch.msgid.link/20241118162609.29063-1-surajsonawane0215@gmail.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/acpi/nfit/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 99e23a5df026..53a60e9e4c6f 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -453,8 +453,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, if (cmd_rc) *cmd_rc = -EINVAL; - if (cmd == ND_CMD_CALL) + if (cmd == ND_CMD_CALL) { + if (!buf || buf_len < sizeof(*call_pkg)) + return -EINVAL; + call_pkg = buf; + } + func = cmd_to_func(nfit_mem, cmd, call_pkg, &family); if (func < 0) return func; -- 2.25.1

2 1

[PATCH OLK-6.6] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> stable inclusion from stable-v6.6.67 commit e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMX CVE: CVE-2024-56662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 265e98f72bac6c41a4492d3e30a8e5fd22fe0779 ] Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 The issue occurs in cmd_to_func when the call_pkg->nd_reserved2 array is accessed without verifying that call_pkg points to a buffer that is appropriately sized as a struct nd_cmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space. To address this, a check was added in acpi_nfit_ctl() to ensure that buf is not NULL and that buf_len is less than sizeof(*call_pkg) before accessing it. This ensures safe access to the members of call_pkg, including the nd_reserved2 array. Reported-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7534f060ebda6b8b51b3 Tested-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Fixes: ebe9f6f19d80 ("acpi/nfit: Fix bus command validation") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Reviewed-by: Alison Schofield <alison.schofield(a)intel.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://patch.msgid.link/20241118162609.29063-1-surajsonawane0215@gmail.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/acpi/nfit/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 7d88db451cfb..7918923e3b74 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -454,8 +454,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, if (cmd_rc) *cmd_rc = -EINVAL; - if (cmd == ND_CMD_CALL) + if (cmd == ND_CMD_CALL) { + if (!buf || buf_len < sizeof(*call_pkg)) + return -EINVAL; + call_pkg = buf; + } + func = cmd_to_func(nfit_mem, cmd, call_pkg, &family); if (func < 0) return func; -- 2.25.1

2 1

[PATCH OLK-6.6] x86/xen: don't do PV iret hypercall through hypercall page
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v6.6.67 commit 82c211ead1ec440dbf81727e17b03b5e3c44b93d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBCAZE CVE: CVE-2024-53241 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a2796dff62d6c6bfc5fbebdf2bee0d5ac0438906 upstream. Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations. This is part of XSA-466 / CVE-2024-53241. Reported-by: Andrew Cooper <andrew.cooper3(a)citrix.com> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Jan Beulich <jbeulich(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- arch/x86/xen/xen-asm.S | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S index 1a9cd18dfbd3..72f61a69f72e 100644 --- a/arch/x86/xen/xen-asm.S +++ b/arch/x86/xen/xen-asm.S @@ -176,7 +176,6 @@ SYM_CODE_START(xen_early_idt_handler_array) SYM_CODE_END(xen_early_idt_handler_array) __FINIT -hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32 /* * Xen64 iret frame: * @@ -186,17 +185,28 @@ hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32 * cs * rip <-- standard iret frame * - * flags + * flags <-- xen_iret must push from here on * - * rcx } - * r11 }<-- pushed by hypercall page - * rsp->rax } + * rcx + * r11 + * rsp->rax */ +.macro xen_hypercall_iret + pushq $0 /* Flags */ + push %rcx + push %r11 + push %rax + mov $__HYPERVISOR_iret, %eax + syscall /* Do the IRET. */ +#ifdef CONFIG_MITIGATION_SLS + int3 +#endif +.endm + SYM_CODE_START(xen_iret) UNWIND_HINT_UNDEFINED ANNOTATE_NOENDBR - pushq $0 - jmp hypercall_iret + xen_hypercall_iret SYM_CODE_END(xen_iret) /* @@ -301,8 +311,7 @@ SYM_CODE_START(xen_entry_SYSENTER_compat) ENDBR lea 16(%rsp), %rsp /* strip %rcx, %r11 */ mov $-ENOSYS, %rax - pushq $0 - jmp hypercall_iret + xen_hypercall_iret SYM_CODE_END(xen_entry_SYSENTER_compat) SYM_CODE_END(xen_entry_SYSCALL_compat) -- 2.25.1

2 1

[PATCH OLK-6.6] drm/i915: Fix NULL pointer dereference in capture_engine
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Eugene Kobyak <eugene.kobyak(a)intel.com> stable inclusion from stable-v6.6.67 commit e07f9c92bd127f8835ac669d83b5e7ff59bbb40f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANL CVE: CVE-2024-56667 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit da0b986256ae9a78b0215214ff44f271bfe237c1 upstream. When the intel_context structure contains NULL, it raises a NULL pointer dereference error in drm_info(). Fixes: e8a3319c31a1 ("drm/i915: Allow error capture without a request") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12309 Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Cc: John Harrison <John.C.Harrison(a)Intel.com> Cc: <stable(a)vger.kernel.org> # v6.3+ Signed-off-by: Eugene Kobyak <eugene.kobyak(a)intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/xmsgfynkhycw3cf56akp4he2ffg44… (cherry picked from commit 754302a5bc1bd8fd3b7d85c168b0a1af6d4bba4d) Signed-off-by: Tvrtko Ursulin <tursulin(a)ursulin.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/gpu/drm/i915/i915_gpu_error.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c index 4008bb09fdb5..074ff6016383 100644 --- a/drivers/gpu/drm/i915/i915_gpu_error.c +++ b/drivers/gpu/drm/i915/i915_gpu_error.c @@ -1638,9 +1638,21 @@ capture_engine(struct intel_engine_cs *engine, return NULL; intel_engine_get_hung_entity(engine, &ce, &rq); - if (rq && !i915_request_started(rq)) - drm_info(&engine->gt->i915->drm, "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n", - engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id); + if (rq && !i915_request_started(rq)) { + /* + * We want to know also what is the guc_id of the context, + * but if we don't have the context reference, then skip + * printing it. + */ + if (ce) + drm_info(&engine->gt->i915->drm, + "Got hung context on %s with active request %lld:%lld [0x%04X] not yet started\n", + engine->name, rq->fence.context, rq->fence.seqno, ce->guc_id.id); + else + drm_info(&engine->gt->i915->drm, + "Got hung context on %s with active request %lld:%lld not yet started\n", + engine->name, rq->fence.context, rq->fence.seqno); + } if (rq) { capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL); -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
by Heyuan Wang 08 Jan '25

08 Jan '25

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v6.6.67 commit f3412522f78826fef1dfae40ef378a863df2591c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMY CVE: CVE-2024-56663 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e3dbf938656986cce73ac4083500d0bcfbffe24 ] Since the netlink attribute range validation provides inclusive checking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be IEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one. One crash stack for demonstration: ================================================================== BUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 Read of size 6 at addr 001102080000000c by task fuzzer.386/9508 CPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_report+0xe0/0x750 mm/kasan/report.c:398 kasan_report+0x139/0x170 mm/kasan/report.c:495 kasan_check_range+0x287/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline] nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [inline] __do_sys_sendmsg net/socket.c:2591 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Update the policy to ensure correct validation. Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Suggested-by: Cengiz Can <cengiz.can(a)canonical.com> Link: https://patch.msgid.link/20241130170526.96698-1-linma@zju.edu.cn Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 797907303669..5b9f39d93b04 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -811,7 +811,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_MLO_LINKS] = NLA_POLICY_NESTED_ARRAY(nl80211_policy), [NL80211_ATTR_MLO_LINK_ID] = - NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS), + NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1), [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN), [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG }, [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT }, -- 2.25.1

2 1

[PATCH OLK-6.6] erofs: handle NONHEAD !delta[1] lclusters gracefully
by Zizhi Wo 08 Jan '25

08 Jan '25

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> stable inclusion from stable-v6.6.64 commit f466641debcbea8bdf78d1b63a6270aadf9301bf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-53234 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ] syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. `lclusterbits > 14` is illegal for compact indexes, error out too. Reported-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/67373c0c.050a0220.2a2fcc.0079.GAE@google.com Tested-by: syzbot+6c0b301317aa0156f9eb(a)syzkaller.appspotmail.com Fixes: d95ae5e25326 ("erofs: add support for the full decompressed length") Fixes: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size") Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> Link: https://lore.kernel.org/r/20241115173651.3339514-1-hsiangkao@linux.alibaba.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/zmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 6bd435a565f6..76566c2cbf63 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -234,7 +234,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, unsigned int amortizedshift; erofs_off_t pos; - if (lcn >= totalidx) + if (lcn >= totalidx || vi->z_logical_clusterbits > 14) return -EINVAL; m->lcn = lcn; @@ -409,7 +409,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits; int err; - do { + while (1) { /* handle the last EOF pcluster (no next HEAD lcluster) */ if ((lcn << lclusterbits) >= inode->i_size) { map->m_llen = inode->i_size - map->m_la; @@ -421,14 +421,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return err; if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) { - DBG_BUGON(!m->delta[1] && - m->clusterofs != 1 << lclusterbits); + /* work around invalid d1 generated by pre-1.0 mkfs */ + if (unlikely(!m->delta[1])) { + m->delta[1] = 1; + DBG_BUGON(1); + } } else if (m->type == Z_EROFS_LCLUSTER_TYPE_PLAIN || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD1 || m->type == Z_EROFS_LCLUSTER_TYPE_HEAD2) { - /* go on until the next HEAD lcluster */ if (lcn != headlcn) - break; + break; /* ends at the next HEAD lcluster */ m->delta[1] = 1; } else { erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu", @@ -437,8 +439,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m) return -EOPNOTSUPP; } lcn += m->delta[1]; - } while (m->delta[1]); - + } map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la; return 0; } -- 2.46.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 323fdd0bb1c04cc9d146fbb356de334a6230d4f2
by kernel test robot 08 Jan '25

08 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 323fdd0bb1c04cc9d146fbb356de334a6230d4f2 !14746 nvme-pci: fix freeing of the HMB descriptor table Error/Warning ids grouped by kconfigs: recent_errors |-- loongarch-allmodconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-allyesconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-randconfig-002-20250107 | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | |-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-get_nt_block_copy_mini_len | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-set_c86_features_para_invalid | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpustate_free_space | |-- arch-x86-kvm-svm-csv.c:warning:no-previous-prototype-for-function-csv_vm_attestation | |-- arch-x86-kvm-svm-sev.c:warning:no-previous-prototype-for-function-sev_install_hooks | |-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_setup_strp | `-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_stream_read |-- x86_64-buildonly-randconfig-001-20250107 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-003-20250107 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus `-- x86_64-buildonly-randconfig-004-20250107 `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) elapsed time: 730m configs tested: 19 configs skipped: 104 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250107 clang-15 arm64 randconfig-002-20250107 clang-20 arm64 randconfig-003-20250107 gcc-14.2.0 arm64 randconfig-004-20250107 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250107 gcc-14.2.0 loongarch randconfig-002-20250107 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250107 clang-19 x86_64 buildonly-randconfig-002-20250107 gcc-12 x86_64 buildonly-randconfig-003-20250107 clang-19 x86_64 buildonly-randconfig-004-20250107 gcc-12 x86_64 buildonly-randconfig-005-20250107 clang-19 x86_64 buildonly-randconfig-006-20250107 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 43c2a19ed680b57698ab6b44cbb76bb5e66dc4dd
by kernel test robot 08 Jan '25

08 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 43c2a19ed680b57698ab6b44cbb76bb5e66dc4dd !14726 etmem: fix use-after-free of mm in the scan release process Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250107 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250107 | |-- include-linux-rcupdate.h:warning:array-subscript-unknown-is-outside-array-bounds-of-struct-net_device | |-- include-linux-spinlock.h:warning:array-subscript-unknown-is-outside-array-bounds-of-struct-smt_entry | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20250107 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250107 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-001-20250107 | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250107 | |-- drivers-staging-media-zoran-zoran_procfs.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-003-20250107 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250107 | |-- drivers-bcma-.tmp_core.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_bridge.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_color_mgmt.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_dp_dual_mode_helper.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_encoder.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_irq.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_lease.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_mode_config.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_modeset_helper.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-.tmp_drm_rect.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-amd-amdgpu-.tmp_amdgpu_gart.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-gpu-drm-amd-amdgpu-.tmp_amdgpu_sched.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-hwmon-.tmp_mlxreg-fan.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-input-serio-.tmp_libps2.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-mfd-.tmp_madera-core.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-of-.tmp_base.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-opp-.tmp_cpu.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-opp-.tmp_of.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pci-controller-.tmp_pcie-cadence.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-power-supply-.tmp_adp5061.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-video-.tmp_hdmi.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-autofs-.tmp_expire.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-notify-.tmp_fdinfo.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-.tmp_dir.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-.tmp_group.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-.tmp_symlink.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-.tmp_stacktrace.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) | |-- kernel-trace-.tmp_trace_events_trigger.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-005-20250107 | |-- arch-x86-kernel-unwind_orc.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-hwtracing-intel_th-debug.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-media-usb-as102-as102_fw.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-media-usb-as102-as1_cmd.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-media-usb-as102-as1_cmd_cfg.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-media-usb-as102-as1_cmd_stream.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-usb-dwc2-hcd_ddma.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-xfs-xfs_bmap_util.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-xfs-xfs_symlink.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-gcov-base.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-buildonly-randconfig-006-20250107 |-- arch-x86-kernel-unwind_orc.o:warning:objtool:missing-symbol-for-section-.text |-- block-bfq-wf2q.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-base.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-core.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-core507d.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-curs.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-oimm.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-oimm507b.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-ovly.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-dispnv50-wimm.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvif-disp.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvif-fifo.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvif-user.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvkm-engine-disp-hdmigv100.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-gpu-drm-nouveau-nvkm-engine-gr-ctxgf117.o:warning:objtool:missing-symbol-for-section-.text |-- drivers-pci-pcie-dpc.o:warning:objtool:missing-symbol-for-section-.init.text |-- drivers-usb-dwc2-hcd_ddma.o:warning:objtool:missing-symbol-for-section-.text |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- fs-xfs-xfs_rtalloc.o:warning:objtool:missing-symbol-for-section-.text |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 740m configs tested: 15 configs skipped: 108 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250107 gcc-14.2.0 arm64 randconfig-002-20250107 gcc-14.2.0 arm64 randconfig-003-20250107 gcc-14.2.0 arm64 randconfig-004-20250107 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250107 clang-19 x86_64 buildonly-randconfig-002-20250107 gcc-12 x86_64 buildonly-randconfig-003-20250107 clang-19 x86_64 buildonly-randconfig-004-20250107 gcc-12 x86_64 buildonly-randconfig-005-20250107 clang-19 x86_64 buildonly-randconfig-006-20250107 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION b21ca7240f2269ad91a1842acef33c267c8b201e
by kernel test robot 08 Jan '25

08 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: b21ca7240f2269ad91a1842acef33c267c8b201e !14604 scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() Error/Warning (recently discovered and may have been fixed): net/core/datagram.o: warning: objtool: __skb_datagram_iter()+0x1b4: unreachable instruction net/mptcp/protocol.o: warning: objtool: mptcp_reset_timer()+0x27: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-001-20250107 | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-002-20250107 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:address-of-array-chip_node-rt_cmd-will-always-evaluate-to-true | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-hashlen_t-is-a-C11-feature | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-page_info_t-is-a-C11-feature | `-- fs-eulerfs-namei.c:warning:variable-de-is-uninitialized-when-used-here |-- x86_64-buildonly-randconfig-001-20250107 | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-002-20250107 | `-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-003-20250107 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20241230 | |-- net-core-datagram.o:warning:objtool:__skb_datagram_iter:unreachable-instruction | `-- net-mptcp-protocol.o:warning:objtool:mptcp_reset_timer:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20250107 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-005-20250107 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-buildonly-randconfig-006-20250107 |-- kernel-rcu-update.o:warning:objtool:synchronize_rcu_tasks_trace:unreachable-instruction |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory elapsed time: 736m configs tested: 15 configs skipped: 100 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250107 clang-15 arm64 randconfig-002-20250107 clang-20 arm64 randconfig-003-20250107 gcc-14.2.0 arm64 randconfig-004-20250107 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250107 clang-19 x86_64 buildonly-randconfig-002-20250107 gcc-12 x86_64 buildonly-randconfig-003-20250107 clang-19 x86_64 buildonly-randconfig-004-20250107 gcc-12 x86_64 buildonly-randconfig-005-20250107 clang-19 x86_64 buildonly-randconfig-006-20250107 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-25.03] PM / devfreq: Rectify the uncore frequency alarm
by Xiangwei Li 07 Jan '25

07 Jan '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBC4SJ -------------------------------- In the x86 architecture, the return value of topology_cluster_cpumask must be a const modification variable. The compilation alarm caused by the constant is rectified. Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/devfreq/hisi_uncore_freq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/devfreq/hisi_uncore_freq.c b/drivers/devfreq/hisi_uncore_freq.c index 89af7aa9a095..d815133b647e 100644 --- a/drivers/devfreq/hisi_uncore_freq.c +++ b/drivers/devfreq/hisi_uncore_freq.c @@ -367,7 +367,7 @@ static int hisi_uncore_devfreq_register(struct hisi_uncore_freq *uncore) static int hisi_uncore_mark_related_cpus(struct hisi_uncore_freq *uncore, char *property, int (get_topo_id)(int cpu), - struct cpumask *(get_cpumask)(int cpu)) + const struct cpumask *(get_cpumask)(int cpu)) { unsigned int i, cpu; size_t len; @@ -419,7 +419,7 @@ static int get_cluster_id(int cpu) return topology_cluster_id(cpu); } -static struct cpumask *get_cluster_cpumask(int cpu) +static const struct cpumask *get_cluster_cpumask(int cpu) { return topology_cluster_cpumask(cpu); } -- 2.25.1

1 0

[PATCH openEuler-25.03] PM / devfreq: Only ARM64 support HiSilicon uncore frequency scaling driver
by Xiangwei Li 07 Jan '25

07 Jan '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBC4SJ -------------------------------- The HiSilicon uncore frequency scaling driver runs on Kunpeng SoCs, which are ARM64 chips. Therefore, architecture restrictions are added. Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/devfreq/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/devfreq/Kconfig b/drivers/devfreq/Kconfig index 1bcdce9a89d3..a8dcebd17275 100644 --- a/drivers/devfreq/Kconfig +++ b/drivers/devfreq/Kconfig @@ -158,7 +158,7 @@ config ARM_SUN8I_A33_MBUS_DEVFREQ config ARM_HISI_UNCORE_DEVFREQ tristate "HiSilicon uncore DEVFREQ Driver" - depends on (PCC && ACPI && ACPI_PPTT) || COMPILE_TEST + depends on ARM64 && ((PCC && ACPI && ACPI_PPTT) || COMPILE_TEST) help HiSilicon uncore DEVFREQ Driver -- 2.25.1

1 0

[PATCH OLK-6.6 0/2] CVE-2024-56677
by Liao Chen 07 Jan '25

07 Jan '25

fix CVE-2024-56677 Ritesh Harjani (IBM) (2): powerpc/fadump: Refactor and prepare fadump_cma_init for late init powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() arch/powerpc/include/asm/fadump.h | 7 +++++++ arch/powerpc/kernel/fadump.c | 23 +++++++---------------- arch/powerpc/kernel/setup-common.c | 6 ++++-- 3 files changed, 18 insertions(+), 18 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-56724
by Liao Chen 07 Jan '25

07 Jan '25

fix CVE-2024-56724 Andy Shevchenko (2): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 82 +++++++++++++++++--------- drivers/platform/x86/intel/bxtwc_tmu.c | 22 ++----- drivers/usb/typec/tcpm/wcove.c | 4 -- 3 files changed, 60 insertions(+), 48 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] tracing: Prevent bad count for tracing_cpumask_write
by Luo Gengkun 07 Jan '25

07 Jan '25

From: Lizhi Xu <lizhi.xu(a)windriver.com> mainline inclusion from mainline-v6.13-rc5 commit 98feccbf32cfdde8c722bc4587aaa60ee5ac33f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PO CVE: CVE-2024-56763 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it. Cc: stable(a)vger.kernel.org Fixes: 9e01c1b74c953 ("cpumask: convert kernel trace functions") Link: https://lore.kernel.org/20241216073238.2573704-1-lizhi.xu@windriver.com Reported-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0aecfd34fb878546f3fd Tested-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/trace/trace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index e9a737451a76..fa138d1bba56 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4878,6 +4878,9 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, cpumask_var_t tracing_cpumask_new; int err; + if (count == 0 || count > KMALLOC_MAX_SIZE) + return -EINVAL; + if (!zalloc_cpumask_var(&tracing_cpumask_new, GFP_KERNEL)) return -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Prevent bad count for tracing_cpumask_write
by Luo Gengkun 07 Jan '25

07 Jan '25

From: Lizhi Xu <lizhi.xu(a)windriver.com> mainline inclusion from mainline-v6.13-rc5 commit 98feccbf32cfdde8c722bc4587aaa60ee5ac33f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PO CVE: CVE-2024-56763 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it. Cc: stable(a)vger.kernel.org Fixes: 9e01c1b74c953 ("cpumask: convert kernel trace functions") Link: https://lore.kernel.org/20241216073238.2573704-1-lizhi.xu@windriver.com Reported-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0aecfd34fb878546f3fd Tested-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/trace/trace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index a470950b8ed6..462d2a70a835 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4869,6 +4869,9 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, cpumask_var_t tracing_cpumask_new; int err; + if (count == 0 || count > KMALLOC_MAX_SIZE) + return -EINVAL; + if (!zalloc_cpumask_var(&tracing_cpumask_new, GFP_KERNEL)) return -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Prevent bad count for tracing_cpumask_write
by Luo Gengkun 07 Jan '25

07 Jan '25

From: Lizhi Xu <lizhi.xu(a)windriver.com> stable inclusion from stable-v6.6.69 commit 03041e474a6a8f1bfd4b96b164bb3165c48fa1a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PO CVE: CVE-2024-56763 Reference: https://git.kernel.org/stable/c/03041e474a6a8f1bfd4b96b164bb3165c48fa1a3 -------------------------------- commit 98feccbf32cfdde8c722bc4587aaa60ee5ac33f0 upstream. If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it. Cc: stable(a)vger.kernel.org Fixes: 9e01c1b74c953 ("cpumask: convert kernel trace functions") Link: https://lore.kernel.org/20241216073238.2573704-1-lizhi.xu@windriver.com Reported-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0aecfd34fb878546f3fd Tested-by: syzbot+0aecfd34fb878546f3fd(a)syzkaller.appspotmail.com Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/trace/trace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 02bc8e03ffa1..24c995d1dab2 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -5331,6 +5331,9 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, cpumask_var_t tracing_cpumask_new; int err; + if (count == 0 || count > KMALLOC_MAX_SIZE) + return -EINVAL; + if (!zalloc_cpumask_var(&tracing_cpumask_new, GFP_KERNEL)) return -ENOMEM; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-56567
by Liao Chen 07 Jan '25

07 Jan '25

fix CVE-2024-56567 Zicheng Qu (1): ad7780: fix division by zero in ad7780_write_raw() drivers/iio/adc/ad7780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[openeuler:OLK-5.10 2656/2656] kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_trace()+0xde: unreachable instruction
by kernel test robot 07 Jan '25

07 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9be6ae394c896999214be0f875765d2c58d15b13 commit: 2509f2079e7247ed0d695bdb69c3d019a700a4b8 [2656/2656] rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug config: x86_64-buildonly-randconfig-006-20250107 (https://download.01.org/0day-ci/archive/20250107/202501071757.EREnWTHH-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250107/202501071757.EREnWTHH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501071757.EREnWTHH-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_trace()+0xde: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/3] CVE-2024-56642
by Liu Jian 07 Jan '25

07 Jan '25

CVE-2024-56642 Eric Dumazet (1): tipc: fix NULL deref in cleanup_bearer() Kuniyuki Iwashima (1): tipc: Fix use-after-free of kernel socket in cleanup_bearer(). Xin Long (1): tipc: remove ub->ubsock checks net/tipc/udp_media.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] bpf, sockmap: Several fixes to bpf_msg_pop_data
by Liu Jian 07 Jan '25

07 Jan '25

From: Zijian Zhang <zijianzhang(a)bytedance.com> stable inclusion from stable-v6.6.64 commit 98c7ea7d11f2588e8197db042e0291e4ac8f8346 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFC CVE: CVE-2024-56720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 5d609ba262475db450ba69b8e8a557bd768ac07a ] Several fixes to bpf_msg_pop_data, 1. In sk_msg_shift_left, we should put_page 2. if (len == 0), return early is better 3. pop the entire sk_msg (last == msg->sg.size) should be supported 4. Fix for the value of variable "a" 5. In sk_msg_shift_left, after shifting, i has already pointed to the next element. Addtional sk_msg_iter_var_next may result in BUG. Fixes: 7246d8ed4dcc ("bpf: helper to pop data from messages") Signed-off-by: Zijian Zhang <zijianzhang(a)bytedance.com> Reviewed-by: John Fastabend <john.fastabend(a)gmail.com> Link: https://lore.kernel.org/r/20241106222520.527076-8-zijianzhang@bytedance.com Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 48dd2896ee1d9..131a21b5463cc 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2889,8 +2889,10 @@ static const struct bpf_func_proto bpf_msg_push_data_proto = { static void sk_msg_shift_left(struct sk_msg *msg, int i) { + struct scatterlist *sge = sk_msg_elem(msg, i); int prev; + put_page(sg_page(sge)); do { prev = i; sk_msg_iter_var_next(i); @@ -2927,6 +2929,9 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, if (unlikely(flags)) return -EINVAL; + if (unlikely(len == 0)) + return 0; + /* First find the starting scatterlist element */ i = msg->sg.start; do { @@ -2939,7 +2944,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, } while (i != msg->sg.end); /* Bounds checks: start and pop must be inside message */ - if (start >= offset + l || last >= msg->sg.size) + if (start >= offset + l || last > msg->sg.size) return -EINVAL; space = MAX_MSG_FRAGS - sk_msg_elem_used(msg); @@ -2968,12 +2973,12 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, */ if (start != offset) { struct scatterlist *nsge, *sge = sk_msg_elem(msg, i); - int a = start; + int a = start - offset; int b = sge->length - pop - a; sk_msg_iter_var_next(i); - if (pop < sge->length - a) { + if (b > 0) { if (space) { sge->length = a; sk_msg_shift_right(msg, i); @@ -2992,7 +2997,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, if (unlikely(!page)) return -ENOMEM; - sge->length = a; orig = sg_page(sge); from = sg_virt(sge); to = page_address(page); @@ -3002,7 +3006,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, put_page(orig); } pop = 0; - } else if (pop >= sge->length - a) { + } else { pop -= (sge->length - a); sge->length = a; } @@ -3036,7 +3040,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, pop -= sge->length; sk_msg_shift_left(msg, i); } - sk_msg_iter_var_next(i); } sk_mem_uncharge(msg->sk, len - pop); -- 2.34.1

2 5

[PATCH OLK-5.10] tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
by Liu Jian 07 Jan '25

07 Jan '25

From: Zijian Zhang <zijianzhang(a)bytedance.com> stable inclusion from stable-v5.10.231 commit dbedc7e142df5ea238a46fdd7462c1c42cd36a10 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANQ CVE: CVE-2024-56633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit ca70b8baf2bd125b2a4d96e76db79375c07d7ff2 ] The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging tosend bytes, which is either msg->sg.size or a smaller value apply_bytes. Potential problems with this strategy are as follows: - If the actual sent bytes are smaller than tosend, we need to charge some bytes back, as in line 487, which is okay but seems not clean. - When tosend is set to apply_bytes, as in line 417, and (ret < 0), we may miss uncharging (msg->sg.size - apply_bytes) bytes. [...] 415 tosend = msg->sg.size; 416 if (psock->apply_bytes && psock->apply_bytes < tosend) 417 tosend = psock->apply_bytes; [...] 443 sk_msg_return(sk, msg, tosend); 444 release_sock(sk); 446 origsize = msg->sg.size; 447 ret = tcp_bpf_sendmsg_redir(sk_redir, redir_ingress, 448 msg, tosend, flags); 449 sent = origsize - msg->sg.size; [...] 454 lock_sock(sk); 455 if (unlikely(ret < 0)) { 456 int free = sk_msg_free_nocharge(sk, msg); 458 if (!cork) 459 *copied -= free; 460 } [...] 487 if (eval == __SK_REDIRECT) 488 sk_mem_charge(sk, tosend - sent); [...] When running the selftest test_txmsg_redir_wait_sndmem with txmsg_apply, the following warning will be reported: ------------[ cut here ]------------ WARNING: CPU: 6 PID: 57 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x190/0x1a0 Modules linked in: CPU: 6 UID: 0 PID: 57 Comm: kworker/6:0 Not tainted 6.12.0-rc1.bm.1-amd64+ #43 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events sk_psock_destroy RIP: 0010:inet_sock_destruct+0x190/0x1a0 RSP: 0018:ffffad0a8021fe08 EFLAGS: 00010206 RAX: 0000000000000011 RBX: ffff9aab4475b900 RCX: ffff9aab481a0800 RDX: 0000000000000303 RSI: 0000000000000011 RDI: ffff9aab4475b900 RBP: ffff9aab4475b990 R08: 0000000000000000 R09: ffff9aab40050ec0 R10: 0000000000000000 R11: ffff9aae6fdb1d01 R12: ffff9aab49c60400 R13: ffff9aab49c60598 R14: ffff9aab49c60598 R15: dead000000000100 FS: 0000000000000000(0000) GS:ffff9aae6fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffec7e47bd8 CR3: 00000001a1a1c004 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x89/0x130 ? inet_sock_destruct+0x190/0x1a0 ? report_bug+0xfc/0x1e0 ? handle_bug+0x5c/0xa0 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? inet_sock_destruct+0x190/0x1a0 __sk_destruct+0x25/0x220 sk_psock_destroy+0x2b2/0x310 process_scheduled_works+0xa3/0x3e0 worker_thread+0x117/0x240 ? __pfx_worker_thread+0x10/0x10 kthread+0xcf/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- In __SK_REDIRECT, a more concise way is delaying the uncharging after sent bytes are finalized, and uncharge this value. When (ret < 0), we shall invoke sk_msg_free. Same thing happens in case __SK_DROP, when tosend is set to apply_bytes, we may miss uncharging (msg->sg.size - apply_bytes) bytes. The same warning will be reported in selftest. [...] 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); 473 return -EACCES; [...] So instead of sk_msg_free_partial we can do sk_msg_free here. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Fixes: 8ec95b94716a ("bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues") Signed-off-by: Zijian Zhang <zijianzhang(a)bytedance.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Link: https://lore.kernel.org/bpf/20241016234838.3167769-3-zijianzhang@bytedance.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/tcp_bpf.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 8645017da9df9..384121426ea28 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -447,7 +447,6 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, cork = true; psock->cork = NULL; } - sk_msg_return(sk, msg, tosend); release_sock(sk); origsize = msg->sg.size; @@ -459,8 +458,9 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, sock_put(sk_redir); lock_sock(sk); + sk_mem_uncharge(sk, sent); if (unlikely(ret < 0)) { - int free = sk_msg_free_nocharge(sk, msg); + int free = sk_msg_free(sk, msg); if (!cork) *copied -= free; @@ -474,7 +474,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, break; case __SK_DROP: default: - sk_msg_free_partial(sk, msg, tosend); + sk_msg_free(sk, msg); sk_msg_apply_bytes(psock, tosend); *copied -= (tosend + delta); return -EACCES; @@ -490,11 +490,8 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, } if (msg && msg->sg.data[msg->sg.start].page_link && - msg->sg.data[msg->sg.start].length) { - if (eval == __SK_REDIRECT) - sk_mem_charge(sk, tosend - sent); + msg->sg.data[msg->sg.start].length) goto more_data; - } } return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6] drm/i915/hdcp: Add encoder check in hdcp2_get_capability
by He Yujie 07 Jan '25

07 Jan '25

From: Suraj Kandpal <suraj.kandpal(a)intel.com> mainline inclusion from mainline-v6.12-rc1 commit d34f4f058edf1235c103ca9c921dc54820d14d40 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQZ CVE: CVE-2024-53050 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add encoder check in intel_hdcp2_get_capability to avoid null pointer error. Signed-off-by: Suraj Kandpal <suraj.kandpal(a)intel.com> Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240722064451.3610512-3-sura… Conflicts: drivers/gpu/drm/i915/display/intel_hdcp.c drivers/gpu/drm/i915/display/intel_dp_hdcp.c [ Context conflict: 130849f8ec14("drm/i915/hdcp: Use intel_connector as argument for hdcp_2_2_capable") a35239a89259("drm/i915/hdcp: Use correct aux for capability check scenario") 287c0de8b294("drm/i915/hdcp: Move to direct reads for HDCP") 55d9b2b8e440("drm/i915/hdcp: Refactor intel_dp_hdcp2_capable") 8e754d9e9e8a("drm/i915/hdcp: Rename hdcp capable functions") the above patches are not merge. ] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c index cb99839afcd0..762170e6cbbb 100644 --- a/drivers/gpu/drm/i915/display/intel_hdcp.c +++ b/drivers/gpu/drm/i915/display/intel_hdcp.c @@ -163,7 +163,7 @@ bool intel_hdcp_capable(struct intel_connector *connector) /* Is HDCP2.2 capable on Platform and Sink */ bool intel_hdcp2_capable(struct intel_connector *connector) { - struct intel_digital_port *dig_port = intel_attached_dig_port(connector); + struct intel_digital_port *dig_port; struct drm_i915_private *i915 = to_i915(connector->base.dev); struct intel_hdcp *hdcp = &connector->hdcp; bool capable = false; @@ -192,6 +192,11 @@ bool intel_hdcp2_capable(struct intel_connector *connector) } mutex_unlock(&i915->display.hdcp.hdcp_mutex); + if (!intel_attached_encoder(connector)) + return false; + + dig_port = intel_attached_dig_port(connector); + /* Sink's capability for HDCP2.2 */ hdcp->shim->hdcp_2_2_capable(dig_port, &capable); -- 2.34.1

2 1

[PATCH OLK-6.6] nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
by He Yujie 07 Jan '25

