- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 v2] ipv4: Fix uninit-value access in __ip_make_skb()
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Shigeru Yoshida <syoshida(a)redhat.com> mainline inclusion from mainline-v6.9-rc7 commit fc1092f51567277509563800a3c56732070b6aa4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TXIE CVE: CVE-2024-36927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IP_HDRINCL changes HDRINCL while __ip_make_skb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN. Check FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of testing HDRINCL on the socket. Also, fl4->fl4_icmp_type and fl4->fl4_icmp_code are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4_init_output(), but we should not rely on specific union layout. Initialize these explicitly in raw_sendmsg(). [1] BUG: KMSAN: uninit-value in __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 ip_finish_skb include/net/ip.h:243 [inline] ip_push_pending_frames+0x4c/0x5c0 net/ipv4/ip_output.c:1508 raw_sendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x5f6/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35a/0x7c0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] __ip_append_data+0x49ab/0x68c0 net/ipv4/ip_output.c:1128 ip_append_data+0x1e7/0x260 net/ipv4/ip_output.c:1365 raw_sendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 Fixes: 99e5acae193e ("ipv4: Fix potential uninit variable access bug in __ip_make_skb()") Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Link: https://lore.kernel.org/r/20240430123945.2057348-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ipv4/ip_output.c [commit cafbe182a467 wasnt merged in 5.10, which leads to context conflicts for inet_test_bit() not implemented] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/ip_output.c | 3 ++- net/ipv4/raw.c | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 5d20dac19e0b..79ff136ae6f5 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1571,7 +1571,8 @@ struct sk_buff *__ip_make_skb(struct sock *sk, * so icmphdr does not in skb linear region and can not get icmp_type * by icmp_hdr(skb)->type. */ - if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl) + if (sk->sk_type == SOCK_RAW && + !(fl4->flowi4_flags & FLOWI_FLAG_KNOWN_NH)) icmp_type = fl4->fl4_icmp_type; else icmp_type = icmp_hdr(skb)->type; diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 5336731b2401..3909dcccdd3e 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -606,6 +606,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0), daddr, saddr, 0, 0, sk->sk_uid); + fl4.fl4_icmp_type = 0; + fl4.fl4_icmp_code = 0; + if (!hdrincl) { rfv.msg = msg; rfv.hlen = 0; -- 2.25.1

2 1

[PATCH OLK-5.10] mlxsw: spectrum_acl_erp: Fix object nesting warning
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Ido Schimmel <idosch(a)nvidia.com> stable inclusion from stable-v5.10.223 commit 36a9996e020dd5aa325e0ecc55eb2328288ea6bb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALEAO CVE: CVE-2024-43880 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97d833ceb27dc19f8777d63f90be4a27b5daeedf ] ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited. In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters. The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask. The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute a more optimal set ("hints") by looking at all the existing objects. When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM. The above can result in the following set of hints: H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition. Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication. This can eventually lead to nested objects which are not supported by the library [1]. Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches. I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour. Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next. [1] WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 Fixes: 9069a3817d82 ("lib: objagg: implement optimization hints assembly and use hints for object creation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Tested-by: Alexander Zubkov <green(a)qrator.net> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- .../ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 ------------- include/linux/objagg.h | 1 - lib/objagg.c | 15 --------------- 3 files changed, 29 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c index d231f4d2888b..9eee229303cc 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c @@ -1217,18 +1217,6 @@ static bool mlxsw_sp_acl_erp_delta_check(void *priv, const void *parent_obj, return err ? false : true; } -static int mlxsw_sp_acl_erp_hints_obj_cmp(const void *obj1, const void *obj2) -{ - const struct mlxsw_sp_acl_erp_key *key1 = obj1; - const struct mlxsw_sp_acl_erp_key *key2 = obj2; - - /* For hints purposes, two objects are considered equal - * in case the masks are the same. Does not matter what - * the "ctcam" value is. - */ - return memcmp(key1->mask, key2->mask, sizeof(key1->mask)); -} - static void *mlxsw_sp_acl_erp_delta_create(void *priv, void *parent_obj, void *obj) { @@ -1308,7 +1296,6 @@ static void mlxsw_sp_acl_erp_root_destroy(void *priv, void *root_priv) static const struct objagg_ops mlxsw_sp_acl_erp_objagg_ops = { .obj_size = sizeof(struct mlxsw_sp_acl_erp_key), .delta_check = mlxsw_sp_acl_erp_delta_check, - .hints_obj_cmp = mlxsw_sp_acl_erp_hints_obj_cmp, .delta_create = mlxsw_sp_acl_erp_delta_create, .delta_destroy = mlxsw_sp_acl_erp_delta_destroy, .root_create = mlxsw_sp_acl_erp_root_create, diff --git a/include/linux/objagg.h b/include/linux/objagg.h index 78021777df46..6df5b887dc54 100644 --- a/include/linux/objagg.h +++ b/include/linux/objagg.h @@ -8,7 +8,6 @@ struct objagg_ops { size_t obj_size; bool (*delta_check)(void *priv, const void *parent_obj, const void *obj); - int (*hints_obj_cmp)(const void *obj1, const void *obj2); void * (*delta_create)(void *priv, void *parent_obj, void *obj); void (*delta_destroy)(void *priv, void *delta_priv); void * (*root_create)(void *priv, void *obj, unsigned int root_id); diff --git a/lib/objagg.c b/lib/objagg.c index 73d711602573..57bde522f249 100644 --- a/lib/objagg.c +++ b/lib/objagg.c @@ -909,20 +909,6 @@ static const struct objagg_opt_algo *objagg_opt_algos[] = { [OBJAGG_OPT_ALGO_SIMPLE_GREEDY] = &objagg_opt_simple_greedy, }; -static int objagg_hints_obj_cmp(struct rhashtable_compare_arg *arg, - const void *obj) -{ - struct rhashtable *ht = arg->ht; - struct objagg_hints *objagg_hints = - container_of(ht, struct objagg_hints, node_ht); - const struct objagg_ops *ops = objagg_hints->ops; - const char *ptr = obj; - - ptr += ht->p.key_offset; - return ops->hints_obj_cmp ? ops->hints_obj_cmp(ptr, arg->key) : - memcmp(ptr, arg->key, ht->p.key_len); -} - /** * objagg_hints_get - obtains hints instance * @objagg: objagg instance @@ -961,7 +947,6 @@ struct objagg_hints *objagg_hints_get(struct objagg *objagg, offsetof(struct objagg_hints_node, obj); objagg_hints->ht_params.head_offset = offsetof(struct objagg_hints_node, ht_node); - objagg_hints->ht_params.obj_cmpfn = objagg_hints_obj_cmp; err = rhashtable_init(&objagg_hints->node_ht, &objagg_hints->ht_params); if (err) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] mlxsw: spectrum_acl_erp: Fix object nesting warning
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Ido Schimmel <idosch(a)nvidia.com> stable inclusion from stable-v5.10.223 commit 36a9996e020dd5aa325e0ecc55eb2328288ea6bb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALEAO CVE: CVE-2024-43880 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97d833ceb27dc19f8777d63f90be4a27b5daeedf ] ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited. In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters. The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask. The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute a more optimal set ("hints") by looking at all the existing objects. When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM. The above can result in the following set of hints: H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition. Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication. This can eventually lead to nested objects which are not supported by the library [1]. Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches. I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour. Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next. [1] WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 Fixes: 9069a3817d82 ("lib: objagg: implement optimization hints assembly and use hints for object creation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Tested-by: Alexander Zubkov <green(a)qrator.net> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- .../ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 ------------- include/linux/objagg.h | 1 - lib/objagg.c | 15 --------------- 3 files changed, 29 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c index d231f4d2888b..9eee229303cc 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c @@ -1217,18 +1217,6 @@ static bool mlxsw_sp_acl_erp_delta_check(void *priv, const void *parent_obj, return err ? false : true; } -static int mlxsw_sp_acl_erp_hints_obj_cmp(const void *obj1, const void *obj2) -{ - const struct mlxsw_sp_acl_erp_key *key1 = obj1; - const struct mlxsw_sp_acl_erp_key *key2 = obj2; - - /* For hints purposes, two objects are considered equal - * in case the masks are the same. Does not matter what - * the "ctcam" value is. - */ - return memcmp(key1->mask, key2->mask, sizeof(key1->mask)); -} - static void *mlxsw_sp_acl_erp_delta_create(void *priv, void *parent_obj, void *obj) { @@ -1308,7 +1296,6 @@ static void mlxsw_sp_acl_erp_root_destroy(void *priv, void *root_priv) static const struct objagg_ops mlxsw_sp_acl_erp_objagg_ops = { .obj_size = sizeof(struct mlxsw_sp_acl_erp_key), .delta_check = mlxsw_sp_acl_erp_delta_check, - .hints_obj_cmp = mlxsw_sp_acl_erp_hints_obj_cmp, .delta_create = mlxsw_sp_acl_erp_delta_create, .delta_destroy = mlxsw_sp_acl_erp_delta_destroy, .root_create = mlxsw_sp_acl_erp_root_create, diff --git a/include/linux/objagg.h b/include/linux/objagg.h index 78021777df46..6df5b887dc54 100644 --- a/include/linux/objagg.h +++ b/include/linux/objagg.h @@ -8,7 +8,6 @@ struct objagg_ops { size_t obj_size; bool (*delta_check)(void *priv, const void *parent_obj, const void *obj); - int (*hints_obj_cmp)(const void *obj1, const void *obj2); void * (*delta_create)(void *priv, void *parent_obj, void *obj); void (*delta_destroy)(void *priv, void *delta_priv); void * (*root_create)(void *priv, void *obj, unsigned int root_id); diff --git a/lib/objagg.c b/lib/objagg.c index 73d711602573..57bde522f249 100644 --- a/lib/objagg.c +++ b/lib/objagg.c @@ -909,20 +909,6 @@ static const struct objagg_opt_algo *objagg_opt_algos[] = { [OBJAGG_OPT_ALGO_SIMPLE_GREEDY] = &objagg_opt_simple_greedy, }; -static int objagg_hints_obj_cmp(struct rhashtable_compare_arg *arg, - const void *obj) -{ - struct rhashtable *ht = arg->ht; - struct objagg_hints *objagg_hints = - container_of(ht, struct objagg_hints, node_ht); - const struct objagg_ops *ops = objagg_hints->ops; - const char *ptr = obj; - - ptr += ht->p.key_offset; - return ops->hints_obj_cmp ? ops->hints_obj_cmp(ptr, arg->key) : - memcmp(ptr, arg->key, ht->p.key_len); -} - /** * objagg_hints_get - obtains hints instance * @objagg: objagg instance @@ -961,7 +947,6 @@ struct objagg_hints *objagg_hints_get(struct objagg *objagg, offsetof(struct objagg_hints_node, obj); objagg_hints->ht_params.head_offset = offsetof(struct objagg_hints_node, ht_node); - objagg_hints->ht_params.obj_cmpfn = objagg_hints_obj_cmp; err = rhashtable_init(&objagg_hints->node_ht, &objagg_hints->ht_params); if (err) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netns: Make get_net_ns() handle zero refcount net
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Yue Haibing <yuehaibing(a)huawei.com> stable inclusion from stable-v5.10.221 commit 2b82028a1f5ee3a8e04090776b10c534144ae77b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACR2S CVE: CVE-2024-40958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ff960f9d3edbe08a736b5a224d91a305ccc946b0 ] Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0xdf/0x1d0 Code: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1 RSP: 0018:ffff8881067b7da0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac RDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001 RBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139 R10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4 R13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040 FS: 00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0xa3/0xc0 ? __warn+0xa5/0x1c0 ? refcount_warn_saturate+0xdf/0x1d0 ? report_bug+0x1fc/0x2d0 ? refcount_warn_saturate+0xdf/0x1d0 ? handle_bug+0xa1/0x110 ? exc_invalid_op+0x3c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? __warn_printk+0xcc/0x140 ? __warn_printk+0xd5/0x140 ? refcount_warn_saturate+0xdf/0x1d0 get_net_ns+0xa4/0xc0 ? __pfx_get_net_ns+0x10/0x10 open_related_ns+0x5a/0x130 __tun_chr_ioctl+0x1616/0x2370 ? __sanitizer_cov_trace_switch+0x58/0xa0 ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30 ? __pfx_tun_chr_ioctl+0x10/0x10 tun_chr_ioctl+0x2f/0x40 __x64_sys_ioctl+0x11b/0x160 x64_sys_call+0x1211/0x20d0 do_syscall_64+0x9e/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b28f165d7 Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8 RSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7 RDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003 RBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0 R10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730 R13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... This is trigger as below: ns0 ns1 tun_set_iff() //dev is tun0 tun->dev = dev //ip link set tun0 netns ns1 put_net() //ref is 0 __tun_chr_ioctl() //TUNGETDEVNETNS net = dev_net(tun->dev); open_related_ns(&net->ns, get_net_ns); //ns1 get_net_ns() get_net() //addition on 0 Use maybe_get_net() in get_net_ns in case net's ref is zero to fix this Fixes: 0c3e0e3bb623 ("tun: Add ioctl() TUNGETDEVNETNS cmd to allow obtaining real net ns of tun device") Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> Link: https://lore.kernel.org/r/20240614131302.2698509-1-yuehaibing@huawei.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/core/net_namespace.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index cd867cb408c9..640891b6d1c2 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -661,11 +661,16 @@ EXPORT_SYMBOL_GPL(__put_net); * get_net_ns - increment the refcount of the network namespace * @ns: common namespace (net) * - * Returns the net's common namespace. + * Returns the net's common namespace or ERR_PTR() if ref is zero. */ struct ns_common *get_net_ns(struct ns_common *ns) { - return &get_net(container_of(ns, struct net, ns))->ns; + struct net *net; + + net = maybe_get_net(container_of(ns, struct net, ns)); + if (net) + return &net->ns; + return ERR_PTR(-EINVAL); } EXPORT_SYMBOL_GPL(get_net_ns); -- 2.25.1