07 Jan '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v6.6.63 commit 59b49ca67cca7b007a5afd3de0283c8008157665 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-53131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cd45e963e44b0f10d90b9e6c0e8b4f47f3c92471 upstream. Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints". This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints. This patch (of 2): It has been reported that when using "block:block_touch_buffer" tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled. This happens because since the tracepoint was added in touch_buffer(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure. In the current implementation, the block_device structure is set after the function returns to the caller. Here, touch_buffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touch_buffer() here in the first place. So this solves the issue by eliminating the touch_buffer() call itself. Link: https://lkml.kernel.org/r/20241106160811.3316-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20241106160811.3316-2-konishi.ryusuke@gmail.com Fixes: 5305cb830834 ("block: add block_{touch|dirty}_buffer tracepoint") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: Ubisectech Sirius <bugreport(a)valiantsec.com> Closes: https://lkml.kernel.org/r/86bd3013-887e-4e38-960f-ca45c657f032.bugreport@va… Reported-by: syzbot+9982fb8d18eba905abe2(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9982fb8d18eba905abe2 Tested-by: syzbot+9982fb8d18eba905abe2(a)syzkaller.appspotmail.com Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- fs/nilfs2/page.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index 9bced0a5c253..144e200c4909 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -39,7 +39,6 @@ __nilfs_get_page_block(struct page *page, unsigned long block, pgoff_t index, first_block = (unsigned long)index << (PAGE_SHIFT - blkbits); bh = nilfs_page_get_nth_block(page, block - first_block); - touch_buffer(bh); wait_on_buffer(bh); return bh; } -- 2.34.1

2 1

[PATCH OLK-6.6] octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
by He Yujie 07 Jan '25

07 Jan '25

From: Dipendra Khadka <kdipendra88(a)gmail.com> stable inclusion from stable-v6.6.64 commit c0f64fd73b60aee85f88c270c9d714ead27a7b7a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-56728 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c ] Add error pointer check after calling otx2_mbox_get_rsp(). Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool") Fixes: d0cf9503e908 ("octeontx2-pf: ethtool fec mode support") Signed-off-by: Dipendra Khadka <kdipendra88(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- .../net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c index 8b7fc0af91ce..532e84bc38c7 100644 --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c @@ -343,6 +343,11 @@ static void otx2_get_pauseparam(struct net_device *netdev, if (!otx2_sync_mbox_msg(&pfvf->mbox)) { rsp = (struct cgx_pause_frm_cfg *) otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); + if (IS_ERR(rsp)) { + mutex_unlock(&pfvf->mbox.lock); + return; + } + pause->rx_pause = rsp->rx_pause; pause->tx_pause = rsp->tx_pause; } @@ -1082,6 +1087,11 @@ static int otx2_set_fecparam(struct net_device *netdev, rsp = (struct fec_mode *)otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); + if (IS_ERR(rsp)) { + err = PTR_ERR(rsp); + goto end; + } + if (rsp->fec >= 0) pfvf->linfo.fec = rsp->fec; else -- 2.34.1

2 1

[PATCH OLK-6.6] usb: musb: Fix hardware lockup on first Rx endpoint request
by He Yujie 07 Jan '25

07 Jan '25

From: Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> stable inclusion from stable-v6.6.64 commit 5906ee3693674d734177df13a519a21bb03f730d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-56687 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3fc137386c4620305bbc2a216868c53f9245670a upstream. There is a possibility that a request's callback could be invoked from usb_ep_queue() (call trace below, supplemented with missing calls): req->complete from usb_gadget_giveback_request (drivers/usb/gadget/udc/core.c:999) usb_gadget_giveback_request from musb_g_giveback (drivers/usb/musb/musb_gadget.c:147) musb_g_giveback from rxstate (drivers/usb/musb/musb_gadget.c:784) rxstate from musb_ep_restart (drivers/usb/musb/musb_gadget.c:1169) musb_ep_restart from musb_ep_restart_resume_work (drivers/usb/musb/musb_gadget.c:1176) musb_ep_restart_resume_work from musb_queue_resume_work (drivers/usb/musb/musb_core.c:2279) musb_queue_resume_work from musb_gadget_queue (drivers/usb/musb/musb_gadget.c:1241) musb_gadget_queue from usb_ep_queue (drivers/usb/gadget/udc/core.c:300) According to the docstring of usb_ep_queue(), this should not happen: "Note that @req's ->complete() callback must never be called from within usb_ep_queue() as that can create deadlock situations." In fact, a hardware lockup might occur in the following sequence: 1. The gadget is initialized using musb_gadget_enable(). 2. Meanwhile, a packet arrives, and the RXPKTRDY flag is set, raising an interrupt. 3. If IRQs are enabled, the interrupt is handled, but musb_g_rx() finds an empty queue (next_request() returns NULL). The interrupt flag has already been cleared by the glue layer handler, but the RXPKTRDY flag remains set. 4. The first request is enqueued using usb_ep_queue(), leading to the call of req->complete(), as shown in the call trace above. 5. If the callback enables IRQs and another packet is waiting, step (3) repeats. The request queue is empty because usb_g_giveback() removes the request before invoking the callback. 6. The endpoint remains locked up, as the interrupt triggered by hardware setting the RXPKTRDY flag has been handled, but the flag itself remains set. For this scenario to occur, it is only necessary for IRQs to be enabled at some point during the complete callback. This happens with the USB Ethernet gadget, whose rx_complete() callback calls netif_rx(). If called in the task context, netif_rx() disables the bottom halves (BHs). When the BHs are re-enabled, IRQs are also enabled to allow soft IRQs to be processed. The gadget itself is initialized at module load (or at boot if built-in), but the first request is enqueued when the network interface is brought up, triggering rx_complete() in the task context via ioctl(). If a packet arrives while the interface is down, it can prevent the interface from receiving any further packets from the USB host. The situation is quite complicated with many parties involved. This particular issue can be resolved in several possible ways: 1. Ensure that callbacks never enable IRQs. This would be difficult to enforce, as discovering how netif_rx() interacts with interrupts was already quite challenging and u_ether is not the only function driver. Similar "bugs" could be hidden in other drivers as well. 2. Disable MUSB interrupts in musb_g_giveback() before calling the callback and re-enable them afterwars (by calling musb_{dis,en}able_interrupts(), for example). This would ensure that MUSB interrupts are not handled during the callback, even if IRQs are enabled. In fact, it would allow IRQs to be enabled when releasing the lock. However, this feels like an inelegant hack. 3. Modify the interrupt handler to clear the RXPKTRDY flag if the request queue is empty. While this approach also feels like a hack, it wastes CPU time by attempting to handle incoming packets when the software is not ready to process them. 4. Flush the Rx FIFO instead of calling rxstate() in musb_ep_restart(). This ensures that the hardware can receive packets when there is at least one request in the queue. Once IRQs are enabled, the interrupt handler will be able to correctly process the next incoming packet (eventually calling rxstate()). This approach may cause one or two packets to be dropped (two if double buffering is enabled), but this seems to be a minor issue, as packet loss can occur when the software is not yet ready to process them. Additionally, this solution makes the gadget driver compliant with the rule mentioned in the docstring of usb_ep_queue(). There may be additional solutions, but from these four, the last one has been chosen as it seems to be the most appropriate, as it addresses the "bad" behavior of the driver. Fixes: baebdf48c360 ("net: dev: Makes sure netif_rx() can be invoked in any context.") Cc: stable(a)vger.kernel.org Signed-off-by: Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> Link: https://lore.kernel.org/r/4ee1ead4525f78fb5909a8cbf99513ad0082ad21.camel@gm… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/usb/musb/musb_gadget.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c index 051c6da7cf6d..f175cb2c3e7b 100644 --- a/drivers/usb/musb/musb_gadget.c +++ b/drivers/usb/musb/musb_gadget.c @@ -1170,12 +1170,19 @@ struct free_record { */ void musb_ep_restart(struct musb *musb, struct musb_request *req) { + u16 csr; + void __iomem *epio = req->ep->hw_ep->regs; + trace_musb_req_start(req); musb_ep_select(musb->mregs, req->epnum); - if (req->tx) + if (req->tx) { txstate(musb, req); - else - rxstate(musb, req); + } else { + csr = musb_readw(epio, MUSB_RXCSR); + csr |= MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_P_WZC_BITS; + musb_writew(epio, MUSB_RXCSR, csr); + musb_writew(epio, MUSB_RXCSR, csr); + } } static int musb_ep_restart_resume_work(struct musb *musb, void *data) -- 2.34.1

2 1

[PATCH OLK-6.6] sched/numa: fix memory leak due to the overwritten vma->numab_state
by He Yujie 07 Jan '25

07 Jan '25

From: Adrian Huang <ahuang12(a)lenovo.com> mainline inclusion from mainline-v6.13-rc2 commit 5f1b64e9a9b7ee9cfd32c6b2fab796e29bfed075 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPC CVE: CVE-2024-56613 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [Problem Description] When running the hackbench program of LTP, the following memory leak is reported by kmemleak. # /opt/ltp/testcases/bin/hackbench 20 thread 1000 Running with 20*40 (== 800) tasks. # dmesg | grep kmemleak ... kmemleak: 480 new suspected memory leaks (see /sys/kernel/debug/kmemleak) kmemleak: 665 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff888cd8ca2c40 (size 64): comm "hackbench", pid 17142, jiffies 4299780315 hex dump (first 32 bytes): ac 74 49 00 01 00 00 00 4c 84 49 00 01 00 00 00 .tI.....L.I..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc bff18fd4): [<ffffffff81419a89>] __kmalloc_cache_noprof+0x2f9/0x3f0 [<ffffffff8113f715>] task_numa_work+0x725/0xa00 [<ffffffff8110f878>] task_work_run+0x58/0x90 [<ffffffff81ddd9f8>] syscall_exit_to_user_mode+0x1c8/0x1e0 [<ffffffff81dd78d5>] do_syscall_64+0x85/0x150 [<ffffffff81e0012b>] entry_SYSCALL_64_after_hwframe+0x76/0x7e ... This issue can be consistently reproduced on three different servers: * a 448-core server * a 256-core server * a 192-core server [Root Cause] Since multiple threads are created by the hackbench program (along with the command argument 'thread'), a shared vma might be accessed by two or more cores simultaneously. When two or more cores observe that vma->numab_state is NULL at the same time, vma->numab_state will be overwritten. Although current code ensures that only one thread scans the VMAs in a single 'numa_scan_period', there might be a chance for another thread to enter in the next 'numa_scan_period' while we have not gotten till numab_state allocation [1]. Note that the command `/opt/ltp/testcases/bin/hackbench 50 process 1000` cannot the reproduce the issue. It is verified with 200+ test runs. [Solution] Use the cmpxchg atomic operation to ensure that only one thread executes the vma->numab_state assignment. [1] https://lore.kernel.org/lkml/1794be3c-358c-4cdc-a43d-a1f841d91ef7@amd.com/ Link: https://lkml.kernel.org/r/20241113102146.2384-1-ahuang12@lenovo.com Fixes: ef6a22b70f6d ("sched/numa: apply the scan delay to every new vma") Signed-off-by: Adrian Huang <ahuang12(a)lenovo.com> Reported-by: Jiwei Sun <sunjw10(a)lenovo.com> Reviewed-by: Raghavendra K T <raghavendra.kt(a)amd.com> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Ben Segall <bsegall(a)google.com> Cc: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Juri Lelli <juri.lelli(a)redhat.com> Cc: Mel Gorman <mgorman(a)suse.de> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: Valentin Schneider <vschneid(a)redhat.com> Cc: Vincent Guittot <vincent.guittot(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: kernel/sched/fair.c [ Context conflict due to not merge 84db47ca7146 ("sched/numa: Fix mm numa_scan_seq based unconditional scan") ] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/sched/fair.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index be1d35549144..7df2b07629c0 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -3452,10 +3452,16 @@ static void task_numa_work(struct callback_head *work) /* Initialise new per-VMA NUMAB state. */ if (!vma->numab_state) { - vma->numab_state = kzalloc(sizeof(struct vma_numab_state), - GFP_KERNEL); - if (!vma->numab_state) + struct vma_numab_state *ptr; + + ptr = kzalloc(sizeof(*ptr), GFP_KERNEL); + if (!ptr) + continue; + + if (cmpxchg(&vma->numab_state, NULL, ptr)) { + kfree(ptr); continue; + } vma->numab_state->next_scan = now + msecs_to_jiffies(sysctl_numa_balancing_scan_delay); -- 2.34.1

2 1

[PATCH OLK-6.6] Add Huawei Intelligent Network Card Driver:hibifur
by Zhang Zhenghao 07 Jan '25

07 Jan '25

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBCO6Q CVE: NA --------------------------------- The BIFUR drive supports the following features: Supports Huawei's self-developed SP670 series network cards; Supports users to allocate specific PF to derive VF for single function stream bifurcation; Signed-off-by: Zhang Zhenghao <zhangzhenghao9(a)huawei.com> --- MAINTAINERS | 7 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/hibifur/Kconfig | 13 + drivers/net/ethernet/huawei/hibifur/Makefile | 26 + .../ethernet/huawei/hibifur/bifur_common.h | 57 ++ .../net/ethernet/huawei/hibifur/bifur_event.c | 381 +++++++++ .../net/ethernet/huawei/hibifur/bifur_event.h | 26 + .../net/ethernet/huawei/hibifur/bifur_main.c | 791 ++++++++++++++++++ .../net/ethernet/huawei/hibifur/bifur_main.h | 57 ++ .../net/ethernet/huawei/hibifur/bifur_pfile.c | 545 ++++++++++++ .../net/ethernet/huawei/hibifur/bifur_pfile.h | 75 ++ .../ethernet/huawei/hibifur/bifur_vf_mgr.c | 263 ++++++ .../ethernet/huawei/hibifur/bifur_vf_mgr.h | 58 ++ .../huawei/hibifur/include/nic/nic_mpu_cmd.h | 183 ++++ .../huawei/hibifur/include/nic/nic_npu_cmd.h | 29 + .../hibifur/include/nic/nic_npu_cmd_defs.h | 133 +++ .../net/ethernet/huawei/hinic3/hinic3_crm.h | 14 + .../net/ethernet/huawei/hinic3/hinic3_main.c | 18 +- .../huawei/hinic3/hinic3_mgmt_interface.h | 9 + .../net/ethernet/huawei/hinic3/hinic3_mt.h | 7 +- .../huawei/hinic3/hw/hinic3_dev_mgmt.c | 3 + .../huawei/hinic3/hw/hinic3_dev_mgmt.h | 2 + .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 14 + .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 2 + .../ethernet/huawei/hinic3/hw/hinic3_lld.c | 2 +- .../huawei/hinic3/hw/hinic3_nictool.c | 22 +- .../include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h | 2 + 30 files changed, 2724 insertions(+), 19 deletions(-) create mode 100644 drivers/net/ethernet/huawei/hibifur/Kconfig create mode 100644 drivers/net/ethernet/huawei/hibifur/Makefile create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_common.h create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_event.c create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_event.h create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_main.c create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_main.h create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_pfile.c create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_pfile.h create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c create mode 100644 drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.h create mode 100644 drivers/net/ethernet/huawei/hibifur/include/nic/nic_mpu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd.h create mode 100644 drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd_defs.h diff --git a/MAINTAINERS b/MAINTAINERS index 219b3d11e..b22778025 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -9690,6 +9690,13 @@ F: drivers/net/ethernet/huawei/hinic3/cqm/ F: drivers/net/ethernet/huawei/hinic3/hw/ F: drivers/net/ethernet/huawei/hinic3/include/ +HUAWEI BIFUR DRIVER +M: Xiaoping zheng <zhengxiaoping5(a)huawei.com> +L: netdev(a)vger.kernel.org +S: Supported +F: drivers/net/ethernet/huawei/hibifur/ +F: drivers/net/ethernet/huawei/hibifur/include/ + HUAWEI PVRDMA DRIVER M: Chengbo Gu <guchengbo(a)huawei.com> R: Xiaoping zheng <zhengxiaoping5(a)huawei.com> diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index fc6053a50..d4a573c8d 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2940,6 +2940,7 @@ CONFIG_NET_VENDOR_HUAWEI=y CONFIG_HINIC=m CONFIG_HINIC3=m CONFIG_BMA=m +CONFIG_HIBIFUR=m # CONFIG_NET_VENDOR_I825XX is not set CONFIG_NET_VENDOR_INTEL=y # CONFIG_E100 is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index adfaef0cb..bcb212458 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2933,6 +2933,7 @@ CONFIG_NET_VENDOR_HUAWEI=y CONFIG_HINIC=m CONFIG_HINIC3=m CONFIG_BMA=m +CONFIG_HIBIFUR=m # CONFIG_NET_VENDOR_I825XX is not set CONFIG_NET_VENDOR_INTEL=y # CONFIG_E100 is not set diff --git a/drivers/net/ethernet/huawei/Kconfig b/drivers/net/ethernet/huawei/Kconfig index 0df9544dc..fc22693e4 100644 --- a/drivers/net/ethernet/huawei/Kconfig +++ b/drivers/net/ethernet/huawei/Kconfig @@ -18,5 +18,6 @@ if NET_VENDOR_HUAWEI source "drivers/net/ethernet/huawei/hinic/Kconfig" source "drivers/net/ethernet/huawei/hinic3/Kconfig" source "drivers/net/ethernet/huawei/bma/Kconfig" +source "drivers/net/ethernet/huawei/hibifur/Kconfig" endif # NET_VENDOR_HUAWEI diff --git a/drivers/net/ethernet/huawei/Makefile b/drivers/net/ethernet/huawei/Makefile index d88e8fd77..97ee28af8 100644 --- a/drivers/net/ethernet/huawei/Makefile +++ b/drivers/net/ethernet/huawei/Makefile @@ -6,3 +6,4 @@ obj-$(CONFIG_HINIC) += hinic/ obj-$(CONFIG_HINIC3) += hinic3/ obj-$(CONFIG_BMA) += bma/ +obj-$(CONFIG_HIBIFUR) += hibifur/ diff --git a/drivers/net/ethernet/huawei/hibifur/Kconfig b/drivers/net/ethernet/huawei/hibifur/Kconfig new file mode 100644 index 000000000..99d7ecec5 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/Kconfig @@ -0,0 +1,13 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# Huawei driver configuration +# + +config HIBIFUR + tristate "Huawei Intelligent Network Interface Card Bifur Driver" + depends on HINIC3 && PCI_MSI && NUMA && PCI_IOV && DCB && (X86 || ARM64) + help + This driver supports HIBIFUR PCIE Ethernet cards. + To compile this driver as part of the kernel, choose Y here. + If unsure, choose N. + The default is N. diff --git a/drivers/net/ethernet/huawei/hibifur/Makefile b/drivers/net/ethernet/huawei/hibifur/Makefile new file mode 100644 index 000000000..a4fd682e1 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/Makefile @@ -0,0 +1,26 @@ +EXPORT_SYMBOL := true + +KBUILD_EXTRA_SYMBOLS += $(srctree)/drivers/net/ethernet/huawei/hinic3/Module.symvers + +SYS_TIME=$(shell date +%Y-%m-%d_%H:%M:%S) +ccflags-y += -D __TIME_STR__=\"$(SYS_TIME)\" + +ccflags-y += -I$(srctree)/include/linux +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/public +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/cqm +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/bond +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include/mpu +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/hw +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/bond +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hibifur/include +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hibifur/include/nic +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3 +ccflags-y += -I$(srctree)/drivers/net/ethernet/huawei/hinic3/include + +obj-$(CONFIG_HIBIFUR) += hibifur3.o + +hibifur3-objs := bifur_main.o \ + bifur_vf_mgr.o \ + bifur_pfile.o \ + bifur_event.o diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_common.h b/drivers/net/ethernet/huawei/hibifur/bifur_common.h new file mode 100644 index 000000000..145db9cd3 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_common.h @@ -0,0 +1,57 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#ifndef BIFUR_COMMON_H__ +#define BIFUR_COMMON_H__ + +#include <linux/module.h> +#include <linux/init.h> +#include <linux/etherdevice.h> +#include <linux/proc_fs.h> +#include <linux/uaccess.h> +#include <linux/types.h> +#include <linux/cdev.h> +#include <linux/fs.h> +#include <linux/mm_types.h> +#include <linux/kdev_t.h> +#include <linux/netdevice.h> +#include <linux/notifier.h> +#include <net/net_namespace.h> +#include "asm-generic/int-ll64.h" +#include "linux/pci.h" + +#include "ossl_knl_linux.h" +#include "hinic3_nic_dev.h" +#include "ossl_knl.h" +#include "hinic3_nic_cfg.h" +#include "hinic3_srv_nic.h" + +#define BIFUR_VF_NUM 40 +#define BIFUR_FILE_PATH_SIZE 50 +#define BIFUR_RESOURCE_PF_SSID 0x5a1 + +#define BIFUR_ENABLED 1 +#define BIFUR_DISABLED 0 + +#define PCI_DBDF(dom, bus, dev, func) \ + ((((u32)(dom) << 16) | ((u32)(bus) << 8) | ((u32)(dev) << 3) | ((u32)(func) & 0x7))) +#define PCI_DBDF_DOM(dbdf) (((dbdf) >> 16) & 0xFFFF) +#define PCI_DBDF_BUS(dbdf) (((dbdf) >> 8) & 0xFF) +#define PCI_DBDF_DEVID(dbdf) (((dbdf) >> 3) & 0x1F) +#define PCI_DBDF_FUNCTION(dbdf) ((dbdf) & 0x7) +#define PCI_DBDF_DEVFN(dbdf) ((dbdf) & 0xFF) + +struct bifur_cdev { + struct cdev cdev; + dev_t cdev_id; + struct proc_dir_entry *proc_dir; +}; + +#define BIFUR_DEV_INFO(lld_dev, fmt, arg...) dev_info(&((lld_dev)->pdev->dev), "[BIFUR]" fmt, ##arg) + +#define BIFUR_DEV_WARN(lld_dev, fmt, arg...) dev_warn(&((lld_dev)->pdev->dev), "[BIFUR]" fmt, ##arg) + +#define BIFUR_DEV_ERR(lld_dev, fmt, arg...) dev_err(&((lld_dev)->pdev->dev), "[BIFUR]" fmt, ##arg) +#endif diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_event.c b/drivers/net/ethernet/huawei/hibifur/bifur_event.c new file mode 100644 index 000000000..397ee107f --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_event.c @@ -0,0 +1,381 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ +#include <net/bonding.h> +#include "hinic3_srv_nic.h" +#include "hinic3_lld.h" +#include "hinic3_bond.h" +#include "hinic3_mt.h" +#include "nic_mpu_cmd.h" +#include "hinic3_hw.h" +#include "hinic3_mgmt_interface.h" + +#include "bifur_common.h" +#include "bifur_vf_mgr.h" +#include "bifur_main.h" +#include "bifur_event.h" + +static int bifur_set_vf_bond_enable(struct bifur_lld_dev *bifur_dev, u16 vf_id, u8 bond_bifur_en) +{ + int err; + struct hinic3_bond_mask_cmd bond_info = { 0 }; + u16 out_size = sizeof(struct hinic3_bond_mask_cmd); + + bond_info.msg_head.status = 1; + bond_info.func_id = vf_id; + bond_info.bond_en = bond_bifur_en; + + err = hinic3_msg_to_mgmt_sync(bifur_dev->lld_dev->hwdev, HINIC3_MOD_L2NIC, + HINIC3_NIC_CMD_SET_BOND_MASK, &bond_info, + sizeof(bond_info), &bond_info, + &out_size, 0, HINIC3_CHANNEL_DEFAULT); + if (bond_info.msg_head.status != 0 || err != 0 || out_size == 0) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, + "Failed to set VF forward id config. err(%d), sts(%u), out_size(%u)\n", + err, bond_info.msg_head.status, out_size); + return -EIO; + } + return 0; +} + +void bifur_set_bond_enable(u8 bond_bifur_en) +{ + int i, err; + struct bifur_vf_info *vf_info = NULL; + struct bifur_vf_mgr *vf_mgr = NULL; + struct bifur_lld_dev *bifur_src_dev = bifur_get_resource_dev(); + + if (!bifur_src_dev) { + pr_err("Bifur source pf didn't inited.\n"); + return; + } + vf_mgr = bifur_src_dev->vf_mgr; + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = &vf_mgr->vf_info[i]; + err = bifur_set_vf_bond_enable(bifur_src_dev, vf_info->glb_func_id, bond_bifur_en); + if (err != 0) { + BIFUR_DEV_WARN(bifur_src_dev->lld_dev, + "Failed to set VF(0x%x) bond enable(%u).\n", + vf_info->glb_func_id, bond_bifur_en); + } + } + + mutex_unlock(&vf_mgr->vf_mgr_mutex); + bifur_dev_put(bifur_src_dev); +} + +static void bifur_attach_bond_work(struct work_struct *_work) +{ + int ret; + u16 bond_id; + struct bifur_bond_work *work = container_of(_work, struct bifur_bond_work, work); + struct bifur_adapter *adp = bifur_get_adp(); + + if (!adp) { + pr_err("Bifur driver init failed.\n"); + kfree(work); + return; + } + + ret = hinic3_bond_attach(work->name, HINIC3_BOND_USER_OVS, &bond_id); + if (ret) { + pr_info("%s: hinic3 bond attach failed, ret(%d).\n", __func__, ret); + kfree(work); + return; + } + + bifur_dev_list_lock(); + adp->bond_id = bond_id; + adp->bond_bifur_enabled = BIFUR_ENABLED; + bifur_dev_list_unlock(); + + pr_info("bifur_attach: %s: bond_name(%s), bond_id(%u)\n", __func__, work->name, bond_id); + bifur_set_bond_enable(BIFUR_ENABLED); + + kfree(work); +} + +static void bifur_queue_bond_work(struct bifur_adapter *adp, struct net_device *upper_netdev) +{ + struct bifur_bond_work *work; + struct bonding *bond = netdev_priv(upper_netdev); + + if (!bond) { + pr_info("%s: (name:%s) has no bond dev.\n", __func__, upper_netdev->name); + return; + } + + work = kzalloc(sizeof(*work), GFP_KERNEL); + if (!work) + return; + + (void)strscpy(work->name, upper_netdev->name, strlen(upper_netdev->name)); + INIT_WORK(&work->work, bifur_attach_bond_work); + (void)queue_work(adp->event_workq, &work->work); +} + +static void bifur_detach_nic_bond_work(struct work_struct *work) +{ + struct bifur_bond_work *detach_work = container_of(work, struct bifur_bond_work, work); + struct bifur_adapter *adp = bifur_get_adp(); + u16 bond_id; + + if (!adp) { + pr_err("Bifur driver init failed.\n"); + kfree(detach_work); + return; + } + + bifur_dev_list_lock(); + bond_id = adp->bond_id; + adp->bond_bifur_enabled = BIFUR_DISABLED; + bifur_dev_list_unlock(); + + hinic3_bond_detach(bond_id, HINIC3_BOND_USER_OVS); + bifur_set_bond_enable(BIFUR_DISABLED); + kfree(detach_work); +} + +static void bifur_queue_detach_bond_work(struct bifur_adapter *adp) +{ + struct bifur_bond_work *work; + + work = kzalloc(sizeof(*work), GFP_KERNEL); + if (!work) + return; + + INIT_WORK(&work->work, bifur_detach_nic_bond_work); + + (void)queue_work(adp->event_workq, &work->work); +} + +static bool bifur_can_do_bond(struct bonding *bond) +{ + bool ret = false; + int slave_cnt = 0; + struct slave *slave = NULL; + struct list_head *iter = NULL; + struct hinic3_lld_dev *lld_dev = NULL; + struct hinic3_lld_dev *ppf_dev = NULL; + + if (!bond) + return ret; + + rcu_read_lock(); + bond_for_each_slave_rcu(bond, slave, iter) { + lld_dev = hinic3_get_lld_dev_by_netdev(slave->dev); + if (!lld_dev) + goto out; + + if (!hinic3_support_bifur(lld_dev->hwdev, NULL)) + goto out; + + if (!ppf_dev) { + ppf_dev = hinic3_get_ppf_lld_dev(lld_dev); + if (!ppf_dev) + goto out; + } + + slave_cnt++; + pr_info("%s:can do bond? slave_cnt(%d), slave_name(%s)", __func__, + slave_cnt, slave->dev->name); + } + + ret = (slave_cnt == BIFUR_BOND_2_FUNC_NUM); +out: + rcu_read_unlock(); + return ret; +} + +static int bifur_bond_netdev_event(struct bifur_adapter *adp, + struct netdev_notifier_changeupper_info *info, + struct net_device *net_dev) +{ + struct bonding *bond = NULL; + struct net_device *upper_netdev = info->upper_dev; + + if (net_eq(dev_net(net_dev), &init_net) == 0) + return NOTIFY_DONE; + + if (!upper_netdev) + return NOTIFY_DONE; + + if (!netif_is_lag_master(upper_netdev)) + return NOTIFY_DONE; + + bond = netdev_priv(upper_netdev); + if (!bifur_can_do_bond(bond)) { + bifur_queue_detach_bond_work(adp); + pr_info("%s: (name:%s) has no bond dev.\n", __func__, upper_netdev->name); + return NOTIFY_DONE; + } + + bifur_queue_bond_work(adp, upper_netdev); + + return NOTIFY_DONE; +} + +int bifur_bond_init(void) +{ + int ret = 0; + struct net_device *upper_netdev; + struct bifur_adapter *adp = bifur_get_adp(); + + if (!adp) { + pr_err("Bifur driver init failed.\n"); + return -EINVAL; + } + + rtnl_lock(); + for_each_netdev(&init_net, upper_netdev) { + if (netif_is_bond_master(upper_netdev) && + bifur_can_do_bond(netdev_priv(upper_netdev))) { + bifur_queue_bond_work(adp, upper_netdev); + break; + } + } + rtnl_unlock(); + + pr_info("%s: bond init exit.\n", __func__); + return ret; +} + +void bifur_bond_exit(void) +{ + struct bifur_adapter *adp = bifur_get_adp(); + + if (!adp) { + pr_err("Bifur driver init failed.\n"); + return; + } + bifur_queue_detach_bond_work(adp); +} + +void bifur_notify_vf_link_status(struct hinic3_lld_dev *lld_dev, u8 port_id, u16 vf_id, + u8 link_status) +{ + struct mag_cmd_get_link_status link; + u16 out_size = sizeof(link); + int err; + + (void)memset(&link, 0, sizeof(link)); + link.status = link_status; + link.port_id = port_id; + + err = hinic3_mbox_to_vf_no_ack(lld_dev->hwdev, vf_id, HINIC3_MOD_HILINK, + MAG_CMD_GET_LINK_STATUS, &link, sizeof(link), + &link, &out_size, HINIC3_CHANNEL_NIC); + if (err == MBOX_ERRCODE_UNKNOWN_DES_FUNC) { + pr_err("Vf%d not initialized, disconnect it\n", HW_VF_ID_TO_OS(vf_id)); + return; + } + + if (err || !out_size || link.head.status) { + pr_err("Send link change event to VF %d failed, err: %d, status: 0x%x, out_size: 0x%x\n", + HW_VF_ID_TO_OS(vf_id), err, link.head.status, out_size); + } +} + +void bifur_notify_all_vfs_link_changed(struct hinic3_lld_dev *lld_dev, u32 dbdf, u8 link_status) +{ + struct bifur_lld_dev *bifur_src_dev = NULL; + struct bifur_vf_mgr *vf_mgr = NULL; + struct bifur_vf_info *vf_info = NULL; + u16 i; + u8 port_id; + + bifur_src_dev = bifur_get_resource_dev(); + if (!bifur_src_dev) + return; + + vf_mgr = bifur_src_dev->vf_mgr; + port_id = hinic3_physical_port_id(lld_dev->hwdev); + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = &vf_mgr->vf_info[i]; + if (vf_info->pf_dbdf == dbdf && vf_info->in_use) + bifur_notify_vf_link_status(bifur_src_dev->lld_dev, port_id, + OS_VF_ID_TO_HW(i), link_status); + } + mutex_unlock(&vf_mgr->vf_mgr_mutex); + + bifur_dev_put(bifur_src_dev); +} + +void bifur_netdev_event(struct work_struct *work) +{ + struct bifur_lld_dev *bifur_dev = container_of(work, struct bifur_lld_dev, netdev_link); + + bifur_notify_all_vfs_link_changed(bifur_dev->lld_dev, bifur_dev->dbdf, + bifur_dev->link_status); + + bifur_dev_put(bifur_dev); +} + +static int bifur_net_link_event(struct bifur_adapter *adp, unsigned long event, + struct net_device *dev) +{ + u32 dbdf; + struct pci_dev *pcidev = NULL; + struct bifur_lld_dev *bifur_dev = NULL; + struct hinic3_nic_dev *nic_dev = NULL; + + nic_dev = netdev_priv(dev); + pcidev = nic_dev->pdev; + dbdf = PCI_DBDF(pci_domain_nr(pcidev->bus), pcidev->bus->number, + PCI_DBDF_DEVID(pcidev->devfn), PCI_DBDF_FUNCTION(pcidev->devfn)); + + bifur_dev = bifur_get_shared_dev_by_dbdf(dbdf); + if (!bifur_dev) + return NOTIFY_DONE; + + bifur_dev->link_status = (event == NETDEV_UP ? 1 : 0); + (void)queue_work(adp->event_workq, &bifur_dev->netdev_link); + return NOTIFY_OK; +} + +int bifur_net_event_callback(struct notifier_block *nb, unsigned long event, void *ptr) +{ + struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct bifur_adapter *adp = bifur_get_adp(); + + if (unlikely(!dev)) { + pr_err("bifur notify dev null\n"); + return NOTIFY_DONE; + } + + /* only self-developed NICs can be processed */ + if (!hinic3_get_lld_dev_by_netdev(dev)) + return NOTIFY_DONE; + + switch (event) { + case NETDEV_UP: + case NETDEV_DOWN: + return bifur_net_link_event(adp, event, dev); + case NETDEV_CHANGEUPPER: + return bifur_bond_netdev_event(adp, (struct netdev_notifier_changeupper_info *)ptr, + dev); + default: + break; + } + + return NOTIFY_OK; +} + +static struct notifier_block g_bifur_event_nb = { + .notifier_call = bifur_net_event_callback +}; + +int bifur_register_net_event(void) +{ + return register_netdevice_notifier(&g_bifur_event_nb); +} + +void bifur_unregister_net_event(void) +{ + (void)unregister_netdevice_notifier(&g_bifur_event_nb); +} diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_event.h b/drivers/net/ethernet/huawei/hibifur/bifur_event.h new file mode 100644 index 000000000..b9068a10f --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_event.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#ifndef BIFUR_EVENT_H__ +#define BIFUR_EVENT_H__ +#include <linux/workqueue.h> +#include <linux/notifier.h> +#include <linux/if.h> + +#define BIFUR_BOND_2_FUNC_NUM 2 + +struct bifur_bond_work { + char name[IFNAMSIZ]; + struct work_struct work; +}; + +void bifur_set_bond_enable(u8 bond_bifur_en); +int bifur_bond_init(void); +void bifur_bond_exit(void); +int bifur_register_net_event(void); +void bifur_unregister_net_event(void); +void bifur_netdev_event(struct work_struct *work); + +#endif diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_main.c b/drivers/net/ethernet/huawei/hibifur/bifur_main.c new file mode 100644 index 000000000..287ef2268 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_main.c @@ -0,0 +1,791 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +/* sdk include */ +#include "hinic3_crm.h" +#include "hinic3_hw.h" +#include "hinic3_cqm.h" +#include "hinic3_lld.h" +#include "hinic3_mt.h" + +#include "bifur_common.h" +#include "bifur_vf_mgr.h" +#include "bifur_pfile.h" +#include "bifur_event.h" +#include "bifur_main.h" +#define BIFUR_DRV_DESC "BIFUR Offload Driver" +#define BIFUR_DRV_VERSION "" + +#define BIFUR_WAIT_TIMES 1000 +#define BIFUR_REMOVE_TIMESTEP 10 +#define BIFUR_KWRITE_BUF_SIZE 20 +#define BIFUR_DPDK_KDRIVER_TYPE 3 + +#define BIFUR_SET_ENABLE 0xc0 +#define BIFUR_GET_ENABLE 0xc1 + +static char *g_bifur_dpdk_kdriver = "vfio-pci"; +module_param(g_bifur_dpdk_kdriver, charp, 0644); +MODULE_PARM_DESC(g_bifur_dpdk_kdriver, + "for dpdk kernel driver module (default:\"igb_uio\", options:\"vfio-pci\", \"uio_pci_generic\")"); +static const char *g_bifur_dpdk_kdriver_all[BIFUR_DPDK_KDRIVER_TYPE] = { + "igb_uio", + "vfio-pci", + "uio_pci_generic" +}; + +/* bifur global manager struct */ +static struct bifur_adapter *g_bifur_adapter; + +static void bifur_destroy_dev(struct bifur_lld_dev *bifur_dev); +static void wait_bifur_dev_unused(struct bifur_lld_dev *bifur_dev); + +struct bifur_adapter *bifur_get_adp(void) +{ + return g_bifur_adapter; +} + +void bifur_dev_hold(struct bifur_lld_dev *bifur_dev) +{ + atomic_inc(&bifur_dev->bifur_dev.bifur_dev_ref); +} + +void bifur_dev_put(struct bifur_lld_dev *bifur_dev) +{ + atomic_dec(&bifur_dev->bifur_dev.bifur_dev_ref); +} + +void bifur_dev_list_lock(void) +{ + mutex_lock(&g_bifur_adapter->bifur_dev_mutex); +} + +void bifur_dev_list_unlock(void) +{ + mutex_unlock(&g_bifur_adapter->bifur_dev_mutex); +} + +static int bifur_alloc_adapter(void) +{ + /* alloc driver global adapter struct */ + if (!g_bifur_adapter) { + g_bifur_adapter = kzalloc(sizeof(*g_bifur_adapter), GFP_KERNEL); + if (!g_bifur_adapter) + return -ENOMEM; + } + + /* init global adapter */ + INIT_LIST_HEAD(&g_bifur_adapter->lld_dev_head); + mutex_init(&g_bifur_adapter->bifur_dev_mutex); + + g_bifur_adapter->event_workq = create_singlethread_workqueue("bifur_eventq"); + if (!g_bifur_adapter->event_workq) { + kfree(g_bifur_adapter); + g_bifur_adapter = NULL; + pr_err("Create bifur event_workq fail"); + return -ENOMEM; + } + + pr_info("Alloc bifur adapter success\n"); + return 0; +} + +static void bifur_free_adapter(void) +{ + destroy_workqueue(g_bifur_adapter->event_workq); + + kfree(g_bifur_adapter); + g_bifur_adapter = NULL; + pr_info("Free adapter success\n"); +} + +static bool bifur_check_dpdk_kdriver(void) +{ + bool is_valid_driver = false; + int i; + + for (i = 0; i < BIFUR_DPDK_KDRIVER_TYPE; ++i) { + if (!strcmp(g_bifur_dpdk_kdriver, g_bifur_dpdk_kdriver_all[i])) + is_valid_driver = true; + } + + return is_valid_driver; +} + +static int bifur_open_and_write_file(const char *file_path, const char *buf, int open_flags, + umode_t open_mode) +{ + struct file *fp = NULL; + loff_t f_pos = 0; + int err = 0; + + fp = filp_open(file_path, open_flags, open_mode); + if (IS_ERR(fp)) { + pr_err("Open %s failed, err %ld\n", file_path, PTR_ERR(fp)); + return -ENOENT; + } + + err = kernel_write(fp, buf, strlen(buf), &f_pos); + if (err < 0) { + pr_err("Write %s to file %s failed, err %d\n", buf, file_path, err); + (void)filp_close(fp, NULL); + return err; + } + + (void)filp_close(fp, NULL); + + return 0; +} + +static int bifur_enable_disable_vfs(struct bifur_lld_dev *bifur_dev, u16 num_vfs) +{ + int err = 0; + char file_path[BIFUR_FILE_PATH_SIZE] = {}; + char buf[BIFUR_KWRITE_BUF_SIZE] = {}; + struct pci_dev *pdev = bifur_dev->lld_dev->pdev; + + /* write vf num to /sys/bus/pci/devices/%s/sriov_numvfs */ + err = snprintf(file_path, BIFUR_FILE_PATH_SIZE, + "/sys/bus/pci/devices/%s/sriov_numvfs", pci_name(pdev)); + if (err == -1) { + pr_err("Snprintf bifur pci dev sriov_numvfs file path, err %d!\n", err); + return err; + } + + err = snprintf(buf, BIFUR_KWRITE_BUF_SIZE, "%u", num_vfs); + if (err == -1) { + pr_err("Snprintf bifur numvfs str, err %d!\n", err); + return err; + } + + err = bifur_open_and_write_file(file_path, buf, O_WRONLY | O_TRUNC, 0); + if (err != 0) { + pr_info("Enable vf of pf failed, dbdf:0x%s, sriov_nums:%u\n", + pci_name(pdev), num_vfs); + return err; + } + + pr_info("Enable vf of pf success, dbdf:0x%s, sriov_nums:%u\n", pci_name(pdev), num_vfs); + + return 0; +} + +int bifur_enable_disable_vf_all(bool enable) +{ + int err = 0; + int num_vfs = enable ? BIFUR_VF_NUM : 0; + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->pf_type != BIFUR_RESOURCE_PF) + continue; + + bifur_dev_hold(bifur_dev); + err = bifur_enable_disable_vfs(bifur_dev, num_vfs); + bifur_dev_put(bifur_dev); + if (err) + return err; + } + + return 0; +} + +static int bifur_one_unbind_driver(u32 dbdf, const char *driver) +{ + int err = 0; + char file_path[BIFUR_FILE_PATH_SIZE] = {}; + char buf[BIFUR_KWRITE_BUF_SIZE] = {}; + + /* write pci dbdf to /sys/bus/pci/drivers/%s/unbind */ + err = snprintf(file_path, BIFUR_FILE_PATH_SIZE, + "/sys/bus/pci/drivers/%s/unbind", driver); + if (err == -1) { + pr_err("Snprintf bifur driver unbind file path, err %d!\n", err); + return err; + } + + err = snprintf(buf, BIFUR_KWRITE_BUF_SIZE, "%.4x:%.2x:%.2x.%x", + PCI_DBDF_DOM(dbdf), PCI_DBDF_BUS(dbdf), + PCI_DBDF_DEVID(dbdf), PCI_DBDF_FUNCTION(dbdf)); + if (err == -1) { + pr_err("Snprintf bifur pci dev dbdf str, err %d!\n", err); + return err; + } + + err = bifur_open_and_write_file(file_path, buf, O_WRONLY | O_APPEND, 0); + if (err != 0) { + pr_info("Unbind vf from driver %s failed\n", driver); + return err; + } + + pr_info("Unbind vf from driver %s success\n", driver); + + return 0; +} + +static int bifur_one_bind_dpdk(u32 dbdf) +{ + int err = 0; + char file_path[BIFUR_FILE_PATH_SIZE] = {}; + char buf[BIFUR_KWRITE_BUF_SIZE] = {}; + const char *kernel_driver = "hisdk3"; + + bifur_one_unbind_driver(dbdf, kernel_driver); + + err = snprintf(file_path, BIFUR_FILE_PATH_SIZE, + "/sys/bus/pci/devices/%.4x:%.2x:%.2x.%x/driver_override", + PCI_DBDF_DOM(dbdf), PCI_DBDF_BUS(dbdf), + PCI_DBDF_DEVID(dbdf), PCI_DBDF_FUNCTION(dbdf)); + if (err == -1) { + pr_err("Snprintf bifur pci dev driver_override file path, err %d!\n", err); + return err; + } + + (void)strscpy(buf, g_bifur_dpdk_kdriver, sizeof(buf)); + + err = bifur_open_and_write_file(file_path, buf, O_WRONLY | O_TRUNC, 0); + if (err != 0) + return err; + + err = snprintf(file_path, BIFUR_FILE_PATH_SIZE, + "/sys/bus/pci/drivers/%s/bind", g_bifur_dpdk_kdriver); + if (err == -1) { + pr_err("Snprintf bifur dpdk driver bind file path, err %d!\n", err); + return err; + } + + err = snprintf(buf, BIFUR_KWRITE_BUF_SIZE, "%.4x:%.2x:%.2x.%x", + PCI_DBDF_DOM(dbdf), PCI_DBDF_BUS(dbdf), + PCI_DBDF_DEVID(dbdf), PCI_DBDF_FUNCTION(dbdf)); + if (err == -1) { + pr_err("Snprintf bifur pci dev dbdf str, err %d!\n", err); + return err; + } + + err = bifur_open_and_write_file(file_path, buf, O_WRONLY | O_APPEND, 0); + if (err != 0) + return err; + + return 0; +} + +static int bifur_bind_unbind_dpdk(struct bifur_lld_dev *bifur_dev, bool enable) +{ + int err = 0; + u32 dbdf = 0; + int i; + + for (i = 0; i < bifur_dev->vf_mgr->vf_sum; ++i) { + dbdf = bifur_dev->vf_mgr->vf_info[i].vf_dbdf; + if (enable) + err = bifur_one_bind_dpdk(dbdf); + else + err = bifur_one_unbind_driver(dbdf, g_bifur_dpdk_kdriver); + if (err) { + pr_err("Bind/Unbind failed for vf %08x\n", dbdf); + return err; + } + } + + return 0; +} + +static int bifur_bind_unbind_dpdk_all(bool enable) +{ + int err = 0; + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->pf_type != BIFUR_RESOURCE_PF) + continue; + + bifur_dev_hold(bifur_dev); + err = bifur_bind_unbind_dpdk(bifur_dev, enable); + bifur_dev_put(bifur_dev); + if (err) + return err; + } + + return 0; +} + +static int bifur_probe_vf(struct hinic3_lld_dev *lld_dev) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_vf_mgr *vf_mgr = NULL; + struct bifur_vf_info *vf_info = NULL; + u32 vf_dbdf; + int ret; + + bifur_dev = bifur_get_resource_dev(); + if (!bifur_dev) + return -ENODEV; + + vf_mgr = bifur_dev->vf_mgr; + vf_dbdf = PCI_DBDF(pci_domain_nr(lld_dev->pdev->bus), lld_dev->pdev->bus->number, + PCI_DBDF_DEVID(lld_dev->pdev->devfn), + PCI_DBDF_FUNCTION(lld_dev->pdev->devfn)); + if (vf_mgr->vf_sum >= BIFUR_VF_NUM) { + bifur_dev_put(bifur_dev); + BIFUR_DEV_ERR(lld_dev, "current_vf_sum(%u) >= BIFUR_VF_NUM(%u)\n", + vf_mgr->vf_sum, BIFUR_VF_NUM); + return -ENOMEM; + } + + mutex_lock(&bifur_dev->vf_mgr->vf_mgr_mutex); + vf_info = &vf_mgr->vf_info[vf_mgr->vf_sum]; + vf_mgr->vf_sum++; + vf_info->vf_dbdf = vf_dbdf; + vf_info->glb_func_id = hinic3_global_func_id(lld_dev->hwdev); + vf_info->in_use = 0; + vf_info->vf_mgr = vf_mgr; + ret = snprintf(vf_info->name, (size_t)BIFURNAMSIZ, "bifur%04x", vf_dbdf); + if (ret < 0) { + mutex_unlock(&bifur_dev->vf_mgr->vf_mgr_mutex); + BIFUR_DEV_ERR(lld_dev, "set name failed, ret(%d)\n", ret); + bifur_dev_put(bifur_dev); + return ret; + } + bifur_vf_cdev_init(vf_info); + mutex_unlock(&bifur_dev->vf_mgr->vf_mgr_mutex); + + bifur_dev_put(bifur_dev); + + return 0; +} + +static int bifur_remove_vf(struct bifur_lld_dev *bifur_dev) +{ + struct bifur_vf_info *vf_info = NULL; + struct bifur_vf_mgr *vf_mgr = NULL; + int i; + + if (!bifur_dev) + return -ENODEV; + vf_mgr = bifur_dev->vf_mgr; + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = &vf_mgr->vf_info[i]; + bifur_vf_cdev_uninit(vf_info); + } + mutex_unlock(&vf_mgr->vf_mgr_mutex); + return 0; +} + +static int bifur_probe(struct hinic3_lld_dev *lld_dev, void **uld_dev, char *uld_dev_name) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + int err = 0; + + if (!uld_dev || !lld_dev || !lld_dev->pdev || !lld_dev->hwdev) { + pr_err("Bifur probe failed for invalid param, lld_dev or uld_dev\n"); + return -EINVAL; + } + + if (hinic3_func_type(lld_dev->hwdev) == TYPE_VF) { + *uld_dev = NULL; + if (hinic3_support_bifur(lld_dev->hwdev, NULL)) { + err = bifur_probe_vf(lld_dev); + return err; + } + return 0; + } + + bifur_dev = kzalloc(sizeof(*bifur_dev), GFP_KERNEL); + if (!bifur_dev) { + BIFUR_DEV_ERR(lld_dev, "Alloc bifur lld dev failed\n"); + return -ENOMEM; + } + + /* init bifur dev */ + bifur_dev->lld_dev = lld_dev; + + if (hinic3_support_bifur(lld_dev->hwdev, NULL)) { + if (lld_dev->pdev->subsystem_device == BIFUR_RESOURCE_PF_SSID) { + bifur_dev->pf_type = BIFUR_RESOURCE_PF; + err = bifur_alloc_vf_mgr(bifur_dev); + if (err) { + kfree(bifur_dev); + bifur_dev = NULL; + return err; + } + } else { + bifur_dev->pf_type = BIFUR_SHARED_PF; + } + } else { + bifur_dev->pf_type = BIFUR_EXCLUSIVE_PF; + } + pr_info("bifur_dev->pf_type: %d\n", bifur_dev->pf_type); + + INIT_WORK(&bifur_dev->netdev_link, bifur_netdev_event); + bifur_dev->dbdf = PCI_DBDF(pci_domain_nr(lld_dev->pdev->bus), lld_dev->pdev->bus->number, + PCI_DBDF_DEVID(lld_dev->pdev->devfn), + PCI_DBDF_FUNCTION(lld_dev->pdev->devfn)); + + atomic_set(&bifur_dev->bifur_dev.bifur_dev_ref, 0); + bifur_dev->bifur_dev.has_created = true; + + bifur_dev_list_lock(); + list_add_tail(&bifur_dev->list, &adp->lld_dev_head); + bifur_dev_list_unlock(); + + *uld_dev = bifur_dev; + + BIFUR_DEV_INFO(lld_dev, "bifur driver probe\n"); + + return 0; +} + +static void bifur_remove(struct hinic3_lld_dev *lld_dev, void *uld_dev) +{ + struct bifur_lld_dev *bifur_dev = (struct bifur_lld_dev *)uld_dev; + + if (!bifur_dev) + return; + + if (bifur_dev->pf_type == BIFUR_RESOURCE_PF) { + (void)bifur_remove_vf(bifur_dev); + bifur_free_vf_mgr(bifur_dev); + } + + /* delete bifur device */ + bifur_dev_list_lock(); + list_del(&bifur_dev->list); + bifur_dev_list_unlock(); + + (void)cancel_work_sync(&bifur_dev->netdev_link); + wait_bifur_dev_unused(bifur_dev); + + bifur_destroy_dev(bifur_dev); + + kfree(bifur_dev); + bifur_dev = NULL; + + BIFUR_DEV_INFO(lld_dev, "bifur driver remove\n"); +} + +static int get_bifur_drv_version(struct drv_version_info *ver_info, u32 *out_size) +{ + int err; + + if (*out_size != sizeof(*ver_info)) { + pr_err("Unexpected out buf size from user :%u, expect: %lu\n", + *out_size, sizeof(*ver_info)); + return -EINVAL; + } + + err = snprintf(ver_info->ver, sizeof(ver_info->ver), "%s %s", + BIFUR_DRV_VERSION, __TIME_STR__); + if (err == -1) { + pr_err("Snprintf bifur version err\n"); + return -EFAULT; + } + + return 0; +} + +static int bifur_enable_vfs(u8 bond_bifur_en) +{ + int err; + + err = bifur_enable_disable_vf_all(true); + if (err) { + pr_err("Enable bifur vf failed. err(%d)\n", err); + return err; + } + + err = bifur_bind_unbind_dpdk_all(true); + if (err) { + (void)bifur_enable_disable_vf_all(false); + pr_err("Bind bifur vf to dpdk failed. err(%d)\n", err); + return err; + } + + bifur_set_bond_enable(bond_bifur_en); + return 0; +} + +static int bifur_disable_vfs(void) +{ + int err; + + bifur_set_bond_enable(BIFUR_DISABLED); + + err = bifur_enable_disable_vf_all(false); + if (err) { + pr_err("Disable bifur vf failed. err(%d)\n", err); + return err; + } + return 0; +} + +static int bifur_set_vfs_enable_state(struct bifur_adapter *adp, int set_enable, + int *out_enable, u32 *out_size) +{ + int err; + u8 bond_bifur_en; + + if (set_enable != BIFUR_ENABLED && set_enable != BIFUR_DISABLED) { + pr_err("Input params invalid. set_enable(%d)\n", set_enable); + return -EINVAL; + } + + if (*out_size != sizeof(*out_enable)) { + pr_err("Unexpected out buf size from user :%u, expect: %lu\n", + *out_size, sizeof(*out_enable)); + return -EINVAL; + } + + bifur_dev_list_lock(); + if ((u8)set_enable == adp->bifur_enabled) { + *out_enable = adp->bifur_enabled; + bifur_dev_list_unlock(); + pr_info("Bifur enabled status has been set. set_enable(%d)\n", set_enable); + return 0; + } + bond_bifur_en = adp->bond_bifur_enabled; + adp->bifur_enabled = set_enable; + bifur_dev_list_unlock(); + + if (set_enable == BIFUR_ENABLED) + err = bifur_enable_vfs(bond_bifur_en); + else + err = bifur_disable_vfs(); + + bifur_dev_list_lock(); + if (err != 0) + adp->bifur_enabled = !set_enable; + *out_enable = adp->bifur_enabled; + bifur_dev_list_unlock(); + + return err; +} + +static int bifur_get_bifur_enabled(struct bifur_adapter *adp, int *enabled_status, u32 *out_size) +{ + if (*out_size != sizeof(*enabled_status)) { + pr_err("Unexpected out buf size from user :%u, expect: %lu\n", + *out_size, sizeof(*enabled_status)); + return -EINVAL; + } + + bifur_dev_list_lock(); + *enabled_status = adp->bifur_enabled; + bifur_dev_list_unlock(); + return 0; +} + +static int bifur_ioctl(void *uld_dev, u32 cmd, const void *buf_in, u32 in_size, + void *buf_out, u32 *out_size) +{ + struct bifur_adapter *adp = bifur_get_adp(); + struct bifur_lld_dev *bifur_dev = (struct bifur_lld_dev *)uld_dev; + + if (!uld_dev || !out_size || !buf_out) { + pr_err("[BIFUR] %s: Input params is null. out_size(%d), buf_out(%d)\n", + __func__, (int)(!out_size), (int)(!buf_out)); + return -EINVAL; + } + + if (!hinic3_support_bifur(bifur_dev->lld_dev->hwdev, NULL)) { + pr_err("[BIFUR] %s: %s Not support bifurcation\n", __func__, + pci_name(bifur_dev->lld_dev->pdev)); + return -EINVAL; + } + + if (cmd == GET_DRV_VERSION) + return get_bifur_drv_version((struct drv_version_info *)buf_out, out_size); + + if (cmd == BIFUR_SET_ENABLE) + return bifur_set_vfs_enable_state(adp, *(int *)buf_in, (int *)buf_out, out_size); + else if (cmd == BIFUR_GET_ENABLE) + return bifur_get_bifur_enabled(adp, (int *)buf_out, out_size); + + pr_err("Not support cmd %u for bifur\n", cmd); + return 0; +} + +static struct hinic3_uld_info bifur_uld_info = { + .probe = bifur_probe, + .remove = bifur_remove, + .suspend = NULL, + .resume = NULL, + .ioctl = bifur_ioctl, +}; + +static __init int hibifur_init(void) +{ + int err = 0; + + pr_info("%s - version %s, compile time:%s\n", BIFUR_DRV_DESC, + BIFUR_DRV_VERSION, __TIME_STR__); + + if (!bifur_check_dpdk_kdriver()) { + pr_err("Invalid dpdk kernel driver type: %s\n", g_bifur_dpdk_kdriver); + return -EINVAL; + } + + err = bifur_alloc_adapter(); + if (err != 0) + return -ENOMEM; + + err = hinic3_register_uld(SERVICE_T_BIFUR, &bifur_uld_info); + if (err != 0) { + pr_err("Register bifur uld failed\n"); + goto register_uld_err; + } + + err = bifur_global_dev_init(); + if (err) { + pr_err("Register bifur global cdev failed\n"); + goto global_dev_init_err; + } + + err = bifur_register_net_event(); + if (err) { + pr_err("Register bifur global cdev failed\n"); + goto register_event_err; + } + + err = bifur_bond_init(); + if (err != 0) { + pr_err("Bifur bond status init failed\n"); + goto bond_init_err; + } + + return 0; + +bond_init_err: + bifur_unregister_net_event(); +register_event_err: + bifur_global_dev_uninit(); +global_dev_init_err: + hinic3_unregister_uld(SERVICE_T_BIFUR); +register_uld_err: + bifur_free_adapter(); + return err; +} + +static __exit void hibifur_exit(void) +{ + struct bifur_adapter *adp = bifur_get_adp(); + u8 bifur_enabled = BIFUR_DISABLED; + + bifur_bond_exit(); + bifur_unregister_net_event(); + bifur_global_dev_uninit(); + + bifur_dev_list_lock(); + if (adp->bifur_enabled) { + bifur_enabled = adp->bifur_enabled; + adp->bifur_enabled = BIFUR_DISABLED; + } + bifur_dev_list_unlock(); + + if (bifur_enabled) { + (void)bifur_bind_unbind_dpdk_all(false); + (void)bifur_enable_disable_vf_all(false); + } + + hinic3_unregister_uld(SERVICE_T_BIFUR); + bifur_free_adapter(); + + pr_info("%s exit\n", BIFUR_DRV_DESC); +} + +struct bifur_lld_dev *bifur_get_resource_dev(void) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + + bifur_dev_list_lock(); + + /* found the bifur_lld_dev of resource pf */ + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->pf_type == BIFUR_RESOURCE_PF) { + bifur_dev_hold(bifur_dev); + bifur_dev_list_unlock(); + pr_info("Find resource pf DBDF 0x%08x\n", bifur_dev->dbdf); + return bifur_dev; + } + } + + bifur_dev_list_unlock(); + + pr_err("Can't find resource pf\n"); + return NULL; +} + +struct bifur_lld_dev *bifur_get_shared_dev_by_dbdf(u32 dbdf) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + + bifur_dev_list_lock(); + + /* found the bifur_lld_dev of shared pf */ + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->pf_type == BIFUR_SHARED_PF && dbdf == bifur_dev->dbdf) { + bifur_dev_hold(bifur_dev); + bifur_dev_list_unlock(); + pr_info("Find shared pf DBDF 0x%08x\n", bifur_dev->dbdf); + return bifur_dev; + } + } + + bifur_dev_list_unlock(); + + pr_err("Can't find shared pf 0x%x\n", dbdf); + return NULL; +} + +static void wait_bifur_dev_unused(struct bifur_lld_dev *bifur_dev) +{ + int i; + + for (i = 0; i < BIFUR_WAIT_TIMES; i++) { + if (!atomic_read(&bifur_dev->bifur_dev.bifur_dev_ref)) + break; + + msleep(BIFUR_REMOVE_TIMESTEP); + } + + if (i == BIFUR_WAIT_TIMES) { + BIFUR_DEV_WARN(bifur_dev->lld_dev, + "destroy BIFUR device failed, bifur_dev_ref(%d) can not be 0 after %d ms\n", + atomic_read(&bifur_dev->bifur_dev.bifur_dev_ref), + (BIFUR_WAIT_TIMES * BIFUR_REMOVE_TIMESTEP)); + } +} + +static void bifur_destroy_dev(struct bifur_lld_dev *bifur_dev) +{ + if (!bifur_dev->bifur_dev.has_created) + return; + + bifur_dev->bifur_dev.has_created = false; + + BIFUR_DEV_INFO(bifur_dev->lld_dev, "Destroy BIFUR device success\n"); +} + +module_init(hibifur_init); +module_exit(hibifur_exit); + +MODULE_AUTHOR("Huawei Technologies CO., Ltd"); +MODULE_DESCRIPTION(BIFUR_DRV_DESC); +MODULE_VERSION(BIFUR_DRV_VERSION); +MODULE_LICENSE("GPL"); diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_main.h b/drivers/net/ethernet/huawei/hibifur/bifur_main.h new file mode 100644 index 000000000..9daac17dd --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_main.h @@ -0,0 +1,57 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#ifndef BIFUR_MAIN_H__ +#define BIFUR_MAIN_H__ + +#include "hinic3_lld.h" +#include "asm-generic/int-ll64.h" + +#include <linux/mutex.h> +#include <linux/types.h> +#include <linux/timer.h> + +enum bifur_func_type { + BIFUR_EXCLUSIVE_PF = 1, + BIFUR_SHARED_PF, + BIFUR_RESOURCE_PF, + BIFUR_RESOURCE_VF, + BIFUR_FUNC_TYPE_MAX +}; + +struct bifur_flow_dev { + atomic_t bifur_dev_ref; + bool has_created; /* bifur dev created or not */ +}; + +struct bifur_adapter { + struct list_head lld_dev_head; /* pcie device list head */ + struct mutex bifur_dev_mutex; /* lock for bifur dev list */ + struct workqueue_struct *event_workq; /* global work queue */ + u8 bifur_enabled; /* used for mark whether to enable traffic bifurcation */ + u8 bond_bifur_enabled; /* used for mark whether to enable bond status of bifurcation vfs */ + u16 bond_id; +}; + +struct bifur_vf_mgr; +struct bifur_lld_dev { + struct list_head list; + struct hinic3_lld_dev *lld_dev; + struct bifur_vf_mgr *vf_mgr; + struct bifur_flow_dev bifur_dev; /* bifur device */ + enum bifur_func_type pf_type; + struct work_struct netdev_link; + u8 link_status; + u32 dbdf; +}; + +void bifur_dev_hold(struct bifur_lld_dev *bifur_dev); +void bifur_dev_put(struct bifur_lld_dev *bifur_dev); +void bifur_dev_list_lock(void); +void bifur_dev_list_unlock(void); +struct bifur_lld_dev *bifur_get_resource_dev(void); +struct bifur_adapter *bifur_get_adp(void); +struct bifur_lld_dev *bifur_get_shared_dev_by_dbdf(u32 dbdf); +#endif diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_pfile.c b/drivers/net/ethernet/huawei/hibifur/bifur_pfile.c new file mode 100644 index 000000000..3621bb10d --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_pfile.c @@ -0,0 +1,545 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#include <linux/kernel.h> +#include "nic_mpu_cmd.h" +#include "hinic3_hw.h" +#include "hinic3_mgmt_interface.h" +#include "hinic3_common.h" + +#include "bifur_common.h" +#include "bifur_vf_mgr.h" +#include "bifur_main.h" +#include "bifur_pfile.h" + +#define BIFUR_GLOBAL_CDEV_NAME "bifur_gdev" +struct bifur_cdev g_bifur_global_dev; +struct bifur_global_file_list_t g_bifur_global_file_list; + +struct class *g_bifur_class; + +void bifur_global_dev_uninit(void) +{ + struct bifur_proc_file_t *tmp = NULL; + struct bifur_proc_file_t *proc_file = NULL; + struct bifur_cdev *bdev = &g_bifur_global_dev; + + mutex_lock(&g_bifur_global_file_list.lock); + list_for_each_entry_safe(proc_file, tmp, &g_bifur_global_file_list.list, node) { + list_del(&proc_file->node); + } + mutex_unlock(&g_bifur_global_file_list.lock); + + device_destroy(g_bifur_class, bdev->cdev_id); + class_destroy(g_bifur_class); + g_bifur_class = NULL; + cdev_del(&bdev->cdev); + unregister_chrdev_region(bdev->cdev_id, 1); + pr_info("Bifur destroy global cdev(%s) succeed.", BIFUR_GLOBAL_CDEV_NAME); +} + +void bifur_global_file_del(struct bifur_proc_file_t *proc_file) +{ + mutex_lock(&g_bifur_global_file_list.lock); + list_del(&proc_file->node); + mutex_unlock(&g_bifur_global_file_list.lock); +} + +int bifur_global_dev_close(struct inode *inode, struct file *filp) +{ + struct bifur_proc_file_t *proc_file = filp->private_data; + + pr_info("Close global proc_file(%p), filp(%p).", proc_file, filp); + bifur_global_file_del(proc_file); // Direct chain removal without traversing + kfree(proc_file); + + return 0; +} + +/* One dpdk process has only one process_file. A unique file is added to the global list. */ +int bifur_global_file_add(struct bifur_proc_file_t *add_proc_file) +{ + struct bifur_proc_file_t *tmp = NULL; + struct bifur_proc_file_t *proc_file = NULL; + + mutex_lock(&g_bifur_global_file_list.lock); + + list_for_each_entry_safe(proc_file, tmp, &g_bifur_global_file_list.list, node) { + if (proc_file->pid == add_proc_file->pid) { + mutex_unlock(&g_bifur_global_file_list.lock); + pr_err("Process(%u) file is exist.", proc_file->pid); + return -EPERM; + } + } + + list_add_tail(&add_proc_file->node, &g_bifur_global_file_list.list); + mutex_unlock(&g_bifur_global_file_list.lock); + + return 0; +} + +struct bifur_proc_file_t *bifur_alloc_proc_file(void) +{ + struct bifur_proc_file_t *proc_file = kzalloc(sizeof(struct bifur_proc_file_t), GFP_KERNEL); + + if (!proc_file) + return NULL; + + proc_file->pid = current->pid; + + return proc_file; +} + +int bifur_global_dev_open(struct inode *inode, struct file *filp) +{ + int ret; + struct bifur_proc_file_t *proc_file = bifur_alloc_proc_file(); + + if (!proc_file) + return -ENOMEM; + + ret = bifur_global_file_add(proc_file); + if (ret != 0) { + pr_err("Duplicate processes(%u) open global char dev.", current->pid); + kfree(proc_file); + return -EEXIST; + } + filp->private_data = proc_file; + + pr_info("Open proc global proc file success, proc_file(%p), filp(%p) pid(%u).", + proc_file, filp, proc_file->pid); + + return nonseekable_open(inode, filp); +} + +static int bifur_drv_cmd_func_attr_get(struct file *filp, struct bifur_msg *cmd) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + int i; + + struct bifur_func_attr_get_cmd_msg *query_cmd; + struct bifur_func_attr_get_cmd_rsp *query_resp; + + query_cmd = (struct bifur_func_attr_get_cmd_msg *)(cmd->in_buf); + query_resp = (struct bifur_func_attr_get_cmd_rsp *)(cmd->out_buf); + if ((!query_cmd) || (!query_resp) || + cmd->in_buf_len < sizeof(struct bifur_func_attr_get_cmd_msg) || + cmd->out_buf_len < sizeof(struct bifur_func_attr_get_cmd_rsp)) { + pr_err("Input param fail, in_buf_len(%u), out_buf_len(%u).", + cmd->in_buf_len, cmd->out_buf_len); + return -EPERM; + } + + query_resp->func_type = 0; + cmd->out_data_len = sizeof(struct bifur_func_attr_get_cmd_rsp); + + bifur_dev_list_lock(); + if (adp->bifur_enabled == BIFUR_DISABLED) { + bifur_dev_list_unlock(); + query_resp->func_type = BIFUR_EXCLUSIVE_PF; + pr_info("Didn't enable traffic bifurcation, functions are exclusive.