2 1

[PATCH OLK-5.10] netns: Make get_net_ns() handle zero refcount net
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Yue Haibing <yuehaibing(a)huawei.com> stable inclusion from stable-v5.10.221 commit 2b82028a1f5ee3a8e04090776b10c534144ae77b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACR2S CVE: CVE-2024-40958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ff960f9d3edbe08a736b5a224d91a305ccc946b0 ] Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0xdf/0x1d0 Code: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1 RSP: 0018:ffff8881067b7da0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac RDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001 RBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139 R10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4 R13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040 FS: 00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0xa3/0xc0 ? __warn+0xa5/0x1c0 ? refcount_warn_saturate+0xdf/0x1d0 ? report_bug+0x1fc/0x2d0 ? refcount_warn_saturate+0xdf/0x1d0 ? handle_bug+0xa1/0x110 ? exc_invalid_op+0x3c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? __warn_printk+0xcc/0x140 ? __warn_printk+0xd5/0x140 ? refcount_warn_saturate+0xdf/0x1d0 get_net_ns+0xa4/0xc0 ? __pfx_get_net_ns+0x10/0x10 open_related_ns+0x5a/0x130 __tun_chr_ioctl+0x1616/0x2370 ? __sanitizer_cov_trace_switch+0x58/0xa0 ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30 ? __pfx_tun_chr_ioctl+0x10/0x10 tun_chr_ioctl+0x2f/0x40 __x64_sys_ioctl+0x11b/0x160 x64_sys_call+0x1211/0x20d0 do_syscall_64+0x9e/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b28f165d7 Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8 RSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7 RDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003 RBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0 R10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730 R13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... This is trigger as below: ns0 ns1 tun_set_iff() //dev is tun0 tun->dev = dev //ip link set tun0 netns ns1 put_net() //ref is 0 __tun_chr_ioctl() //TUNGETDEVNETNS net = dev_net(tun->dev); open_related_ns(&net->ns, get_net_ns); //ns1 get_net_ns() get_net() //addition on 0 Use maybe_get_net() in get_net_ns in case net's ref is zero to fix this Fixes: 0c3e0e3bb623 ("tun: Add ioctl() TUNGETDEVNETNS cmd to allow obtaining real net ns of tun device") Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> Link: https://lore.kernel.org/r/20240614131302.2698509-1-yuehaibing@huawei.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/core/net_namespace.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index cd867cb408c9..640891b6d1c2 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -661,11 +661,16 @@ EXPORT_SYMBOL_GPL(__put_net); * get_net_ns - increment the refcount of the network namespace * @ns: common namespace (net) * - * Returns the net's common namespace. + * Returns the net's common namespace or ERR_PTR() if ref is zero. */ struct ns_common *get_net_ns(struct ns_common *ns) { - return &get_net(container_of(ns, struct net, ns))->ns; + struct net *net; + + net = maybe_get_net(container_of(ns, struct net, ns)); + if (net) + return &net->ns; + return ERR_PTR(-EINVAL); } EXPORT_SYMBOL_GPL(get_net_ns); -- 2.25.1

2 1

[PATCH OLK-6.6] net: ena: Add validation for completion descriptors consistency
by Dong Chenchen 14 Oct '24

14 Oct '24

From: David Arinzon <darinzon(a)amazon.com> mainline inclusion from mainline-v6.10-rc1 commit b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACS9I CVE: CVE-2024-40999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Validate that `first` flag is set only for the first descriptor in multi-buffer packets. In case of an invalid descriptor, a reset will occur. A new reset reason for RX data corruption has been added. Signed-off-by: Shahar Itzko <itzko(a)amazon.com> Signed-off-by: David Arinzon <darinzon(a)amazon.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240512134637.25299-4-darinzon@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/amazon/ena/ena_regs_defs.h [commit 071271f39ce8 add ENA_REGS_RESET_SUSPECTED_POLL_STARVATION, which lead to conflicts for not merged] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 37 ++++++++++++++----- drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 + .../net/ethernet/amazon/ena/ena_regs_defs.h | 1 + 3 files changed, 30 insertions(+), 10 deletions(-) diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c index 933e619b3a31..4c6e07aa4bbb 100644 --- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c +++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c @@ -229,30 +229,43 @@ static struct ena_eth_io_rx_cdesc_base * idx * io_cq->cdesc_entry_size_in_bytes); } -static u16 ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq, - u16 *first_cdesc_idx) +static int ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq, + u16 *first_cdesc_idx, + u16 *num_descs) { + u16 count = io_cq->cur_rx_pkt_cdesc_count, head_masked; struct ena_eth_io_rx_cdesc_base *cdesc; - u16 count = 0, head_masked; u32 last = 0; do { + u32 status; + cdesc = ena_com_get_next_rx_cdesc(io_cq); if (!cdesc) break; + status = READ_ONCE(cdesc->status); ena_com_cq_inc_head(io_cq); + if (unlikely((status & ENA_ETH_IO_RX_CDESC_BASE_FIRST_MASK) >> + ENA_ETH_IO_RX_CDESC_BASE_FIRST_SHIFT && count != 0)) { + struct ena_com_dev *dev = ena_com_io_cq_to_ena_dev(io_cq); + + netdev_err(dev->net_device, + "First bit is on in descriptor #%d on q_id: %d, req_id: %u\n", + count, io_cq->qid, cdesc->req_id); + return -EFAULT; + } count++; - last = (READ_ONCE(cdesc->status) & ENA_ETH_IO_RX_CDESC_BASE_LAST_MASK) >> - ENA_ETH_IO_RX_CDESC_BASE_LAST_SHIFT; + last = (status & ENA_ETH_IO_RX_CDESC_BASE_LAST_MASK) >> + ENA_ETH_IO_RX_CDESC_BASE_LAST_SHIFT; } while (!last); if (last) { *first_cdesc_idx = io_cq->cur_rx_pkt_cdesc_start_idx; - count += io_cq->cur_rx_pkt_cdesc_count; head_masked = io_cq->head & (io_cq->q_depth - 1); + *num_descs = count; io_cq->cur_rx_pkt_cdesc_count = 0; io_cq->cur_rx_pkt_cdesc_start_idx = head_masked; @@ -260,11 +273,11 @@ static u16 ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq, "ENA q_id: %d packets were completed. first desc idx %u descs# %d\n", io_cq->qid, *first_cdesc_idx, count); } else { - io_cq->cur_rx_pkt_cdesc_count += count; - count = 0; + io_cq->cur_rx_pkt_cdesc_count = count; + *num_descs = 0; } - return count; + return 0; } static int ena_com_create_meta(struct ena_com_io_sq *io_sq, @@ -539,10 +552,14 @@ int ena_com_rx_pkt(struct ena_com_io_cq *io_cq, u16 cdesc_idx = 0; u16 nb_hw_desc; u16 i = 0; + int rc; WARN(io_cq->direction != ENA_COM_IO_QUEUE_DIRECTION_RX, "wrong Q type"); - nb_hw_desc = ena_com_cdesc_rx_pkt_get(io_cq, &cdesc_idx); + rc = ena_com_cdesc_rx_pkt_get(io_cq, &cdesc_idx, &nb_hw_desc); + if (unlikely(rc != 0)) + return -EFAULT; + if (nb_hw_desc == 0) { ena_rx_ctx->descs = nb_hw_desc; return 0; diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c index 0d201a57d7e2..6907e99b2ea7 100644 --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -1323,6 +1323,8 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi, if (rc == -ENOSPC) { ena_increase_stat(&rx_ring->rx_stats.bad_desc_num, 1, &rx_ring->syncp); ena_reset_device(adapter, ENA_REGS_RESET_TOO_MANY_RX_DESCS); + } else if (rc == -EFAULT) { + ena_reset_device(adapter, ENA_REGS_RESET_RX_DESCRIPTOR_MALFORMED); } else { ena_increase_stat(&rx_ring->rx_stats.bad_req_id, 1, &rx_ring->syncp); diff --git a/drivers/net/ethernet/amazon/ena/ena_regs_defs.h b/drivers/net/ethernet/amazon/ena/ena_regs_defs.h index 1e007a41a525..2e7109968205 100644 --- a/drivers/net/ethernet/amazon/ena/ena_regs_defs.h +++ b/drivers/net/ethernet/amazon/ena/ena_regs_defs.h @@ -21,6 +21,7 @@ enum ena_regs_reset_reason_types { ENA_REGS_RESET_USER_TRIGGER = 12, ENA_REGS_RESET_GENERIC = 13, ENA_REGS_RESET_MISS_INTERRUPT = 14, + ENA_REGS_RESET_RX_DESCRIPTOR_MALFORMED = 15, }; /* ena_registers offsets */ -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] net/sched: Fix CVE-2024-36244
by Dong Chenchen 14 Oct '24

14 Oct '24

Fix CVE-2024-36244. Kuniyuki Iwashima (1): net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. Vladimir Oltean (1): net/sched: taprio: extend minimum interval restriction to entire cycle too net/sched/sch_taprio.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] net/sched: Fix CVE-2024-36244
by Dong Chenchen 14 Oct '24

14 Oct '24

Fix CVE-2024-36244 Kuniyuki Iwashima (1): net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. Vladimir Oltean (1): net/sched: taprio: extend minimum interval restriction to entire cycle too net/sched/sch_taprio.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] net: stmmac: move the EST lock to struct stmmac_priv
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Xiaolei Wang <xiaolei.wang(a)windriver.com> mainline inclusion from mainline-v6.10-rc1 commit 36ac9e7f2e5786bd37c5cd91132e1f39c29b8197 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S5U CVE: CVE-2024-38594 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reinitialize the whole EST structure would also reset the mutex lock which is embedded in the EST structure, and then trigger the following warning. To address this, move the lock to struct stmmac_priv. We also need to reacquire the mutex lock when doing this initialization. DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 3 PID: 505 at kernel/locking/mutex.c:587 __mutex_lock+0xd84/0x1068 Modules linked in: CPU: 3 PID: 505 Comm: tc Not tainted 6.9.0-rc6-00053-g0106679839f7-dirty #29 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock+0xd84/0x1068 lr : __mutex_lock+0xd84/0x1068 sp : ffffffc0864e3570 x29: ffffffc0864e3570 x28: ffffffc0817bdc78 x27: 0000000000000003 x26: ffffff80c54f1808 x25: ffffff80c9164080 x24: ffffffc080d723ac x23: 0000000000000000 x22: 0000000000000002 x21: 0000000000000000 x20: 0000000000000000 x19: ffffffc083bc3000 x18: ffffffffffffffff x17: ffffffc08117b080 x16: 0000000000000002 x15: ffffff80d2d40000 x14: 00000000000002da x13: ffffff80d2d404b8 x12: ffffffc082b5a5c8 x11: ffffffc082bca680 x10: ffffffc082bb2640 x9 : ffffffc082bb2698 x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000000001 x5 : ffffff8178fe0d48 x4 : 0000000000000000 x3 : 0000000000000027 x2 : ffffff8178fe0d50 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: __mutex_lock+0xd84/0x1068 mutex_lock_nested+0x28/0x34 tc_setup_taprio+0x118/0x68c stmmac_setup_tc+0x50/0xf0 taprio_change+0x868/0xc9c Fixes: b2aae654a479 ("net: stmmac: add mutex lock to protect est parameters") Signed-off-by: Xiaolei Wang <xiaolei.wang(a)windriver.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Serge Semin <fancer.lancer(a)gmail.com> Reviewed-by: Andrew Halaney <ahalaney(a)redhat.com> Link: https://lore.kernel.org/r/20240513014346.1718740-2-xiaolei.wang@windriver.c… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c [commit c5c3e1bfc9e0("net: stmmac: Offload queueMaxSDU from tc-taprio") wasnt merged, which add tc_taprio_map_maxsdu_txq lead to conflicts.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 ++ .../net/ethernet/stmicro/stmmac/stmmac_ptp.c | 8 ++++---- .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 18 ++++++++++-------- include/linux/stmmac.h | 1 - 4 files changed, 16 insertions(+), 13 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h index b8c93b881a65..85a55f459af0 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h @@ -248,6 +248,8 @@ struct stmmac_priv { struct stmmac_extra_stats xstats ____cacheline_aligned_in_smp; struct stmmac_safety_stats sstats; struct plat_stmmacenet_data *plat; + /* Protect est parameters */ + struct mutex est_lock; struct dma_features dma_cap; struct stmmac_counters mmc; int hw_cap_support; diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c index 3d7825cb30bb..a04bb2e42c4e 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c @@ -70,11 +70,11 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta) /* If EST is enabled, disabled it before adjust ptp time. */ if (priv->plat->est && priv->plat->est->enable) { est_rst = true; - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); priv->plat->est->enable = false; stmmac_est_configure(priv, priv->ioaddr, priv->plat->est, priv->plat->clk_ptp_rate); - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); } write_lock_irqsave(&priv->ptp_lock, flags); @@ -87,7 +87,7 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta) ktime_t current_time_ns, basetime; u64 cycle_time; - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, &current_time); current_time_ns = timespec64_to_ktime(current_time); time.tv_nsec = priv->plat->est->btr_reserve[0]; @@ -104,7 +104,7 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta) priv->plat->est->enable = true; ret = stmmac_est_configure(priv, priv->ioaddr, priv->plat->est, priv->plat->clk_ptp_rate); - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); if (ret) netdev_err(priv->dev, "failed to configure EST\n"); } diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c index 77245f856dd0..a11bb042db27 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c @@ -983,17 +983,19 @@ static int tc_setup_taprio(struct stmmac_priv *priv, if (!plat->est) return -ENOMEM; - mutex_init(&priv->plat->est->lock); + mutex_init(&priv->est_lock); } else { + mutex_lock(&priv->est_lock); memset(plat->est, 0, sizeof(*plat->est)); + mutex_unlock(&priv->est_lock); } size = qopt->num_entries; - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); priv->plat->est->gcl_size = size; priv->plat->est->enable = qopt->cmd == TAPRIO_CMD_REPLACE; - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); for (i = 0; i < size; i++) { s64 delta_ns = qopt->entries[i].interval; @@ -1024,7 +1026,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->est->gcl[i] = delta_ns | (gates << wid); } - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); /* Adjust for real system time */ priv->ptp_clock_ops.gettime64(&priv->ptp_clock_ops, &current_time); current_time_ns = timespec64_to_ktime(current_time); @@ -1043,7 +1045,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, priv->plat->est->ctr[1] = (u32)ctr; if (fpe && !priv->dma_cap.fpesel) { - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); return -EOPNOTSUPP; } @@ -1054,7 +1056,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv, ret = stmmac_est_configure(priv, priv->ioaddr, priv->plat->est, priv->plat->clk_ptp_rate); - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); if (ret) { netdev_err(priv->dev, "failed to configure EST\n"); goto disable; @@ -1071,11 +1073,11 @@ static int tc_setup_taprio(struct stmmac_priv *priv, disable: if (priv->plat->est) { - mutex_lock(&priv->plat->est->lock); + mutex_lock(&priv->est_lock); priv->plat->est->enable = false; stmmac_est_configure(priv, priv->ioaddr, priv->plat->est, priv->plat->clk_ptp_rate); - mutex_unlock(&priv->plat->est->lock); + mutex_unlock(&priv->est_lock); } priv->plat->fpe_cfg->enable = false; diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h index 482f56e27988..e286ebd32fe6 100644 --- a/include/linux/stmmac.h +++ b/include/linux/stmmac.h @@ -118,7 +118,6 @@ struct stmmac_axi { #define EST_GCL 1024 struct stmmac_est { - struct mutex lock; int enable; u32 btr_reserve[2]; u32 btr_offset[2]; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ipv6: sr: fix invalid unregister error path
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Hangbin Liu <liuhangbin(a)gmail.com> stable inclusion from stable-v5.10.219 commit 00e6335329f23ac6cf3105931691674e28bc598c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SHW CVE: CVE-2024-38612 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 160e9d2752181fcf18c662e74022d77d3164cd45 ] The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL is not defined. In that case if seg6_hmac_init() fails, the genl_unregister_family() isn't called. This issue exist since commit 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref") replaced unregister_pernet_subsys() with genl_unregister_family() in this error path. Fixes: 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support") Reported-by: Guillaume Nault <gnault(a)redhat.com> Signed-off-by: Hangbin Liu <liuhangbin(a)gmail.com> Reviewed-by: Sabrina Dubroca <sd(a)queasysnail.net> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20240509131812.1662197-4-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/seg6.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c index d59eef2f41c6..327e231021e3 100644 --- a/net/ipv6/seg6.c +++ b/net/ipv6/seg6.c @@ -494,6 +494,8 @@ int __init seg6_init(void) #endif #ifdef CONFIG_IPV6_SEG6_LWTUNNEL out_unregister_genl: +#endif +#if IS_ENABLED(CONFIG_IPV6_SEG6_LWTUNNEL) || IS_ENABLED(CONFIG_IPV6_SEG6_HMAC) genl_unregister_family(&seg6_genl_family); #endif out_unregister_pernet: -- 2.25.1