\n"); + return 0; + } + bifur_dev_list_unlock(); + + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->dbdf == query_cmd->dbdf) { + query_resp->func_type = bifur_dev->pf_type; + break; + } + + if (bifur_dev->pf_type == BIFUR_RESOURCE_PF) { + for (i = 0; i < bifur_dev->vf_mgr->vf_sum; ++i) { + if (bifur_dev->vf_mgr->vf_info[i].vf_dbdf == query_cmd->dbdf) { + query_resp->func_type = BIFUR_RESOURCE_VF; + break; + } + } + } + } + + pr_info("Do get func attr cmd success\n"); + return 0; +} + +static inline void bifur_release_vf(struct bifur_vf_mgr *vf_mgr, struct bifur_vf_info *vf_info) +{ + mutex_lock(&vf_mgr->vf_mgr_mutex); + vf_info->in_use = 0; + vf_mgr->vf_in_use--; + mutex_unlock(&vf_mgr->vf_mgr_mutex); +} + +static int get_global_func_id_by_dbdf(u32 dbdf, u16 *glb_func_id) +{ + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *tmp_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + struct list_head *head = &adp->lld_dev_head; + int i; + + list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { + if (bifur_dev->dbdf == dbdf) { + *glb_func_id = hinic3_global_func_id(bifur_dev->lld_dev->hwdev); + return 0; + } + + if (bifur_dev->pf_type == BIFUR_RESOURCE_PF) { + for (i = 0; i < bifur_dev->vf_mgr->vf_sum; ++i) { + if (bifur_dev->vf_mgr->vf_info[i].vf_dbdf == dbdf) { + *glb_func_id = bifur_dev->vf_mgr->vf_info[i].glb_func_id; + return 0; + } + } + } + } + return -ENODEV; +} + +static int bifur_set_vf_tx_port(struct bifur_lld_dev *bifur_dev, u32 src_dbdf, u32 dst_dbdf) +{ + int err; + struct hinic3_func_er_value_cmd vf_fwd_id_cfg = {0}; + u16 out_size = sizeof(struct hinic3_func_er_value_cmd); + + err = get_global_func_id_by_dbdf(src_dbdf, &vf_fwd_id_cfg.vf_id); + if (err != 0) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Do not exit this vf, vf(%u)\n", src_dbdf); + return err; + } + BIFUR_DEV_INFO(bifur_dev->lld_dev, "src_vf(0x%x), vf_id(%u)\n", + src_dbdf, vf_fwd_id_cfg.vf_id); + + err = get_global_func_id_by_dbdf(dst_dbdf, &vf_fwd_id_cfg.er_fwd_id); + if (err != 0) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Do not exit this port, port dbdf(%u)\n", + dst_dbdf); + return err; + } + BIFUR_DEV_INFO(bifur_dev->lld_dev, "dst_dbdf(0x%x), er_fwd_id(%u)\n", + dst_dbdf, vf_fwd_id_cfg.er_fwd_id); + + err = hinic3_msg_to_mgmt_sync(bifur_dev->lld_dev->hwdev, HINIC3_MOD_L2NIC, + HINIC3_NIC_CMD_SET_FUNC_ER_FWD_ID, &vf_fwd_id_cfg, + sizeof(vf_fwd_id_cfg), &vf_fwd_id_cfg, &out_size, 0, + HINIC3_CHANNEL_DEFAULT); + if (vf_fwd_id_cfg.msg_head.status != 0 || err != 0 || out_size == 0) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, + "Failed to set VF forward id config. err(%d), sts(%u), out_size(%u)\n", + err, vf_fwd_id_cfg.msg_head.status, out_size); + return -EIO; + } + return 0; +} + +static int bifur_drv_cmd_vf_alloc(struct file *filp, struct bifur_msg *cmd) +{ + int err; + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_vf_info *vf_info = NULL; + struct bifur_vf_alloc_cmd_msg *query_cmd = (struct bifur_vf_alloc_cmd_msg *)(cmd->in_buf); + struct bifur_vf_alloc_cmd_rsp *query_resp = (struct bifur_vf_alloc_cmd_rsp *)(cmd->out_buf); + struct bifur_adapter *adp = bifur_get_adp(); + + if (!query_cmd || !query_resp || + cmd->in_buf_len < sizeof(struct bifur_vf_alloc_cmd_msg) || + cmd->out_buf_len < sizeof(struct bifur_vf_alloc_cmd_rsp)) { + pr_err("Input param fail, in_buf_len(%u), out_buf_len(%u).", + cmd->in_buf_len, cmd->out_buf_len); + return -EINVAL; + } + + bifur_dev_list_lock(); + if (adp->bifur_enabled == BIFUR_DISABLED) { + bifur_dev_list_unlock(); + pr_err("Didn't enable traffic bifurcation.\n"); + return -EPERM; + } + bifur_dev_list_unlock(); + + /* found the bifur device */ + bifur_dev = bifur_get_resource_dev(); + if (!bifur_dev) + return -EINVAL; + + vf_info = bifur_find_vf(bifur_dev->vf_mgr, query_cmd->dbdf); + if (!vf_info) { + bifur_dev_put(bifur_dev); + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Alloc vf failed, %u vf in use\n", + bifur_dev->vf_mgr->vf_in_use); + return -EFAULT; + } + + err = bifur_set_vf_tx_port(bifur_dev, vf_info->vf_dbdf, query_cmd->dbdf); + if (err) { + bifur_release_vf(bifur_dev->vf_mgr, vf_info); + bifur_dev_put(bifur_dev); + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Set vf forward id failed, vf(%u), dst_pf(%u)\n", + vf_info->vf_dbdf, query_cmd->dbdf); + return err; + } + query_resp->vf_dbdf = vf_info->vf_dbdf; + + BIFUR_DEV_INFO(bifur_dev->lld_dev, "pf_dbdf: 0x%x\n", query_cmd->dbdf); + BIFUR_DEV_INFO(bifur_dev->lld_dev, "alloc_vf_dbdf: 0x%x\n", query_resp->vf_dbdf); + + cmd->out_data_len = sizeof(struct bifur_vf_alloc_cmd_rsp); + bifur_dev_put(bifur_dev); + pr_info("Do vf alloc cmd success\n"); + return 0; +} + +static int bifur_drv_cmd_mac_get(struct file *filp, struct bifur_msg *cmd) +{ + int ret; + u32 pf_dbdf; + struct bifur_lld_dev *bifur_dev = NULL; + struct bifur_lld_dev *shared_bifur_dev = NULL; + struct net_device *net_dev = NULL; + struct bifur_adapter *adp = bifur_get_adp(); + + struct bifur_mac_get_cmd_msg *query_cmd = (struct bifur_mac_get_cmd_msg *)(cmd->in_buf); + struct bifur_mac_get_cmd_rsp *query_resp = (struct bifur_mac_get_cmd_rsp *)(cmd->out_buf); + + if (!query_cmd || !query_resp || + cmd->in_buf_len < sizeof(struct bifur_mac_get_cmd_msg) || + cmd->out_buf_len < sizeof(struct bifur_mac_get_cmd_rsp)) { + pr_err("Input param fail, in_buf_len(%u), out_buf_len(%u).", + cmd->in_buf_len, cmd->out_buf_len); + return -EINVAL; + } + + bifur_dev_list_lock(); + if (adp->bifur_enabled == BIFUR_DISABLED) { + bifur_dev_list_unlock(); + pr_err("Didn't enable traffic bifurcation.\n"); + return -EPERM; + } + bifur_dev_list_unlock(); + + bifur_dev = bifur_get_resource_dev(); + if (!bifur_dev) + return -EINVAL; + + ret = bifur_find_pf_by_vf(bifur_dev->vf_mgr, query_cmd->dbdf, &pf_dbdf); + if (ret != 0) { + bifur_dev_put(bifur_dev); + pr_err("Find pf dbdf failed, vf dbdf(0x%x)\n", query_cmd->dbdf); + return -EFAULT; + } + + /* found shared dev by pf dbdf */ + shared_bifur_dev = bifur_get_shared_dev_by_dbdf(pf_dbdf); + if (!shared_bifur_dev) { + bifur_dev_put(bifur_dev); + return -EINVAL; + } + + /* found net device by shared dev lld dev */ + net_dev = hinic3_get_netdev_by_lld(shared_bifur_dev->lld_dev); + if (!net_dev) { + bifur_dev_put(bifur_dev); + bifur_dev_put(shared_bifur_dev); + pr_err("Get net device by lld dev failed, pf_dbdf(0x%x)\n", pf_dbdf); + return -EINVAL; + } + + ether_addr_copy(query_resp->mac, net_dev->dev_addr); + bifur_dev_put(bifur_dev); + bifur_dev_put(shared_bifur_dev); + + cmd->out_data_len = sizeof(struct bifur_mac_get_cmd_rsp); + pr_info("DO Get mac cmd of vf success\n"); + return 0; +} + +struct { + enum bifur_cmd_m drv_cmd; + int (*cmd_handle)(struct file *filp, struct bifur_msg *msg); +} g_bifur_cmd_table[] = { + {BIFUR_DRV_CMD_FUNC_ATTR_GET, bifur_drv_cmd_func_attr_get}, + {BIFUR_DRV_CMD_VF_ALLOC, bifur_drv_cmd_vf_alloc}, + {BIFUR_DRV_CMD_MAC_GET, bifur_drv_cmd_mac_get}, +}; + +int bifur_cmd_exec(struct file *file, struct bifur_msg *msg) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(g_bifur_cmd_table); i++) { + if (g_bifur_cmd_table[i].drv_cmd == msg->drv_cmd) + return g_bifur_cmd_table[i].cmd_handle(file, msg); + } + + pr_err("Cmd(%u) is not supported.", msg->drv_cmd); + return -EOPNOTSUPP; +} + +int bifur_msg_copy_from_usr(const char __user *ubuf, size_t size, struct bifur_msg *usr, + struct bifur_msg *knl) +{ + u64 ret = 0; + + ret = copy_from_user(usr, ubuf, size); + if (ret != 0) { + pr_err("Copy msg from user failed, ret(0x%llx).", ret); + return -EFAULT; + } + + if (usr->in_buf && (usr->in_buf_len == 0 || usr->in_buf_len > BIFUR_MAX_CMD_LEN)) { + pr_err("Invalid in buf param, cmd(%u) in_buf_len(%u).", + usr->drv_cmd, usr->in_buf_len); + return -EINVAL; + } + if (usr->out_buf && (usr->out_buf_len == 0 || usr->out_buf_len > BIFUR_MAX_CMD_LEN)) { + pr_err("Invalid out buf param, cmd(%u) out_buf_len(%u).", + usr->drv_cmd, usr->out_buf_len); + return -EINVAL; + } + knl->drv_cmd = usr->drv_cmd; + knl->in_buf_len = usr->in_buf_len; + knl->out_buf_len = usr->out_buf_len; + + if (usr->in_buf) { + knl->in_buf = kzalloc((size_t)usr->in_buf_len, GFP_KERNEL); + if (!knl->in_buf) + return -ENOMEM; + ret = copy_from_user(knl->in_buf, usr->in_buf, (size_t)usr->in_buf_len); + if (ret != 0) { + pr_err("Cmd(%u) copy in_buf from user failed, ret(0x%llx).", + usr->drv_cmd, ret); + BUFUR_CHECK_KFREE(knl->in_buf); + return -EFAULT; + } + } + + if (usr->out_buf) { + knl->out_buf = kzalloc((size_t)usr->out_buf_len, GFP_KERNEL); + if (!knl->out_buf) { + BUFUR_CHECK_KFREE(knl->in_buf); + return -ENOMEM; + } + } + return 0; +} + +void bifur_free_knl_msg_buf(struct bifur_msg *msg) +{ + BUFUR_CHECK_KFREE(msg->in_buf); + BUFUR_CHECK_KFREE(msg->out_buf); +} + +int bifur_msg_copy_to_usr(struct bifur_msg *usr, struct bifur_msg *knl) +{ + u64 ret; + u32 copy_len; + + if (!usr->out_buf || knl->out_data_len == 0) { + usr->out_data_len = 0; + return 0; + } + + copy_len = (usr->out_buf_len > knl->out_data_len) ? knl->out_data_len : usr->out_buf_len; + ret = copy_to_user(usr->out_buf, knl->out_buf, (ulong)copy_len); + if (ret != 0) { + pr_err("Cmd(%u) copy out_buf to user failed, ret(0x%llx).", usr->drv_cmd, ret); + return -EFAULT; + } + + return 0; +} + +ssize_t bifur_file_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) +{ + int ret = 0; + struct bifur_msg usr_msg = { 0 }; + struct bifur_msg knl_msg = { 0 }; + + if (!ubuf || size < sizeof(struct bifur_msg) || size > BIFUR_MAX_CMD_LEN) { + pr_err("Invalid param, size(%lu).", size); + return -EINVAL; + } + + ret = bifur_msg_copy_from_usr(ubuf, size, &usr_msg, &knl_msg); + if (ret != 0) + return ret; + + ret = bifur_cmd_exec(file, &knl_msg); + if (ret != 0) { + bifur_free_knl_msg_buf(&knl_msg); + return (ret < 0) ? ret : -EFAULT; + } + + ret = bifur_msg_copy_to_usr(&usr_msg, &knl_msg); + if (ret != 0) { + bifur_free_knl_msg_buf(&knl_msg); + return ret; + } + bifur_free_knl_msg_buf(&knl_msg); + + return 0; +} + +ssize_t bifur_proc_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) +{ + return bifur_file_write(file, ubuf, size, pos); +} + +static const struct file_operations g_bifur_global_cdev_fops = { + .owner = THIS_MODULE, + .open = bifur_global_dev_open, + .release = bifur_global_dev_close, + .write = bifur_proc_write, +}; + +/* When the module is initialized, prepare the global character device. */ +int bifur_global_dev_init(void) +{ + char *name = BIFUR_GLOBAL_CDEV_NAME; + struct device *device; + struct bifur_cdev *bdev = &g_bifur_global_dev; + + int ret = alloc_chrdev_region(&bdev->cdev_id, 0, 1, name); + + if (ret < 0) { + pr_err("Bifur cdev(%s) alloc card chrdev region fail, ret(%d).", name, ret); + return -EFAULT; + } + + cdev_init(&bdev->cdev, &g_bifur_global_cdev_fops); + + ret = cdev_add(&bdev->cdev, bdev->cdev_id, 1); + if (ret < 0) { + unregister_chrdev_region(bdev->cdev_id, 1); + pr_err("Bifur cdev(%s) add cdev fail, ret(%d).", name, ret); + return -EFAULT; + } + + g_bifur_class = class_create(BIFUR_MOD_NAME); + if (IS_ERR(g_bifur_class)) { + unregister_chrdev_region(bdev->cdev_id, 1); + cdev_del(&bdev->cdev); + pr_err("Bifur create class fail."); + return -EEXIST; + } + + device = device_create(g_bifur_class, NULL, bdev->cdev_id, NULL, "%s", name); + if (IS_ERR(device)) { + class_destroy(g_bifur_class); + unregister_chrdev_region(bdev->cdev_id, 1); + cdev_del(&bdev->cdev); + pr_err("Bifur cdev(%s) create device fail.", name); + return -EFAULT; + } + + mutex_init(&g_bifur_global_file_list.lock); + INIT_LIST_HEAD(&g_bifur_global_file_list.list); + pr_info("Bifur create global cdev(%s) succeed.", name); + + return 0; +} diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_pfile.h b/drivers/net/ethernet/huawei/hibifur/bifur_pfile.h new file mode 100644 index 000000000..396d76311 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_pfile.h @@ -0,0 +1,75 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ +#ifndef BIFUR_PFILE_H +#define BIFUR_PFILE_H + +#define BIFUR_MAX_CMD_LEN (1024 * 1024) + +#define BIFUR_MOD_NAME "bifur" +#define BIFUR_PROC_DIR_MOD 0550 + +#define BUFUR_CHECK_KFREE(m) \ +do { \ + kfree(m); \ + m = NULL; \ +} while (0) + +#define BIFUR_UNREF_PARAM(x) ((x)) + +struct bifur_msg { + u32 drv_cmd; + u32 in_buf_len; + u32 out_buf_len; + u32 out_data_len; + void *in_buf; + void *out_buf; + u8 rsvd[24]; +}; + +enum bifur_cmd_m { + BIFUR_DRV_CMD_FUNC_ATTR_GET = 1, + BIFUR_DRV_CMD_VF_ALLOC, + BIFUR_DRV_CMD_MAC_GET, + BIFUR_CMD_BUTT +}; + +struct bifur_vf_alloc_cmd_msg { + unsigned int dbdf; +}; + +struct bifur_vf_alloc_cmd_rsp { + u32 vf_dbdf; +}; + +struct bifur_func_attr_get_cmd_msg { + unsigned int dbdf; +}; + +struct bifur_func_attr_get_cmd_rsp { + u32 func_type; +}; + +struct bifur_mac_get_cmd_msg { + unsigned int dbdf; +}; + +struct bifur_mac_get_cmd_rsp { + u8 mac[6]; +}; + +struct bifur_global_file_list_t { + struct mutex lock; + struct list_head list; +}; + +struct bifur_proc_file_t { + struct list_head node; + pid_t pid; +}; + +int bifur_global_dev_init(void); +void bifur_global_dev_uninit(void); + +#endif // BIFUR_PFILE_H diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c b/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c new file mode 100644 index 000000000..71974c85d --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c @@ -0,0 +1,263 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ +#include "bifur_common.h" +#include "bifur_pfile.h" +#include "bifur_main.h" +#include "bifur_vf_mgr.h" + +#define PDE_DATA(inode) pde_data(inode) + +int bifur_alloc_vf_mgr(struct bifur_lld_dev *bifur_dev) +{ + struct bifur_vf_mgr *vf_mgr = NULL; + struct bifur_vf_info *vf_info = NULL; + + vf_mgr = kzalloc(sizeof(*vf_mgr), GFP_KERNEL); + if (!vf_mgr) { + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Alloc vf mgr failed\n"); + return -ENOMEM; + } + + bifur_dev->vf_mgr = vf_mgr; + vf_info = kzalloc(sizeof(*vf_info) * BIFUR_VF_NUM, GFP_KERNEL); + if (!vf_info) { + kfree(vf_mgr); + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Alloc vf info failed\n"); + return -ENOMEM; + } + + vf_mgr->vf_sum = 0; + vf_mgr->vf_in_use = 0; + vf_mgr->vf_info = vf_info; + mutex_init(&vf_mgr->vf_mgr_mutex); + if (!vf_mgr->bifur_proc_root) { + vf_mgr->bifur_proc_root = proc_mkdir_mode(BIFUR_MOD_NAME, BIFUR_PROC_DIR_MOD, + init_net.proc_net); + if (!vf_mgr->bifur_proc_root) { + kfree(vf_mgr); + kfree(vf_info); + bifur_dev->vf_mgr = NULL; + BIFUR_DEV_ERR(bifur_dev->lld_dev, "Bifur create dir failed."); + return -ENOMEM; + } + } + + BIFUR_DEV_INFO(bifur_dev->lld_dev, "Alloc vf mgr success\n"); + return 0; +} + +void bifur_free_vf_mgr(struct bifur_lld_dev *bifur_dev) +{ + if (bifur_dev->vf_mgr && bifur_dev->vf_mgr->vf_info) { + kfree(bifur_dev->vf_mgr->vf_info); + bifur_dev->vf_mgr->vf_info = NULL; + } + + if (bifur_dev->vf_mgr != NULL) { + kfree(bifur_dev->vf_mgr); + bifur_dev->vf_mgr = NULL; + } + + remove_proc_entry(BIFUR_MOD_NAME, init_net.proc_net); + BIFUR_DEV_INFO(bifur_dev->lld_dev, "Free vf mgr success\n"); +} + +struct bifur_vf_info *bifur_find_vf(struct bifur_vf_mgr *vf_mgr, u32 pf_dbdf) +{ + u32 i; + struct bifur_vf_info *vf_info = NULL; + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = &vf_mgr->vf_info[i]; + if (!vf_info->in_use) { + vf_info->in_use = 1; + vf_info->pf_dbdf = pf_dbdf; + vf_mgr->vf_in_use++; + mutex_unlock(&vf_mgr->vf_mgr_mutex); + return vf_info; + } + } + mutex_unlock(&vf_mgr->vf_mgr_mutex); + + return NULL; +} + +void bifur_vf_info_hold(struct bifur_vf_info *dev) +{ + atomic_inc(&dev->refcount); +} + +void bifur_vf_info_put(struct bifur_vf_info *dev) +{ + if (atomic_dec_and_test(&dev->refcount)) + pr_info("Dev(%s) pci_bdf(0x%x) comp complete.", dev->name, dev->vf_dbdf); +} + +void bifur_dev_file_add(struct bifur_dev_file_t *dev_file) +{ + mutex_lock(&dev_file->dev->dev_file_mgt.lock); + list_add_tail(&dev_file->node, &dev_file->dev->dev_file_mgt.list); + mutex_unlock(&dev_file->dev->dev_file_mgt.lock); +} + +void bifur_dev_file_del(struct bifur_dev_file_t *dev_file) +{ + mutex_lock(&dev_file->dev->dev_file_mgt.lock); + list_del(&dev_file->node); + mutex_unlock(&dev_file->dev->dev_file_mgt.lock); +} + +int bifur_proc_open(struct inode *inode, struct file *filp) +{ + struct bifur_vf_info *dev = (struct bifur_vf_info *)PDE_DATA(file_inode(filp)); + struct bifur_dev_file_t *dev_file = kzalloc(sizeof(*dev_file), GFP_KERNEL); + + if (!dev_file) + return -ENOMEM; + + atomic_set(&dev_file->refcount, 1); + dev_file->dev = dev; + bifur_vf_info_hold(dev_file->dev); + + bifur_dev_file_add(dev_file); + filp->private_data = dev_file; + + pr_info("Open proc dev(%s) success, filp(%p).", dev->name, filp); + + return nonseekable_open(inode, filp); +} + +int bifur_proc_close(struct inode *inode, struct file *filp) +{ + struct bifur_dev_file_t *dev_file = filp->private_data; + struct bifur_vf_info *dev = dev_file->dev; + struct bifur_vf_mgr *vf_mgr = dev->vf_mgr; + + pr_info("Close proc dev(%s), pci_bdf(0x%x), filp(%p).", dev_file->dev->name, + dev_file->dev->vf_dbdf, filp); + + bifur_dev_file_del(dev_file); + mutex_lock(&vf_mgr->vf_mgr_mutex); + dev->in_use = 0; + dev->pf_dbdf = 0; + vf_mgr->vf_in_use--; + bifur_vf_info_put(dev_file->dev); + mutex_unlock(&vf_mgr->vf_mgr_mutex); + + memset(dev_file, 0, sizeof(*dev_file)); + kfree(dev_file); + filp->private_data = NULL; + + return 0; +} + +#ifdef HAVE_PROC_OPS +const struct proc_ops g_bifur_proc_fops = { + .proc_open = bifur_proc_open, + .proc_release = bifur_proc_close, +}; +#else +const struct file_operations g_bifur_proc_fops = { + .owner = THIS_MODULE, + .open = bifur_proc_open, + .llseek = NULL, + .release = bifur_proc_close, +}; +#endif + +int bifur_dev_proc_build(struct bifur_vf_info *dev) +{ + struct proc_dir_entry *dir = NULL; + char pci_dev_name[BIFURNAMSIZ] = { 0 }; + struct bifur_vf_mgr *vf_mgr = dev->vf_mgr; + + int ret = sprintf(pci_dev_name, "0x%x", dev->vf_dbdf); + + if (ret < 0) { + pr_err("Bifur dev(%s) proc dir create fail, bdf(0x%x).", dev->name, dev->vf_dbdf); + return -ENOEXEC; + } + + dev->cdev.proc_dir = proc_mkdir_mode(pci_dev_name, BIFUR_PROC_DIR_MOD, + vf_mgr->bifur_proc_root); + if (!dev->cdev.proc_dir) { + pr_err("Bifur dev(%s) proc dir create fail.", dev->name); + return -EINVAL; + } + + dir = proc_create_data(BIFUR_CDEV_PROC_NAME, BIFUR_PROC_FILE_MOD, + dev->cdev.proc_dir, &g_bifur_proc_fops, dev); + if (!dir) { + remove_proc_entry(pci_dev_name, vf_mgr->bifur_proc_root); + dev->cdev.proc_dir = NULL; + pr_err("Bifur dev(%s) create card file failed.", dev->name); + return -EPERM; + } + + pr_info("Bifur dev(%p) name(%s,%s) proc build success.", dev, dev->name, pci_dev_name); + return 0; +} + +int bifur_dev_proc_destroy(struct bifur_vf_info *dev) +{ + char pci_dev_name[BIFURNAMSIZ] = { 0 }; + struct bifur_vf_mgr *vf_mgr = dev->vf_mgr; + + int ret = sprintf(pci_dev_name, "0x%x", dev->vf_dbdf); + + if (ret < 0) { + pr_err("Bifur dev(%s) proc dir create fail, bdf(0x%x).", dev->name, dev->vf_dbdf); + return -ENOEXEC; + } + + remove_proc_entry(BIFUR_CDEV_PROC_NAME, dev->cdev.proc_dir); + remove_proc_entry(pci_dev_name, vf_mgr->bifur_proc_root); + dev->cdev.proc_dir = NULL; + + pr_info("Bifur dev(%s) proc destroy success, pci_dev_name(%s).", dev->name, pci_dev_name); + + return 0; +} + +int bifur_find_pf_by_vf(struct bifur_vf_mgr *vf_mgr, u32 vf_dbdf, u32 *pf_dbdf) +{ + u32 i; + struct bifur_vf_info *vf_info = NULL; + + mutex_lock(&vf_mgr->vf_mgr_mutex); + for (i = 0; i < vf_mgr->vf_sum; ++i) { + vf_info = vf_mgr->vf_info + i; + if (vf_info->vf_dbdf == vf_dbdf && vf_info->in_use) { + *pf_dbdf = vf_info->pf_dbdf; + mutex_unlock(&vf_mgr->vf_mgr_mutex); + return 0; + } + } + mutex_unlock(&vf_mgr->vf_mgr_mutex); + + return -EINVAL; +} + +int bifur_vf_cdev_init(struct bifur_vf_info *dev) +{ + int ret; + + mutex_init(&dev->dev_file_mgt.lock); + INIT_LIST_HEAD(&dev->dev_file_mgt.list); + + ret = bifur_dev_proc_build(dev); + if (ret != 0) { + pr_err("Init dev build failed, ret(%d).", ret); + return ret; + } + + return 0; +} + +void bifur_vf_cdev_uninit(struct bifur_vf_info *dev) +{ + (void)bifur_dev_proc_destroy(dev); +} diff --git a/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.h b/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.h new file mode 100644 index 000000000..7c4124495 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.h @@ -0,0 +1,58 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) Huawei Technologies Co., Ltd. 2024-2024. All rights reserved. + */ + +#ifndef BIFUR_VF_MGR_H__ +#define BIFUR_VF_MGR_H__ + +#define BIFURNAMSIZ 20 +#define BIFUR_PROC_FILE_MOD 0640 +#define BIFUR_CDEV_PROC_NAME "bifur_vdev" + +struct bifur_dev_file_mgt_t { + struct mutex lock; + struct list_head list; +}; +struct bifur_lld_dev; +struct bifur_vf_mgr; + +struct bifur_vf_info { + char name[BIFURNAMSIZ]; + u32 vf_dbdf; + u32 pf_dbdf; + u16 glb_func_id; + bool in_use; + struct bifur_cdev cdev; + struct bifur_dev_file_mgt_t dev_file_mgt; + struct bifur_vf_mgr *vf_mgr; + atomic_t refcount; +}; + +struct bifur_vf_mgr { + u32 vf_sum; + u32 vf_in_use; + struct bifur_vf_info *vf_info; + struct mutex vf_mgr_mutex; + struct proc_dir_entry *bifur_proc_root; +}; + +struct bifur_dev_file_t { + struct list_head node; + struct bifur_vf_info *dev; + + atomic_t refcount; +}; + +int bifur_alloc_vf_mgr(struct bifur_lld_dev *bifur_dev); + +void bifur_free_vf_mgr(struct bifur_lld_dev *bifur_dev); + +struct bifur_vf_info *bifur_find_vf(struct bifur_vf_mgr *vf_mgr, u32 dbdf); + +int bifur_find_pf_by_vf(struct bifur_vf_mgr *vf_mgr, u32 vf_dbdf, u32 *pf_dbdf); + +int bifur_vf_cdev_init(struct bifur_vf_info *dev); +void bifur_vf_cdev_uninit(struct bifur_vf_info *dev); + +#endif diff --git a/drivers/net/ethernet/huawei/hibifur/include/nic/nic_mpu_cmd.h b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_mpu_cmd.h new file mode 100644 index 000000000..1a3c26d00 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_mpu_cmd.h @@ -0,0 +1,183 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright(c) 2024 Huawei Technologies Co., Ltd */ + +#ifndef NIC_MPU_CMD_H +#define NIC_MPU_CMD_H + +/** Commands between NIC to MPU + */ +enum hinic3_nic_cmd { + HINIC3_NIC_CMD_VF_REGISTER = 0, /**< Only for PFD and VFD @see > hinic3_cmd_register_vf */ + + /** FUNC CFG */ + HINIC3_NIC_CMD_SET_FUNC_TBL = 5, /**< Set function table @see > hinic3_cmd_set_func_tbl */ + HINIC3_NIC_CMD_SET_VPORT_ENABLE, /**< Enable a vport @see > hinic3_vport_state */ + HINIC3_NIC_CMD_SET_RX_MODE, /**< Set nic rx mode. @see > hinic3_rx_mode_config */ + HINIC3_NIC_CMD_SQ_CI_ATTR_SET, /**< Set SQ CI attr @see > hinic3_cmd_cons_idx_attr */ + /**< Get vport stat @see > hinic3_port_stats_info, < hinic3_cmd_vport_stats */ + HINIC3_NIC_CMD_GET_VPORT_STAT, + /**< Clean vport stat @see > hinic3_cmd_clear_vport_stats */ + HINIC3_NIC_CMD_CLEAN_VPORT_STAT, + /**< Clean queue pair resource @see > hinic3_cmd_clear_qp_resource */ + HINIC3_NIC_CMD_CLEAR_QP_RESOURCE, + HINIC3_NIC_CMD_CFG_FLEX_QUEUE, /**< Set flex queue @see > hinic3_cmd_cfg_qps */ + /** LRO CFG */ + HINIC3_NIC_CMD_CFG_RX_LRO, /**< Set rx LRO @see > hinic3_cmd_lro_config */ + HINIC3_NIC_CMD_CFG_LRO_TIMER, /**< Set LRO timer @see > hinic3_cmd_lro_timer */ + /**< negotiate features @see > hinic3_cmd_feature_nego */ + HINIC3_NIC_CMD_FEATURE_NEGO, + /**< Configure local LRO state @see > hinic3_cmd_local_lro_state */ + HINIC3_NIC_CMD_CFG_LOCAL_LRO_STATE, + + /**< Cache out queue pair resource @see > hinic3_cmd_cache_out_qp_resource */ + HINIC3_NIC_CMD_CACHE_OUT_QP_RES, + /**< Set nic er fwd id. @see > mpu_nic_cmd_set_func_er_fwd_id */ + HINIC3_NIC_CMD_SET_FUNC_ER_FWD_ID, + + /** MAC & VLAN CFG */ + HINIC3_NIC_CMD_GET_MAC = 20, /**< Get mac address @see > hinic3_port_mac_set */ + HINIC3_NIC_CMD_SET_MAC, /**< Set mac address @see > hinic3_port_mac_set */ + HINIC3_NIC_CMD_DEL_MAC, /**< Delete mac address @see > hinic3_port_mac_set */ + /**< Update mac address @see > hinic3_port_mac_update */ + HINIC3_NIC_CMD_UPDATE_MAC, + /**< Get all default mac address @see > cmd_mac_info_get_s */ + HINIC3_NIC_CMD_GET_ALL_DEFAULT_MAC, + + /**< Configure function vlan @see > hinic3_cmd_vlan_config */ + HINIC3_NIC_CMD_CFG_FUNC_VLAN, + /**< Enable vlan filter @see > hinic3_cmd_set_vlan_filter */ + HINIC3_NIC_CMD_SET_VLAN_FILTER_EN, + /**< Set rx vlan offload @see > hinic3_cmd_vlan_offload */ + HINIC3_NIC_CMD_SET_RX_VLAN_OFFLOAD, + HINIC3_NIC_CMD_SMAC_CHECK_STATE, + + /** SR-IOV */ + /**< Configure vf vlan @see > hinic3_cmd_vf_vlan_config */ + HINIC3_NIC_CMD_CFG_VF_VLAN = 40, + /**< Set snoopchk state @see > hinic3_cmd_spoofchk_set */ + HINIC3_NIC_CMD_SET_SPOOPCHK_STATE, + /* RATE LIMIT */ + /**< Set rate limit @see > HINIC3_NIC_CMD_SET_MAX_MIN_RATE */ + HINIC3_NIC_CMD_SET_MAX_MIN_RATE, + + /** RSS CFG */ + HINIC3_NIC_CMD_RSS_CFG = 60, /**< Set rss config @see > hinic3_cmd_rss_config */ + HINIC3_NIC_CMD_RSS_TEMP_MGR, /**< TODO: delete after implement nego cmd */ + HINIC3_NIC_CMD_GET_RSS_CTX_TBL, /**< TODO: delete: move to ucode cmd */ + /**< Set rss hash key @see > hinic3_cmd_rss_hash_key */ + HINIC3_NIC_CMD_CFG_RSS_HASH_KEY, + /**< Set rss hash engine type @see > hinic3_cmd_rss_engine_type */ + HINIC3_NIC_CMD_CFG_RSS_HASH_ENGINE, + /**< Set rss context table info @see > hinic3_rss_context_table */ + HINIC3_NIC_CMD_SET_RSS_CTX_TBL_INTO_FUNC, + /** IP checksum error packets, enable rss quadruple hash */ + /**< Set rss config @see > hinic3_ipcs_err_rss_enable_operation_s */ + HINIC3_NIC_CMD_IPCS_ERR_RSS_ENABLE_OP = 66, + + /** PPA/FDIR */ + HINIC3_NIC_CMD_ADD_TC_FLOW = 80, /**< Add tc flow @see > nic_cmd_fdir_add_rule */ + HINIC3_NIC_CMD_DEL_TC_FLOW, /**< Delete tc flow @see > nic_cmd_fdir_del_rules */ + HINIC3_NIC_CMD_GET_TC_FLOW, /**< Get tc flow @see > nic_cmd_fdir_get_rule */ + HINIC3_NIC_CMD_FLUSH_TCAM, /**< Flush TCAM @see > nic_cmd_flush_tcam_rules */ + /**< Configure TCAM block @see > nic_cmd_ctrl_tcam_block_out */ + HINIC3_NIC_CMD_CFG_TCAM_BLOCK, + /**< Enable TCAM @see > nic_cmd_set_tcam_enable */ + HINIC3_NIC_CMD_ENABLE_TCAM, + /**< Get TCAM block @see > nic_cmd_dfx_fdir_tcam_block_table */ + HINIC3_NIC_CMD_GET_TCAM_BLOCK, + /**< Configure PPA table id @see > hinic3_ppa_cfg_table_id_cmd */ + HINIC3_NIC_CMD_CFG_PPA_TABLE_ID, + /**< Set PPA enable @see > hinic3_ppa_cfg_ppa_en_cmd */ + HINIC3_NIC_CMD_SET_PPA_EN = 88, + /**< Configure PPA mode @see > hinic3_ppa_cfg_mode_cmd */ + HINIC3_NIC_CMD_CFG_PPA_MODE, + /**< Configure PPA flush @see > hinic3_ppa_cfg_flush_cmd */ + HINIC3_NIC_CMD_CFG_PPA_FLUSH, + /**< Set FDIR status @see > hinic3_set_fdir_ethertype_rule */ + HINIC3_NIC_CMD_SET_FDIR_STATUS, + /**< Get PPA counter @see > hinic3_ppa_fdir_query_cmd */ + HINIC3_NIC_CMD_GET_PPA_COUNTER, + /**< Set flow bifur status @see > cmd_flow_bifur_func_handle */ + HINIC3_NIC_CMD_SET_FUNC_FLOW_BIFUR_ENABLE, + /**< Set flow bifur bond @see > cmd_flow_bifur_bond_handle */ + HINIC3_NIC_CMD_SET_BOND_MASK, + /**< Get func tcam table @see > get_fdir_func_tcam_table */ + HINIC3_NIC_CMD_GET_BLOCK_TC_FLOWS, + /**< Get flow bifur bond @see > cmd_flow_bifur_bond_handle */ + HINIC3_NIC_CMD_GET_BOND_MASK, + + /** PORT CFG */ + HINIC3_NIC_CMD_SET_PORT_ENABLE = 100, /**< set port enable @see > hinic3_port_state */ + HINIC3_NIC_CMD_CFG_PAUSE_INFO, /**< Configure pause info @see > hinic3_cmd_pause_config */ + + HINIC3_NIC_CMD_SET_PORT_CAR, /**< Set port Car @see > hinic3_cmd_set_port_car */ + HINIC3_NIC_CMD_SET_ER_DROP_PKT, /**< Unused */ + + HINIC3_NIC_CMD_VF_COS, /**< Get vf CoS @see > hinic3_cmd_vf_dcb_state */ + HINIC3_NIC_CMD_SETUP_COS_MAPPING, /**< Unused */ + HINIC3_NIC_CMD_SET_ETS, /**< Unused */ + HINIC3_NIC_CMD_SET_PFC, /**< Unused */ + HINIC3_NIC_CMD_QOS_ETS, /**< Set QoS ETS @see > hinic3_cmd_ets_cfg */ + HINIC3_NIC_CMD_QOS_PFC, /**< Set QoS PFC @see > hinic3_cmd_set_pfc */ + HINIC3_NIC_CMD_QOS_DCB_STATE, /**< Get QoS DCB state @see > hinic3_cmd_set_dcb_state */ + HINIC3_NIC_CMD_QOS_PORT_CFG, /**< Get QoS port cfg @see > hinic3_cmd_qos_port_cfg */ + HINIC3_NIC_CMD_QOS_MAP_CFG, /**< Get QoS map cfg @see > hinic3_cmd_qos_map_cfg */ + HINIC3_NIC_CMD_FORCE_PKT_DROP, /**< Force pkt drop @see > hinic3_force_pkt_drop */ + /**< Configure nic tx promisc skip @see > hinic3_tx_promisc_cfg */ + HINIC3_NIC_CMD_CFG_TX_PROMISC_SKIP = 114, + /**< Set flow bifur port switch @see > cmd_flow_bifur_port_handle */ + HINIC3_NIC_CMD_SET_PORT_FLOW_BIFUR_ENABLE = 117, + /**< Set tx pause exc notice @see > nic_cmd_tx_pause_notice */ + HINIC3_NIC_CMD_TX_PAUSE_EXCP_NOTICE = 118, + /**< Inquirt pause cfg @see > nic_cmd_pause_inquiry_cfg_s */ + HINIC3_NIC_CMD_INQUIRT_PAUSE_CFG = 119, + + /** MISC */ + HINIC3_NIC_CMD_BIOS_CFG = 120, /**< Set QoS ETS @see > nic_cmd_bios_cfg */ + HINIC3_NIC_CMD_SET_FIRMWARE_CUSTOM_PACKETS_MSG, /**< Set QoS ETS @see > fault_msg_st */ + + /** BOND */ + /**< Create bond device @see > hinic3_cmd_create_bond */ + HINIC3_NIC_CMD_BOND_DEV_CREATE = 134, + HINIC3_NIC_CMD_BOND_DEV_DELETE, /**< Delete bond device @see > hinic3_cmd_delete_bond */ + /**<Open/close bond dev @see > hinic3_cmd_open_close_bond */ + HINIC3_NIC_CMD_BOND_DEV_OPEN_CLOSE, + HINIC3_NIC_CMD_BOND_INFO_GET, /**< Set QoS ETS @see > hinic3_bond_status_info */ + /**< Get bond active info @see > hinic3_bond_active_report_info */ + HINIC3_NIC_CMD_BOND_ACTIVE_INFO_GET, + /**< Bond active notice report @see > nic_cmd_bond_active_report_info */ + HINIC3_NIC_CMD_BOND_ACTIVE_NOTICE, + + /** DFX */ + HINIC3_NIC_CMD_GET_SM_TABLE = 140, /**< Get sm table @see > nic_cmd_dfx_sm_table */ + /**< Set RD line table @see > nic_mpu_lt_opera, < nic_mpu_lt_opera */ + HINIC3_NIC_CMD_RD_LINE_TBL, + + HINIC3_NIC_CMD_SET_UCAPTURE_OPT = 160, /**< TODO: move to roce */ + HINIC3_NIC_CMD_SET_VHD_CFG, /**< Set VHD configuration @see > hinic3_set_vhd_mode */ + + /** TODO: move to HILINK */ + /**< Get port stat @see > hinic3_port_stats_info, < hinic3_port_stats */ + HINIC3_NIC_CMD_GET_PORT_STAT = 200, + HINIC3_NIC_CMD_CLEAN_PORT_STAT, /**< Unused */ + HINIC3_NIC_CMD_CFG_LOOPBACK_MODE, /**< Unused */ + HINIC3_NIC_CMD_GET_SFP_QSFP_INFO, /**< Unused */ + HINIC3_NIC_CMD_SET_SFP_STATUS, /**< Unused */ + HINIC3_NIC_CMD_GET_LIGHT_MODULE_ABS, /**< Unused */ + HINIC3_NIC_CMD_GET_LINK_INFO, /**< Unused */ + HINIC3_NIC_CMD_CFG_AN_TYPE, /**< Unused */ + HINIC3_NIC_CMD_GET_PORT_INFO, /**< Get port info @see > hinic3_cmd_port_info */ + HINIC3_NIC_CMD_SET_LINK_SETTINGS, /**< Unused */ + HINIC3_NIC_CMD_ACTIVATE_BIOS_LINK_CFG, /**< Unused */ + HINIC3_NIC_CMD_RESTORE_LINK_CFG, /**< Unused */ + HINIC3_NIC_CMD_SET_LINK_FOLLOW, /**< Unused */ + HINIC3_NIC_CMD_GET_LINK_STATE, /**< Unused */ + HINIC3_NIC_CMD_LINK_STATUS_REPORT, /**< Unused */ + HINIC3_NIC_CMD_CABLE_PLUG_EVENT, /**< Unused */ + HINIC3_NIC_CMD_LINK_ERR_EVENT, /**< Unused */ + HINIC3_NIC_CMD_SET_LED_STATUS, /**< Unused */ + + HINIC3_NIC_CMD_MAX = 256, +}; + +#endif /* NIC_MPU_CMD_H */ diff --git a/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd.h b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd.h new file mode 100644 index 000000000..65b243a0e --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd.h @@ -0,0 +1,29 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright(c) 2024 Huawei Technologies Co., Ltd */ + +#ifndef NIC_NPU_CMD_H +#define NIC_NPU_CMD_H + +/* NIC CMDQ MODE */ +enum hinic3_ucode_cmd { + /**< Modify queue context. @see > hinic3_sq_ctxt_block */ + HINIC3_UCODE_CMD_MODIFY_QUEUE_CTX = 0, + /**< Clean queue context. @see > hinic3_clean_queue_ctxt */ + HINIC3_UCODE_CMD_CLEAN_QUEUE_CONTEXT, + HINIC3_UCODE_CMD_ARM_SQ, /**< Unused */ + HINIC3_UCODE_CMD_ARM_RQ, /**< Unused */ + /**< Set RSS indir table. @see > nic_rss_indirect_tbl */ + HINIC3_UCODE_CMD_SET_RSS_INDIR_TABLE, + /**< Set RSS indir table. @see > nic_rss_context_tbl */ + HINIC3_UCODE_CMD_SET_RSS_CONTEXT_TABLE, + HINIC3_UCODE_CMD_GET_RSS_INDIR_TABLE, + HINIC3_UCODE_CMD_GET_RSS_CONTEXT_TABLE, /**< Unused */ + HINIC3_UCODE_CMD_SET_IQ_ENABLE, /**< Unused */ + HINIC3_UCODE_CMD_SET_RQ_FLUSH = 10, /**< Set RQ flush. @see > hinic3_cmd_set_rq_flush */ + HINIC3_UCODE_CMD_MODIFY_VLAN_CTX, /**< Get rxq info. @see > nic_vlan_ctx */ + HINIC3_UCODE_CMD_PPA_HASH_TABLE, + /**< Get rxq info. @see > hinic3_rxq_hw, < rxq_check_info */ + HINIC3_UCODE_CMD_RXQ_INFO_GET = 13, +}; + +#endif /* NIC_NPU_CMD_H */ diff --git a/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd_defs.h b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd_defs.h new file mode 100644 index 000000000..b5461ad85 --- /dev/null +++ b/drivers/net/ethernet/huawei/hibifur/include/nic/nic_npu_cmd_defs.h @@ -0,0 +1,133 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright(c) 2024 Huawei Technologies Co., Ltd */ + + +#ifndef NIC_NPU_CMD_DEFS_H +#define NIC_NPU_CMD_DEFS_H + +#include "typedef.h" +#include "nic_cfg_comm.h" + +/* NIC Command Queue Header + * This header is used to indicate the start of a NIC command queue. + * All contexts that follow this header should be consecutive. + */ +struct nic_cmdq_header { + union { + struct { +#if (BYTE_ORDER == BIG_ENDIAN) + /* 0x0:SQ, 0x1:RQ */ + u16 queue_type; + /* queue number in buffer follow this header */ + u16 queue_num; +#else + u16 queue_num; + u16 queue_type; +#endif + } cmdq_ctx_dw0; + + u32 ctx_dw0; + }; + +#if (BYTE_ORDER == BIG_ENDIAN) + u16 rsvd; + u16 start_qid; +#else + u16 start_qid; + u16 rsvd; +#endif +}; + +struct nic_cmdq_context_modify_s { + struct nic_cmdq_header hdr; + u8 data[2016]; +}; + +struct nic_cmdq_clean_q_space { + /* queue_type = 0, TSO (TCP Segmentation Offload) + * queue_type = 1, LRO (Large Receive Offload) + */ + union { + struct { +#if (BYTE_ORDER == BIG_ENDIAN) + u16 queue_type; + u16 queue_num; +#else + u16 queue_num; + u16 queue_type; +#endif + } cmdq_space_dw0; + + u32 space_dw0; + }; + +#if (BYTE_ORDER == BIG_ENDIAN) + u16 rsvd; + u16 start_qid; +#else + u16 start_qid; + u16 rsvd; +#endif + + u32 rsvd1; +}; + +struct nic_cmdq_flush_rq_task { + union { + struct { +#if (BYTE_ORDER == BIG_ENDIAN) + u16 q_id; + u16 glb_rq_id; +#else + u16 glb_rq_id; + u16 q_id; +#endif + } bs; + + u32 value; + } dw0; +}; + +/* arm sq/rq */ +union nic_cmdq_arm { + struct cmdq_arm_dw0_s { +#if (BYTE_ORDER == BIG_ENDIAN) + u16 qpn; + u16 pi; +#else + u16 pi; + u16 qpn; +#endif + } dw0; + + u32 arm_dw0; +}; + +/* rss */ +struct nic_rss_indirect_tbl { + u32 rsvd[4]; // Make sure that 16B beyond entry[] + u16 entry[NIC_RSS_INDIR_SIZE]; +}; + +struct nic_rss_glb_qid_indirect_tbl { + u32 group_index; + u32 offset; + u32 size; + u32 rsvd; /* Make sure that 16B beyond entry[] */ + u16 entry[NIC_RSS_INDIR_SIZE]; +}; + +struct nic_rss_context_tbl { + u32 rsvd[4]; + u32 ctx; +}; + +struct nic_vlan_ctx { + u32 func_id; + u32 qid; /* if qid = 0xFFFF, config current function all queue */ + u32 vlan_id; + u32 vlan_mode; + u32 vlan_sel; +}; + +#endif /* NIC_NPU_CMD_DEFS_H */ diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h b/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h index 14d409b02..64139c49a 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h @@ -45,6 +45,7 @@ enum hinic3_service_type { SERVICE_T_CUSTOM, SERVICE_T_VROCE, SERVICE_T_CRYPT, + SERVICE_T_BIFUR, SERVICE_T_MAX, /* Only used for interruption resource management, @@ -76,6 +77,10 @@ struct ppa_service_cap { u16 rsvd1; }; +struct bifur_service_cap { + u8 rsvd; +}; + struct vbs_service_cap { u16 vbs_max_volq; u8 vbs_main_pf_enable; @@ -785,6 +790,15 @@ bool hinic3_support_toe(void *hwdev, struct toe_service_cap *cap); */ bool hinic3_support_ppa(void *hwdev, struct ppa_service_cap *cap); +/* * + * @brief hinic3_support_bifur - function support bifur + * @param hwdev: device pointer to hwdev + * @param cap: bifur service capbility + * @retval zero: success + * @retval non-zero: failure + */ +bool hinic3_support_bifur(void *hwdev, struct bifur_service_cap *cap); + /* * * @brief hinic3_support_migr - function support migrate * @param hwdev: device pointer to hwdev diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_main.c b/drivers/net/ethernet/huawei/hinic3/hinic3_main.c index d07a1ba04..6f90c868a 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_main.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_main.c @@ -89,6 +89,8 @@ enum hinic3_rx_buff_len { #define CONVERT_UNIT 1024 +#define BIFUR_RESOURCE_PF_SSID 0x5a1 + #ifdef HAVE_MULTI_VLAN_OFFLOAD_EN static int hinic3_netdev_event(struct notifier_block *notifier, unsigned long event, void *ptr); @@ -876,11 +878,13 @@ static int nic_probe(struct hinic3_lld_dev *lld_dev, void **uld_dev, hinic3_register_notifier(nic_dev); #endif - err = register_netdev(netdev); - if (err) { - nic_err(&pdev->dev, "Failed to register netdev\n"); - err = -ENOMEM; - goto netdev_err; + if (pdev->subsystem_device != BIFUR_RESOURCE_PF_SSID) { + err = register_netdev(netdev); + if (err) { + nic_err(&pdev->dev, "Failed to register netdev\n"); + err = -ENOMEM; + goto netdev_err; + } } queue_delayed_work(nic_dev->workq, &nic_dev->periodic_work, HZ); @@ -928,7 +932,9 @@ static void nic_remove(struct hinic3_lld_dev *lld_dev, void *adapter) netdev = nic_dev->netdev; - unregister_netdev(netdev); + if (lld_dev->pdev->subsystem_device != BIFUR_RESOURCE_PF_SSID) + unregister_netdev(netdev); + #ifdef HAVE_MULTI_VLAN_OFFLOAD_EN hinic3_unregister_notifier(nic_dev); #endif diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h b/drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h index 952133f10..18a85f489 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h @@ -1091,9 +1091,18 @@ struct hinic3_bond_mask_cmd { u8 rsvd[3]; }; +struct hinic3_func_er_value_cmd { + struct hinic3_mgmt_msg_head msg_head; + u16 vf_id; + u16 er_fwd_id; +}; + #define HINIC3_TX_SET_PROMISC_SKIP 0 #define HINIC3_TX_GET_PROMISC_SKIP 1 +#define HINIC3_GET_TRAFFIC_BIFUR_STATE 0 +#define HINIC3_SET_TRAFFIC_BIFUR_STATE 1 + struct hinic3_tx_promisc_cfg { struct hinic3_mgmt_msg_head msg_head; u8 port_id; diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_mt.h b/drivers/net/ethernet/huawei/hinic3/hinic3_mt.h index b5bcd8ae8..94e606e96 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_mt.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_mt.h @@ -132,7 +132,8 @@ enum module_name { SEND_TO_MIGRATE_DRIVER, SEND_TO_PPA_DRIVER, SEND_TO_CUSTOM_DRIVER = SEND_TO_SRV_DRV_BASE + 11, - SEND_TO_DRIVER_MAX = SEND_TO_SRV_DRV_BASE + 15, /* reserved */ + SEND_TO_BIFUR_DRIVER = SEND_TO_SRV_DRV_BASE + 15, + SEND_TO_DRIVER_MAX = SEND_TO_SRV_DRV_BASE + 16, /* reserved */ }; enum driver_cmd_type { @@ -208,12 +209,16 @@ enum driver_cmd_type { GET_XSFP_PRESENT = 0x51, GET_XSFP_INFO = 0x52, DEV_NAME_TEST = 0x53, + GET_XSFP_INFO_COMP_CMIS = 0x54, GET_WIN_STAT = 0x60, WIN_CSR_READ = 0x61, WIN_CSR_WRITE = 0x62, WIN_API_CMD_RD = 0x63, + BIFUR_SET_ENABLE = 0xc0, + BIFUR_GET_ENABLE = 0xc1, + VM_COMPAT_TEST = 0xFF }; diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c index 9154a1d27..5e0139aa9 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c @@ -622,6 +622,9 @@ void hinic3_get_card_info(const void *hwdev, void *bufin) if (hinic3_func_for_mgmt(fun_hwdev)) strscpy(info->pf[i].name, "FOR_MGMT", IFNAMSIZ); + if (dev->lld_dev.pdev->subsystem_device == BIFUR_RESOURCE_PF_SSID) + strscpy(info->pf[i].name, "bifur", IFNAMSIZ); + strscpy(info->pf[i].bus_info, pci_name(dev->pcidev), sizeof(info->pf[i].bus_info)); info->pf_num++; diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h index bb7f5bb67..5c7c7cdd8 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h @@ -20,6 +20,8 @@ #define ULD_LOCK_MIN_USLEEP_TIME 900 #define ULD_LOCK_MAX_USLEEP_TIME 1000 +#define BIFUR_RESOURCE_PF_SSID 0x05a1 + #define HINIC3_IS_VF_DEV(pdev) ((pdev)->device == HINIC3_DEV_ID_VF) #define HINIC3_IS_SPU_DEV(pdev) ((pdev)->device == HINIC3_DEV_ID_SPU) diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c index 819c56f42..030ef6df7 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c @@ -1172,6 +1172,20 @@ bool hinic3_support_ppa(void *hwdev, struct ppa_service_cap *cap) } EXPORT_SYMBOL(hinic3_support_ppa); +bool hinic3_support_bifur(void *hwdev, struct bifur_service_cap *cap) +{ + struct hinic3_hwdev *dev = (struct hinic3_hwdev *)hwdev; + + if (!hwdev) + return false; + + if (!IS_BIFUR_TYPE(dev)) + return false; + + return true; +} +EXPORT_SYMBOL(hinic3_support_bifur); + bool hinic3_support_migr(void *hwdev, struct migr_service_cap *cap) { struct hinic3_hwdev *dev = hwdev; diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h index db6e3cab6..671eed69c 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h @@ -322,6 +322,8 @@ struct cfg_mgmt_info { (((u32)(dev)->cfg_mgmt->svc_cap.chip_svc_type) & CFG_SERVICE_MASK_PPA) #define IS_MIGR_TYPE(dev) \ (((u32)(dev)->cfg_mgmt->svc_cap.chip_svc_type) & CFG_SERVICE_MASK_MIGRATE) +#define IS_BIFUR_TYPE(dev) \ + (((u32)(dev)->cfg_mgmt->svc_cap.chip_svc_type) & CFG_SERVICE_MASK_BIFUR) int init_cfg_mgmt(struct hinic3_hwdev *dev); diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c index 0b1c995bd..6ab1b92e7 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c @@ -73,7 +73,7 @@ void hinic3_uld_lock_init(void) static const char *s_uld_name[SERVICE_T_MAX] = { "nic", "ovs", "roce", "toe", "ioe", - "fc", "vbs", "ipsec", "virtio", "migrate", "ppa", "custom"}; + "fc", "vbs", "ipsec", "virtio", "migrate", "ppa", "bifur", "custom"}; const char **hinic3_get_uld_names(void) { diff --git a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c index 4cdc6f6ea..5e4804a96 100644 --- a/drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c +++ b/drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c @@ -550,8 +550,17 @@ static struct hinic3_lld_dev *get_lld_dev_by_nt_msg(struct msg_module *nt_msg) { struct hinic3_lld_dev *lld_dev = NULL; - if (nt_msg->module >= SEND_TO_SRV_DRV_BASE && nt_msg->module < SEND_TO_DRIVER_MAX && - nt_msg->module != SEND_TO_HW_DRIVER && nt_msg->msg_formate != GET_DRV_VERSION) { + if (nt_msg->module == SEND_TO_NIC_DRIVER && (nt_msg->msg_formate == GET_XSFP_INFO || + nt_msg->msg_formate == GET_XSFP_PRESENT || + nt_msg->msg_formate == GET_XSFP_INFO_COMP_CMIS)) { + lld_dev = hinic3_get_lld_dev_by_chip_and_port(nt_msg->device_name, nt_msg->port_id); + } else if (nt_msg->module == SEND_TO_CUSTOM_DRIVER && + nt_msg->msg_formate == CMD_CUSTOM_BOND_GET_CHIP_NAME) { + lld_dev = hinic3_get_lld_dev_by_dev_name(nt_msg->device_name, SERVICE_T_MAX); + } else if (nt_msg->module == SEND_TO_VBS_DRIVER || nt_msg->module == SEND_TO_BIFUR_DRIVER) { + lld_dev = hinic3_get_lld_dev_by_chip_name(nt_msg->device_name); + } else if (nt_msg->module >= SEND_TO_SRV_DRV_BASE && nt_msg->module < SEND_TO_DRIVER_MAX && + nt_msg->msg_formate != GET_DRV_VERSION) { lld_dev = hinic3_get_lld_dev_by_dev_name(nt_msg->device_name, nt_msg->module - SEND_TO_SRV_DRV_BASE); } else { @@ -561,15 +570,6 @@ static struct hinic3_lld_dev *get_lld_dev_by_nt_msg(struct msg_module *nt_msg) SERVICE_T_MAX); } - if (nt_msg->module == SEND_TO_NIC_DRIVER && (nt_msg->msg_formate == GET_XSFP_INFO || - nt_msg->msg_formate == GET_XSFP_PRESENT)) - lld_dev = hinic3_get_lld_dev_by_chip_and_port(nt_msg->device_name, - nt_msg->port_id); - - if (nt_msg->module == SEND_TO_CUSTOM_DRIVER && - nt_msg->msg_formate == CMD_CUSTOM_BOND_GET_CHIP_NAME) - lld_dev = hinic3_get_lld_dev_by_dev_name(nt_msg->device_name, SERVICE_T_MAX); - return lld_dev; } diff --git a/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h b/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h index f56df083a..e7e16fca4 100644 --- a/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h +++ b/drivers/net/ethernet/huawei/hinic3/include/cfg_mgmt/cfg_mgmt_mpu_cmd_defs.h @@ -21,6 +21,7 @@ enum servic_bit_define { SERVICE_BIT_PPA = 11, SERVICE_BIT_MIGRATE = 12, SERVICE_BIT_VROCE = 13, + SERVICE_BIT_BIFUR = 14, SERVICE_BIT_MAX }; @@ -38,6 +39,7 @@ enum servic_bit_define { #define CFG_SERVICE_MASK_PPA (0x1 << SERVICE_BIT_PPA) #define CFG_SERVICE_MASK_MIGRATE (0x1 << SERVICE_BIT_MIGRATE) #define CFG_SERVICE_MASK_VROCE (0x1 << SERVICE_BIT_VROCE) +#define CFG_SERVICE_MASK_BIFUR (0x1 << SERVICE_BIT_BIFUR) /* Definition of the scenario ID in the cfg_data, which is used for SML memory allocation. */ enum scenes_id_define { -- 2.45.1.windows.1

2 1

[PATCH OLK-6.6 00/16] net:yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 07 Jan '25

07 Jan '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (16): motorcomm:yt6801: Add support for a pci table in this module motorcomm:yt6801: Implement pci_driver shutdown motorcomm:yt6801: Implement the fxgmac_drv_probe function motorcomm:yt6801: Implement the .ndo_open function motorcomm:yt6801: Implement the fxgmac_start function motorcomm:yt6801: Implement the poll functions motorcomm:yt6801: Implement the fxgmac_init function motorcomm:yt6801: Implement the fxgmac_read_mac_addr function motorcomm:yt6801: Implement some hw_ops function motorcomm:yt6801: Implement .ndo_start_xmit function motorcomm:yt6801: Implement some net_device_ops function motorcomm:yt6801: Implement .ndo_tx_timeout and .ndo_change_mtu functions motorcomm:yt6801: Implement some ethtool_ops function motorcomm:yt6801: Implement the WOL function of ethtool_ops motorcomm:yt6801: Implement pci_driver suspend and resume motorcomm:yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 8 + arch/arm64/configs/openeuler_defconfig | 2 + arch/riscv/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 9 + .../net/ethernet/motorcomm/yt6801/yt6801.h | 617 +++ .../ethernet/motorcomm/yt6801/yt6801_desc.c | 638 ++++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 39 + .../motorcomm/yt6801/yt6801_ethtool.c | 838 ++++ .../net/ethernet/motorcomm/yt6801/yt6801_hw.c | 3383 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.c | 2907 ++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_net.h | 32 + .../ethernet/motorcomm/yt6801/yt6801_pci.c | 191 + .../ethernet/motorcomm/yt6801/yt6801_type.h | 1398 +++++++ 18 files changed, 10101 insertions(+) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_ethtool.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_hw.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_net.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_pci.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

2 17

[PATCH OLK-6.6] wifi: ath12k: Skip Rx TID cleanup for self peer
by Qi Xi 07 Jan '25

07 Jan '25

From: Ramya Gnanasekar <quic_rgnanase(a)quicinc.com> mainline inclusion from mainline-v6.13-rc1 commit 1a0c640ce1cdcde3eb131a0c1e70ca1ed7cf27cb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADH CVE: CVE-2024-56543 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During peer create, dp setup for the peer is done where Rx TID is updated for all the TIDs. Peer object for self peer will not go through dp setup. When core halts, dp cleanup is done for all the peers. While cleanup, rx_tid::ab is accessed which causes below stack trace for self peer. WARNING: CPU: 6 PID: 12297 at drivers/net/wireless/ath/ath12k/dp_rx.c:851 Call Trace: __warn+0x7b/0x1a0 ath12k_dp_rx_frags_cleanup+0xd2/0xe0 [ath12k] report_bug+0x10b/0x200 handle_bug+0x3f/0x70 exc_invalid_op+0x13/0x60 asm_exc_invalid_op+0x16/0x20 ath12k_dp_rx_frags_cleanup+0xd2/0xe0 [ath12k] ath12k_dp_rx_frags_cleanup+0xca/0xe0 [ath12k] ath12k_dp_rx_peer_tid_cleanup+0x39/0xa0 [ath12k] ath12k_mac_peer_cleanup_all+0x61/0x100 [ath12k] ath12k_core_halt+0x3b/0x100 [ath12k] ath12k_core_reset+0x494/0x4c0 [ath12k] sta object in peer will be updated when remote peer is created. Hence use peer::sta to detect the self peer and skip the cleanup. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Ramya Gnanasekar <quic_rgnanase(a)quicinc.com> Acked-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240905042851.2282306-1-quic_rgnanase@quicinc.com Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/net/wireless/ath/ath12k/mac.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c index 4bb30e403728..f90191a290c2 100644 --- a/drivers/net/wireless/ath/ath12k/mac.c +++ b/drivers/net/wireless/ath/ath12k/mac.c @@ -775,7 +775,10 @@ void ath12k_mac_peer_cleanup_all(struct ath12k *ar) spin_lock_bh(&ab->base_lock); list_for_each_entry_safe(peer, tmp, &ab->peers, list) { - ath12k_dp_rx_peer_tid_cleanup(ar, peer); + /* Skip Rx TID cleanup for self peer */ + if (peer->sta) + ath12k_dp_rx_peer_tid_cleanup(ar, peer); + list_del(&peer->list); kfree(peer); } -- 2.33.0

2 1

[PATCH OLK-5.10] media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
by Qi Xi 07 Jan '25

07 Jan '25

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMP CVE: CVE-2024-56572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here. To mitigate this, free the buffer when allegro_alloc_buffer fails. Fixes: f20387dfd065 ("media: allegro: add Allegro DVT video IP core driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Conflicts: drivers/media/platform/allegro-dvt/allegro-core.c drivers/staging/media/allegro-dvt/allegro-core.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/staging/media/allegro-dvt/allegro-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/allegro-dvt/allegro-core.c b/drivers/staging/media/allegro-dvt/allegro-core.c index 28b6ba895ccd..84bd3d8649a8 100644 --- a/drivers/staging/media/allegro-dvt/allegro-core.c +++ b/drivers/staging/media/allegro-dvt/allegro-core.c @@ -1208,8 +1208,10 @@ static int allocate_buffers_internal(struct allegro_channel *channel, INIT_LIST_HEAD(&buffer->head); err = allegro_alloc_buffer(dev, buffer, size); - if (err) + if (err) { + kfree(buffer); goto err; + } list_add(&buffer->head, list); } -- 2.33.0

2 1

[PATCH OLK-6.6] media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
by Qi Xi 07 Jan '25

07 Jan '25

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMP CVE: CVE-2024-56572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here. To mitigate this, free the buffer when allegro_alloc_buffer fails. Fixes: f20387dfd065 ("media: allegro: add Allegro DVT video IP core driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/media/platform/allegro-dvt/allegro-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/allegro-dvt/allegro-core.c b/drivers/media/platform/allegro-dvt/allegro-core.c index da61f9beb6b4..7dffea2ad88a 100644 --- a/drivers/media/platform/allegro-dvt/allegro-core.c +++ b/drivers/media/platform/allegro-dvt/allegro-core.c @@ -1509,8 +1509,10 @@ static int allocate_buffers_internal(struct allegro_channel *channel, INIT_LIST_HEAD(&buffer->head); err = allegro_alloc_buffer(dev, buffer, size); - if (err) + if (err) { + kfree(buffer); goto err; + } list_add(&buffer->head, list); } -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
by Qi Xi 07 Jan '25

07 Jan '25

From: Frank Li <Frank.Li(a)nxp.com> mainline inclusion from mainline-v6.13-rc1 commit 3082990592f7c6d7510a9133afa46e31bbe26533 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAM5 CVE: CVE-2024-56562 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- if (dev->boardinfo && dev->boardinfo->init_dyn_addr) ^^^ here check "init_dyn_addr" i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...) ^^^^ free "dyn_addr" Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr". Cc: stable(a)kernel.org Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Frank Li <Frank.Li(a)nxp.com> Link: https://lore.kernel.org/r/20241001162608.224039-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/i3c/master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 1c6b78ad5ade..c3f1345c08de 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -1285,7 +1285,7 @@ static void i3c_master_put_i3c_addrs(struct i3c_dev_desc *dev) I3C_ADDR_SLOT_FREE); if (dev->boardinfo && dev->boardinfo->init_dyn_addr) - i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, + i3c_bus_set_addr_slot_status(&master->bus, dev->boardinfo->init_dyn_addr, I3C_ADDR_SLOT_FREE); } -- 2.33.0

2 1

[PATCH OLK-5.10] i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
by Qi Xi 07 Jan '25

07 Jan '25

From: Frank Li <Frank.Li(a)nxp.com> mainline inclusion from mainline-v6.13-rc1 commit 3082990592f7c6d7510a9133afa46e31bbe26533 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAM5 CVE: CVE-2024-56562 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- if (dev->boardinfo && dev->boardinfo->init_dyn_addr) ^^^ here check "init_dyn_addr" i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...) ^^^^ free "dyn_addr" Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr". Cc: stable(a)kernel.org Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Frank Li <Frank.Li(a)nxp.com> Link: https://lore.kernel.org/r/20241001162608.224039-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/i3c/master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 828fb236a63a..2527965a6f24 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -1285,7 +1285,7 @@ static void i3c_master_put_i3c_addrs(struct i3c_dev_desc *dev) I3C_ADDR_SLOT_FREE); if (dev->boardinfo && dev->boardinfo->init_dyn_addr) - i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, + i3c_bus_set_addr_slot_status(&master->bus, dev->boardinfo->init_dyn_addr, I3C_ADDR_SLOT_FREE); } -- 2.33.0

2 1

[PATCH OLK-6.6] i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
by Qi Xi 07 Jan '25

07 Jan '25

From: Frank Li <Frank.Li(a)nxp.com> mainline inclusion from mainline-v6.13-rc1 commit 3082990592f7c6d7510a9133afa46e31bbe26533 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAM5 CVE: CVE-2024-56562 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- if (dev->boardinfo && dev->boardinfo->init_dyn_addr) ^^^ here check "init_dyn_addr" i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...) ^^^^ free "dyn_addr" Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr". Cc: stable(a)kernel.org Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Frank Li <Frank.Li(a)nxp.com> Link: https://lore.kernel.org/r/20241001162608.224039-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/i3c/master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 0e9ff5500a77..70d120dfb090 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -1293,7 +1293,7 @@ static void i3c_master_put_i3c_addrs(struct i3c_dev_desc *dev) I3C_ADDR_SLOT_FREE); if (dev->boardinfo && dev->boardinfo->init_dyn_addr) - i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, + i3c_bus_set_addr_slot_status(&master->bus, dev->boardinfo->init_dyn_addr, I3C_ADDR_SLOT_FREE); } -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
by Zeng Heng 07 Jan '25