2 1

[PATCH OLK-5.10] ipv6: sr: fix invalid unregister error path
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Hangbin Liu <liuhangbin(a)gmail.com> stable inclusion from stable-v5.10.219 commit 00e6335329f23ac6cf3105931691674e28bc598c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SHW CVE: CVE-2024-38612 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 160e9d2752181fcf18c662e74022d77d3164cd45 ] The error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL is not defined. In that case if seg6_hmac_init() fails, the genl_unregister_family() isn't called. This issue exist since commit 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref") replaced unregister_pernet_subsys() with genl_unregister_family() in this error path. Fixes: 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support") Reported-by: Guillaume Nault <gnault(a)redhat.com> Signed-off-by: Hangbin Liu <liuhangbin(a)gmail.com> Reviewed-by: Sabrina Dubroca <sd(a)queasysnail.net> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://lore.kernel.org/r/20240509131812.1662197-4-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/seg6.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c index d59eef2f41c6..327e231021e3 100644 --- a/net/ipv6/seg6.c +++ b/net/ipv6/seg6.c @@ -494,6 +494,8 @@ int __init seg6_init(void) #endif #ifdef CONFIG_IPV6_SEG6_LWTUNNEL out_unregister_genl: +#endif +#if IS_ENABLED(CONFIG_IPV6_SEG6_LWTUNNEL) || IS_ENABLED(CONFIG_IPV6_SEG6_HMAC) genl_unregister_family(&seg6_genl_family); #endif out_unregister_pernet: -- 2.25.1

2 1

[PATCH OLK-5.10] ipv4: Fix uninit-value access in __ip_make_skb()
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Shigeru Yoshida <syoshida(a)redhat.com> mainline inclusion from mainline-v6.9-rc7 commit fc1092f51567277509563800a3c56732070b6aa4 category: bugfix bugzilla: 190087 CVE: CVE-2024-36927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IP_HDRINCL changes HDRINCL while __ip_make_skb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN. Check FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of testing HDRINCL on the socket. Also, fl4->fl4_icmp_type and fl4->fl4_icmp_code are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4_init_output(), but we should not rely on specific union layout. Initialize these explicitly in raw_sendmsg(). [1] BUG: KMSAN: uninit-value in __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 ip_finish_skb include/net/ip.h:243 [inline] ip_push_pending_frames+0x4c/0x5c0 net/ipv4/ip_output.c:1508 raw_sendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x5f6/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35a/0x7c0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] __ip_append_data+0x49ab/0x68c0 net/ipv4/ip_output.c:1128 ip_append_data+0x1e7/0x260 net/ipv4/ip_output.c:1365 raw_sendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 Fixes: 99e5acae193e ("ipv4: Fix potential uninit variable access bug in __ip_make_skb()") Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Link: https://lore.kernel.org/r/20240430123945.2057348-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ipv4/ip_output.c [commit cafbe182a467 wasnt merged in 5.10, which leads to context conflicts for inet_test_bit() not implemented] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/ip_output.c | 3 ++- net/ipv4/raw.c | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 5d20dac19e0b..79ff136ae6f5 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1571,7 +1571,8 @@ struct sk_buff *__ip_make_skb(struct sock *sk, * so icmphdr does not in skb linear region and can not get icmp_type * by icmp_hdr(skb)->type. */ - if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl) + if (sk->sk_type == SOCK_RAW && + !(fl4->flowi4_flags & FLOWI_FLAG_KNOWN_NH)) icmp_type = fl4->fl4_icmp_type; else icmp_type = icmp_hdr(skb)->type; diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 5336731b2401..3909dcccdd3e 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -606,6 +606,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0), daddr, saddr, 0, 0, sk->sk_uid); + fl4.fl4_icmp_type = 0; + fl4.fl4_icmp_code = 0; + if (!hdrincl) { rfv.msg = msg; rfv.hlen = 0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] atm: idt77252: prevent use after free in dequeue_rx()
by Peng Zhang 14 Oct '24

14 Oct '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.225 commit 1cece837e387c039225f19028df255df87a97c0d category: bugfix bugzilla: 189268 CVE: CVE-2024-44998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a9a18e8f770c9b0703dab93580d0b02e199a4c79 ] We can't dereference "skb" after calling vcc->push() because the skb is released. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/atm/idt77252.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c index e616e33c8a20..25fd73fafb37 100644 --- a/drivers/atm/idt77252.c +++ b/drivers/atm/idt77252.c @@ -1118,8 +1118,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) rpp->len += skb->len; if (stat & SAR_RSQE_EPDU) { + unsigned int len, truesize; unsigned char *l1l2; - unsigned int len; l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6); @@ -1189,14 +1189,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) ATM_SKB(skb)->vcc = vcc; __net_timestamp(skb); + truesize = skb->truesize; vcc->push(vcc, skb); atomic_inc(&vcc->stats->rx); - if (skb->truesize > SAR_FB_SIZE_3) + if (truesize > SAR_FB_SIZE_3) add_rx_skb(card, 3, SAR_FB_SIZE_3, 1); - else if (skb->truesize > SAR_FB_SIZE_2) + else if (truesize > SAR_FB_SIZE_2) add_rx_skb(card, 2, SAR_FB_SIZE_2, 1); - else if (skb->truesize > SAR_FB_SIZE_1) + else if (truesize > SAR_FB_SIZE_1) add_rx_skb(card, 1, SAR_FB_SIZE_1, 1); else add_rx_skb(card, 0, SAR_FB_SIZE_0, 1); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] fou: remove warn in gue_gro_receive on unsupported protocol
by Peng Zhang 14 Oct '24

14 Oct '24

From: Willem de Bruijn <willemb(a)google.com> mainline inclusion from mainline-v6.11-rc1 commit dd89a81d850fa9a65f67b4527c0e420d15bf836c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMLZ CVE: CVE-2024-44940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Drop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is not known or does not have a GRO handler. Such a packet is easily constructed. Syzbot generates them and sets off this warning. Remove the warning as it is expected and not actionable. The warning was previously reduced from WARN_ON to WARN_ON_ONCE in commit 270136613bf7 ("fou: Do WARN_ON_ONCE in gue_gro_receive for bad proto callbacks"). Signed-off-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240614122552.1649044-1-willemdebruijn.kernel@gm… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/fou.c net/ipv4/fou_core.c [The file where the code is located is changed due to refactoring] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- net/ipv4/fou.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c index e5f69b0bf3df..3b777457ad5b 100644 --- a/net/ipv4/fou.c +++ b/net/ipv4/fou.c @@ -441,7 +441,7 @@ static struct sk_buff *gue_gro_receive(struct sock *sk, rcu_read_lock(); offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads; ops = rcu_dereference(offloads[proto]); - if (WARN_ON_ONCE(!ops || !ops->callbacks.gro_receive)) + if (!ops || !ops->callbacks.gro_receive) goto out_unlock; pp = call_gro_receive(ops->callbacks.gro_receive, head, skb); -- 2.25.1

2 1

[PATCH OLK-5.10] fou: remove warn in gue_gro_receive on unsupported protocol
by Peng Zhang 14 Oct '24

14 Oct '24

From: Willem de Bruijn <willemb(a)google.com> mainline inclusion from mainline-v6.11-rc1 commit dd89a81d850fa9a65f67b4527c0e420d15bf836c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMLZ CVE: CVE-2024-44940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Drop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is not known or does not have a GRO handler. Such a packet is easily constructed. Syzbot generates them and sets off this warning. Remove the warning as it is expected and not actionable. The warning was previously reduced from WARN_ON to WARN_ON_ONCE in commit 270136613bf7 ("fou: Do WARN_ON_ONCE in gue_gro_receive for bad proto callbacks"). Signed-off-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240614122552.1649044-1-willemdebruijn.kernel@gm… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/fou.c net/ipv4/fou_core.c [The file where the code is located is changed due to refactoring] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- net/ipv4/fou.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c index e5f69b0bf3df..3b777457ad5b 100644 --- a/net/ipv4/fou.c +++ b/net/ipv4/fou.c @@ -441,7 +441,7 @@ static struct sk_buff *gue_gro_receive(struct sock *sk, rcu_read_lock(); offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads; ops = rcu_dereference(offloads[proto]); - if (WARN_ON_ONCE(!ops || !ops->callbacks.gro_receive)) + if (!ops || !ops->callbacks.gro_receive) goto out_unlock; pp = call_gro_receive(ops->callbacks.gro_receive, head, skb); -- 2.25.1

2 1

[PATCH OLK-5.10] atm: idt77252: prevent use after free in dequeue_rx()
by Peng Zhang 14 Oct '24

14 Oct '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.225 commit 1cece837e387c039225f19028df255df87a97c0d category: bugfix bugzilla: 189268 CVE: CVE-2024-44998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a9a18e8f770c9b0703dab93580d0b02e199a4c79 ] We can't dereference "skb" after calling vcc->push() because the skb is released. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/atm/idt77252.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c index e616e33c8a20..25fd73fafb37 100644 --- a/drivers/atm/idt77252.c +++ b/drivers/atm/idt77252.c @@ -1118,8 +1118,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) rpp->len += skb->len; if (stat & SAR_RSQE_EPDU) { + unsigned int len, truesize; unsigned char *l1l2; - unsigned int len; l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6); @@ -1189,14 +1189,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) ATM_SKB(skb)->vcc = vcc; __net_timestamp(skb); + truesize = skb->truesize; vcc->push(vcc, skb); atomic_inc(&vcc->stats->rx); - if (skb->truesize > SAR_FB_SIZE_3) + if (truesize > SAR_FB_SIZE_3) add_rx_skb(card, 3, SAR_FB_SIZE_3, 1); - else if (skb->truesize > SAR_FB_SIZE_2) + else if (truesize > SAR_FB_SIZE_2) add_rx_skb(card, 2, SAR_FB_SIZE_2, 1); - else if (skb->truesize > SAR_FB_SIZE_1) + else if (truesize > SAR_FB_SIZE_1) add_rx_skb(card, 1, SAR_FB_SIZE_1, 1); else add_rx_skb(card, 0, SAR_FB_SIZE_0, 1); -- 2.25.1

2 1

[PATCH OLK-5.10] xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
by Peng Zhang 14 Oct '24

14 Oct '24

From: Mathias Nyman <mathias.nyman(a)linux.intel.com> stable inclusion from stable-v5.10.225 commit 0f0654318e25b2c185e245ba4a591e42fabb5e59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZE CVE: CVE-2024-45006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit af8e119f52e9c13e556be9e03f27957554a84656 upstream. re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size value during enumeration. Usb core calls usb_ep0_reinit() in this case, which ends up calling xhci_configure_endpoint(). On Panther point xHC the xhci_configure_endpoint() function will additionally check and reserve bandwidth in software. Other hosts do this in hardware If xHC address device command fails then a new xhci_virt_device structure is allocated as part of re-enabling the slot, but the bandwidth table pointers are not set up properly here. This triggers the NULL pointer dereference the next time usb_ep0_reinit() is called and xhci_configure_endpoint() tries to check and reserve bandwidth [46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd [46710.713699] usb 3-1: Device not responding to setup address. [46710.917684] usb 3-1: Device not responding to setup address. [46711.125536] usb 3-1: device not accepting address 5, error -71 [46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008 [46711.125600] #PF: supervisor read access in kernel mode [46711.125603] #PF: error_code(0x0000) - not-present page [46711.125606] PGD 0 P4D 0 [46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI [46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1 [46711.125620] Hardware name: Gigabyte Technology Co., Ltd. [46711.125623] Workqueue: usb_hub_wq hub_event [usbcore] [46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c Fix this by making sure bandwidth table pointers are set up correctly after a failed address device command, and additionally by avoiding checking for bandwidth in cases like this where no actual endpoints are added or removed, i.e. only context for default control endpoint 0 is evaluated. Reported-by: Karel Balej <balejk(a)matfyz.cz> Closes: https://lore.kernel.org/linux-usb/D3CKQQAETH47.1MUO22RTCH2O3@matfyz.cz/ Cc: stable(a)vger.kernel.org Fixes: 651aaf36a7d7 ("usb: xhci: Handle USB transaction error on address command") Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20240815141117.2702314-2-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/usb/host/xhci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index b37ddbb88b74..b4e5b15fbed9 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -2826,7 +2826,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci, xhci->num_active_eps); return -ENOMEM; } - if ((xhci->quirks & XHCI_SW_BW_CHECKING) && + if ((xhci->quirks & XHCI_SW_BW_CHECKING) && !ctx_change && xhci_reserve_bandwidth(xhci, virt_dev, command->in_ctx)) { if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) xhci_free_host_resources(xhci, ctrl_ctx); @@ -4242,8 +4242,10 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, mutex_unlock(&xhci->mutex); ret = xhci_disable_slot(xhci, udev->slot_id); xhci_free_virt_device(xhci, udev->slot_id); - if (!ret) - xhci_alloc_dev(hcd, udev); + if (!ret) { + if (xhci_alloc_dev(hcd, udev) == 1) + xhci_setup_addressable_virt_dev(xhci, udev); + } kfree(command->completion); kfree(command); return -EPROTO; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
by Peng Zhang 14 Oct '24

14 Oct '24

From: Mathias Nyman <mathias.nyman(a)linux.intel.com> stable inclusion from stable-v5.10.225 commit 0f0654318e25b2c185e245ba4a591e42fabb5e59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZE CVE: CVE-2024-45006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit af8e119f52e9c13e556be9e03f27957554a84656 upstream. re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size value during enumeration. Usb core calls usb_ep0_reinit() in this case, which ends up calling xhci_configure_endpoint(). On Panther point xHC the xhci_configure_endpoint() function will additionally check and reserve bandwidth in software. Other hosts do this in hardware If xHC address device command fails then a new xhci_virt_device structure is allocated as part of re-enabling the slot, but the bandwidth table pointers are not set up properly here. This triggers the NULL pointer dereference the next time usb_ep0_reinit() is called and xhci_configure_endpoint() tries to check and reserve bandwidth [46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd [46710.713699] usb 3-1: Device not responding to setup address. [46710.917684] usb 3-1: Device not responding to setup address. [46711.125536] usb 3-1: device not accepting address 5, error -71 [46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008 [46711.125600] #PF: supervisor read access in kernel mode [46711.125603] #PF: error_code(0x0000) - not-present page [46711.125606] PGD 0 P4D 0 [46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI [46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1 [46711.125620] Hardware name: Gigabyte Technology Co., Ltd. [46711.125623] Workqueue: usb_hub_wq hub_event [usbcore] [46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c Fix this by making sure bandwidth table pointers are set up correctly after a failed address device command, and additionally by avoiding checking for bandwidth in cases like this where no actual endpoints are added or removed, i.e. only context for default control endpoint 0 is evaluated. Reported-by: Karel Balej <balejk(a)matfyz.cz> Closes: https://lore.kernel.org/linux-usb/D3CKQQAETH47.1MUO22RTCH2O3@matfyz.cz/ Cc: stable(a)vger.kernel.org Fixes: 651aaf36a7d7 ("usb: xhci: Handle USB transaction error on address command") Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20240815141117.2702314-2-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/usb/host/xhci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index b37ddbb88b74..b4e5b15fbed9 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -2826,7 +2826,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci, xhci->num_active_eps); return -ENOMEM; } - if ((xhci->quirks & XHCI_SW_BW_CHECKING) && + if ((xhci->quirks & XHCI_SW_BW_CHECKING) && !ctx_change && xhci_reserve_bandwidth(xhci, virt_dev, command->in_ctx)) { if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) xhci_free_host_resources(xhci, ctrl_ctx); @@ -4242,8 +4242,10 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, mutex_unlock(&xhci->mutex); ret = xhci_disable_slot(xhci, udev->slot_id); xhci_free_virt_device(xhci, udev->slot_id); - if (!ret) - xhci_alloc_dev(hcd, udev); + if (!ret) { + if (xhci_alloc_dev(hcd, udev) == 1) + xhci_setup_addressable_virt_dev(xhci, udev); + } kfree(command->completion); kfree(command); return -EPROTO; -- 2.25.1

2 1

[PATCH OLK-6.6] crypto: stm32/cryp - call finalize with bh disabled
by Huang Xiaojia 14 Oct '24

14 Oct '24

From: Maxime Méré <maxime.mere(a)foss.st.com> stable inclusion from stable-v6.6.50 commit d93a2f86b0a998aa1f0870c85a2a60a0771ef89a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU3C CVE: CVE-2024-47658 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56ddb9aa3b324c2d9645b5a7343e46010cf3f6ce ] The finalize operation in interrupt mode produce a produces a spinlock recursion warning. The reason is the fact that BH must be disabled during this process. Signed-off-by: Maxime Méré <maxime.mere(a)foss.st.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/crypto/stm32/stm32-cryp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c index f095f0065428..2f1b82cf10b1 100644 --- a/drivers/crypto/stm32/stm32-cryp.c +++ b/drivers/crypto/stm32/stm32-cryp.c @@ -11,6 +11,7 @@ #include <crypto/internal/des.h> #include <crypto/internal/skcipher.h> #include <crypto/scatterwalk.h> +#include <linux/bottom_half.h> #include <linux/clk.h> #include <linux/delay.h> #include <linux/err.h> @@ -1665,8 +1666,11 @@ static irqreturn_t stm32_cryp_irq_thread(int irq, void *arg) it_mask &= ~IMSCR_OUT; stm32_cryp_write(cryp, cryp->caps->imsc, it_mask); - if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) + if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) { + local_bh_disable(); stm32_cryp_finish_req(cryp, 0); + local_bh_enable(); + } return IRQ_HANDLED; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] crypto: stm32/cryp - call finalize with bh disabled
by Huang Xiaojia 14 Oct '24

14 Oct '24

From: Maxime Méré <maxime.mere(a)foss.st.com> stable inclusion from stable-v6.6.50 commit d93a2f86b0a998aa1f0870c85a2a60a0771ef89a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU3C CVE: CVE-2024-47658 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56ddb9aa3b324c2d9645b5a7343e46010cf3f6ce ] The finalize operation in interrupt mode produce a produces a spinlock recursion warning. The reason is the fact that BH must be disabled during this process. Signed-off-by: Maxime Méré <maxime.mere(a)foss.st.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/crypto/stm32/stm32-cryp.c [Adapt context conflict] Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/crypto/stm32/stm32-cryp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c index 81eb136b6c11..3467d0c98129 100644 --- a/drivers/crypto/stm32/stm32-cryp.c +++ b/drivers/crypto/stm32/stm32-cryp.c @@ -1525,8 +1525,11 @@ static irqreturn_t stm32_cryp_irq_thread(int irq, void *arg) it_mask &= ~IMSCR_OUT; stm32_cryp_write(cryp, CRYP_IMSCR, it_mask); - if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) + if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) { + local_bh_disable(); stm32_cryp_finish_req(cryp, 0); + local_bh_enable(); + } return IRQ_HANDLED; } -- 2.34.1

2 1

[PATCH OLK-5.10] crypto: stm32/cryp - call finalize with bh disabled
by Huang Xiaojia 14 Oct '24

14 Oct '24

From: Maxime Méré <maxime.mere(a)foss.st.com> stable inclusion from stable-v6.6.50 commit d93a2f86b0a998aa1f0870c85a2a60a0771ef89a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU3C CVE: CVE-2024-47658 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56ddb9aa3b324c2d9645b5a7343e46010cf3f6ce ] The finalize operation in interrupt mode produce a produces a spinlock recursion warning. The reason is the fact that BH must be disabled during this process. Signed-off-by: Maxime Méré <maxime.mere(a)foss.st.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/crypto/stm32/stm32-cryp.c [Adapt context conflict] Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/crypto/stm32/stm32-cryp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c index 81eb136b6c11..3467d0c98129 100644 --- a/drivers/crypto/stm32/stm32-cryp.c +++ b/drivers/crypto/stm32/stm32-cryp.c @@ -1525,8 +1525,11 @@ static irqreturn_t stm32_cryp_irq_thread(int irq, void *arg) it_mask &= ~IMSCR_OUT; stm32_cryp_write(cryp, CRYP_IMSCR, it_mask); - if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) + if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) { + local_bh_disable(); stm32_cryp_finish_req(cryp, 0); + local_bh_enable(); + } return IRQ_HANDLED; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
by Yuan Can 14 Oct '24

14 Oct '24

From: Christophe Leroy <christophe.leroy(a)csgroup.eu> mainline inclusion from mainline-v6.10-rc1 commit e60adf513275c3a38e5cb67f7fd12387e43a3ff5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEOD CVE: CVE-2024-42067 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- set_memory_rox() can fail, leaving memory unprotected. Check return and bail out when bpf_jit_binary_lock_ro() returns an error. Link: https://github.com/KSPP/linux/issues/7 Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> Cc: linux-hardening(a)vger.kernel.org <linux-hardening(a)vger.kernel.org> Reviewed-by: Kees Cook <keescook(a)chromium.org> Reviewed-by: Puranjay Mohan <puranjay12(a)gmail.com> Reviewed-by: Ilya Leoshkevich <iii(a)linux.ibm.com> # s390x Acked-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> # LoongArch Reviewed-by: Johan Almbladh <johan.almbladh(a)anyfinetworks.com> # MIPS Part Message-ID: <036b6393f23a2032ce75a1c92220b2afcb798d5d.1709850515.git.christophe.leroy(a)csgroup.eu> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: include/linux/filter.h arch/sparc/net/bpf_jit_comp_64.c arch/loongarch/net/bpf_jit.c arch/parisc/net/bpf_jit_core.c arch/arm/net/bpf_jit_32.c arch/mips/net/bpf_jit_comp.c arch/arm64/net/bpf_jit_comp.c arch/x86/net/bpf_jit_comp.c [some context conflict and unintroduced files on 5.10] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/arm/net/bpf_jit_32.c | 25 ++++++++++++------------- arch/arm64/net/bpf_jit_comp.c | 9 ++++++++- arch/mips/net/ebpf_jit.c | 3 ++- arch/s390/net/bpf_jit_comp.c | 6 +++++- arch/sparc/net/bpf_jit_comp_64.c | 6 +++++- arch/sw_64/net/bpf_jit_comp.c | 6 +++++- arch/x86/net/bpf_jit_comp.c | 9 ++++++++- arch/x86/net/bpf_jit_comp32.c | 3 +-- include/linux/filter.h | 10 +++++++--- 9 files changed, 53 insertions(+), 24 deletions(-) diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c index 1214e39aad5e..9f9a2481b95f 100644 --- a/arch/arm/net/bpf_jit_32.c +++ b/arch/arm/net/bpf_jit_32.c @@ -2003,28 +2003,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) /* If building the body of the JITed code fails somehow, * we fall back to the interpretation. */ - if (build_body(&ctx) < 0) { - image_ptr = NULL; - bpf_jit_binary_free(header); - prog = orig_prog; - goto out_imms; - } + if (build_body(&ctx) < 0) + goto out_free; build_epilogue(&ctx); /* 3.) Extra pass to validate JITed Code */ - if (validate_code(&ctx)) { - image_ptr = NULL; - bpf_jit_binary_free(header); - prog = orig_prog; - goto out_imms; - } + if (validate_code(&ctx)) + goto out_free; flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx)); if (bpf_jit_enable > 1) /* there are 2 passes here */ bpf_jit_dump(prog->len, image_size, 2, ctx.target); - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) + goto out_free; prog->bpf_func = (void *)ctx.target; prog->jited = 1; prog->jited_len = image_size; @@ -2041,5 +2034,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_jit_prog_release_other(prog, prog == orig_prog ? tmp : orig_prog); return prog; + +out_free: + image_ptr = NULL; + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_imms; } diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 18627cbd6da4..aee69d78dbfa 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1114,7 +1114,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) prog->jited_len = 0; goto out_off; } - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + prog->bpf_func = NULL; + prog->jited = 0; + prog->jited_len = 0; + goto out_off; + } } else { jit_data->ctx = ctx; jit_data->image = image_ptr; diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c index b31b91e57c34..a012366155c6 100644 --- a/arch/mips/net/ebpf_jit.c +++ b/arch/mips/net/ebpf_jit.c @@ -1912,7 +1912,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) /* Dump JIT code */ bpf_jit_dump(prog->len, image_size, 2, ctx.target); - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) + goto out_err; prog->bpf_func = (void *)ctx.target; prog->jited = 1; prog->jited_len = image_size; diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c index cd0cbdafedbd..4915868bec1e 100644 --- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c @@ -1807,7 +1807,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) print_fn_code(jit.prg_buf, jit.size_prg); } if (!fp->is_func || extra_pass) { - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + fp = orig_fp; + goto free_addrs; + } } else { jit_data->header = header; jit_data->ctx = jit; diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c index fef734473c0f..32a53eb91797 100644 --- a/arch/sparc/net/bpf_jit_comp_64.c +++ b/arch/sparc/net/bpf_jit_comp_64.c @@ -1591,7 +1591,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_flush_icache(header, (u8 *)header + (header->pages * PAGE_SIZE)); if (!prog->is_func || extra_pass) { - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_off; + } } else { jit_data->ctx = ctx; jit_data->image = image_ptr; diff --git a/arch/sw_64/net/bpf_jit_comp.c b/arch/sw_64/net/bpf_jit_comp.c index 47e805569154..7931c5536170 100644 --- a/arch/sw_64/net/bpf_jit_comp.c +++ b/arch/sw_64/net/bpf_jit_comp.c @@ -1466,7 +1466,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_flush_icache(header, ctx.image + ctx.idx); if (!prog->is_func || extra_pass) { - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_off; + } } else { jit_data->ctx = ctx; jit_data->image = image_ptr; diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 6c8b9151eda8..7202dd20240a 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2127,7 +2127,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) if (image) { if (!prog->is_func || extra_pass) { bpf_tail_call_direct_fixup(prog); - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + prog->bpf_func = NULL; + prog->jited = 0; + prog->jited_len = 0; + goto out_addrs; + } } else { jit_data->addrs = addrs; jit_data->ctx = ctx; diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c index 622af951220c..5a208eba5f35 100644 --- a/arch/x86/net/bpf_jit_comp32.c +++ b/arch/x86/net/bpf_jit_comp32.c @@ -2409,8 +2409,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) if (bpf_jit_enable > 1) bpf_jit_dump(prog->len, proglen, pass + 1, image); - if (image) { - bpf_jit_binary_lock_ro(header); + if (image && !bpf_jit_binary_lock_ro(header)) { prog->bpf_func = (void *)image; prog->jited = 1; prog->jited_len = proglen; diff --git a/include/linux/filter.h b/include/linux/filter.h index 8ee00f20614f..0f85a05a1971 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -835,11 +835,15 @@ static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp) return 0; } -static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) +static inline int __must_check +bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) { + int ret = 0; set_vm_flush_reset_perms(hdr); - set_memory_ro((unsigned long)hdr, hdr->pages); - set_memory_x((unsigned long)hdr, hdr->pages); + ret = set_memory_ro((unsigned long)hdr, hdr->pages); + if (ret) + return ret; + return set_memory_x((unsigned long)hdr, hdr->pages); } static inline struct bpf_binary_header * -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
by Yuan Can 14 Oct '24