07 Jan '25

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> stable inclusion from stable-v5.10.231 commit 0b648968bfa4f5c9c4983bca9f2de17626ed6fb6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOS CVE: CVE-2024-56691 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686fb77712a4bc94b76a0c5ae74c60118b7a0d79 ] While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ). Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them. Fixes: 9c6235c86332 ("mfd: intel_soc_pmic_bxtwc: Add bxt_wcove_usbc device") Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY") Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips") Reported-by: Zhang Ning <zhangn1985(a)outlook.com> Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3… Tested-by: Zhang Ning <zhangn1985(a)outlook.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://lore.kernel.org/r/20241005193029.1929139-2-andriy.shevchenko@linux.… Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/mfd/intel_soc_pmic_bxtwc.c | 61 ++++++++++++++++++++---------- drivers/usb/typec/tcpm/wcove.c | 4 -- 2 files changed, 40 insertions(+), 25 deletions(-) diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c index eba89780dbe7..e1570191795d 100644 --- a/drivers/mfd/intel_soc_pmic_bxtwc.c +++ b/drivers/mfd/intel_soc_pmic_bxtwc.c @@ -240,16 +240,6 @@ static struct mfd_cell bxt_wc_dev[] = { .num_resources = ARRAY_SIZE(thermal_resources), .resources = thermal_resources, }, - { - .name = "bxt_wcove_usbc", - .num_resources = ARRAY_SIZE(usbc_resources), - .resources = usbc_resources, - }, - { - .name = "bxt_wcove_ext_charger", - .num_resources = ARRAY_SIZE(charger_resources), - .resources = charger_resources, - }, { .name = "bxt_wcove_bcu", .num_resources = ARRAY_SIZE(bcu_resources), @@ -271,6 +261,19 @@ static struct mfd_cell bxt_wc_dev[] = { }, }; +static struct mfd_cell bxt_wc_chgr_dev[] = { + { + .name = "bxt_wcove_usbc", + .num_resources = ARRAY_SIZE(usbc_resources), + .resources = usbc_resources, + }, + { + .name = "bxt_wcove_ext_charger", + .num_resources = ARRAY_SIZE(charger_resources), + .resources = charger_resources, + }, +}; + static int regmap_ipc_byte_reg_read(void *context, unsigned int reg, unsigned int *val) { @@ -421,6 +424,26 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, 0, chip, data); } +static int bxtwc_add_chained_devices(struct intel_soc_pmic *pmic, + const struct mfd_cell *cells, int n_devs, + struct regmap_irq_chip_data *pdata, + int pirq, int irq_flags, + const struct regmap_irq_chip *chip, + struct regmap_irq_chip_data **data) +{ + struct device *dev = pmic->dev; + struct irq_domain *domain; + int ret; + + ret = bxtwc_add_chained_irq_chip(pmic, pdata, pirq, irq_flags, chip, data); + if (ret) + return dev_err_probe(dev, ret, "Failed to add %s IRQ chip\n", chip->name); + + domain = regmap_irq_get_domain(*data); + + return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, cells, n_devs, NULL, 0, domain); +} + static int bxtwc_probe(struct platform_device *pdev) { int ret; @@ -520,18 +543,14 @@ static int bxtwc_probe(struct platform_device *pdev) return ret; } - /* Add chained IRQ handler for CHGR IRQs */ - ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, - BXTWC_CHGR_LVL1_IRQ, - IRQF_ONESHOT, - &bxtwc_regmap_irq_chip_chgr, - &pmic->irq_chip_data_chgr); - - - if (ret) { - dev_err(&pdev->dev, "Failed to add CHGR IRQ chip\n"); + ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev), + pmic->irq_chip_data, + BXTWC_CHGR_LVL1_IRQ, + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_chgr, + &pmic->irq_chip_data_chgr); + if (ret) return ret; - } /* Add chained IRQ handler for CRIT IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, diff --git a/drivers/usb/typec/tcpm/wcove.c b/drivers/usb/typec/tcpm/wcove.c index 7e9c279bf49d..22fe8d60fe36 100644 --- a/drivers/usb/typec/tcpm/wcove.c +++ b/drivers/usb/typec/tcpm/wcove.c @@ -620,10 +620,6 @@ static int wcove_typec_probe(struct platform_device *pdev) if (irq < 0) return irq; - irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq); - if (irq < 0) - return irq; - ret = guid_parse(WCOVE_DSM_UUID, &wcove->guid); if (ret) return ret; -- 2.25.1

2 1

[PATCH OLK-5.10] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
by Zeng Heng 07 Jan '25

07 Jan '25

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> stable inclusion from stable-v5.10.231 commit 0b648968bfa4f5c9c4983bca9f2de17626ed6fb6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOS CVE: CVE-2024-56691 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686fb77712a4bc94b76a0c5ae74c60118b7a0d79 ] While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ). Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them. Fixes: 9c6235c86332 ("mfd: intel_soc_pmic_bxtwc: Add bxt_wcove_usbc device") Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY") Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips") Reported-by: Zhang Ning <zhangn1985(a)outlook.com> Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3… Tested-by: Zhang Ning <zhangn1985(a)outlook.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://lore.kernel.org/r/20241005193029.1929139-2-andriy.shevchenko@linux.… Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/mfd/intel_soc_pmic_bxtwc.c | 61 ++++++++++++++++++++---------- drivers/usb/typec/tcpm/wcove.c | 4 -- 2 files changed, 40 insertions(+), 25 deletions(-) diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c index eba89780dbe7..e1570191795d 100644 --- a/drivers/mfd/intel_soc_pmic_bxtwc.c +++ b/drivers/mfd/intel_soc_pmic_bxtwc.c @@ -240,16 +240,6 @@ static struct mfd_cell bxt_wc_dev[] = { .num_resources = ARRAY_SIZE(thermal_resources), .resources = thermal_resources, }, - { - .name = "bxt_wcove_usbc", - .num_resources = ARRAY_SIZE(usbc_resources), - .resources = usbc_resources, - }, - { - .name = "bxt_wcove_ext_charger", - .num_resources = ARRAY_SIZE(charger_resources), - .resources = charger_resources, - }, { .name = "bxt_wcove_bcu", .num_resources = ARRAY_SIZE(bcu_resources), @@ -271,6 +261,19 @@ static struct mfd_cell bxt_wc_dev[] = { }, }; +static struct mfd_cell bxt_wc_chgr_dev[] = { + { + .name = "bxt_wcove_usbc", + .num_resources = ARRAY_SIZE(usbc_resources), + .resources = usbc_resources, + }, + { + .name = "bxt_wcove_ext_charger", + .num_resources = ARRAY_SIZE(charger_resources), + .resources = charger_resources, + }, +}; + static int regmap_ipc_byte_reg_read(void *context, unsigned int reg, unsigned int *val) { @@ -421,6 +424,26 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, 0, chip, data); } +static int bxtwc_add_chained_devices(struct intel_soc_pmic *pmic, + const struct mfd_cell *cells, int n_devs, + struct regmap_irq_chip_data *pdata, + int pirq, int irq_flags, + const struct regmap_irq_chip *chip, + struct regmap_irq_chip_data **data) +{ + struct device *dev = pmic->dev; + struct irq_domain *domain; + int ret; + + ret = bxtwc_add_chained_irq_chip(pmic, pdata, pirq, irq_flags, chip, data); + if (ret) + return dev_err_probe(dev, ret, "Failed to add %s IRQ chip\n", chip->name); + + domain = regmap_irq_get_domain(*data); + + return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, cells, n_devs, NULL, 0, domain); +} + static int bxtwc_probe(struct platform_device *pdev) { int ret; @@ -520,18 +543,14 @@ static int bxtwc_probe(struct platform_device *pdev) return ret; } - /* Add chained IRQ handler for CHGR IRQs */ - ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, - BXTWC_CHGR_LVL1_IRQ, - IRQF_ONESHOT, - &bxtwc_regmap_irq_chip_chgr, - &pmic->irq_chip_data_chgr); - - - if (ret) { - dev_err(&pdev->dev, "Failed to add CHGR IRQ chip\n"); + ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev), + pmic->irq_chip_data, + BXTWC_CHGR_LVL1_IRQ, + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_chgr, + &pmic->irq_chip_data_chgr); + if (ret) return ret; - } /* Add chained IRQ handler for CRIT IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, diff --git a/drivers/usb/typec/tcpm/wcove.c b/drivers/usb/typec/tcpm/wcove.c index 7e9c279bf49d..22fe8d60fe36 100644 --- a/drivers/usb/typec/tcpm/wcove.c +++ b/drivers/usb/typec/tcpm/wcove.c @@ -620,10 +620,6 @@ static int wcove_typec_probe(struct platform_device *pdev) if (irq < 0) return irq; - irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq); - if (irq < 0) - return irq; - ret = guid_parse(WCOVE_DSM_UUID, &wcove->guid); if (ret) return ret; -- 2.25.1

2 1

[PATCH OLK-6.6] usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
by Liu Mingrui 07 Jan '25

07 Jan '25

From: Lianqin Hu <hulianqin(a)vivo.com> stable inclusion from stable-v6.6.67 commit 8ca07a3d18f39b1669927ef536e485787e856df6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO8 CVE: CVE-2024-56670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4cfbca86f6a8b801f3254e0e3c8f2b1d2d64be2b upstream. Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Thread A is executing the open operation and calling the gs_open, Thread B is executing the disconnect operation and calling the gserial_disconnect function,The port->port_usb pointer will be set to NULL. E.g. Thread A Thread B gs_open() gadget_unbind_driver() gs_start_io() composite_disconnect() gs_start_rx() gserial_disconnect() ... ... spin_unlock(&port->port_lock) status = usb_ep_queue() spin_lock(&port->port_lock) spin_lock(&port->port_lock) port->port_usb = NULL gs_free_requests(port->port_usb->in) spin_unlock(&port->port_lock) Crash This causes thread A to access a null pointer (port->port_usb is null) when calling the gs_free_requests function, causing a crash. If port_usb is NULL, the release request will be skipped as it will be done by gserial_disconnect. So add a null pointer check to gs_start_io before attempting to access the value of the pointer port->port_usb. Call trace: gs_start_io+0x164/0x25c gs_open+0x108/0x13c tty_open+0x314/0x638 chrdev_open+0x1b8/0x258 do_dentry_open+0x2c4/0x700 vfs_open+0x2c/0x3c path_openat+0xa64/0xc60 do_filp_open+0xb8/0x164 do_sys_openat2+0x84/0xf0 __arm64_sys_openat+0x70/0x9c invoke_syscall+0x58/0x114 el0_svc_common+0x80/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x38/0x68 Fixes: c1dca562be8a ("usb gadget: split out serial core") Cc: stable(a)vger.kernel.org Suggested-by: Prashanth K <quic_prashk(a)quicinc.com> Signed-off-by: Lianqin Hu <hulianqin(a)vivo.com> Acked-by: Prashanth K <quic_prashk(a)quicinc.com> Link: https://lore.kernel.org/r/TYUPR06MB62178DC3473F9E1A537DCD02D2362@TYUPR06MB6… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/gadget/function/u_serial.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 8962f96ae729..729b0472bab0 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -575,9 +575,12 @@ static int gs_start_io(struct gs_port *port) * we didn't in gs_start_tx() */ tty_wakeup(port->port.tty); } else { - gs_free_requests(ep, head, &port->read_allocated); - gs_free_requests(port->port_usb->in, &port->write_pool, - &port->write_allocated); + /* Free reqs only if we are still connected */ + if (port->port_usb) { + gs_free_requests(ep, head, &port->read_allocated); + gs_free_requests(port->port_usb->in, &port->write_pool, + &port->write_allocated); + } status = -EIO; } -- 2.25.1

2 1

[PATCH OLK-6.6] net/mlx5: DR, prevent potential error pointer dereference
by Wang Wensheng 07 Jan '25

07 Jan '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.67 commit 325cf73a1b449fea3158ab99d03a7a717aad1618 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMV CVE: CVE-2024-56660 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=325c… -------------------------------- [ Upstream commit 11776cff0b563c8b8a4fa76cab620bfb633a8cb8 ] The dr_domain_add_vport_cap() function generally returns NULL on error but sometimes we want it to return ERR_PTR(-EBUSY) so the caller can retry. The problem here is that "ret" can be either -EBUSY or -ENOMEM and if it's and -ENOMEM then the error pointer is propogated back and eventually dereferenced in dr_ste_v0_build_src_gvmi_qpn_tag(). Fixes: 11a45def2e19 ("net/mlx5: DR, Add support for SF vports") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/07477254-e179-43e2-b1b3-3b9db4674195@stanley.mount… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c index 3d74109f8230..49f22cad92bf 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c @@ -297,7 +297,9 @@ dr_domain_add_vport_cap(struct mlx5dr_domain *dmn, u16 vport) if (ret) { mlx5dr_dbg(dmn, "Couldn't insert new vport into xarray (%d)\n", ret); kvfree(vport_caps); - return ERR_PTR(ret); + if (ret == -EBUSY) + return ERR_PTR(-EBUSY); + return NULL; } return vport_caps; -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] BMA: Fix Oops and spin lock deadlock problem, and change the version number.
by Yuan Can 07 Jan '25

07 Jan '25

From: Wujiahai <wujiahai(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBD74A CVE: NA ----------------------------------------- 1. Prevents iBMA driver from causing Oops problems. 2. The spin lock deadlock bug of the ibma iBMA is fixed. 3. Change the iBMA driver version. Fixes: ea190d90c609 ("Huawei BMA: Adding Huawei BMA driver: host_edma_drv") Signed-off-by: Wujiahai <wujiahai(a)huawei.com> --- drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c | 10 ++++++++-- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 9 --------- .../net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 6 files changed, 12 insertions(+), 15 deletions(-) diff --git a/drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c b/drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c index 4be8a4fc6cec..275c2cdfe5db 100644 --- a/drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c +++ b/drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c @@ -28,7 +28,7 @@ #ifdef DRV_VERSION #define CDEV_VERSION MICRO_TO_STR(DRV_VERSION) #else -#define CDEV_VERSION "0.3.8" +#define CDEV_VERSION "0.3.10" #endif #define CDEV_DEFAULT_NUM 4 diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c b/drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c index 556130ab8a65..baa65b8885ff 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c @@ -135,6 +135,7 @@ static void bma_priv_clean_up(struct bma_priv_data_s *bma_priv) int i = 0; struct bma_priv_data_s *priv = bma_priv; struct edma_recv_msg_s *msg = NULL; + unsigned long flags = 0; if (!priv) return; @@ -144,6 +145,7 @@ static void bma_priv_clean_up(struct bma_priv_data_s *bma_priv) return; } + spin_lock_irqsave(&priv->recv_msg_lock, flags); for (i = 0; i < priv->user.max_recvmsg_nums; i++) { ret = edma_host_recv_msg(&g_bma_dev->edma_host, priv, &msg); if (ret) @@ -151,6 +153,7 @@ static void bma_priv_clean_up(struct bma_priv_data_s *bma_priv) kfree(msg); } + spin_unlock_irqrestore(&priv->recv_msg_lock, flags); priv->user.type = TYPE_UNKNOWN; priv->user.sub_type = 0; @@ -419,8 +422,8 @@ EXPORT_SYMBOL(bma_intf_int_to_bmc); int bma_intf_is_link_ok(void) { - if ((&g_bma_dev->edma_host != NULL) && - (g_bma_dev->edma_host.statistics.remote_status == REGISTERED)) + if (g_bma_dev && + g_bma_dev->edma_host.statistics.remote_status == REGISTERED) return 1; return 0; } @@ -432,6 +435,7 @@ int bma_cdev_recv_msg(void *handle, char __user *data, size_t count) struct edma_recv_msg_s *msg = NULL; int result = 0; int len = 0; + unsigned long flags = 0; if (!handle || !data || count == 0) { BMA_LOG(DLOG_DEBUG, "input NULL point!\n"); @@ -440,7 +444,9 @@ int bma_cdev_recv_msg(void *handle, char __user *data, size_t count) priv = (struct bma_priv_data_s *)handle; + spin_lock_irqsave(&priv->recv_msg_lock, flags); result = edma_host_recv_msg(&g_bma_dev->edma_host, priv, &msg); + spin_unlock_irqrestore(&priv->recv_msg_lock, flags); if (result != 0) return -ENODATA; diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h b/drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h index d1c62a77a434..7639b11a3f50 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h +++ b/drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h @@ -71,7 +71,7 @@ struct bma_pci_dev_s { #ifdef DRV_VERSION #define BMA_VERSION MICRO_TO_STR(DRV_VERSION) #else -#define BMA_VERSION "0.3.8" +#define BMA_VERSION "0.3.10" #endif #ifdef CONFIG_ARM64 diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c b/drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c index 4641e359e8fc..d9da64b94eb9 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c @@ -1069,21 +1069,14 @@ int edma_host_recv_msg(struct edma_host_s *edma_host, struct bma_priv_data_s *priv, struct edma_recv_msg_s **msg) { - unsigned long flags = 0; struct list_head *entry = NULL; struct edma_recv_msg_s *msg_tmp = NULL; - struct bma_dev_s *bma_dev = NULL; if (!edma_host || !priv || !msg) return -EAGAIN; - bma_dev = list_entry(edma_host, struct bma_dev_s, edma_host); - - spin_lock_irqsave(&bma_dev->priv_list_lock, flags); - if (list_empty(&priv->recv_msgs)) { priv->user.cur_recvmsg_nums = 0; - spin_unlock_irqrestore(&bma_dev->priv_list_lock, flags); BMA_LOG(DLOG_DEBUG, "recv msgs empty\n"); return -EAGAIN; } @@ -1095,8 +1088,6 @@ int edma_host_recv_msg(struct edma_host_s *edma_host, if (priv->user.cur_recvmsg_nums > 0) priv->user.cur_recvmsg_nums--; - spin_unlock_irqrestore(&bma_dev->priv_list_lock, flags); - *msg = msg_tmp; BMA_LOG(DLOG_DEBUG, "msg->msg_len = %d\n", (int)msg_tmp->msg_len); diff --git a/drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h b/drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h index 8371903e2c33..0d82ee6f7c83 100644 --- a/drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h +++ b/drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h @@ -23,7 +23,7 @@ #ifdef DRV_VERSION #define KBOX_VERSION MICRO_TO_STR(DRV_VERSION) #else -#define KBOX_VERSION "0.3.8" +#define KBOX_VERSION "0.3.10" #endif #define UNUSED(x) (x = x) diff --git a/drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h b/drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h index f03e6eccde6c..242d3ec128d3 100644 --- a/drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h +++ b/drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h @@ -31,7 +31,7 @@ extern "C" { #ifdef DRV_VERSION #define VETH_VERSION MICRO_TO_STR(DRV_VERSION) #else -#define VETH_VERSION "0.3.8" +#define VETH_VERSION "0.3.10" #endif #define MODULE_NAME "veth" -- 2.22.0

2 1

[PATCH OLK-6.6] net: enetc: Do not configure preemptible TCs if SIs do not support
by Li Huafei 07 Jan '25

07 Jan '25

From: Wei Fang <wei.fang(a)nxp.com> stable inclusion from stable-v6.6.66 commit 66127f0d1ecf00604aeab71132bde398fd9ec7c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO0 CVE: CVE-2024-56649 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b2420b8c81ec674552d00c55d46245e5c184b260 ] Both ENETC PF and VF drivers share enetc_setup_tc_mqprio() to configure MQPRIO. And enetc_setup_tc_mqprio() calls enetc_change_preemptible_tcs() to configure preemptible TCs. However, only PF is able to configure preemptible TCs. Because only PF has related registers, while VF does not have these registers. So for VF, its hw->port pointer is NULL. Therefore, VF will access an invalid pointer when accessing a non-existent register, which will cause a crash issue. The simplified log is as follows. root@ls1028ardb:~# tc qdisc add dev eno0vf0 parent root handle 100: \ mqprio num_tc 4 map 0 0 1 1 2 2 3 3 queues 1@0 1@1 1@2 1@3 hw 1 [ 187.290775] Unable to handle kernel paging request at virtual address 0000000000001f00 [ 187.424831] pc : enetc_mm_commit_preemptible_tcs+0x1c4/0x400 [ 187.430518] lr : enetc_mm_commit_preemptible_tcs+0x30c/0x400 [ 187.511140] Call trace: [ 187.513588] enetc_mm_commit_preemptible_tcs+0x1c4/0x400 [ 187.518918] enetc_setup_tc_mqprio+0x180/0x214 [ 187.523374] enetc_vf_setup_tc+0x1c/0x30 [ 187.527306] mqprio_enable_offload+0x144/0x178 [ 187.531766] mqprio_init+0x3ec/0x668 [ 187.535351] qdisc_create+0x15c/0x488 [ 187.539023] tc_modify_qdisc+0x398/0x73c [ 187.542958] rtnetlink_rcv_msg+0x128/0x378 [ 187.547064] netlink_rcv_skb+0x60/0x130 [ 187.550910] rtnetlink_rcv+0x18/0x24 [ 187.554492] netlink_unicast+0x300/0x36c [ 187.558425] netlink_sendmsg+0x1a8/0x420 [ 187.606759] ---[ end trace 0000000000000000 ]--- In addition, some PFs also do not support configuring preemptible TCs, such as eno1 and eno3 on LS1028A. It won't crash like it does for VFs, but we should prevent these PFs from accessing these unimplemented registers. Fixes: 827145392a4a ("net: enetc: only commit preemptible TCs to hardware when MM TX is active") Signed-off-by: Wei Fang <wei.fang(a)nxp.com> Suggested-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Reviewed-by: Frank Li <Frank.Li(a)nxp.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/net/ethernet/freescale/enetc/enetc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c index c17b9e338516..87b27bd7a13b 100644 --- a/drivers/net/ethernet/freescale/enetc/enetc.c +++ b/drivers/net/ethernet/freescale/enetc/enetc.c @@ -28,6 +28,9 @@ EXPORT_SYMBOL_GPL(enetc_port_mac_wr); static void enetc_change_preemptible_tcs(struct enetc_ndev_priv *priv, u8 preemptible_tcs) { + if (!(priv->si->hw_features & ENETC_SI_F_QBU)) + return; + priv->preemptible_tcs = preemptible_tcs; enetc_mm_commit_preemptible_tcs(priv); } -- 2.25.1

2 1

[PATCH OLK-6.6] nvme-pci: fix freeing of the HMB descriptor table
by Yu Kuai 07 Jan '25

07 Jan '25

From: Christoph Hellwig <hch(a)lst.de> stable inclusion from stable-v6.6.64 commit cee3bff51a35cab1c5d842d409a7b11caefe2386 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGM CVE: CVE-2024-56756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a ] The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent. In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page. Fixes: 87ad72a59a38 ("nvme-pci: implement host memory buffer support") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/nvme/host/pci.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index b701969cf1c2..e0b502573b42 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -153,6 +153,7 @@ struct nvme_dev { /* host memory buffer support: */ u64 host_mem_size; u32 nr_host_mem_descs; + u32 host_mem_descs_size; dma_addr_t host_mem_descs_dma; struct nvme_host_mem_buf_desc *host_mem_descs; void **host_mem_desc_bufs; @@ -1929,10 +1930,10 @@ static void nvme_free_host_mem(struct nvme_dev *dev) kfree(dev->host_mem_desc_bufs); dev->host_mem_desc_bufs = NULL; - dma_free_coherent(dev->dev, - dev->nr_host_mem_descs * sizeof(*dev->host_mem_descs), + dma_free_coherent(dev->dev, dev->host_mem_descs_size, dev->host_mem_descs, dev->host_mem_descs_dma); dev->host_mem_descs = NULL; + dev->host_mem_descs_size = 0; dev->nr_host_mem_descs = 0; } @@ -1940,7 +1941,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, u32 chunk_size) { struct nvme_host_mem_buf_desc *descs; - u32 max_entries, len; + u32 max_entries, len, descs_size; dma_addr_t descs_dma; int i = 0; void **bufs; @@ -1953,8 +1954,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries) max_entries = dev->ctrl.hmmaxd; - descs = dma_alloc_coherent(dev->dev, max_entries * sizeof(*descs), - &descs_dma, GFP_KERNEL); + descs_size = max_entries * sizeof(*descs); + descs = dma_alloc_coherent(dev->dev, descs_size, &descs_dma, + GFP_KERNEL); if (!descs) goto out; @@ -1983,6 +1985,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, dev->host_mem_size = size; dev->host_mem_descs = descs; dev->host_mem_descs_dma = descs_dma; + dev->host_mem_descs_size = descs_size; dev->host_mem_desc_bufs = bufs; return 0; @@ -1997,8 +2000,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, kfree(bufs); out_free_descs: - dma_free_coherent(dev->dev, max_entries * sizeof(*descs), descs, - descs_dma); + dma_free_coherent(dev->dev, descs_size, descs, descs_dma); out: dev->host_mem_descs = NULL; return -ENOMEM; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
by Zeng Heng 07 Jan '25

07 Jan '25

From: Yongliang Gao <leonylgao(a)tencent.com> stable inclusion from stable-v6.6.64 commit dd4b1cbcc916fad5d10c2662b62def9f05e453d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFG CVE: CVE-2024-56739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d ] If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware. When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, they will continually expire, may causing kernel softlockup. Fixes: 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") Signed-off-by: Yongliang Gao <leonylgao(a)tencent.com> Acked-by: Jingqun Li <jingqunli(a)tencent.com> Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rtc/interface.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index ce051f91829f..1ab619fb978a 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -914,13 +914,18 @@ void rtc_timer_do_work(struct work_struct *work) struct timerqueue_node *next; ktime_t now; struct rtc_time tm; + int err; struct rtc_device *rtc = container_of(work, struct rtc_device, irqwork); mutex_lock(&rtc->ops_lock); again: - __rtc_read_time(rtc, &tm); + err = __rtc_read_time(rtc, &tm); + if (err) { + mutex_unlock(&rtc->ops_lock); + return; + } now = rtc_tm_to_ktime(tm); while ((next = timerqueue_getnext(&rtc->timerqueue))) { if (next->expires > now) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
by Zeng Heng 07 Jan '25

07 Jan '25

From: Yongliang Gao <leonylgao(a)tencent.com> stable inclusion from stable-v6.6.64 commit dd4b1cbcc916fad5d10c2662b62def9f05e453d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFG CVE: CVE-2024-56739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d ] If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware. When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, they will continually expire, may causing kernel softlockup. Fixes: 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") Signed-off-by: Yongliang Gao <leonylgao(a)tencent.com> Acked-by: Jingqun Li <jingqunli(a)tencent.com> Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rtc/interface.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index 16fbcf6835f3..809ada324e4d 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -908,13 +908,18 @@ void rtc_timer_do_work(struct work_struct *work) struct timerqueue_node *next; ktime_t now; struct rtc_time tm; + int err; struct rtc_device *rtc = container_of(work, struct rtc_device, irqwork); mutex_lock(&rtc->ops_lock); again: - __rtc_read_time(rtc, &tm); + err = __rtc_read_time(rtc, &tm); + if (err) { + mutex_unlock(&rtc->ops_lock); + return; + } now = rtc_tm_to_ktime(tm); while ((next = timerqueue_getnext(&rtc->timerqueue))) { if (next->expires > now) -- 2.25.1

2 1

[PATCH OLK-5.10] rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
by Zeng Heng 07 Jan '25

07 Jan '25

From: Yongliang Gao <leonylgao(a)tencent.com> stable inclusion from stable-v6.6.64 commit dd4b1cbcc916fad5d10c2662b62def9f05e453d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFG CVE: CVE-2024-56739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d ] If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware. When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, they will continually expire, may causing kernel softlockup. Fixes: 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") Signed-off-by: Yongliang Gao <leonylgao(a)tencent.com> Acked-by: Jingqun Li <jingqunli(a)tencent.com> Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rtc/interface.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index 16fbcf6835f3..809ada324e4d 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -908,13 +908,18 @@ void rtc_timer_do_work(struct work_struct *work) struct timerqueue_node *next; ktime_t now; struct rtc_time tm; + int err; struct rtc_device *rtc = container_of(work, struct rtc_device, irqwork); mutex_lock(&rtc->ops_lock); again: - __rtc_read_time(rtc, &tm); + err = __rtc_read_time(rtc, &tm); + if (err) { + mutex_unlock(&rtc->ops_lock); + return; + } now = rtc_tm_to_ktime(tm); while ((next = timerqueue_getnext(&rtc->timerqueue))) { if (next->expires > now) -- 2.25.1

2 1

[PATCH OLK-6.6] io_uring: check for overflows in io_pin_pages
by Long Li 07 Jan '25

07 Jan '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 0c0a4eae26ac78379d0c1db053de168a8febc6c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFR CVE: CVE-2024-53187 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 Call Trace: <TASK> __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183 io_rings_map io_uring/io_uring.c:2611 [inline] io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470 io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692 io_uring_setup io_uring/io_uring.c:3781 [inline] ... </TASK> io_pin_pages()'s uaddr parameter came directly from the user and can be garbage. Don't just add size to it as it can overflow. Cc: stable(a)vger.kernel.org Reported-by: syzbot+2159cbb522b02847c053(a)syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/1b7520ddb168e1d537d64be47414a0629d0d8f8f.17325810… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/rsrc.c io_uring/memmap.c [Conflicts due to io_pin_pages() move to io_uring/memmap.c in mainline] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/rsrc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 0f9dcde72ebf..7ca3d2d2290e 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -879,7 +879,12 @@ struct page **io_pin_pages(unsigned long ubuf, unsigned long len, int *npages) struct page **pages = NULL; int pret, ret = -ENOMEM; - end = (ubuf + len + PAGE_SIZE - 1) >> PAGE_SHIFT; + if (check_add_overflow(ubuf, len, &end)) + return ERR_PTR(-EOVERFLOW); + if (check_add_overflow(end, PAGE_SIZE - 1, &end)) + return ERR_PTR(-EOVERFLOW); + + end = end >> PAGE_SHIFT; start = ubuf >> PAGE_SHIFT; nr_pages = end - start; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] NFSv4: Fix deadlock during the running of state manager
by Li Lingfeng 07 Jan '25

07 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBAFF1 -------------------------------- Unlinking file may cause the following deadlock in state manager: [root@localhost test]# cat /proc/2943/stack [<0>] rpc_wait_bit_killable+0x1a/0x90 [<0>] _nfs4_proc_delegreturn+0x60f/0x760 [<0>] nfs4_proc_delegreturn+0x13d/0x2a0 [<0>] nfs_do_return_delegation+0xba/0x110 [<0>] nfs_end_delegation_return+0x32c/0x620 [<0>] nfs_complete_unlink+0xc7/0x290 [<0>] nfs_dentry_iput+0x36/0x50 [<0>] __dentry_kill+0xaa/0x250 [<0>] dput.part.0+0x26c/0x4d0 [<0>] __put_nfs_open_context+0x1d9/0x260 [<0>] nfs4_open_reclaim+0x77/0xa0 [<0>] nfs4_do_reclaim+0x385/0xf40 [<0>] nfs4_state_manager+0x762/0x14e0 [<0>] nfs4_run_state_manager+0x181/0x330 [<0>] kthread+0x1a7/0x1f0 [<0>] ret_from_fork+0x34/0x60 [<0>] ret_from_fork_asm+0x1a/0x30 [root@localhost test]# It can be reproduced by following steps: 1) client: open file 2) client: unlink file 3) server: service restart(trigger state manager in client) 4) client: close file(in nfs4_open_reclaim, between nfs4_do_open_reclaim and put_nfs_open_context) Since the file has been open, unlinking will just set DCACHE_NFSFS_RENAMED for the dentry like this: nfs_unlink nfs_sillyrename nfs_async_unlink // set DCACHE_NFSFS_RENAMED Restarting service will trigger state manager in client. (1) NFS4_SLOT_TBL_DRAINING will be set to nfs4_slot_table since session has been reset. (2) DCACHE_NFSFS_RENAMED is detected in nfs_dentry_iput. Therefore, nfs_complete_unlink is called to trigger delegation return. (3) Due to the slot table being in draining state and sa_privileged being 0, the delegation return will be queued and wait. nfs4_state_manager nfs4_reset_session nfs4_begin_drain_session nfs4_drain_slot_tbl // set NFS4_SLOT_TBL_DRAINING (1) nfs4_do_reclaim nfs4_open_reclaim __put_nfs_open_context __dentry_kill nfs_dentry_iput // check DCACHE_NFSFS_RENAMED (2) nfs_complete_unlink nfs_end_delegation_return nfs_do_return_delegation nfs4_proc_delegreturn _nfs4_proc_delegreturn rpc_run_task ... nfs4_delegreturn_prepare nfs4_setup_sequence nfs4_slot_tbl_draining // check NFS4_SLOT_TBL_DRAINING // and sa_privileged is 0 (3) rpc_sleep_on // set queued and add to slot_tbl_waitq // rpc_task is async and wait in __rpc_execute rpc_wait_for_completion_task __rpc_wait_for_completion_task out_of_line_wait_on_bit rpc_wait_bit_killable // wait for rpc_task to complete <-------- can not get here to wake up rpc_task --------> nfs4_end_drain_session nfs4_end_drain_slot_table nfs41_wake_slot_table On the one hand, the state manager is blocked by the unfinished delegation return. As a result, nfs4_end_drain_session cannot be invoked to clear NFS4_SLOT_TBL_DRAINING and wake up waiting tasks. On the other hand, since NFS4_SLOT_TBL_DRAINING is not cleared, delegation return can only wait in the queue, resulting in a deadlock. Fix it by turning the delegation return into a privileged operation for the case where the nfs_client is in NFS4CLNT_RECLAIM_REBOOT state. Fixes: 977fcc2b0b41 ("NFS: Add a delegation return into nfs4_proc_unlink_setup()") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 5985f326550e..282e5559b176 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6295,7 +6295,8 @@ static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, co data->lr.roc = false; } - if (!data->inode) + if (!data->inode || + test_bit(NFS4CLNT_RECLAIM_REBOOT, &server->nfs_client->cl_state)) nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1, 1); else -- 2.31.1

2 1

[PATCH OLK-6.6] mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
by Zeng Heng 07 Jan '25