14 Oct '24

From: Christophe Leroy <christophe.leroy(a)csgroup.eu> mainline inclusion from mainline-v6.10-rc1 commit e60adf513275c3a38e5cb67f7fd12387e43a3ff5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEOD CVE: CVE-2024-42067 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- set_memory_rox() can fail, leaving memory unprotected. Check return and bail out when bpf_jit_binary_lock_ro() returns an error. Link: https://github.com/KSPP/linux/issues/7 Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> Cc: linux-hardening(a)vger.kernel.org <linux-hardening(a)vger.kernel.org> Reviewed-by: Kees Cook <keescook(a)chromium.org> Reviewed-by: Puranjay Mohan <puranjay12(a)gmail.com> Reviewed-by: Ilya Leoshkevich <iii(a)linux.ibm.com> # s390x Acked-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> # LoongArch Reviewed-by: Johan Almbladh <johan.almbladh(a)anyfinetworks.com> # MIPS Part Message-ID: <036b6393f23a2032ce75a1c92220b2afcb798d5d.1709850515.git.christophe.leroy(a)csgroup.eu> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: include/linux/filter.h arch/sparc/net/bpf_jit_comp_64.c arch/loongarch/net/bpf_jit.c arch/parisc/net/bpf_jit_core.c arch/arm/net/bpf_jit_32.c arch/mips/net/bpf_jit_comp.c arch/arm64/net/bpf_jit_comp.c arch/riscv/net/bpf_jit_core.c arch/x86/net/bpf_jit_comp.c [some context conflict and unintroduced files on 5.10] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/arm/net/bpf_jit_32.c | 25 ++++++++++++------------- arch/arm64/net/bpf_jit_comp.c | 9 ++++++++- arch/mips/net/ebpf_jit.c | 3 ++- arch/riscv/net/bpf_jit_core.c | 9 ++++++++- arch/s390/net/bpf_jit_comp.c | 6 +++++- arch/sparc/net/bpf_jit_comp_64.c | 6 +++++- arch/sw_64/net/bpf_jit_comp.c | 6 +++++- arch/x86/net/bpf_jit_comp.c | 9 ++++++++- arch/x86/net/bpf_jit_comp32.c | 3 +-- include/linux/filter.h | 10 +++++++--- 10 files changed, 61 insertions(+), 25 deletions(-) diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c index 1214e39aad5e..9f9a2481b95f 100644 --- a/arch/arm/net/bpf_jit_32.c +++ b/arch/arm/net/bpf_jit_32.c @@ -2003,28 +2003,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) /* If building the body of the JITed code fails somehow, * we fall back to the interpretation. */ - if (build_body(&ctx) < 0) { - image_ptr = NULL; - bpf_jit_binary_free(header); - prog = orig_prog; - goto out_imms; - } + if (build_body(&ctx) < 0) + goto out_free; build_epilogue(&ctx); /* 3.) Extra pass to validate JITed Code */ - if (validate_code(&ctx)) { - image_ptr = NULL; - bpf_jit_binary_free(header); - prog = orig_prog; - goto out_imms; - } + if (validate_code(&ctx)) + goto out_free; flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx)); if (bpf_jit_enable > 1) /* there are 2 passes here */ bpf_jit_dump(prog->len, image_size, 2, ctx.target); - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) + goto out_free; prog->bpf_func = (void *)ctx.target; prog->jited = 1; prog->jited_len = image_size; @@ -2041,5 +2034,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_jit_prog_release_other(prog, prog == orig_prog ? tmp : orig_prog); return prog; + +out_free: + image_ptr = NULL; + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_imms; } diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index f6e790058b0a..adab5f03a306 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1425,7 +1425,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) prog->jited_len = 0; goto out_off; } - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + prog->bpf_func = NULL; + prog->jited = 0; + prog->jited_len = 0; + goto out_off; + } } else { jit_data->ctx = ctx; jit_data->image = image_ptr; diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c index b31b91e57c34..a012366155c6 100644 --- a/arch/mips/net/ebpf_jit.c +++ b/arch/mips/net/ebpf_jit.c @@ -1912,7 +1912,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) /* Dump JIT code */ bpf_jit_dump(prog->len, image_size, 2, ctx.target); - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) + goto out_err; prog->bpf_func = (void *)ctx.target; prog->jited = 1; prog->jited_len = image_size; diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c index ef17bc8055d4..30a144b7650a 100644 --- a/arch/riscv/net/bpf_jit_core.c +++ b/arch/riscv/net/bpf_jit_core.c @@ -163,7 +163,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_flush_icache(jit_data->header, ctx->insns + ctx->ninsns); if (!prog->is_func || extra_pass) { - bpf_jit_binary_lock_ro(jit_data->header); + if (bpf_jit_binary_lock_ro(jit_data->header)) { + bpf_jit_binary_free(jit_data->header); + prog = orig_prog; + prog->bpf_func = NULL; + prog->jited = 0; + prog->jited_len = 0; + goto out_offset; + } for (i = 0; i < prog->len; i++) ctx->offset[i] = ninsns_rvoff(ctx->offset[i]); bpf_prog_fill_jited_linfo(prog, ctx->offset); diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c index cd0cbdafedbd..4915868bec1e 100644 --- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c @@ -1807,7 +1807,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) print_fn_code(jit.prg_buf, jit.size_prg); } if (!fp->is_func || extra_pass) { - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + fp = orig_fp; + goto free_addrs; + } } else { jit_data->header = header; jit_data->ctx = jit; diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c index fef734473c0f..32a53eb91797 100644 --- a/arch/sparc/net/bpf_jit_comp_64.c +++ b/arch/sparc/net/bpf_jit_comp_64.c @@ -1591,7 +1591,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_flush_icache(header, (u8 *)header + (header->pages * PAGE_SIZE)); if (!prog->is_func || extra_pass) { - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_off; + } } else { jit_data->ctx = ctx; jit_data->image = image_ptr; diff --git a/arch/sw_64/net/bpf_jit_comp.c b/arch/sw_64/net/bpf_jit_comp.c index a8393598a4bc..43d548f7f755 100644 --- a/arch/sw_64/net/bpf_jit_comp.c +++ b/arch/sw_64/net/bpf_jit_comp.c @@ -1424,7 +1424,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_flush_icache(header, ctx.image + ctx.idx); if (!prog->is_func || extra_pass) { - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_off; + } } else { jit_data->ctx = ctx; jit_data->image = image_ptr; diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 3a82c9508817..987b02b857bc 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2127,7 +2127,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) if (image) { if (!prog->is_func || extra_pass) { bpf_tail_call_direct_fixup(prog); - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + prog->bpf_func = NULL; + prog->jited = 0; + prog->jited_len = 0; + goto out_addrs; + } } else { jit_data->addrs = addrs; jit_data->ctx = ctx; diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c index 622af951220c..5a208eba5f35 100644 --- a/arch/x86/net/bpf_jit_comp32.c +++ b/arch/x86/net/bpf_jit_comp32.c @@ -2409,8 +2409,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) if (bpf_jit_enable > 1) bpf_jit_dump(prog->len, proglen, pass + 1, image); - if (image) { - bpf_jit_binary_lock_ro(header); + if (image && !bpf_jit_binary_lock_ro(header)) { prog->bpf_func = (void *)image; prog->jited = 1; prog->jited_len = proglen; diff --git a/include/linux/filter.h b/include/linux/filter.h index 41627cfaf7f9..758adb32d352 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -846,11 +846,15 @@ static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp) return 0; } -static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) +static inline int __must_check +bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) { + int ret = 0; set_vm_flush_reset_perms(hdr); - set_memory_ro((unsigned long)hdr, hdr->pages); - set_memory_x((unsigned long)hdr, hdr->pages); + ret = set_memory_ro((unsigned long)hdr, hdr->pages); + if (ret) + return ret; + return set_memory_x((unsigned long)hdr, hdr->pages); } static inline struct bpf_binary_header * -- 2.17.1

2 1

[PATCH OLK-5.10] bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
by Yuan Can 14 Oct '24

14 Oct '24

From: Christophe Leroy <christophe.leroy(a)csgroup.eu> mainline inclusion from mainline-v6.10-rc1 commit e60adf513275c3a38e5cb67f7fd12387e43a3ff5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEOD CVE: CVE-2024-42067 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- set_memory_rox() can fail, leaving memory unprotected. Check return and bail out when bpf_jit_binary_lock_ro() returns an error. Link: https://github.com/KSPP/linux/issues/7 Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> Cc: linux-hardening(a)vger.kernel.org <linux-hardening(a)vger.kernel.org> Reviewed-by: Kees Cook <keescook(a)chromium.org> Reviewed-by: Puranjay Mohan <puranjay12(a)gmail.com> Reviewed-by: Ilya Leoshkevich <iii(a)linux.ibm.com> # s390x Acked-by: Tiezhu Yang <yangtiezhu(a)loongson.cn> # LoongArch Reviewed-by: Johan Almbladh <johan.almbladh(a)anyfinetworks.com> # MIPS Part Message-ID: <036b6393f23a2032ce75a1c92220b2afcb798d5d.1709850515.git.christophe.leroy(a)csgroup.eu> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: include/linux/filter.h arch/sparc/net/bpf_jit_comp_64.c arch/loongarch/net/bpf_jit.c arch/parisc/net/bpf_jit_core.c arch/arm/net/bpf_jit_32.c arch/mips/net/bpf_jit_comp.c arch/arm64/net/bpf_jit_comp.c arch/riscv/net/bpf_jit_core.c arch/x86/net/bpf_jit_comp.c [some context conflict and unintroduced files on 5.10] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- arch/arm/net/bpf_jit_32.c | 25 ++++++++++++------------- arch/arm64/net/bpf_jit_comp.c | 9 ++++++++- arch/mips/net/ebpf_jit.c | 3 ++- arch/riscv/net/bpf_jit_core.c | 9 ++++++++- arch/s390/net/bpf_jit_comp.c | 6 +++++- arch/sparc/net/bpf_jit_comp_64.c | 6 +++++- arch/sw_64/net/bpf_jit_comp.c | 6 +++++- arch/x86/net/bpf_jit_comp.c | 9 ++++++++- arch/x86/net/bpf_jit_comp32.c | 3 +-- include/linux/filter.h | 10 +++++++--- 10 files changed, 61 insertions(+), 25 deletions(-) diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c index 1214e39aad5e..9f9a2481b95f 100644 --- a/arch/arm/net/bpf_jit_32.c +++ b/arch/arm/net/bpf_jit_32.c @@ -2003,28 +2003,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) /* If building the body of the JITed code fails somehow, * we fall back to the interpretation. */ - if (build_body(&ctx) < 0) { - image_ptr = NULL; - bpf_jit_binary_free(header); - prog = orig_prog; - goto out_imms; - } + if (build_body(&ctx) < 0) + goto out_free; build_epilogue(&ctx); /* 3.) Extra pass to validate JITed Code */ - if (validate_code(&ctx)) { - image_ptr = NULL; - bpf_jit_binary_free(header); - prog = orig_prog; - goto out_imms; - } + if (validate_code(&ctx)) + goto out_free; flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx)); if (bpf_jit_enable > 1) /* there are 2 passes here */ bpf_jit_dump(prog->len, image_size, 2, ctx.target); - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) + goto out_free; prog->bpf_func = (void *)ctx.target; prog->jited = 1; prog->jited_len = image_size; @@ -2041,5 +2034,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_jit_prog_release_other(prog, prog == orig_prog ? tmp : orig_prog); return prog; + +out_free: + image_ptr = NULL; + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_imms; } diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index f6e790058b0a..adab5f03a306 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1425,7 +1425,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) prog->jited_len = 0; goto out_off; } - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + prog->bpf_func = NULL; + prog->jited = 0; + prog->jited_len = 0; + goto out_off; + } } else { jit_data->ctx = ctx; jit_data->image = image_ptr; diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c index b31b91e57c34..a012366155c6 100644 --- a/arch/mips/net/ebpf_jit.c +++ b/arch/mips/net/ebpf_jit.c @@ -1912,7 +1912,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) /* Dump JIT code */ bpf_jit_dump(prog->len, image_size, 2, ctx.target); - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) + goto out_err; prog->bpf_func = (void *)ctx.target; prog->jited = 1; prog->jited_len = image_size; diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c index ef17bc8055d4..30a144b7650a 100644 --- a/arch/riscv/net/bpf_jit_core.c +++ b/arch/riscv/net/bpf_jit_core.c @@ -163,7 +163,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_flush_icache(jit_data->header, ctx->insns + ctx->ninsns); if (!prog->is_func || extra_pass) { - bpf_jit_binary_lock_ro(jit_data->header); + if (bpf_jit_binary_lock_ro(jit_data->header)) { + bpf_jit_binary_free(jit_data->header); + prog = orig_prog; + prog->bpf_func = NULL; + prog->jited = 0; + prog->jited_len = 0; + goto out_offset; + } for (i = 0; i < prog->len; i++) ctx->offset[i] = ninsns_rvoff(ctx->offset[i]); bpf_prog_fill_jited_linfo(prog, ctx->offset); diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c index cd0cbdafedbd..4915868bec1e 100644 --- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c @@ -1807,7 +1807,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) print_fn_code(jit.prg_buf, jit.size_prg); } if (!fp->is_func || extra_pass) { - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + fp = orig_fp; + goto free_addrs; + } } else { jit_data->header = header; jit_data->ctx = jit; diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c index fef734473c0f..32a53eb91797 100644 --- a/arch/sparc/net/bpf_jit_comp_64.c +++ b/arch/sparc/net/bpf_jit_comp_64.c @@ -1591,7 +1591,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_flush_icache(header, (u8 *)header + (header->pages * PAGE_SIZE)); if (!prog->is_func || extra_pass) { - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_off; + } } else { jit_data->ctx = ctx; jit_data->image = image_ptr; diff --git a/arch/sw_64/net/bpf_jit_comp.c b/arch/sw_64/net/bpf_jit_comp.c index a8393598a4bc..43d548f7f755 100644 --- a/arch/sw_64/net/bpf_jit_comp.c +++ b/arch/sw_64/net/bpf_jit_comp.c @@ -1424,7 +1424,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_flush_icache(header, ctx.image + ctx.idx); if (!prog->is_func || extra_pass) { - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_off; + } } else { jit_data->ctx = ctx; jit_data->image = image_ptr; diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 3a82c9508817..987b02b857bc 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2127,7 +2127,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) if (image) { if (!prog->is_func || extra_pass) { bpf_tail_call_direct_fixup(prog); - bpf_jit_binary_lock_ro(header); + if (bpf_jit_binary_lock_ro(header)) { + bpf_jit_binary_free(header); + prog = orig_prog; + prog->bpf_func = NULL; + prog->jited = 0; + prog->jited_len = 0; + goto out_addrs; + } } else { jit_data->addrs = addrs; jit_data->ctx = ctx; diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c index 622af951220c..5a208eba5f35 100644 --- a/arch/x86/net/bpf_jit_comp32.c +++ b/arch/x86/net/bpf_jit_comp32.c @@ -2409,8 +2409,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) if (bpf_jit_enable > 1) bpf_jit_dump(prog->len, proglen, pass + 1, image); - if (image) { - bpf_jit_binary_lock_ro(header); + if (image && !bpf_jit_binary_lock_ro(header)) { prog->bpf_func = (void *)image; prog->jited = 1; prog->jited_len = proglen; diff --git a/include/linux/filter.h b/include/linux/filter.h index 41627cfaf7f9..758adb32d352 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -846,11 +846,15 @@ static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp) return 0; } -static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) +static inline int __must_check +bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr) { + int ret = 0; set_vm_flush_reset_perms(hdr); - set_memory_ro((unsigned long)hdr, hdr->pages); - set_memory_x((unsigned long)hdr, hdr->pages); + ret = set_memory_ro((unsigned long)hdr, hdr->pages); + if (ret) + return ret; + return set_memory_x((unsigned long)hdr, hdr->pages); } static inline struct bpf_binary_header * -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] md/raid1: don't free conf on raid0_run failure
by Zheng Qixing 14 Oct '24

14 Oct '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.11-rc1 commit 17f91ac0843b50462a9c9c8f18df962338bd3db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUQ97 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The core md code calls the ->free method which already frees conf. Fixes: 07f1a6850c5d ("md/raid1: fail run raid1 array when active disk less than one") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240604172607.3185916-3-hch@lst.de Conflicts: drivers/md/raid1.c [The conflicts here are due to inconsistencies in the context.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 4584fba5a010..333b611aa152 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -3069,7 +3069,6 @@ static struct r1conf *setup_conf(struct mddev *mddev) return ERR_PTR(err); } -static void raid1_free(struct mddev *mddev, void *priv); static int raid1_run(struct mddev *mddev) { struct r1conf *conf; @@ -3128,8 +3127,7 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(&conf->thread); - ret = -EINVAL; - goto abort; + return -EINVAL; } if (conf->raid_disks - mddev->degraded == 1) @@ -3162,14 +3160,8 @@ static int raid1_run(struct mddev *mddev) } ret = md_integrity_register(mddev); - if (ret) { + if (ret) md_unregister_thread(&mddev->thread); - goto abort; - } - return 0; - -abort: - raid1_free(mddev, conf); return ret; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] md/raid1: don't free conf on raid0_run failure
by Zheng Qixing 14 Oct '24