07 Jan '25

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> stable inclusion from stable-v6.6.64 commit e1ef62e8d262e3f27446d26742208c1c81e9ee18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOS CVE: CVE-2024-56691 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686fb77712a4bc94b76a0c5ae74c60118b7a0d79 ] While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ). Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them. Fixes: 9c6235c86332 ("mfd: intel_soc_pmic_bxtwc: Add bxt_wcove_usbc device") Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY") Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips") Reported-by: Zhang Ning <zhangn1985(a)outlook.com> Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3… Tested-by: Zhang Ning <zhangn1985(a)outlook.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Link: https://lore.kernel.org/r/20241005193029.1929139-2-andriy.shevchenko@linux.… Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/mfd/intel_soc_pmic_bxtwc.c | 57 +++++++++++++++++++++--------- drivers/usb/typec/tcpm/wcove.c | 4 --- 2 files changed, 40 insertions(+), 21 deletions(-) diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c index 8dac0d41f64f..6ea98321bbf2 100644 --- a/drivers/mfd/intel_soc_pmic_bxtwc.c +++ b/drivers/mfd/intel_soc_pmic_bxtwc.c @@ -241,16 +241,6 @@ static struct mfd_cell bxt_wc_dev[] = { .num_resources = ARRAY_SIZE(thermal_resources), .resources = thermal_resources, }, - { - .name = "bxt_wcove_usbc", - .num_resources = ARRAY_SIZE(usbc_resources), - .resources = usbc_resources, - }, - { - .name = "bxt_wcove_ext_charger", - .num_resources = ARRAY_SIZE(charger_resources), - .resources = charger_resources, - }, { .name = "bxt_wcove_bcu", .num_resources = ARRAY_SIZE(bcu_resources), @@ -272,6 +262,19 @@ static struct mfd_cell bxt_wc_dev[] = { }, }; +static struct mfd_cell bxt_wc_chgr_dev[] = { + { + .name = "bxt_wcove_usbc", + .num_resources = ARRAY_SIZE(usbc_resources), + .resources = usbc_resources, + }, + { + .name = "bxt_wcove_ext_charger", + .num_resources = ARRAY_SIZE(charger_resources), + .resources = charger_resources, + }, +}; + static int regmap_ipc_byte_reg_read(void *context, unsigned int reg, unsigned int *val) { @@ -426,6 +429,26 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic, 0, chip, data); } +static int bxtwc_add_chained_devices(struct intel_soc_pmic *pmic, + const struct mfd_cell *cells, int n_devs, + struct regmap_irq_chip_data *pdata, + int pirq, int irq_flags, + const struct regmap_irq_chip *chip, + struct regmap_irq_chip_data **data) +{ + struct device *dev = pmic->dev; + struct irq_domain *domain; + int ret; + + ret = bxtwc_add_chained_irq_chip(pmic, pdata, pirq, irq_flags, chip, data); + if (ret) + return dev_err_probe(dev, ret, "Failed to add %s IRQ chip\n", chip->name); + + domain = regmap_irq_get_domain(*data); + + return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, cells, n_devs, NULL, 0, domain); +} + static int bxtwc_probe(struct platform_device *pdev) { struct device *dev = &pdev->dev; @@ -501,14 +524,14 @@ static int bxtwc_probe(struct platform_device *pdev) if (ret) return dev_err_probe(dev, ret, "Failed to add ADC IRQ chip\n"); - /* Add chained IRQ handler for CHGR IRQs */ - ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, - BXTWC_CHGR_LVL1_IRQ, - IRQF_ONESHOT, - &bxtwc_regmap_irq_chip_chgr, - &pmic->irq_chip_data_chgr); + ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev), + pmic->irq_chip_data, + BXTWC_CHGR_LVL1_IRQ, + IRQF_ONESHOT, + &bxtwc_regmap_irq_chip_chgr, + &pmic->irq_chip_data_chgr); if (ret) - return dev_err_probe(dev, ret, "Failed to add CHGR IRQ chip\n"); + return ret; /* Add chained IRQ handler for CRIT IRQs */ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data, diff --git a/drivers/usb/typec/tcpm/wcove.c b/drivers/usb/typec/tcpm/wcove.c index 87d4abde0ea2..e08244f555f0 100644 --- a/drivers/usb/typec/tcpm/wcove.c +++ b/drivers/usb/typec/tcpm/wcove.c @@ -621,10 +621,6 @@ static int wcove_typec_probe(struct platform_device *pdev) if (irq < 0) return irq; - irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq); - if (irq < 0) - return irq; - ret = guid_parse(WCOVE_DSM_UUID, &wcove->guid); if (ret) return ret; -- 2.25.1

2 1

[PATCH OLK-6.6 0/6] LoongArch: fix some dwmac/pci/SE/i2c/interrupt issues
by Hongchen Zhang 07 Jan '25

07 Jan '25

Zhao Qunqin (3): pci/quirks: LS7A2000: fix pm transition of devices under pcie port net: stmmac: dwmac-loongson: fix Mac DMA reset drivers/char: add ACPI firmware support for Loongson SE driver wanghongliang (3): LoongArch: fix i2c related issues LoongArch: eiointc: fix ext irq route error LoongArch: adjust the calc method of number of packages. arch/loongarch/configs/loongson3_defconfig | 2 + arch/loongarch/include/asm/topology.h | 4 + arch/loongarch/kernel/setup.c | 1 + arch/loongarch/kernel/smp.c | 3 + drivers/char/loongson_se.c | 440 +++++++----------- drivers/char/lsse_sdf_cdev.c | 310 ++++++------ drivers/gpio/Kconfig | 2 +- drivers/gpio/gpio-loongson-64bit.c | 298 ++++++++++-- drivers/i2c/busses/i2c-ls2x.c | 12 +- drivers/irqchip/irq-loongson-eiointc.c | 47 +- .../ethernet/stmicro/stmmac/dwmac-loongson.c | 14 + drivers/pci/quirks.c | 30 ++ drivers/platform/loongarch/cpu_hwmon.c | 3 +- include/linux/pci.h | 1 + .../include/asm => include/soc/loongson}/se.h | 52 +-- 15 files changed, 711 insertions(+), 508 deletions(-) rename {arch/loongarch/include/asm => include/soc/loongson}/se.h (68%) -- 2.33.0

2 7

[PATCH OLK-5.10] BEAEC[Backport] ALSA: 6fire: Release resources at card release
by Lin Ruifeng 07 Jan '25

07 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit f2d06d4e129e2508e356136f99bb20a332ff1a00 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEC CVE: CVE-2024-53239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ] The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback. Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://patch.msgid.link/20241113111042.15058-6-tiwai@suse.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index 08c6e6a52eb9..ad6f89845a5c 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -62,8 +62,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy(struct sfire_chip *chip) +static void usb6fire_card_free(struct snd_card *card) { + struct sfire_chip *chip = card->private_data; + if (chip) { if (chip->pcm) usb6fire_pcm_destroy(chip); @@ -73,8 +75,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip) usb6fire_comm_destroy(chip); if (chip->control) usb6fire_control_destroy(chip); - if (chip->card) - snd_card_free(chip->card); } } @@ -137,6 +137,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count = 1; chip->card = card; + card->private_free = usb6fire_card_free; ret = usb6fire_comm_init(chip); if (ret < 0) @@ -163,7 +164,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, return 0; destroy_chip: - usb6fire_chip_destroy(chip); + snd_card_free(card); return ret; } @@ -182,7 +183,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true; usb6fire_chip_abort(chip); - usb6fire_chip_destroy(chip); } } } -- 2.22.0

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] Fix iBMA bug and change version
by Li Nan 07 Jan '25

07 Jan '25

From: Wujiahai <wujiahai(a)huawei.com> 1. Prevents iBMA driver from causing Oops problems. 2. The spin lock deadlock bug of the ibma iBMA is fixed. 3. Change the iBMA driver version. Wujiahai (1): BMA: Fix Oops and spin lock deadlock problem, and change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c | 10 ++++++++-- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 9 --------- .../net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 6 files changed, 12 insertions(+), 15 deletions(-) -- 2.27.0

2 2

[PATCH OLK-5.10 0/1] Fix iBMA bug and change version
by Li Nan 07 Jan '25

07 Jan '25

From: Wujiahai <wujiahai(a)huawei.com> 1. Prevents iBMA driver from causing Oops problems. 2. The spin lock deadlock bug of the ibma iBMA is fixed. 3. Change the iBMA driver version. Wujiahai (1): BMA: Fix Oops and spin lock deadlock problem, and change the version number. drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../net/ethernet/huawei/bma/edma_drv/bma_devintf.c | 11 ++++++++--- drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c | 9 --------- .../net/ethernet/huawei/bma/kbox_drv/kbox_include.h | 2 +- drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 6 files changed, 12 insertions(+), 16 deletions(-) -- 2.27.0

2 2

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 14976601769745e54bd7fca29434a43ab556780f
by kernel test robot 07 Jan '25

07 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 14976601769745e54bd7fca29434a43ab556780f !14390 CVE-2024-53173 Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250106 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250106 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-003-20250106 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250106 | `-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250106 | |-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-003-20250106 | |-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-004-20250106 | `-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-005-20250106 | |-- drivers-xen-mem-reservation.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250106 | `-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) `-- x86_64-randconfig-161-20250107 |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 729m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250106 gcc-14.2.0 arm64 randconfig-002-20250106 gcc-14.2.0 arm64 randconfig-003-20250106 gcc-14.2.0 arm64 randconfig-004-20250106 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250106 clang-19 x86_64 buildonly-randconfig-002-20250106 gcc-12 x86_64 buildonly-randconfig-003-20250106 gcc-12 x86_64 buildonly-randconfig-004-20250106 gcc-12 x86_64 buildonly-randconfig-005-20250106 clang-19 x86_64 buildonly-randconfig-006-20250106 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION fc1d9b69d2a40bb05543f9a4f13016c71e9ae77c
by kernel test robot 07 Jan '25

07 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: fc1d9b69d2a40bb05543f9a4f13016c71e9ae77c !14472 jfs: fix array-index-out-of-bounds in jfs_readdir Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_DRBG_CTR-when-selected-by-CRYPTO_DEV_HISI_TRNG |-- loongarch-allmodconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | `-- include-linux-suspend.h:error:expected-)-before-numeric-constant |-- loongarch-allyesconfig | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid | |-- drivers-scsi-leapioraid-leapioraid_func.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- loongarch-defconfig | |-- arch-loongarch-kvm-intc-pch_pic.c:warning:variable-ret-set-but-not-used | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-e-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-irq_source_id-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-kvm-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-level-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-irqfd.c:warning:Function-parameter-or-member-line_status-not-described-in-kvm_set_msi | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpu-set-but-not-used | |-- arch-loongarch-kvm-vm.c:warning:variable-vcpus-set-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:Function-parameter-or-member-ivrs-not-described-in-get_highest_supported_ivhd_type | |-- drivers-iommu-loongarch_iommu.c:warning:la_iommu_setup-defined-but-not-used | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-check_device_compat | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-create_rlookup_entry | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_attach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-domain_deattach_iommu | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-find_iommu_by_dev | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-get_iommu_info_from_dom | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-iommu_init_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-la_iommu_probe_device | |-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-lookup_rlooptable | `-- drivers-iommu-loongarch_iommu.c:warning:no-previous-prototype-for-loongarch_get_iommu_by_devid |-- loongarch-randconfig-002-20250106 | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | |-- arch-loongarch-kernel-paravirt.c:error:KVM_HCALL_FUNC_PV_IPI-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:mp_ops-undeclared-(first-use-in-this-function) | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-paravt_steal_clock | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-parse_no_stealacc | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_cpu_reboot | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_disable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_enable_steal_time | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_nb | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_reboot_notify | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_down_prepare | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_cpu_online | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-pv_time_init | |-- arch-loongarch-kernel-paravirt.c:error:redefinition-of-steal_acc | |-- arch-loongarch-kernel-paravirt.c:warning:paravt_steal_clock-defined-but-not-used | |-- include-linux-init.h:error:redefinition-of-parse_no_stealacc | `-- include-linux-init.h:error:redefinition-of-str_parse_no_stealacc |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-VFIO_MDEV-when-selected-by-CRYPTO_DEV_HCT | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-get_nt_block_copy_mini_len | |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-function-set_c86_features_para_invalid | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpustate_free_space | |-- arch-x86-kvm-svm-csv.c:warning:no-previous-prototype-for-function-csv_vm_attestation | |-- arch-x86-kvm-svm-sev.c:warning:no-previous-prototype-for-function-sev_install_hooks | |-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-dcn30-display_mode_vba_30.c:warning:stack-frame-size-()-exceeds-limit-()-in-dml30_ModeSupportAndSystemConfigurationFull | |-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_setup_strp | `-- net-ipv4-tcp_comp.c:warning:no-previous-prototype-for-function-comp_stream_read |-- x86_64-buildonly-randconfig-003-20250106 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-005-20250106 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus `-- x86_64-buildonly-randconfig-006-20250106 `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) elapsed time: 724m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250106 clang-16 arm64 randconfig-002-20250106 clang-18 arm64 randconfig-003-20250106 clang-16 arm64 randconfig-004-20250106 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250106 gcc-14.2.0 loongarch randconfig-002-20250106 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250106 clang-19 x86_64 buildonly-randconfig-002-20250106 gcc-12 x86_64 buildonly-randconfig-003-20250106 gcc-12 x86_64 buildonly-randconfig-004-20250106 gcc-12 x86_64 buildonly-randconfig-005-20250106 clang-19 x86_64 buildonly-randconfig-006-20250106 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 27d5cc061b0818d460e0d39f605be0be5fa7ada4
by kernel test robot 07 Jan '25

07 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 27d5cc061b0818d460e0d39f605be0be5fa7ada4 !14457 cgroup: Fix potential overflow issue when checking max_depth Error/Warning (recently discovered and may have been fixed): fs/btrfs/qgroup.o: warning: objtool: btrfs_qgroup_account_extents()+0xe9: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-001-20250106 | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-002-20250106 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20250106 | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-004-20250106 | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:address-of-array-chip_node-rt_cmd-will-always-evaluate-to-true | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-hashlen_t-is-a-C11-feature | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-page_info_t-is-a-C11-feature | `-- fs-eulerfs-namei.c:warning:variable-de-is-uninitialized-when-used-here |-- x86_64-buildonly-randconfig-001-20250106 | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-002-20250106 | `-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-004-20241230 | `-- fs-btrfs-qgroup.o:warning:objtool:btrfs_qgroup_account_extents:unreachable-instruction |-- x86_64-buildonly-randconfig-005-20250106 | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-randconfig-161-20250107 |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory elapsed time: 729m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250106 clang-16 arm64 randconfig-002-20250106 clang-18 arm64 randconfig-003-20250106 clang-16 arm64 randconfig-004-20250106 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250106 clang-19 x86_64 buildonly-randconfig-002-20250106 gcc-12 x86_64 buildonly-randconfig-003-20250106 gcc-12 x86_64 buildonly-randconfig-004-20250106 gcc-12 x86_64 buildonly-randconfig-005-20250106 clang-19 x86_64 buildonly-randconfig-006-20250106 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] kprobes: Fix deadlock when unwinding kretprobe_trampoline
by Chen Zhongjin 06 Jan '25

06 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBFZSL -------------------------------- When there are two kretprobes on one stack and unwind the stack in the top kretprobe handler, there will be a AA dead lock as below: kretprobe_find_ret_addr <- try to lock hash lock unwind_stack kretp_handler __kretprobe_trampoline_handler <- holding hash lock 1 trampoline_probe_handler 2 kretprobe_trampoline+0 <- unwinding this frame ... Fix this if the unwinding task is current because hash table for current task can't be changed in unwinding, so there is no need to lock the hash ptr. Fixes: 88fef946364b ("kprobes: Add kretprobe_find_ret_addr() for searching return address") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/kprobes.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index 5d64d97975ba..9df872b3818a 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1995,7 +1995,11 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) unsigned long flags; kprobe_opcode_t *correct_ret_addr = NULL; - kretprobe_hash_lock(tsk, &head, &flags); + if (tsk != current) + kretprobe_hash_lock(tsk, &head, &flags); + else + head = &kretprobe_inst_table[hash_ptr(tsk, KPROBE_HASH_BITS)]; + hlist_for_each_entry(ri, head, hlist) { if (ri->task != tsk) continue; @@ -2006,7 +2010,8 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) break; } } - kretprobe_hash_unlock(tsk, &flags); + if (tsk != current) + kretprobe_hash_unlock(tsk, &flags); return (unsigned long)correct_ret_addr; } NOKPROBE_SYMBOL(kretprobe_find_ret_addr); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] kprobes: Fix deadlock when unwinding kretprobe_trampoline
by Chen Zhongjin 06 Jan '25

06 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBFZSL -------------------------------- When there are two kretprobes on one stack and unwind the stack in the top kretprobe handler, there will be a AA dead lock as below: kretprobe_find_ret_addr <- try to lock hash lock unwind_stack kretp_handler __kretprobe_trampoline_handler <- holding hash lock 1 trampoline_probe_handler 2 kretprobe_trampoline+0 <- unwinding this frame ... Fix this if the unwinding task is current because hash table for current task can't be changed in unwinding, so there is no need to lock the hash ptr. Fixes: b67815b05d67 ("[Backport] kprobes: Add kretprobe_find_ret_addr() for searching return address") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/kprobes.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index 5d64d97975ba..9df872b3818a 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1995,7 +1995,11 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) unsigned long flags; kprobe_opcode_t *correct_ret_addr = NULL; - kretprobe_hash_lock(tsk, &head, &flags); + if (tsk != current) + kretprobe_hash_lock(tsk, &head, &flags); + else + head = &kretprobe_inst_table[hash_ptr(tsk, KPROBE_HASH_BITS)]; + hlist_for_each_entry(ri, head, hlist) { if (ri->task != tsk) continue; @@ -2006,7 +2010,8 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) break; } } - kretprobe_hash_unlock(tsk, &flags); + if (tsk != current) + kretprobe_hash_unlock(tsk, &flags); return (unsigned long)correct_ret_addr; } NOKPROBE_SYMBOL(kretprobe_find_ret_addr); -- 2.25.1

2 1

[PATCH OLK-5.10] kprobes: Fix deadlock when unwinding kretprobe_trampoline
by Chen Zhongjin 06 Jan '25

06 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBFZSL -------------------------------- When there are two kretprobes on one stack and unwind the stack in the top kretprobe handler, there will be a AA dead lock as below: kretprobe_find_ret_addr <- try to lock hash lock unwind_stack kretp_handler __kretprobe_trampoline_handler <- holding hash lock 1 trampoline_probe_handler 2 kretprobe_trampoline+0 <- unwinding this frame ... Fix this if the unwinding task is current because hash table for current task can't be changed in unwinding, so there is no need to lock the hash ptr. Fixes: b67815b05d67 ("[Backport] kprobes: Add kretprobe_find_ret_addr() for searching return address") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/kprobes.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index 5d64d97975ba..9df872b3818a 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1995,7 +1995,11 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) unsigned long flags; kprobe_opcode_t *correct_ret_addr = NULL; - kretprobe_hash_lock(tsk, &head, &flags); + if (tsk != current) + kretprobe_hash_lock(tsk, &head, &flags); + else + head = &kretprobe_inst_table[hash_ptr(tsk, KPROBE_HASH_BITS)]; + hlist_for_each_entry(ri, head, hlist) { if (ri->task != tsk) continue; @@ -2006,7 +2010,8 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) break; } } - kretprobe_hash_unlock(tsk, &flags); + if (tsk != current) + kretprobe_hash_unlock(tsk, &flags); return (unsigned long)correct_ret_addr; } NOKPROBE_SYMBOL(kretprobe_find_ret_addr); -- 2.25.1

2 1

[PATCH OLK-6.6] octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
by Zeng Heng 06 Jan '25

06 Jan '25

From: Dipendra Khadka <kdipendra88(a)gmail.com> stable inclusion from stable-v6.6.64 commit 52c63a6a27d3178fab533fcfb4baa2ed5b8608a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOQ CVE: CVE-2024-56679 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0fbc7a5027c6f7f2c785adae3dcec22b2f2b69b3 ] Add error pointer check after calling otx2_mbox_get_rsp(). Fixes: ab58a416c93f ("octeontx2-pf: cn10k: Get max mtu supported from admin function") Signed-off-by: Dipendra Khadka <kdipendra88(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c index b3064377510e..47adccf7a777 100644 --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c @@ -1837,6 +1837,10 @@ u16 otx2_get_max_mtu(struct otx2_nic *pfvf) if (!rc) { rsp = (struct nix_hw_info *) otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); + if (IS_ERR(rsp)) { + rc = PTR_ERR(rsp); + goto out; + } /* HW counts VLAN insertion bytes (8 for double tag) * irrespective of whether SQE is requesting to insert VLAN -- 2.25.1

2 1

[PATCH OLK-6.6 V1] sched: Fix bpf cpustats refcount leak
by Cheng Yu 06 Jan '25

06 Jan '25

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBG1V2 CVE: NA -------------------------------- Refcount 'cpustats->usage' is clear in bpf_sched_cpu_stats_of which triggering WARNING bpf_sched_cpustats_release called. refcount_t: underflow; use-after-free. WARNING: CPU: 31 PID: 9517 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148 Call trace: refcount_warn_saturate+0xf4/0x148 bpf_sched_cpustats_release+0xa4/0xc0 bpf_prog_62f48e1f0ef32ae3_select_rq+0x360/0x398 bpf_trampoline_6442463850+0x8c/0x1000 bpf_sched_cfs_select_rq+0x8/0x18 select_task_rq_fair+0x250/0x4c8 Ctx is clear in bpf_sched_cpustats_create, so it not need to clear in bpf_sched_cpu_stats_of. Fixes: ace175278fa1 ("sched: Add kfunc to get cpu statistics") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/bpf_sched.c | 1 - 1 file changed, 1 deletion(-) diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c index 2958b3029d38..1973cfacc079 100644 --- a/kernel/sched/bpf_sched.c +++ b/kernel/sched/bpf_sched.c @@ -152,7 +152,6 @@ __bpf_kfunc s32 bpf_sched_cpu_stats_of(int cpuid, return -EINVAL; rq = cpu_rq(cpu); - memset(ctx, 0, sizeof(*ctx)); SCHED_WARN_ON(!rcu_read_lock_held()); /* nr_running */ -- 2.25.1

2 1

[PATCH OLK-6.6] KVM: arm64: Don't retire aborted MMIO instruction
by Zhang Kunbo 06 Jan '25

06 Jan '25

From: Oliver Upton <oliver.upton(a)linux.dev> stable inclusion from stable-v6.6.66 commit ea6b5d98fea4ee8cb443ea98fda520909e90d30e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAG3 CVE: CVE-2024-53196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e735a5da64420a86be370b216c269b5dd8e830e2 ] Returning an abort to the guest for an unsupported MMIO access is a documented feature of the KVM UAPI. Nevertheless, it's clear that this plumbing has seen limited testing, since userspace can trivially cause a WARN in the MMIO return: WARNING: CPU: 0 PID: 30558 at arch/arm64/include/asm/kvm_emulate.h:536 kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 Call trace: kvm_handle_mmio_return+0x46c/0x5c4 arch/arm64/include/asm/kvm_emulate.h:536 kvm_arch_vcpu_ioctl_run+0x98/0x15b4 arch/arm64/kvm/arm.c:1133 kvm_vcpu_ioctl+0x75c/0xa78 virt/kvm/kvm_main.c:4487 __do_sys_ioctl fs/ioctl.c:51 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x1e0/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x38/0x68 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x90/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The splat is complaining that KVM is advancing PC while an exception is pending, i.e. that KVM is retiring the MMIO instruction despite a pending synchronous external abort. Womp womp. Fix the glaring UAPI bug by skipping over all the MMIO emulation in case there is a pending synchronous exception. Note that while userspace is capable of pending an asynchronous exception (SError, IRQ, or FIQ), it is still safe to retire the MMIO instruction in this case as (1) they are by definition asynchronous, and (2) KVM relies on hardware support for pending/delivering these exceptions instead of the software state machine for advancing PC. Cc: stable(a)vger.kernel.org Fixes: da345174ceca ("KVM: arm/arm64: Allow user injection of external data aborts") Reported-by: Alexander Potapenko <glider(a)google.com> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20241025203106.3529261-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/arm64/kvm/mmio.c [ different return polarity introduced by this commit not merged: cc81b6dfc3bc8 ("KVM: arm64: Change kvm_handle_mmio_return() return polarity") ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/arm64/kvm/mmio.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/mmio.c b/arch/arm64/kvm/mmio.c index 40d6d056e261..bf5de05cb7a8 100644 --- a/arch/arm64/kvm/mmio.c +++ b/arch/arm64/kvm/mmio.c @@ -73,6 +73,31 @@ unsigned long kvm_mmio_read_buf(const void *buf, unsigned int len) return data; } +static bool kvm_pending_sync_exception(struct kvm_vcpu *vcpu) +{ + if (!vcpu_get_flag(vcpu, PENDING_EXCEPTION)) + return false; + + if (vcpu_el1_is_32bit(vcpu)) { + switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) { + case unpack_vcpu_flag(EXCEPT_AA32_UND): + case unpack_vcpu_flag(EXCEPT_AA32_IABT): + case unpack_vcpu_flag(EXCEPT_AA32_DABT): + return true; + default: + return false; + } + } else { + switch (vcpu_get_flag(vcpu, EXCEPT_MASK)) { + case unpack_vcpu_flag(EXCEPT_AA64_EL1_SYNC): + case unpack_vcpu_flag(EXCEPT_AA64_EL2_SYNC): + return true; + default: + return false; + } + } +} + /** * kvm_handle_mmio_return -- Handle MMIO loads after user space emulation * or in-kernel IO emulation @@ -85,8 +110,11 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu) unsigned int len; int mask; - /* Detect an already handled MMIO return */ - if (unlikely(!vcpu->mmio_needed)) + /* + * Detect if the MMIO return was already handled or if userspace aborted + * the MMIO access. + */ + if (unlikely(!vcpu->mmio_needed || kvm_pending_sync_exception(vcpu))) return 0; vcpu->mmio_needed = 0; -- 2.34.1

2 1

[PATCH OLK-6.6] f2fs: fix to account dirty data in __get_secs_required()
by Liu Mingrui 06 Jan '25

06 Jan '25

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.64 commit f1b8bfe8d2f2fdf905d37c174d5bc1cd2b6910c5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1acd73edbbfef2c3c5b43cba4006a7797eca7050 ] It will trigger system panic w/ testcase in [1]: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2752! RIP: 0010:new_curseg+0xc81/0x2110 Call Trace: f2fs_allocate_data_block+0x1c91/0x4540 do_write_page+0x163/0xdf0 f2fs_outplace_write_data+0x1aa/0x340 f2fs_do_write_data_page+0x797/0x2280 f2fs_write_single_data_page+0x16cd/0x2190 f2fs_write_cache_pages+0x994/0x1c80 f2fs_write_data_pages+0x9cc/0xea0 do_writepages+0x194/0x7a0 filemap_fdatawrite_wbc+0x12b/0x1a0 __filemap_fdatawrite_range+0xbb/0xf0 file_write_and_wait_range+0xa1/0x110 f2fs_do_sync_file+0x26f/0x1c50 f2fs_sync_file+0x12b/0x1d0 vfs_fsync_range+0xfa/0x230 do_fsync+0x3d/0x80 __x64_sys_fsync+0x37/0x50 x64_sys_call+0x1e88/0x20d0 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e The root cause is if checkpoint_disabling and lfs_mode are both on, it will trigger OPU for all overwritten data, it may cost more free segment than expected, so f2fs must account those data correctly to calculate cosumed free segments later, and return ENOSPC earlier to avoid run out of free segment during block allocation. [1] https://lore.kernel.org/fstests/20241015025106.3203676-1-chao@kernel.org/ Fixes: 4354994f097d ("f2fs: checkpoint disabling") Cc: Daniel Rosenberg <drosen(a)google.com> Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- fs/f2fs/segment.h | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-) diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h index 952970166d5d..cd2ec6acc717 100644 --- a/fs/f2fs/segment.h +++ b/fs/f2fs/segment.h @@ -559,18 +559,21 @@ static inline int reserved_sections(struct f2fs_sb_info *sbi) } static inline bool has_curseg_enough_space(struct f2fs_sb_info *sbi, - unsigned int node_blocks, unsigned int dent_blocks) + unsigned int node_blocks, unsigned int data_blocks, + unsigned int dent_blocks) { - unsigned segno, left_blocks; + unsigned int segno, left_blocks, blocks; int i; - /* check current node sections in the worst case. */ - for (i = CURSEG_HOT_NODE; i <= CURSEG_COLD_NODE; i++) { + /* check current data/node sections in the worst case. */ + for (i = CURSEG_HOT_DATA; i < NR_PERSISTENT_LOG; i++) { segno = CURSEG_I(sbi, i)->segno; left_blocks = CAP_BLKS_PER_SEC(sbi) - get_ckpt_valid_blocks(sbi, segno, true); - if (node_blocks > left_blocks) + + blocks = i <= CURSEG_COLD_DATA ? data_blocks : node_blocks; + if (blocks > left_blocks) return false; } @@ -584,8 +587,9 @@ static inline bool has_curseg_enough_space(struct f2fs_sb_info *sbi, } /* - * calculate needed sections for dirty node/dentry - * and call has_curseg_enough_space + * calculate needed sections for dirty node/dentry and call + * has_curseg_enough_space, please note that, it needs to account + * dirty data as well in lfs mode when checkpoint is disabled. */ static inline void __get_secs_required(struct f2fs_sb_info *sbi, unsigned int *lower_p, unsigned int *upper_p, bool *curseg_p) @@ -594,19 +598,30 @@ static inline void __get_secs_required(struct f2fs_sb_info *sbi, get_pages(sbi, F2FS_DIRTY_DENTS) + get_pages(sbi, F2FS_DIRTY_IMETA); unsigned int total_dent_blocks = get_pages(sbi, F2FS_DIRTY_DENTS); + unsigned int total_data_blocks = 0; unsigned int node_secs = total_node_blocks / CAP_BLKS_PER_SEC(sbi); unsigned int dent_secs = total_dent_blocks / CAP_BLKS_PER_SEC(sbi); + unsigned int data_secs = 0; unsigned int node_blocks = total_node_blocks % CAP_BLKS_PER_SEC(sbi); unsigned int dent_blocks = total_dent_blocks % CAP_BLKS_PER_SEC(sbi); + unsigned int data_blocks = 0; + + if (f2fs_lfs_mode(sbi) && + unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { + total_data_blocks = get_pages(sbi, F2FS_DIRTY_DATA); + data_secs = total_data_blocks / CAP_BLKS_PER_SEC(sbi); + data_blocks = total_data_blocks % CAP_BLKS_PER_SEC(sbi); + } if (lower_p) - *lower_p = node_secs + dent_secs; + *lower_p = node_secs + dent_secs + data_secs; if (upper_p) *upper_p = node_secs + dent_secs + - (node_blocks ? 1 : 0) + (dent_blocks ? 1 : 0); + (node_blocks ? 1 : 0) + (dent_blocks ? 1 : 0) + + (data_blocks ? 1 : 0); if (curseg_p) *curseg_p = has_curseg_enough_space(sbi, - node_blocks, dent_blocks); + node_blocks, data_blocks, dent_blocks); } static inline bool has_not_enough_free_secs(struct f2fs_sb_info *sbi, -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] gpiolib: fix memory use-after-free in gpiochip_setup_dev()
by He Yujie 06 Jan '25

06 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB8UN5 CVE: CVE-2022-48975 -------------------------------- Commit aa1e2bfdc899 attempt to fix a CVE problem, but the patch conflicted with current version. When the patch is adapted, an error is introduced in the function of gpiochip_add_data_with_key. After the gdev is released, the gdev is still accessed, resulting in use-after-free. The value of gdev->ngpio is assigned from gc->ngpio and is not changed during the processing of function. Therefore, this patch changes gdev->ngpio to gc->ngpio to solve the above use-after-free problem. Fixes: aa1e2bfdc899 ("gpiolib: fix memory leak in gpiochip_setup_dev()") Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpio/gpiolib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 206d73810876..07d26ca22c2c 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -796,7 +796,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data, err_print_message: /* failures here can mean systems won't boot... */ pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__, - base, base + gdev->ngpio - 1, + base, base + (int)gc->ngpio - 1, gc->label ? : "generic", ret); return ret; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] etmem: fix use-after-free of mm in the scan release process
by chenrenhui 06 Jan '25

06 Jan '25

etmem: fix use-after-free of mm in the scan release process chenrenhui (1): etmem: fix use-after-free of mm in the scan release process fs/proc/task_mmu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1] etmem: fix use-after-free of mm in the scan release process
by chenrenhui 06 Jan '25

06 Jan '25

etmem: fix use-after-free of mm in the scan release process chenrenhui (1): etmem: fix use-after-free of mm in the scan release process fs/proc/etmem_proc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH openEuler-25.03 0/1] etmem: fix use-after-free of mm in the scan release process
by chenrenhui 06 Jan '25

06 Jan '25

etmem: fix use-after-free of mm in the scan release process chenrenhui (1): etmem: fix use-after-free of mm in the scan release process fs/proc/etmem_proc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

1 1

[PATCH openEuler-22.03-LTS-SP1 0/1] etmem: fix use-after-free of mm in the scan release process
by chenrenhui 06 Jan '25

06 Jan '25

etmem: fix use-after-free of mm in the scan release process chenrenhui (1): etmem: fix use-after-free of mm in the scan release process fs/proc/task_mmu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH openEuler-25.03 0/1] etmem: fix use-after-free of mm in the scan release process
by chenrenhui 06 Jan '25

06 Jan '25

etmem: fix use-after-free of mm in the scan release process chenrenhui (1): etmem: fix use-after-free of mm in the scan release process fs/proc/etmem_proc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

1 1

[PATCH OLK-6.6] Bluetooth: MGMT: Fix possible deadlocks
by dinglongwei 06 Jan '25

06 Jan '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.64 commit 5703fb1d85f653e35b327b14de4db7da239e4fd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAGI CVE: CVE-2024-53207 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a66dfaf18fd61bb75ef8cee83db46b2aadf153d0 ] This fixes possible deadlocks like the following caused by hci_cmd_sync_dequeue causing the destroy function to run: INFO: task kworker/u19:0:143 blocked for more than 120 seconds. Tainted: G W O 6.8.0-2024-03-19-intel-next-iLS-24ww14 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u19:0 state:D stack:0 pid:143 tgid:143 ppid:2 flags:0x00004000 Workqueue: hci0 hci_cmd_sync_work [bluetooth] Call Trace: <TASK> __schedule+0x374/0xaf0 schedule+0x3c/0xf0 schedule_preempt_disabled+0x1c/0x30 __mutex_lock.constprop.0+0x3ef/0x7a0 __mutex_lock_slowpath+0x13/0x20 mutex_lock+0x3c/0x50 mgmt_set_connectable_complete+0xa4/0x150 [bluetooth] ? kfree+0x211/0x2a0 hci_cmd_sync_dequeue+0xae/0x130 [bluetooth] ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth] cmd_complete_rsp+0x26/0x80 [bluetooth] mgmt_pending_foreach+0x4d/0x70 [bluetooth] __mgmt_power_off+0x8d/0x180 [bluetooth] ? _raw_spin_unlock_irq+0x23/0x40 hci_dev_close_sync+0x445/0x5b0 [bluetooth] hci_set_powered_sync+0x149/0x250 [bluetooth] set_powered_sync+0x24/0x60 [bluetooth] hci_cmd_sync_work+0x90/0x150 [bluetooth] process_one_work+0x13e/0x300 worker_thread+0x2f7/0x420 ? __pfx_worker_thread+0x10/0x10 kthread+0x107/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3d/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Tested-by: Kiran K <kiran.k(a)intel.com> Fixes: f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on mgmt_index_removed") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- net/bluetooth/mgmt.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 1f3a39c20a91..2238f431858a 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -1503,7 +1503,8 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, bt_dev_dbg(hdev, "err %d", err); /* Make sure cmd still outstanding. */ - if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) return; hci_dev_lock(hdev); @@ -1677,7 +1678,8 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, bt_dev_dbg(hdev, "err %d", err); /* Make sure cmd still outstanding. */ - if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) return; hci_dev_lock(hdev); @@ -1910,7 +1912,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) bool changed; /* Make sure cmd still outstanding. */ - if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) + if (err == -ECANCELED || cmd != pending_find(MGMT_OP_SET_SSP, hdev)) return; if (err) { @@ -3775,7 +3777,8 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err) bt_dev_dbg(hdev, "err %d", err); - if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) return; if (status) { @@ -3950,7 +3953,8 @@ static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) struct sk_buff *skb = cmd->skb; u8 status = mgmt_status(err); - if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) return; if (!status) { @@ -5841,13 +5845,16 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) { struct mgmt_pending_cmd *cmd = data; + bt_dev_dbg(hdev, "err %d", err); + + if (err == -ECANCELED) + return; + if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) return; - bt_dev_dbg(hdev, "err %d", err); - mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), cmd->param, 1); mgmt_pending_remove(cmd); @@ -6080,7 +6087,8 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) { struct mgmt_pending_cmd *cmd = data; - if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) return; bt_dev_dbg(hdev, "err %d", err); @@ -8025,7 +8033,8 @@ static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, u8 status = mgmt_status(err); u16 eir_len; - if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) return; if (!status) { -- 2.22.0