14 Oct '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.11-rc1 commit 17f91ac0843b50462a9c9c8f18df962338bd3db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUQ97 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The core md code calls the ->free method which already frees conf. Fixes: 07f1a6850c5d ("md/raid1: fail run raid1 array when active disk less than one") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240604172607.3185916-3-hch@lst.de Conflicts: drivers/md/raid1.c [The conflicts here are due to inconsistencies in the context.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index d5737d91b48c..ee3826db193d 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -3090,7 +3090,6 @@ static struct r1conf *setup_conf(struct mddev *mddev) return ERR_PTR(err); } -static void raid1_free(struct mddev *mddev, void *priv); static int raid1_run(struct mddev *mddev) { struct r1conf *conf; @@ -3149,8 +3148,7 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(&conf->thread); - ret = -EINVAL; - goto abort; + return -EINVAL; } if (conf->raid_disks - mddev->degraded == 1) @@ -3183,14 +3181,8 @@ static int raid1_run(struct mddev *mddev) } ret = md_integrity_register(mddev); - if (ret) { + if (ret) md_unregister_thread(&mddev->thread); - goto abort; - } - return 0; - -abort: - raid1_free(mddev, conf); return ret; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS v2 0/2] bonding: Fix CVE-2024-44990
by Dong Chenchen 14 Oct '24

14 Oct '24

bonding: Fix CVE-2024-44990 Nikolay Aleksandrov (2): bonding: fix bond_ipsec_offload_ok return type bonding: fix null pointer deref in bond_ipsec_offload_ok drivers/net/bonding/bond_main.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-22.03-LTS-SP1] ipv4: Fix uninit-value access in __ip_make_skb()
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Shigeru Yoshida <syoshida(a)redhat.com> mainline inclusion from mainline-v6.9-rc7 commit fc1092f51567277509563800a3c56732070b6aa4 category: bugfix bugzilla: 190087 CVE: CVE-2024-36927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt(2) with IP_HDRINCL changes HDRINCL while __ip_make_skb() is running, the function will access icmphdr in the skb even if it is not included. This causes the issue reported by KMSAN. Check FLOWI_FLAG_KNOWN_NH on fl4->flowi4_flags instead of testing HDRINCL on the socket. Also, fl4->fl4_icmp_type and fl4->fl4_icmp_code are not initialized. These are union in struct flowi4 and are implicitly initialized by flowi4_init_output(), but we should not rely on specific union layout. Initialize these explicitly in raw_sendmsg(). [1] BUG: KMSAN: uninit-value in __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 __ip_make_skb+0x2b74/0x2d20 net/ipv4/ip_output.c:1481 ip_finish_skb include/net/ip.h:243 [inline] ip_push_pending_frames+0x4c/0x5c0 net/ipv4/ip_output.c:1508 raw_sendmsg+0x2381/0x2690 net/ipv4/raw.c:654 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x5f6/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35a/0x7c0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] __ip_append_data+0x49ab/0x68c0 net/ipv4/ip_output.c:1128 ip_append_data+0x1e7/0x260 net/ipv4/ip_output.c:1365 raw_sendmsg+0x22b1/0x2690 net/ipv4/raw.c:648 inet_sendmsg+0x27b/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x274/0x3c0 net/socket.c:745 __sys_sendto+0x62c/0x7b0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x130/0x200 net/socket.c:2199 do_syscall_64+0xd8/0x1f0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 15709 Comm: syz-executor.7 Not tainted 6.8.0-11567-gb3603fcb79b1 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 Fixes: 99e5acae193e ("ipv4: Fix potential uninit variable access bug in __ip_make_skb()") Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Link: https://lore.kernel.org/r/20240430123945.2057348-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ipv4/ip_output.c [commit cafbe182a467 wasnt merged in 5.10, which leads to context conflicts for inet_test_bit() not implemented] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/ip_output.c | 3 ++- net/ipv4/raw.c | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 5d20dac19e0b..79ff136ae6f5 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1571,7 +1571,8 @@ struct sk_buff *__ip_make_skb(struct sock *sk, * so icmphdr does not in skb linear region and can not get icmp_type * by icmp_hdr(skb)->type. */ - if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl) + if (sk->sk_type == SOCK_RAW && + !(fl4->flowi4_flags & FLOWI_FLAG_KNOWN_NH)) icmp_type = fl4->fl4_icmp_type; else icmp_type = icmp_hdr(skb)->type; diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 5336731b2401..3909dcccdd3e 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -606,6 +606,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0), daddr, saddr, 0, 0, sk->sk_uid); + fl4.fl4_icmp_type = 0; + fl4.fl4_icmp_code = 0; + if (!hdrincl) { rfv.msg = msg; rfv.hlen = 0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bonding: fix xfrm real_dev null pointer dereference
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Nikolay Aleksandrov <razor(a)blackwall.org> stable inclusion from stable-v5.10.225 commit 21816b696c172c19d53a30d45ee005cce246ed21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZI CVE: CVE-2024-44989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8cde9805981c50d0c029063dc7d82821806fc44 ] We shouldn't set real_dev to NULL because packets can be in transit and xfrm might call xdo_dev_offload_ok() in parallel. All callbacks assume real_dev is set. Example trace: kernel: BUG: unable to handle page fault for address: 0000000000001030 kernel: bond0: (slave eni0np1): making interface the new active one kernel: #PF: supervisor write access in kernel mode kernel: #PF: error_code(0x0002) - not-present page kernel: PGD 0 P4D 0 kernel: Oops: 0002 [#1] PREEMPT SMP kernel: CPU: 4 PID: 2237 Comm: ping Not tainted 6.7.7+ #12 kernel: Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 kernel: RIP: 0010:nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: Code: e0 0f 0b 48 83 7f 38 00 74 de 0f 0b 48 8b 47 08 48 8b 37 48 8b 78 40 e9 b2 e5 9a d7 66 90 0f 1f 44 00 00 48 8b 86 80 02 00 00 <83> 80 30 10 00 00 01 b8 01 00 00 00 c3 0f 1f 80 00 00 00 00 0f 1f kernel: bond0: (slave eni0np1): making interface the new active one kernel: RSP: 0018:ffffabde81553b98 EFLAGS: 00010246 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: kernel: RAX: 0000000000000000 RBX: ffff9eb404e74900 RCX: ffff9eb403d97c60 kernel: RDX: ffffffffc090de10 RSI: ffff9eb404e74900 RDI: ffff9eb3c5de9e00 kernel: RBP: ffff9eb3c0a42000 R08: 0000000000000010 R09: 0000000000000014 kernel: R10: 7974203030303030 R11: 3030303030303030 R12: 0000000000000000 kernel: R13: ffff9eb3c5de9e00 R14: ffffabde81553cc8 R15: ffff9eb404c53000 kernel: FS: 00007f2a77a3ad00(0000) GS:ffff9eb43bd00000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 0000000000001030 CR3: 00000001122ab000 CR4: 0000000000350ef0 kernel: bond0: (slave eni0np1): making interface the new active one kernel: Call Trace: kernel: <TASK> kernel: ? __die+0x1f/0x60 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ? page_fault_oops+0x142/0x4c0 kernel: ? do_user_addr_fault+0x65/0x670 kernel: ? kvm_read_and_reset_apf_flags+0x3b/0x50 kernel: bond0: (slave eni0np1): making interface the new active one kernel: ? exc_page_fault+0x7b/0x180 kernel: ? asm_exc_page_fault+0x22/0x30 kernel: ? nsim_bpf_uninit+0x50/0x50 [netdevsim] kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ? nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1): making interface the new active one kernel: bond_ipsec_offload_ok+0x7b/0x90 [bonding] kernel: xfrm_output+0x61/0x3b0 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ip_push_pending_frames+0x56/0x80 Fixes: 18cb261afd7b ("bonding: support hardware encryption offload to slaves") Signed-off-by: Nikolay Aleksandrov <razor(a)blackwall.org> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/bonding/bond_main.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index ed4f1c752bfb..e5ff9cee9661 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -554,7 +554,6 @@ static void bond_ipsec_del_sa_all(struct bonding *bond) } else { slave->dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs); } - ipsec->xs->xso.real_dev = NULL; } spin_unlock_bh(&bond->ipsec_lock); rcu_read_unlock(); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS v2] netfilter: flowtable: initialise extack before use
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Donald Hunter <donald.hunter(a)gmail.com> stable inclusion from stable-v5.10.225 commit e5ceff2196dc633c995afb080f6f44a72cff6e1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZI CVE: CVE-2024-45018 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e9767137308daf906496613fd879808a07f006a2 ] Fix missing initialisation of extack in flow offload. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Donald Hunter <donald.hunter(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_flow_table_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c index 746ca77d0aad..f6275d93f8a5 100644 --- a/net/netfilter/nf_flow_table_offload.c +++ b/net/netfilter/nf_flow_table_offload.c @@ -682,8 +682,8 @@ static int nf_flow_offload_tuple(struct nf_flowtable *flowtable, struct list_head *block_cb_list) { struct flow_cls_offload cls_flow = {}; + struct netlink_ext_ack extack = {}; struct flow_block_cb *block_cb; - struct netlink_ext_ack extack; __be16 proto = ETH_P_ALL; int err, i = 0; -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS] bonding: fix xfrm real_dev null pointer dereference
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Nikolay Aleksandrov <razor(a)blackwall.org> stable inclusion from stable-v5.10.225 commit 21816b696c172c19d53a30d45ee005cce246ed21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZI CVE: CVE-2024-44989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8cde9805981c50d0c029063dc7d82821806fc44 ] We shouldn't set real_dev to NULL because packets can be in transit and xfrm might call xdo_dev_offload_ok() in parallel. All callbacks assume real_dev is set. Example trace: kernel: BUG: unable to handle page fault for address: 0000000000001030 kernel: bond0: (slave eni0np1): making interface the new active one kernel: #PF: supervisor write access in kernel mode kernel: #PF: error_code(0x0002) - not-present page kernel: PGD 0 P4D 0 kernel: Oops: 0002 [#1] PREEMPT SMP kernel: CPU: 4 PID: 2237 Comm: ping Not tainted 6.7.7+ #12 kernel: Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 kernel: RIP: 0010:nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: Code: e0 0f 0b 48 83 7f 38 00 74 de 0f 0b 48 8b 47 08 48 8b 37 48 8b 78 40 e9 b2 e5 9a d7 66 90 0f 1f 44 00 00 48 8b 86 80 02 00 00 <83> 80 30 10 00 00 01 b8 01 00 00 00 c3 0f 1f 80 00 00 00 00 0f 1f kernel: bond0: (slave eni0np1): making interface the new active one kernel: RSP: 0018:ffffabde81553b98 EFLAGS: 00010246 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: kernel: RAX: 0000000000000000 RBX: ffff9eb404e74900 RCX: ffff9eb403d97c60 kernel: RDX: ffffffffc090de10 RSI: ffff9eb404e74900 RDI: ffff9eb3c5de9e00 kernel: RBP: ffff9eb3c0a42000 R08: 0000000000000010 R09: 0000000000000014 kernel: R10: 7974203030303030 R11: 3030303030303030 R12: 0000000000000000 kernel: R13: ffff9eb3c5de9e00 R14: ffffabde81553cc8 R15: ffff9eb404c53000 kernel: FS: 00007f2a77a3ad00(0000) GS:ffff9eb43bd00000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 0000000000001030 CR3: 00000001122ab000 CR4: 0000000000350ef0 kernel: bond0: (slave eni0np1): making interface the new active one kernel: Call Trace: kernel: <TASK> kernel: ? __die+0x1f/0x60 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ? page_fault_oops+0x142/0x4c0 kernel: ? do_user_addr_fault+0x65/0x670 kernel: ? kvm_read_and_reset_apf_flags+0x3b/0x50 kernel: bond0: (slave eni0np1): making interface the new active one kernel: ? exc_page_fault+0x7b/0x180 kernel: ? asm_exc_page_fault+0x22/0x30 kernel: ? nsim_bpf_uninit+0x50/0x50 [netdevsim] kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ? nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1): making interface the new active one kernel: bond_ipsec_offload_ok+0x7b/0x90 [bonding] kernel: xfrm_output+0x61/0x3b0 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ip_push_pending_frames+0x56/0x80 Fixes: 18cb261afd7b ("bonding: support hardware encryption offload to slaves") Signed-off-by: Nikolay Aleksandrov <razor(a)blackwall.org> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/bonding/bond_main.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 78782bb48800..1801abeed8d6 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -554,7 +554,6 @@ static void bond_ipsec_del_sa_all(struct bonding *bond) } else { slave->dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs); } - ipsec->xs->xso.real_dev = NULL; } spin_unlock_bh(&bond->ipsec_lock); rcu_read_unlock(); -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS-SP1] netfilter: flowtable: initialise extack before use
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Donald Hunter <donald.hunter(a)gmail.com> stable inclusion from stable-v5.10.225 commit e5ceff2196dc633c995afb080f6f44a72cff6e1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZI CVE: CVE-2024-45018 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e9767137308daf906496613fd879808a07f006a2 ] Fix missing initialisation of extack in flow offload. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Donald Hunter <donald.hunter(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_flow_table_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c index 746ca77d0aad..f6275d93f8a5 100644 --- a/net/netfilter/nf_flow_table_offload.c +++ b/net/netfilter/nf_flow_table_offload.c @@ -682,8 +682,8 @@ static int nf_flow_offload_tuple(struct nf_flowtable *flowtable, struct list_head *block_cb_list) { struct flow_cls_offload cls_flow = {}; + struct netlink_ext_ack extack = {}; struct flow_block_cb *block_cb; - struct netlink_ext_ack extack; __be16 proto = ETH_P_ALL; int err, i = 0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] bonding: Fix CVE-2024-44990
by Dong Chenchen 14 Oct '24

14 Oct '24

bonding: Fix CVE-2024-44990 Nikolay Aleksandrov (2): bonding: fix bond_ipsec_offload_ok return type bonding: fix null pointer deref in bond_ipsec_offload_ok drivers/net/bonding/bond_main.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] bonding: Fix CVE-2024-44990
by Dong Chenchen 14 Oct '24

14 Oct '24

bonding: Fix CVE-2024-44990 Nikolay Aleksandrov (2): bonding: fix bond_ipsec_offload_ok return type bonding: fix null pointer deref in bond_ipsec_offload_ok drivers/net/bonding/bond_main.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS] [Backport] netfilter: flowtable: initialise extack before use
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Donald Hunter <donald.hunter(a)gmail.com> stable inclusion from stable-v5.10.225 commit e5ceff2196dc633c995afb080f6f44a72cff6e1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZI CVE: CVE-2024-45018 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e9767137308daf906496613fd879808a07f006a2 ] Fix missing initialisation of extack in flow offload. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Donald Hunter <donald.hunter(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_flow_table_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c index 746ca77d0aad..f6275d93f8a5 100644 --- a/net/netfilter/nf_flow_table_offload.c +++ b/net/netfilter/nf_flow_table_offload.c @@ -682,8 +682,8 @@ static int nf_flow_offload_tuple(struct nf_flowtable *flowtable, struct list_head *block_cb_list) { struct flow_cls_offload cls_flow = {}; + struct netlink_ext_ack extack = {}; struct flow_block_cb *block_cb; - struct netlink_ext_ack extack; __be16 proto = ETH_P_ALL; int err, i = 0; -- 2.25.1