2 1

[PATCH OLK-6.6] Bluetooth: MGMT: Fix possible deadlocks
by dinglongwei 06 Jan '25

06 Jan '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.64 commit 5703fb1d85f653e35b327b14de4db7da239e4fd9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAGI CVE: CVE-2024-53207 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a66dfaf18fd61bb75ef8cee83db46b2aadf153d0 ] This fixes possible deadlocks like the following caused by hci_cmd_sync_dequeue causing the destroy function to run: INFO: task kworker/u19:0:143 blocked for more than 120 seconds. Tainted: G W O 6.8.0-2024-03-19-intel-next-iLS-24ww14 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u19:0 state:D stack:0 pid:143 tgid:143 ppid:2 flags:0x00004000 Workqueue: hci0 hci_cmd_sync_work [bluetooth] Call Trace: <TASK> __schedule+0x374/0xaf0 schedule+0x3c/0xf0 schedule_preempt_disabled+0x1c/0x30 __mutex_lock.constprop.0+0x3ef/0x7a0 __mutex_lock_slowpath+0x13/0x20 mutex_lock+0x3c/0x50 mgmt_set_connectable_complete+0xa4/0x150 [bluetooth] ? kfree+0x211/0x2a0 hci_cmd_sync_dequeue+0xae/0x130 [bluetooth] ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth] cmd_complete_rsp+0x26/0x80 [bluetooth] mgmt_pending_foreach+0x4d/0x70 [bluetooth] __mgmt_power_off+0x8d/0x180 [bluetooth] ? _raw_spin_unlock_irq+0x23/0x40 hci_dev_close_sync+0x445/0x5b0 [bluetooth] hci_set_powered_sync+0x149/0x250 [bluetooth] set_powered_sync+0x24/0x60 [bluetooth] hci_cmd_sync_work+0x90/0x150 [bluetooth] process_one_work+0x13e/0x300 worker_thread+0x2f7/0x420 ? __pfx_worker_thread+0x10/0x10 kthread+0x107/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3d/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Tested-by: Kiran K <kiran.k(a)intel.com> Fixes: f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on mgmt_index_removed") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- net/bluetooth/mgmt.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 1f3a39c20a91..2238f431858a 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -1503,7 +1503,8 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, bt_dev_dbg(hdev, "err %d", err); /* Make sure cmd still outstanding. */ - if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) return; hci_dev_lock(hdev); @@ -1677,7 +1678,8 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, bt_dev_dbg(hdev, "err %d", err); /* Make sure cmd still outstanding. */ - if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) return; hci_dev_lock(hdev); @@ -1910,7 +1912,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) bool changed; /* Make sure cmd still outstanding. */ - if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) + if (err == -ECANCELED || cmd != pending_find(MGMT_OP_SET_SSP, hdev)) return; if (err) { @@ -3775,7 +3777,8 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err) bt_dev_dbg(hdev, "err %d", err); - if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) return; if (status) { @@ -3950,7 +3953,8 @@ static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) struct sk_buff *skb = cmd->skb; u8 status = mgmt_status(err); - if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) return; if (!status) { @@ -5841,13 +5845,16 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) { struct mgmt_pending_cmd *cmd = data; + bt_dev_dbg(hdev, "err %d", err); + + if (err == -ECANCELED) + return; + if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) return; - bt_dev_dbg(hdev, "err %d", err); - mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), cmd->param, 1); mgmt_pending_remove(cmd); @@ -6080,7 +6087,8 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) { struct mgmt_pending_cmd *cmd = data; - if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) return; bt_dev_dbg(hdev, "err %d", err); @@ -8025,7 +8033,8 @@ static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, u8 status = mgmt_status(err); u16 eir_len; - if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) return; if (!status) { -- 2.22.0

2 1

[PATCH OLK-6.6] rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
by Zeng Heng 06 Jan '25

06 Jan '25

From: Yongliang Gao <leonylgao(a)tencent.com> stable inclusion from stable-v6.6.64 commit dd4b1cbcc916fad5d10c2662b62def9f05e453d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFG CVE: CVE-2024-56739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d ] If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware. When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, they will continually expire, may causing kernel softlockup. Fixes: 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") Signed-off-by: Yongliang Gao <leonylgao(a)tencent.com> Acked-by: Jingqun Li <jingqunli(a)tencent.com> Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rtc/interface.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index 0b23706d9fd3..4a7c41a6c21e 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -904,13 +904,18 @@ void rtc_timer_do_work(struct work_struct *work) struct timerqueue_node *next; ktime_t now; struct rtc_time tm; + int err; struct rtc_device *rtc = container_of(work, struct rtc_device, irqwork); mutex_lock(&rtc->ops_lock); again: - __rtc_read_time(rtc, &tm); + err = __rtc_read_time(rtc, &tm); + if (err) { + mutex_unlock(&rtc->ops_lock); + return; + } now = rtc_tm_to_ktime(tm); while ((next = timerqueue_getnext(&rtc->timerqueue))) { if (next->expires > now) -- 2.25.1

2 1

[PATCH OLK-6.6] rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
by Zeng Heng 06 Jan '25

06 Jan '25

From: "Uladzislau Rezki (Sony)" <urezki(a)gmail.com> stable inclusion from stable-v6.6.64 commit 967a0e61910825d1fad009d836a6cb41f7402395 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGP CVE: CVE-2024-53160 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a23da88c6c80e41e0503e0b481a22c9eea63f263 ] KCSAN reports a data race when access the krcp->monitor_work.timer.expires variable in the schedule_delayed_monitor_work() function: <snip> BUG: KCSAN: data-race in __mod_timer / kvfree_call_rcu read to 0xffff888237d1cce8 of 8 bytes by task 10149 on cpu 1: schedule_delayed_monitor_work kernel/rcu/tree.c:3520 [inline] kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839 trie_update_elem+0x47c/0x620 kernel/bpf/lpm_trie.c:441 bpf_map_update_value+0x324/0x350 kernel/bpf/syscall.c:203 generic_map_update_batch+0x401/0x520 kernel/bpf/syscall.c:1849 bpf_map_do_batch+0x28c/0x3f0 kernel/bpf/syscall.c:5143 __sys_bpf+0x2e5/0x7a0 __do_sys_bpf kernel/bpf/syscall.c:5741 [inline] __se_sys_bpf kernel/bpf/syscall.c:5739 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5739 x64_sys_call+0x2625/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f write to 0xffff888237d1cce8 of 8 bytes by task 56 on cpu 0: __mod_timer+0x578/0x7f0 kernel/time/timer.c:1173 add_timer_global+0x51/0x70 kernel/time/timer.c:1330 __queue_delayed_work+0x127/0x1a0 kernel/workqueue.c:2523 queue_delayed_work_on+0xdf/0x190 kernel/workqueue.c:2552 queue_delayed_work include/linux/workqueue.h:677 [inline] schedule_delayed_monitor_work kernel/rcu/tree.c:3525 [inline] kfree_rcu_monitor+0x5e8/0x660 kernel/rcu/tree.c:3643 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391 kthread+0x1d1/0x210 kernel/kthread.c:389 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Reported by Kernel Concurrency Sanitizer on: CPU: 0 UID: 0 PID: 56 Comm: kworker/u8:4 Not tainted 6.12.0-rc2-syzkaller-00050-g5b7c893ed5ed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_unbound kfree_rcu_monitor <snip> kfree_rcu_monitor() rearms the work if a "krcp" has to be still offloaded and this is done without holding krcp->lock, whereas the kvfree_call_rcu() holds it. Fix it by acquiring the "krcp->lock" for kfree_rcu_monitor() so both functions do not race anymore. Reported-by: syzbot+061d370693bdd99f9d34(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/lkml/ZxZ68KmHDQYU0yfD@pc636/T/ Fixes: 8fc5494ad5fa ("rcu/kvfree: Move need_offload_krc() out of krcp->lock") Signed-off-by: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Reviewed-by: Neeraj Upadhyay <Neeraj.Upadhyay(a)amd.com> Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- kernel/rcu/tree.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c index 3d7b119f6e2a..fda08520c75c 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -3150,7 +3150,7 @@ static int krc_count(struct kfree_rcu_cpu *krcp) } static void -schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp) +__schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp) { long delay, delay_left; @@ -3164,6 +3164,16 @@ schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp) queue_delayed_work(system_wq, &krcp->monitor_work, delay); } +static void +schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp) +{ + unsigned long flags; + + raw_spin_lock_irqsave(&krcp->lock, flags); + __schedule_delayed_monitor_work(krcp); + raw_spin_unlock_irqrestore(&krcp->lock, flags); +} + static void kvfree_rcu_drain_ready(struct kfree_rcu_cpu *krcp) { @@ -3460,7 +3470,7 @@ void kvfree_call_rcu(struct rcu_head *head, void *ptr) // Set timer to drain after KFREE_DRAIN_JIFFIES. if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING) - schedule_delayed_monitor_work(krcp); + __schedule_delayed_monitor_work(krcp); unlock_return: krc_this_cpu_unlock(krcp, flags); -- 2.25.1

2 1

[PATCH OLK-6.6] PCI: Fix reset_method_store() memory leak
by Zeng Heng 06 Jan '25

06 Jan '25

From: Todd Kjos <tkjos(a)google.com> stable inclusion from stable-v6.6.64 commit 8e098baf6bc3f3a6aefc383509aba07e202f7ee0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGF6 CVE: CVE-2024-56745 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2985b1844f3f3447f2d938eff1ef6762592065a5 ] In reset_method_store(), a string is allocated via kstrndup() and assigned to the local "options". options is then used in with strsep() to find spaces: while ((name = strsep(&options, " ")) != NULL) { If there are no remaining spaces, then options is set to NULL by strsep(), so the subsequent kfree(options) doesn't free the memory allocated via kstrndup(). Fix by using a separate tmp_options to iterate with strsep() so options is preserved. Link: https://lore.kernel.org/r/20241001231147.3583649-1-tkjos@google.com Fixes: d88f521da3ef ("PCI: Allow userspace to query and set device reset mechanism") Signed-off-by: Todd Kjos <tkjos(a)google.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/pci.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index cd7903702f57..e02bf0c1f35e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5463,7 +5463,7 @@ static ssize_t reset_method_store(struct device *dev, const char *buf, size_t count) { struct pci_dev *pdev = to_pci_dev(dev); - char *options, *name; + char *options, *tmp_options, *name; int m, n; u8 reset_methods[PCI_NUM_RESET_METHODS] = { 0 }; @@ -5483,7 +5483,8 @@ static ssize_t reset_method_store(struct device *dev, return -ENOMEM; n = 0; - while ((name = strsep(&options, " ")) != NULL) { + tmp_options = options; + while ((name = strsep(&tmp_options, " ")) != NULL) { if (sysfs_streq(name, "")) continue; -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] etmem: fix use-after-free of mm in the scan release process
by chenrenhui 06 Jan '25

06 Jan '25

etmem: fix use-after-free of mm in the scan release process chenrenhui (1): etmem: fix use-after-free of mm in the scan release process fs/proc/etmem_proc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH openEuler-22.03-LTS-SP1] media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
by Cai Xinchen 06 Jan '25

06 Jan '25

From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> stable inclusion from stable-v5.10.154 commit 1609231f86760c1f6a429de7913dd795b9faa08c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBFBZR CVE: CVE-2022-49035 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ] I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/media/cec/platform/s5p/s5p_cec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/cec/platform/s5p/s5p_cec.c b/drivers/media/cec/platform/s5p/s5p_cec.c index 028a09a7531e..102f1af01000 100644 --- a/drivers/media/cec/platform/s5p/s5p_cec.c +++ b/drivers/media/cec/platform/s5p/s5p_cec.c @@ -115,6 +115,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); cec->rx = STATE_BUSY; cec->msg.len = status >> 24; + if (cec->msg.len > CEC_MAX_MSG_SIZE) + cec->msg.len = CEC_MAX_MSG_SIZE; cec->msg.rx_status = CEC_RX_STATUS_OK; s5p_cec_get_rx_buf(cec, cec->msg.len, cec->msg.msg); -- 2.34.1

2 1

[PATCH OLK-6.6] media: atomisp: Add check for rgby_data memory allocation failure
by Wang Wensheng 06 Jan '25

06 Jan '25

From: Li Huafei <lihuafei1(a)huawei.com> stable inclusion from stable-v6.6.64 commit 8066badaf7463194473fb4be19dbe50b11969aa0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-56705 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ed61c59139509f76d3592683c90dc3fdc6e23cd6 ] In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not successfully allocated, it may trigger the assert(host_stats->rgby_data) assertion in ia_css_s3a_hmem_decode(). Adding a check to fix this potential issue. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Andy Shevchenko <andy(a)kernel.org> Link: https://lore.kernel.org/r/20241104145051.3088231-1-lihuafei1@huawei.com Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/staging/media/atomisp/pci/sh_css_params.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/media/atomisp/pci/sh_css_params.c b/drivers/staging/media/atomisp/pci/sh_css_params.c index 588f2adab058..760fe9bef211 100644 --- a/drivers/staging/media/atomisp/pci/sh_css_params.c +++ b/drivers/staging/media/atomisp/pci/sh_css_params.c @@ -4144,6 +4144,8 @@ ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid) goto err; /* No weighted histogram, no structure, treat the histogram data as a byte dump in a byte array */ me->rgby_data = kvmalloc(sizeof_hmem(HMEM0_ID), GFP_KERNEL); + if (!me->rgby_data) + goto err; IA_CSS_LEAVE("return=%p", me); return me; -- 2.22.0

2 1

[PATCH OLK-6.6] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
by Wang Wensheng 06 Jan '25

06 Jan '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.64 commit 95f7a972194ad20696c36523b54c19a3567e0697 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBA6RL CVE: CVE-2024-53208 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0b882940665ca2849386ee459d4331aa2f8c4e7d ] This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353 Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54 CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 q kasan_report+0x143/0x180 mm/kasan/report.c:601 set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5247: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193 kmalloc_noprof include/linux/slab.h:681 [inline] kzalloc_noprof include/linux/slab.h:807 [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296 set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394 hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa72/0xc90 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5246: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2256 [inline] slab_free mm/slub.c:4477 [inline] kfree+0x149/0x360 mm/slub.c:4598 settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455 hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1222 sock_ioctl+0x629/0x8e0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: syzbot+03d6270b6425df1605bf(a)syzkaller.appspotmail.com Tested-by: syzbot+03d6270b6425df1605bf(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- net/bluetooth/mgmt.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 1f3a39c20a91..f84912552d29 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -1318,7 +1318,8 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) struct mgmt_mode *cp; /* Make sure cmd still outstanding. */ - if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) + if (err == -ECANCELED || + cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) return; cp = cmd->param; @@ -1351,7 +1352,13 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) static int set_powered_sync(struct hci_dev *hdev, void *data) { struct mgmt_pending_cmd *cmd = data; - struct mgmt_mode *cp = cmd->param; + struct mgmt_mode *cp; + + /* Make sure cmd still outstanding. */ + if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) + return -ECANCELED; + + cp = cmd->param; BT_DBG("%s", hdev->name); -- 2.22.0

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2024-56705
by Wang Wensheng 06 Jan '25

06 Jan '25

Li Huafei (1): media: atomisp: Add check for rgby_data memory allocation failure Mauro Carvalho Chehab (1): media: atomisp: remove #ifdef HAS_NO_HMEM .../atomisp/pci/isp/kernels/bh/bh_2/ia_css_bh.host.c | 2 -- .../raw_aa_binning_1.0/ia_css_raa.host.c | 2 -- .../pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c | 5 ----- .../media/atomisp/pci/runtime/binary/src/binary.c | 4 ---- drivers/staging/media/atomisp/pci/sh_css_params.c | 12 ++---------- 5 files changed, 2 insertions(+), 23 deletions(-) -- 2.22.0

2 3

[PATCH openEuler-22.03-LTS-SP1] kprobes: Fix deadlock when unwinding kretprobe_trampoline
by Chen Zhongjin 06 Jan '25

06 Jan '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBFZSL -------------------------------- When there are two kretprobes on one stack and unwind the stack in the top kretprobe handler, there will be a AA dead lock as below: kretprobe_find_ret_addr <- try to lock hash lock unwind_stack kretp_handler __kretprobe_trampoline_handler <- holding hash lock 1 trampoline_probe_handler 2 kretprobe_trampoline+0 <- unwinding this frame ... Fix this if the unwinding task is current because hash table for current task can't be changed in unwinding, so there is no need to lock the hash ptr. Fixes: b67815b05d67 ("[Backport] kprobes: Add kretprobe_find_ret_addr() for searching return address") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/kprobes.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index 5d64d97975ba..9df872b3818a 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1995,7 +1995,11 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) unsigned long flags; kprobe_opcode_t *correct_ret_addr = NULL; - kretprobe_hash_lock(tsk, &head, &flags); + if (tsk != current) + kretprobe_hash_lock(tsk, &head, &flags); + else + head = &kretprobe_inst_table[hash_ptr(tsk, KPROBE_HASH_BITS)]; + hlist_for_each_entry(ri, head, hlist) { if (ri->task != tsk) continue; @@ -2006,7 +2010,8 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) break; } } - kretprobe_hash_unlock(tsk, &flags); + if (tsk != current) + kretprobe_hash_unlock(tsk, &flags); return (unsigned long)correct_ret_addr; } NOKPROBE_SYMBOL(kretprobe_find_ret_addr); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-56654
by Yongqiang Liu 06 Jan '25

06 Jan '25

Iulia Tanasescu (1): Bluetooth: ISO: Reassociate a socket with an active BIS Luiz Augusto von Dentz (1): Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating include/net/bluetooth/hci_core.h | 24 ++++++++++ net/bluetooth/hci_conn.c | 32 ++++++++++++- net/bluetooth/hci_event.c | 33 +++++-------- net/bluetooth/iso.c | 79 +++++++++++++++++++++++++++++++- 4 files changed, 142 insertions(+), 26 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] kprobes: Fix deadlock when unwinding kretprobe_trampoline
by Chen Zhongjin 06 Jan '25

06 Jan '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBFZSL -------------------------------- When there are two kretprobes on one stack and unwind the stack in the top kretprobe handler, there will be a AA dead lock as below: kretprobe_find_ret_addr <- try to lock hash lock unwind_stack kretp_handler __kretprobe_trampoline_handler <- holding hash lock 1 trampoline_probe_handler 2 kretprobe_trampoline+0 <- unwinding this frame ... Fix this if the unwinding task is current because hash table for current task can't be changed in unwinding, so there is no need to lock the hash ptr. Fixes: b67815b05d67 ("[Backport] kprobes: Add kretprobe_find_ret_addr() for searching return address") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/kprobes.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index 5d64d97975ba..9df872b3818a 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1995,7 +1995,11 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) unsigned long flags; kprobe_opcode_t *correct_ret_addr = NULL; - kretprobe_hash_lock(tsk, &head, &flags); + if (tsk != current) + kretprobe_hash_lock(tsk, &head, &flags); + else + head = &kretprobe_inst_table[hash_ptr(tsk, KPROBE_HASH_BITS)]; + hlist_for_each_entry(ri, head, hlist) { if (ri->task != tsk) continue; @@ -2006,7 +2010,8 @@ unsigned long kretprobe_find_ret_addr(struct task_struct *tsk, void *fp) break; } } - kretprobe_hash_unlock(tsk, &flags); + if (tsk != current) + kretprobe_hash_unlock(tsk, &flags); return (unsigned long)correct_ret_addr; } NOKPROBE_SYMBOL(kretprobe_find_ret_addr); -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56546
by Lin Yujun 06 Jan '25

06 Jan '25

Gaosheng Cui (1): drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() drivers/soc/xilinx/xlnx_event_manager.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-53158
by Lin Yujun 06 Jan '25

06 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-56746
by Liu Shixin 06 Jan '25

06 Jan '25

Thomas Zimmermann (1): fbdev/sh7760fb: Alloc DMA memory from hardware device Zhen Lei (1): fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() drivers/video/fbdev/sh7760fb.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] 9p/xen: fix release of IRQ
by Ze Zuo 06 Jan '25

06 Jan '25

From: Alex Zenla <alex(a)edera.dev> stable inclusion from stable-v4.19.325 commit 692eb06703afc3e24d889d77e94a0e20229f6a4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDPA CVE: CVE-2024-56704 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e43c608f40c065b30964f0a806348062991b802d ] Kernel logs indicate an IRQ was double-freed. Pass correct device ID during IRQ release. Fixes: 71ebd71921e45 ("xen/9pfs: connect to the backend") Signed-off-by: Alex Zenla <alex(a)edera.dev> Signed-off-by: Alexander Merritt <alexander(a)edera.dev> Signed-off-by: Ariadne Conill <ariadne(a)ariadne.space> Reviewed-by: Juergen Gross <jgross(a)suse.com> Message-ID: <20241121225100.5736-1-alexander(a)edera.dev> [Dominique: remove confusing variable reset to 0] Signed-off-by: Dominique Martinet <asmadeus(a)codewreck.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> (cherry picked from commit 692eb06703afc3e24d889d77e94a0e20229f6a4a) Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/9p/trans_xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 8e158f09cba8..4096cfc7efc6 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -297,7 +297,7 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0) - unbind_from_irqhandler(priv->rings[i].irq, priv->dev); + unbind_from_irqhandler(priv->rings[i].irq, ring); if (priv->rings[i].data.in) { for (j = 0; j < (1 << XEN_9PFS_RING_ORDER); j++) { grant_ref_t ref; -- 2.25.1

2 1

[PATCH OLK-5.10] bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
by Chen Zhongjin 06 Jan '25

06 Jan '25

From: Tao Lyu <tao.lyu(a)epfl.ch> mainline inclusion from mainline-v6.13-rc2 commit b0e66977dc072906bb76555fb1a64261d7f63d0f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBFYC8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When CAP_PERFMON and CAP_SYS_ADMIN (allow_ptr_leaks) are disabled, the verifier aims to reject partial overwrite on an 8-byte stack slot that contains a spilled pointer. However, in such a scenario, it rejects all partial stack overwrites as long as the targeted stack slot is a spilled register, because it does not check if the stack slot is a spilled pointer. Incomplete checks will result in the rejection of valid programs, which spill narrower scalar values onto scalar slots, as shown below. 0: R1=ctx() R10=fp0 ; asm volatile ( @ repro.bpf.c:679 0: (7a) *(u64 *)(r10 -8) = 1 ; R10=fp0 fp-8_w=1 1: (62) *(u32 *)(r10 -8) = 1 attempt to corrupt spilled pointer on stack processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0. Fix this by expanding the check to not consider spilled scalar registers when rejecting the write into the stack. Previous discussion on this patch is at link [0]. [0]: https://lore.kernel.org/bpf/20240403202409.2615469-1-tao.lyu@epfl.ch Fixes: ab125ed3ec1c ("bpf: fix check for attempt to corrupt spilled pointer") Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Tao Lyu <tao.lyu(a)epfl.ch> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Link: https://lore.kernel.org/r/20241204044757.1483141-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 642746168b33..11414b1efc50 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2681,6 +2681,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, */ if (!env->allow_ptr_leaks && is_spilled_reg(&state->stack[spi]) && + !is_spilled_scalar_reg(&state->stack[spi]) && size != BPF_REG_SIZE) { verbose(env, "attempt to corrupt spilled pointer on stack\n"); return -EACCES; -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: ath10k: avoid NULL pointer error during sdio remove
by Liu Mingrui 06 Jan '25

06 Jan '25

From: Kang Yang <quic_kangyang(a)quicinc.com> mainline inclusion from mainline-v6.13-rc1 commit 95c38953cb1ecf40399a676a1f85dfe2b5780a9a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPA CVE: CVE-2024-56599 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen: Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c This is because during 'rmmod ath10k', ath10k_sdio_remove() will call ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release() will finally be called in ath10k_core_destroy(). This function will free struct cfg80211_registered_device *rdev and all its members, including wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio workqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON. After device release, destroy_workqueue() will use NULL pointer then the kernel panic happen. Call trace: ath10k_sdio_remove ->ath10k_core_unregister …… ->ath10k_core_stop ->ath10k_hif_stop ->ath10k_sdio_irq_disable ->ath10k_hif_power_down ->del_timer_sync(&ar_sdio->sleep_timer) ->ath10k_core_destroy ->ath10k_mac_destroy ->ieee80211_free_hw ->wiphy_free …… ->wiphy_dev_release ->destroy_workqueue Need to call destroy_workqueue() before ath10k_core_destroy(), free the work queue buffer first and then free pointer of work queue by ath10k_core_destroy(). This order matches the error path order in ath10k_sdio_probe(). No work will be queued on sdio workqueue between it is destroyed and ath10k_core_destroy() is called. Based on the call_stack above, the reason is: Only ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and ath10k_sdio_irq_disable() will queue work on sdio workqueue. Sleep timer will be deleted before ath10k_core_destroy() in ath10k_hif_power_down(). ath10k_sdio_irq_disable() only be called in ath10k_hif_stop(). ath10k_core_unregister() will call ath10k_hif_power_down() to stop hif bus, so ath10k_sdio_hif_tx_sg() won't be called anymore. Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189 Signed-off-by: Kang Yang <quic_kangyang(a)quicinc.com> Tested-by: David Ruth <druth(a)chromium.org> Reviewed-by: David Ruth <druth(a)chromium.org> Link: https://patch.msgid.link/20241008022246.1010-1-quic_kangyang@quicinc.com Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Conflicts: drivers/net/wireless/ath/ath10k/sdio.c Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/net/wireless/ath/ath10k/sdio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c index 56fbcfb80bf8..850d999615a2 100644 --- a/drivers/net/wireless/ath/ath10k/sdio.c +++ b/drivers/net/wireless/ath/ath10k/sdio.c @@ -3,6 +3,7 @@ * Copyright (c) 2004-2011 Atheros Communications Inc. * Copyright (c) 2011-2012,2017 Qualcomm Atheros, Inc. * Copyright (c) 2016-2017 Erik Stromdahl <erik.stromdahl(a)gmail.com> + * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include <linux/module.h> @@ -2647,9 +2648,9 @@ static void ath10k_sdio_remove(struct sdio_func *func) netif_napi_del(&ar->napi); - ath10k_core_destroy(ar); - destroy_workqueue(ar_sdio->workqueue); + + ath10k_core_destroy(ar); } static const struct sdio_device_id ath10k_sdio_devices[] = { -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-53158
by Lin Yujun 06 Jan '25

06 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-53158
by Lin Yujun 06 Jan '25

06 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-53158
by Lin Yujun 06 Jan '25

06 Jan '25

Dan Carpenter (1): soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] CVE-2024-53158
by Lin Yujun 06 Jan '25

06 Jan '25

Dan Carpenter (1): [Backport] soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
by Chen Zhongjin 06 Jan '25

06 Jan '25

From: Tao Lyu <tao.lyu(a)epfl.ch> stable inclusion from stable-v6.6.66 commit c169daf3cf3939df45796f025bed12565e0c8202 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBFYC8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b0e66977dc072906bb76555fb1a64261d7f63d0f ] When CAP_PERFMON and CAP_SYS_ADMIN (allow_ptr_leaks) are disabled, the verifier aims to reject partial overwrite on an 8-byte stack slot that contains a spilled pointer. However, in such a scenario, it rejects all partial stack overwrites as long as the targeted stack slot is a spilled register, because it does not check if the stack slot is a spilled pointer. Incomplete checks will result in the rejection of valid programs, which spill narrower scalar values onto scalar slots, as shown below. 0: R1=ctx() R10=fp0 ; asm volatile ( @ repro.bpf.c:679 0: (7a) *(u64 *)(r10 -8) = 1 ; R10=fp0 fp-8_w=1 1: (62) *(u32 *)(r10 -8) = 1 attempt to corrupt spilled pointer on stack processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0. Fix this by expanding the check to not consider spilled scalar registers when rejecting the write into the stack. Previous discussion on this patch is at link [0]. [0]: https://lore.kernel.org/bpf/20240403202409.2615469-1-tao.lyu@epfl.ch Fixes: ab125ed3ec1c ("bpf: fix check for attempt to corrupt spilled pointer") Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Tao Lyu <tao.lyu(a)epfl.ch> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Link: https://lore.kernel.org/r/20241204044757.1483141-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 8fa7b37152c0..8d56fce24713 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4630,6 +4630,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, */ if (!env->allow_ptr_leaks && is_spilled_reg(&state->stack[spi]) && + !is_spilled_scalar_reg(&state->stack[spi]) && size != BPF_REG_SIZE) { verbose(env, "attempt to corrupt spilled pointer on stack\n"); return -EACCES; -- 2.25.1

2 1

[PATCH OLK-6.6] um: ubd: Do not use drvdata in release
by Yuan Can 06 Jan '25

06 Jan '25

From: Tiwei Bie <tiwei.btw(a)antgroup.com> stable inclusion from stable-v6.6.64 commit 2d194d951895df214e066d08146e77cb6e02c1d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEN CVE: CVE-2024-53184 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5bee35e5389f450a7eea7318deb9073e9414d3b1 upstream. The drvdata is not available in release. Let's just use container_of() to get the ubd instance. Otherwise, removing a ubd device will result in a crash: RIP: 0033:blk_mq_free_tag_set+0x1f/0xba RSP: 00000000e2083bf0 EFLAGS: 00010246 RAX: 000000006021463a RBX: 0000000000000348 RCX: 0000000062604d00 RDX: 0000000004208060 RSI: 00000000605241a0 RDI: 0000000000000348 RBP: 00000000e2083c10 R08: 0000000062414010 R09: 00000000601603f7 R10: 000000000000133a R11: 000000006038c4bd R12: 0000000000000000 R13: 0000000060213a5c R14: 0000000062405d20 R15: 00000000604f7aa0 Kernel panic - not syncing: Segfault with no mm CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.8.0-rc3-00107-gba3f67c11638 #1 Workqueue: events mc_work_proc Stack: 00000000 604f7ef0 62c5d000 62405d20 e2083c30 6002c776 6002c755 600e47ff e2083c60 6025ffe3 04208060 603d36e0 Call Trace: [<6002c776>] ubd_device_release+0x21/0x55 [<6002c755>] ? ubd_device_release+0x0/0x55 [<600e47ff>] ? kfree+0x0/0x100 [<6025ffe3>] device_release+0x70/0xba [<60381d6a>] kobject_put+0xb5/0xe2 [<6026027b>] put_device+0x19/0x1c [<6026a036>] platform_device_put+0x26/0x29 [<6026ac5a>] platform_device_unregister+0x2c/0x2e [<6002c52e>] ubd_remove+0xb8/0xd6 [<6002bb74>] ? mconsole_reply+0x0/0x50 [<6002b926>] mconsole_remove+0x160/0x1cc [<6002bbbc>] ? mconsole_reply+0x48/0x50 [<6003379c>] ? um_set_signals+0x3b/0x43 [<60061c55>] ? update_min_vruntime+0x14/0x70 [<6006251f>] ? dequeue_task_fair+0x164/0x235 [<600620aa>] ? update_cfs_group+0x0/0x40 [<603a0e77>] ? __schedule+0x0/0x3ed [<60033761>] ? um_set_signals+0x0/0x43 [<6002af6a>] mc_work_proc+0x77/0x91 [<600520b4>] process_scheduled_works+0x1af/0x2c3 [<6004ede3>] ? assign_work+0x0/0x58 [<600527a1>] worker_thread+0x2f7/0x37a [<6004ee3b>] ? set_pf_worker+0x0/0x64 [<6005765d>] ? arch_local_irq_save+0x0/0x2d [<60058e07>] ? kthread_exit+0x0/0x3a [<600524aa>] ? worker_thread+0x0/0x37a [<60058f9f>] kthread+0x130/0x135 [<6002068e>] new_thread_handler+0x85/0xb6 Cc: stable(a)vger.kernel.org Signed-off-by: Tiwei Bie <tiwei.btw(a)antgroup.com> Acked-By: Anton Ivanov <anton.ivanov(a)cambridgegreys.com> Link: https://patch.msgid.link/20241104163203.435515-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/um/drivers/ubd_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c index ef7b4b911a45..7ddda2c0ae43 100644 --- a/arch/um/drivers/ubd_kern.c +++ b/arch/um/drivers/ubd_kern.c @@ -799,7 +799,7 @@ static int ubd_open_dev(struct ubd *ubd_dev) static void ubd_device_release(struct device *dev) { - struct ubd *ubd_dev = dev_get_drvdata(dev); + struct ubd *ubd_dev = container_of(dev, struct ubd, pdev.dev); blk_mq_free_tag_set(&ubd_dev->tag_set); *ubd_dev = ((struct ubd) DEFAULT_UBD); -- 2.22.0

2 1

[PATCH OLK-6.6 0/2] CVE-2024-56724
by Liao Chen 06 Jan '25

06 Jan '25

fix CVE-2024-56724 Andy Shevchenko (2): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 82 +++++++++++++++++--------- drivers/platform/x86/intel/bxtwc_tmu.c | 22 ++----- drivers/usb/typec/tcpm/wcove.c | 4 -- 3 files changed, 60 insertions(+), 48 deletions(-) -- 2.34.1

2 3