2 5

[PATCH OLK-5.10 v2] netfilter: flowtable: initialise extack before use
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Donald Hunter <donald.hunter(a)gmail.com> stable inclusion from stable-v5.10.225 commit e5ceff2196dc633c995afb080f6f44a72cff6e1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZI CVE: CVE-2024-45018 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e9767137308daf906496613fd879808a07f006a2 ] Fix missing initialisation of extack in flow offload. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Donald Hunter <donald.hunter(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_flow_table_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c index 746ca77d0aad..f6275d93f8a5 100644 --- a/net/netfilter/nf_flow_table_offload.c +++ b/net/netfilter/nf_flow_table_offload.c @@ -682,8 +682,8 @@ static int nf_flow_offload_tuple(struct nf_flowtable *flowtable, struct list_head *block_cb_list) { struct flow_cls_offload cls_flow = {}; + struct netlink_ext_ack extack = {}; struct flow_block_cb *block_cb; - struct netlink_ext_ack extack; __be16 proto = ETH_P_ALL; int err, i = 0; -- 2.25.1

2 1

[PATCH OLK-5.10] bonding: fix xfrm real_dev null pointer dereference
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Nikolay Aleksandrov <razor(a)blackwall.org> stable inclusion from stable-v5.10.225 commit 21816b696c172c19d53a30d45ee005cce246ed21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZI CVE: CVE-2024-44989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8cde9805981c50d0c029063dc7d82821806fc44 ] We shouldn't set real_dev to NULL because packets can be in transit and xfrm might call xdo_dev_offload_ok() in parallel. All callbacks assume real_dev is set. Example trace: kernel: BUG: unable to handle page fault for address: 0000000000001030 kernel: bond0: (slave eni0np1): making interface the new active one kernel: #PF: supervisor write access in kernel mode kernel: #PF: error_code(0x0002) - not-present page kernel: PGD 0 P4D 0 kernel: Oops: 0002 [#1] PREEMPT SMP kernel: CPU: 4 PID: 2237 Comm: ping Not tainted 6.7.7+ #12 kernel: Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 kernel: RIP: 0010:nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: Code: e0 0f 0b 48 83 7f 38 00 74 de 0f 0b 48 8b 47 08 48 8b 37 48 8b 78 40 e9 b2 e5 9a d7 66 90 0f 1f 44 00 00 48 8b 86 80 02 00 00 <83> 80 30 10 00 00 01 b8 01 00 00 00 c3 0f 1f 80 00 00 00 00 0f 1f kernel: bond0: (slave eni0np1): making interface the new active one kernel: RSP: 0018:ffffabde81553b98 EFLAGS: 00010246 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: kernel: RAX: 0000000000000000 RBX: ffff9eb404e74900 RCX: ffff9eb403d97c60 kernel: RDX: ffffffffc090de10 RSI: ffff9eb404e74900 RDI: ffff9eb3c5de9e00 kernel: RBP: ffff9eb3c0a42000 R08: 0000000000000010 R09: 0000000000000014 kernel: R10: 7974203030303030 R11: 3030303030303030 R12: 0000000000000000 kernel: R13: ffff9eb3c5de9e00 R14: ffffabde81553cc8 R15: ffff9eb404c53000 kernel: FS: 00007f2a77a3ad00(0000) GS:ffff9eb43bd00000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 0000000000001030 CR3: 00000001122ab000 CR4: 0000000000350ef0 kernel: bond0: (slave eni0np1): making interface the new active one kernel: Call Trace: kernel: <TASK> kernel: ? __die+0x1f/0x60 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ? page_fault_oops+0x142/0x4c0 kernel: ? do_user_addr_fault+0x65/0x670 kernel: ? kvm_read_and_reset_apf_flags+0x3b/0x50 kernel: bond0: (slave eni0np1): making interface the new active one kernel: ? exc_page_fault+0x7b/0x180 kernel: ? asm_exc_page_fault+0x22/0x30 kernel: ? nsim_bpf_uninit+0x50/0x50 [netdevsim] kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ? nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1): making interface the new active one kernel: bond_ipsec_offload_ok+0x7b/0x90 [bonding] kernel: xfrm_output+0x61/0x3b0 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ip_push_pending_frames+0x56/0x80 Fixes: 18cb261afd7b ("bonding: support hardware encryption offload to slaves") Signed-off-by: Nikolay Aleksandrov <razor(a)blackwall.org> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/bonding/bond_main.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 78782bb48800..1801abeed8d6 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -554,7 +554,6 @@ static void bond_ipsec_del_sa_all(struct bonding *bond) } else { slave->dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs); } - ipsec->xs->xso.real_dev = NULL; } spin_unlock_bh(&bond->ipsec_lock); rcu_read_unlock(); -- 2.25.1

2 1

[PATCH OLK-5.10] [Backport] netfilter: flowtable: initialise extack before use
by Dong Chenchen 14 Oct '24

14 Oct '24

From: Donald Hunter <donald.hunter(a)gmail.com> stable inclusion from stable-v5.10.225 commit e5ceff2196dc633c995afb080f6f44a72cff6e1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZI CVE: CVE-2024-45018 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e9767137308daf906496613fd879808a07f006a2 ] Fix missing initialisation of extack in flow offload. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Donald Hunter <donald.hunter(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_flow_table_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c index 746ca77d0aad..f6275d93f8a5 100644 --- a/net/netfilter/nf_flow_table_offload.c +++ b/net/netfilter/nf_flow_table_offload.c @@ -682,8 +682,8 @@ static int nf_flow_offload_tuple(struct nf_flowtable *flowtable, struct list_head *block_cb_list) { struct flow_cls_offload cls_flow = {}; + struct netlink_ext_ack extack = {}; struct flow_block_cb *block_cb; - struct netlink_ext_ack extack; __be16 proto = ETH_P_ALL; int err, i = 0; -- 2.25.1

2 1

[PATCH OLK-6.6] nfc: pn533: Add poll mod list filling check
by Lin Ruifeng 14 Oct '24

14 Oct '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> stable inclusion from stable-v6.6.49 commit 56ad559cf6d87f250a8d203b555dfc3716afa946 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR4F8 CVE: CVE-2024-46676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit febccb39255f9df35527b88c953b2e0deae50e53 ] In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/nfc/pn533/pn533.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c index b19c39dcfbd9..e2bc67300a91 100644 --- a/drivers/nfc/pn533/pn533.c +++ b/drivers/nfc/pn533/pn533.c @@ -1723,6 +1723,11 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev, } pn533_poll_create_mod_list(dev, im_protocols, tm_protocols); + if (!dev->poll_mod_count) { + nfc_err(dev->dev, + "Poll mod list is empty\n"); + return -EINVAL; + } /* Do not always start polling from the same modulation */ get_random_bytes(&rand_mod, sizeof(rand_mod)); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
by Zhang Kunbo 14 Oct '24

14 Oct '24

From: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> stable inclusion from stable-v6.6.53 commit 4d0a900ec470d392476c428875dbf053f8a0ae5e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU90 CVE: CVE-2024-47672 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ] There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was recently converted from just a message), that can be hit if we wait for TX queues to become empty after firmware died. Clearly, we can't expect anything from the firmware after it's declared dead. Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could be a good idea to stop the flow earlier, the flush functions do some maintenance work that is not related to the firmware, so keep that part of the code running even when the firmware is not running. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://patch.msgid.link/20240825191257.a7cbd794cee9.I44a739fbd4ffcc46b8384… [edit commit message] Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c index d2c6fdb70273..0ae8b601b8ca 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -4747,6 +4747,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop) int i; if (!iwl_mvm_has_new_tx_api(mvm)) { + /* we can't ask the firmware anything if it is dead */ + if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, + &mvm->status)) + return; if (drop) { mutex_lock(&mvm->mutex); iwl_mvm_flush_tx_path(mvm, @@ -4828,8 +4832,11 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw, /* this can take a while, and we may need/want other operations * to succeed while doing this, so do it without the mutex held + * If the firmware is dead, this can't work... */ - if (!drop && !iwl_mvm_has_new_tx_api(mvm)) + if (!drop && !iwl_mvm_has_new_tx_api(mvm) && + !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, + &mvm->status)) iwl_trans_wait_tx_queues_empty(mvm->trans, msk); } -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
by Zhang Kunbo 14 Oct '24

14 Oct '24

From: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> stable inclusion from stable-v6.6.53 commit 4d0a900ec470d392476c428875dbf053f8a0ae5e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU90 CVE: CVE-2024-47672 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ] There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was recently converted from just a message), that can be hit if we wait for TX queues to become empty after firmware died. Clearly, we can't expect anything from the firmware after it's declared dead. Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could be a good idea to stop the flow earlier, the flush functions do some maintenance work that is not related to the firmware, so keep that part of the code running even when the firmware is not running. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://patch.msgid.link/20240825191257.a7cbd794cee9.I44a739fbd4ffcc46b8384… [edit commit message] Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c index 08008b0c0637..fa784d835290 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -4747,6 +4747,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop) int i; if (!iwl_mvm_has_new_tx_api(mvm)) { + /* we can't ask the firmware anything if it is dead */ + if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, + &mvm->status)) + return; if (drop) { mutex_lock(&mvm->mutex); iwl_mvm_flush_tx_path(mvm, @@ -4828,8 +4832,11 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw, /* this can take a while, and we may need/want other operations * to succeed while doing this, so do it without the mutex held + * If the firmware is dead, this can't work... */ - if (!drop && !iwl_mvm_has_new_tx_api(mvm)) + if (!drop && !iwl_mvm_has_new_tx_api(mvm) && + !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, + &mvm->status)) iwl_trans_wait_tx_queues_empty(mvm->trans, msk); } -- 2.34.1

2 1

[PATCH OLK-6.6] nfc: pn533: Add poll mod list filling check
by Lin Ruifeng 14 Oct '24

14 Oct '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> [ Upstream commit febccb39255f9df35527b88c953b2e0deae50e53 ] In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/nfc/pn533/pn533.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c index b19c39dcfbd9..e2bc67300a91 100644 --- a/drivers/nfc/pn533/pn533.c +++ b/drivers/nfc/pn533/pn533.c @@ -1723,6 +1723,11 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev, } pn533_poll_create_mod_list(dev, im_protocols, tm_protocols); + if (!dev->poll_mod_count) { + nfc_err(dev->dev, + "Poll mod list is empty\n"); + return -EINVAL; + } /* Do not always start polling from the same modulation */ get_random_bytes(&rand_mod, sizeof(rand_mod)); -- 2.17.1

2 1

[PATCH OLK-6.6] wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
by Zhang Kunbo 14 Oct '24

14 Oct '24

From: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> stable inclusion from stable-v6.6.53 commit 4d0a900ec470d392476c428875dbf053f8a0ae5e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU90 CVE: CVE-2024-47672 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ] There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was recently converted from just a message), that can be hit if we wait for TX queues to become empty after firmware died. Clearly, we can't expect anything from the firmware after it's declared dead. Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could be a good idea to stop the flow earlier, the flush functions do some maintenance work that is not related to the firmware, so keep that part of the code running even when the firmware is not running. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://patch.msgid.link/20240825191257.a7cbd794cee9.I44a739fbd4ffcc46b8384… [edit commit message] Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c index add60031c8d7..7084f192cfc7 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -5569,6 +5569,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop) int i; if (!iwl_mvm_has_new_tx_api(mvm)) { + /* we can't ask the firmware anything if it is dead */ + if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, + &mvm->status)) + return; if (drop) { mutex_lock(&mvm->mutex); iwl_mvm_flush_tx_path(mvm, @@ -5653,8 +5657,11 @@ void iwl_mvm_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, /* this can take a while, and we may need/want other operations * to succeed while doing this, so do it without the mutex held + * If the firmware is dead, this can't work... */ - if (!drop && !iwl_mvm_has_new_tx_api(mvm)) + if (!drop && !iwl_mvm_has_new_tx_api(mvm) && + !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, + &mvm->status)) iwl_trans_wait_tx_queues_empty(mvm->trans, msk); } -- 2.34.1

2 1

[PATCH OLK-6.6] mm: page_cache_ra_order: Restore 'PF_MEMALLOC_NOFS' flag in 'fallback' branch
by Zhihao Cheng 14 Oct '24

14 Oct '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWTIW CVE: NA -------------------------------- When an ext4 image is mounted with '-obuffered_iomap', the readahead and defragmentation on the same file may let readahead process miss restoring 'PF_MEMALLOC_NOFS' flag, which could fail subsequent memory allocations in the same process. Specifically: ioctl(fd, EXT4_IOC_MOVE_EXT) read(fd) page_cache_ra_order nofs = memalloc_nofs_save() // set 'PF_MEMALLOC_NOFS' for current ext4_move_extents ext4_disable_buffered_iomap_aops mapping_clear_large_folios if (unlikely(!mapping_large_folio_support(mapping))) goto fallback // Forget clearing 'PF_MEMALLOC_NOFS' Fix it by adding 'memalloc_nofs_restore' in 'fallback' branch. Fixes: 1325aef8d896 ("mm: use memalloc_nofs_save() in page_cache_ra_order()") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- mm/readahead.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/readahead.c b/mm/readahead.c index 12ae30a966ef..08a7490ef793 100644 --- a/mm/readahead.c +++ b/mm/readahead.c @@ -546,6 +546,7 @@ void page_cache_ra_order(struct readahead_control *ractl, if (unlikely(!mapping_large_folio_support(mapping))) { filemap_invalidate_unlock_shared(mapping); + memalloc_nofs_restore(nofs); goto fallback; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] nfc: pn533: Add poll mod list filling check
by Lin Ruifeng 14 Oct '24

14 Oct '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> stable inclusion from stable-v5.10.225 commit 8ddaea033de051ed61b39f6b69ad54a411172b33 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR4F8 CVE: CVE-2024-46676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit febccb39255f9df35527b88c953b2e0deae50e53 ] In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/nfc/pn533/pn533.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c index a0cc1cc45292..1a833d94ecfe 100644 --- a/drivers/nfc/pn533/pn533.c +++ b/drivers/nfc/pn533/pn533.c @@ -1572,6 +1572,11 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev, pn533_poll_create_mod_list(dev, im_protocols, tm_protocols); dev->poll_protocols = im_protocols; dev->listen_protocols = tm_protocols; + if (!dev->poll_mod_count) { + nfc_err(dev->dev, + "Poll mod list is empty\n"); + return -EINVAL; + } /* Do not always start polling from the same modulation */ get_random_bytes(&rand_mod, sizeof(rand_mod)); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
by Zhang Kunbo 14 Oct '24

14 Oct '24

From: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> stable inclusion from stable-v6.6.53 commit 4d0a900ec470d392476c428875dbf053f8a0ae5e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU90 CVE: CVE-2024-47672 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ] There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was recently converted from just a message), that can be hit if we wait for TX queues to become empty after firmware died. Clearly, we can't expect anything from the firmware after it's declared dead. Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could be a good idea to stop the flow earlier, the flush functions do some maintenance work that is not related to the firmware, so keep that part of the code running even when the firmware is not running. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://patch.msgid.link/20240825191257.a7cbd794cee9.I44a739fbd4ffcc46b8384… [edit commit message] Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c index 476c44db0e64..64aadaf8eb7d 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -4293,6 +4293,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop) int i; if (!iwl_mvm_has_new_tx_api(mvm)) { + /* we can't ask the firmware anything if it is dead */ + if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, + &mvm->status)) + return; if (drop) { mutex_lock(&mvm->mutex); iwl_mvm_flush_tx_path(mvm, @@ -4374,8 +4378,11 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw, /* this can take a while, and we may need/want other operations * to succeed while doing this, so do it without the mutex held + * If the firmware is dead, this can't work... */ - if (!drop && !iwl_mvm_has_new_tx_api(mvm)) + if (!drop && !iwl_mvm_has_new_tx_api(mvm) && + !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, + &mvm->status)) iwl_trans_wait_tx_queues_empty(mvm->trans, msk); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nfc: pn533: Add poll mod list filling check
by Lin Ruifeng 14 Oct '24

14 Oct '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> stable inclusion from stable-v6.6.49 commit 56ad559cf6d87f250a8d203b555dfc3716afa946 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR4F8 CVE: CVE-2024-46676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit febccb39255f9df35527b88c953b2e0deae50e53 ] In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/nfc/pn533/pn533.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c index b19c39dcfbd9..e2bc67300a91 100644 --- a/drivers/nfc/pn533/pn533.c +++ b/drivers/nfc/pn533/pn533.c @@ -1723,6 +1723,11 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev, } pn533_poll_create_mod_list(dev, im_protocols, tm_protocols); + if (!dev->poll_mod_count) { + nfc_err(dev->dev, + "Poll mod list is empty\n"); + return -EINVAL; + } /* Do not always start polling from the same modulation */ get_random_bytes(&rand_mod, sizeof(rand_mod)); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nfc: pn533: Add poll mod list filling check
by Lin Ruifeng 14 Oct '24

14 Oct '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> stable inclusion from stable-v6.6.49 commit 56ad559cf6d87f250a8d203b555dfc3716afa946 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR4F8 CVE: CVE-2024-46676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit febccb39255f9df35527b88c953b2e0deae50e53 ] In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/nfc/pn533/pn533.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c index b19c39dcfbd9..e2bc67300a91 100644 --- a/drivers/nfc/pn533/pn533.c +++ b/drivers/nfc/pn533/pn533.c @@ -1723,6 +1723,11 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev, } pn533_poll_create_mod_list(dev, im_protocols, tm_protocols); + if (!dev->poll_mod_count) { + nfc_err(dev->dev, + "Poll mod list is empty\n"); + return -EINVAL; + } /* Do not always start polling from the same modulation */ get_random_bytes(&rand_mod, sizeof(rand_mod)); -- 2.17.1

2 1

[PATCH OLK-5.10] nfc: pn533: Add poll mod list filling check
by Lin Ruifeng 14 Oct '24

14 Oct '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> stable inclusion from stable-v6.6.49 commit 56ad559cf6d87f250a8d203b555dfc3716afa946 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR4F8 CVE: CVE-2024-46676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit febccb39255f9df35527b88c953b2e0deae50e53 ] In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/nfc/pn533/pn533.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c index b19c39dcfbd9..e2bc67300a91 100644 --- a/drivers/nfc/pn533/pn533.c +++ b/drivers/nfc/pn533/pn533.c @@ -1723,6 +1723,11 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev, } pn533_poll_create_mod_list(dev, im_protocols, tm_protocols); + if (!dev->poll_mod_count) { + nfc_err(dev->dev, + "Poll mod list is empty\n"); + return -EINVAL; + } /* Do not always start polling from the same modulation */ get_random_bytes(&rand_mod, sizeof(rand_mod)); -- 2.17.1

2 1

[PATCH OLK-6.6] nfc: pn533: Add poll mod list filling check
by Lin Ruifeng 14 Oct '24

14 Oct '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> stable inclusion from stable-v5.10.225 commit 8ddaea033de051ed61b39f6b69ad54a411172b33 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR4F8 CVE: CVE-2024-46676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit febccb39255f9df35527b88c953b2e0deae50e53 ] In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/nfc/pn533/pn533.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c index a0cc1cc45292..1a833d94ecfe 100644 --- a/drivers/nfc/pn533/pn533.c +++ b/drivers/nfc/pn533/pn533.c @@ -1572,6 +1572,11 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev, pn533_poll_create_mod_list(dev, im_protocols, tm_protocols); dev->poll_protocols = im_protocols; dev->listen_protocols = tm_protocols; + if (!dev->poll_mod_count) { + nfc_err(dev->dev, + "Poll mod list is empty\n"); + return -EINVAL; + } /* Do not always start polling from the same modulation */ get_random_bytes(&rand_mod, sizeof(rand_mod)); -- 2.17.1

2 1

[PATCH OLK-6.6] drm/vmwgfx: Fix prime with external buffers
by Lin Ruifeng 14 Oct '24

14 Oct '24

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v6.6.49 commit 9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR5I8 CVE: CVE-2024-46709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 50f1199250912568606b3778dc56646c10cb7b04 upstream. Make sure that for external buffers mapping goes through the dma_buf interface instead of trying to access pages directly. External buffers might not provide direct access to readable/writable pages so to make sure the bo's created from external dma_bufs can be read dma_buf interface has to be used. Fixes crashes in IGT's kms_prime with vgem. Regular desktop usage won't trigger this due to the fact that virtual machines will not have multiple GPUs but it enables better test coverage in IGT. Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Fixes: b32233acceff ("drm/vmwgfx: Fix prime import/export") Cc: <stable(a)vger.kernel.org> # v6.6+ Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list(a)broadcom.com> Cc: dri-devel(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v6.9+ Link: https://patchwork.freedesktop.org/patch/msgid/20240816183332.31961-3-zack.r… Reviewed-by: Martin Krastev <martin.krastev(a)broadcom.com> Reviewed-by: Maaz Mombasawala <maaz.mombasawala(a)broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 114 ++++++++++++++++++++++++++- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 12 +-- 3 files changed, 118 insertions(+), 12 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c b/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c index 717d624e9a05..890a66a2361f 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_blit.c @@ -27,6 +27,8 @@ **************************************************************************/ #include "vmwgfx_drv.h" + +#include "vmwgfx_bo.h" #include <linux/highmem.h> /* @@ -420,13 +422,105 @@ static int vmw_bo_cpu_blit_line(struct vmw_bo_blit_line_data *d, return 0; } +static void *map_external(struct vmw_bo *bo, struct iosys_map *map) +{ + struct vmw_private *vmw = + container_of(bo->tbo.bdev, struct vmw_private, bdev); + void *ptr = NULL; + int ret; + + if (bo->tbo.base.import_attach) { + ret = dma_buf_vmap(bo->tbo.base.dma_buf, map); + if (ret) { + drm_dbg_driver(&vmw->drm, + "Wasn't able to map external bo!\n"); + goto out; + } + ptr = map->vaddr; + } else { + ptr = vmw_bo_map_and_cache(bo); + } + +out: + return ptr; +} + +static void unmap_external(struct vmw_bo *bo, struct iosys_map *map) +{ + if (bo->tbo.base.import_attach) + dma_buf_vunmap(bo->tbo.base.dma_buf, map); + else + vmw_bo_unmap(bo); +} + +static int vmw_external_bo_copy(struct vmw_bo *dst, u32 dst_offset, + u32 dst_stride, struct vmw_bo *src, + u32 src_offset, u32 src_stride, + u32 width_in_bytes, u32 height, + struct vmw_diff_cpy *diff) +{ + struct vmw_private *vmw = + container_of(dst->tbo.bdev, struct vmw_private, bdev); + size_t dst_size = dst->tbo.resource->size; + size_t src_size = src->tbo.resource->size; + struct iosys_map dst_map = {0}; + struct iosys_map src_map = {0}; + int ret, i; + int x_in_bytes; + u8 *vsrc; + u8 *vdst; + + vsrc = map_external(src, &src_map); + if (!vsrc) { + drm_dbg_driver(&vmw->drm, "Wasn't able to map src\n"); + ret = -ENOMEM; + goto out; + } + + vdst = map_external(dst, &dst_map); + if (!vdst) { + drm_dbg_driver(&vmw->drm, "Wasn't able to map dst\n"); + ret = -ENOMEM; + goto out; + } + + vsrc += src_offset; + vdst += dst_offset; + if (src_stride == dst_stride) { + dst_size -= dst_offset; + src_size -= src_offset; + memcpy(vdst, vsrc, + min(dst_stride * height, min(dst_size, src_size))); + } else { + WARN_ON(dst_stride < width_in_bytes); + for (i = 0; i < height; ++i) { + memcpy(vdst, vsrc, width_in_bytes); + vsrc += src_stride; + vdst += dst_stride; + } + } + + x_in_bytes = (dst_offset % dst_stride); + diff->rect.x1 = x_in_bytes / diff->cpp; + diff->rect.y1 = ((dst_offset - x_in_bytes) / dst_stride); + diff->rect.x2 = diff->rect.x1 + width_in_bytes / diff->cpp; + diff->rect.y2 = diff->rect.y1 + height; + + ret = 0; +out: + unmap_external(src, &src_map); + unmap_external(dst, &dst_map); + + return ret; +} + /** * vmw_bo_cpu_blit - in-kernel cpu blit. * - * @dst: Destination buffer object. + * @vmw_dst: Destination buffer object. * @dst_offset: Destination offset of blit start in bytes. * @dst_stride: Destination stride in bytes. - * @src: Source buffer object. + * @vmw_src: Source buffer object. * @src_offset: Source offset of blit start in bytes. * @src_stride: Source stride in bytes. * @w: Width of blit. @@ -444,13 +538,15 @@ static int vmw_bo_cpu_blit_line(struct vmw_bo_blit_line_data *d, * Neither of the buffer objects may be placed in PCI memory * (Fixed memory in TTM terminology) when using this function. */ -int vmw_bo_cpu_blit(struct ttm_buffer_object *dst, +int vmw_bo_cpu_blit(struct vmw_bo *vmw_dst, u32 dst_offset, u32 dst_stride, - struct ttm_buffer_object *src, + struct vmw_bo *vmw_src, u32 src_offset, u32 src_stride, u32 w, u32 h, struct vmw_diff_cpy *diff) { + struct ttm_buffer_object *src = &vmw_src->tbo; + struct ttm_buffer_object *dst = &vmw_dst->tbo; struct ttm_operation_ctx ctx = { .interruptible = false, .no_wait_gpu = false @@ -460,6 +556,11 @@ int vmw_bo_cpu_blit(struct ttm_buffer_object *dst, int ret = 0; struct page **dst_pages = NULL; struct page **src_pages = NULL; + bool src_external = (src->ttm->page_flags & TTM_TT_FLAG_EXTERNAL) != 0; + bool dst_external = (dst->ttm->page_flags & TTM_TT_FLAG_EXTERNAL) != 0; + + if (WARN_ON(dst == src)) + return -EINVAL; /* Buffer objects need to be either pinned or reserved: */ if (!(dst->pin_count)) @@ -479,6 +580,11 @@ int vmw_bo_cpu_blit(struct ttm_buffer_object *dst, return ret; } + if (src_external || dst_external) + return vmw_external_bo_copy(vmw_dst, dst_offset, dst_stride, + vmw_src, src_offset, src_stride, + w, h, diff); + if (!src->ttm->pages && src->ttm->sg) { src_pages = kvmalloc_array(src->ttm->num_pages, sizeof(struct page *), GFP_KERNEL); diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h index 13423c7b0cbd..ac3d7ff3f5bb 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h @@ -1355,9 +1355,9 @@ void vmw_diff_memcpy(struct vmw_diff_cpy *diff, u8 *dest, const u8 *src, void vmw_memcpy(struct vmw_diff_cpy *diff, u8 *dest, const u8 *src, size_t n); -int vmw_bo_cpu_blit(struct ttm_buffer_object *dst, +int vmw_bo_cpu_blit(struct vmw_bo *dst, u32 dst_offset, u32 dst_stride, - struct ttm_buffer_object *src, + struct vmw_bo *src, u32 src_offset, u32 src_stride, u32 w, u32 h, struct vmw_diff_cpy *diff); diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c index cb03c589ab22..b22ae25db4e1 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c @@ -497,7 +497,7 @@ static void vmw_stdu_bo_cpu_commit(struct vmw_kms_dirty *dirty) container_of(dirty->unit, typeof(*stdu), base); s32 width, height; s32 src_pitch, dst_pitch; - struct ttm_buffer_object *src_bo, *dst_bo; + struct vmw_bo *src_bo, *dst_bo; u32 src_offset, dst_offset; struct vmw_diff_cpy diff = VMW_CPU_BLIT_DIFF_INITIALIZER(stdu->cpp); @@ -512,11 +512,11 @@ static void vmw_stdu_bo_cpu_commit(struct vmw_kms_dirty *dirty) /* Assume we are blitting from Guest (bo) to Host (display_srf) */ src_pitch = stdu->display_srf->metadata.base_size.width * stdu->cpp; - src_bo = &stdu->display_srf->res.guest_memory_bo->tbo; + src_bo = stdu->display_srf->res.guest_memory_bo; src_offset = ddirty->top * src_pitch + ddirty->left * stdu->cpp; dst_pitch = ddirty->pitch; - dst_bo = &ddirty->buf->tbo; + dst_bo = ddirty->buf; dst_offset = ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp; (void) vmw_bo_cpu_blit(dst_bo, dst_offset, dst_pitch, @@ -1136,7 +1136,7 @@ vmw_stdu_bo_populate_update_cpu(struct vmw_du_update_plane *update, void *cmd, struct vmw_diff_cpy diff = VMW_CPU_BLIT_DIFF_INITIALIZER(0); struct vmw_stdu_update_gb_image *cmd_img = cmd; struct vmw_stdu_update *cmd_update; - struct ttm_buffer_object *src_bo, *dst_bo; + struct vmw_bo *src_bo, *dst_bo; u32 src_offset, dst_offset; s32 src_pitch, dst_pitch; s32 width, height; @@ -1150,11 +1150,11 @@ vmw_stdu_bo_populate_update_cpu(struct vmw_du_update_plane *update, void *cmd, diff.cpp = stdu->cpp; - dst_bo = &stdu->display_srf->res.guest_memory_bo->tbo; + dst_bo = stdu->display_srf->res.guest_memory_bo; dst_pitch = stdu->display_srf->metadata.base_size.width * stdu->cpp; dst_offset = bb->y1 * dst_pitch + bb->x1 * stdu->cpp; - src_bo = &vfbbo->buffer->tbo; + src_bo = vfbbo->buffer; src_pitch = update->vfb->base.pitches[0]; src_offset = bo_update->fb_top * src_pitch + bo_update->fb_left * stdu->cpp; -- 2.17.1

2 1

[PATCH OLK-5.10] net/hinic3: fix version showed in ethtool
by s00851154 14 Oct '24

14 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWGUW CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Fixes: 3b469ecc9cb3 ("Add Huawei Intelligent Network Card Driver: hinic3") Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10] arm64/mpam: Be compatible with MPAM architecture v1.x
by Zeng Heng 14 Oct '24

14 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWM0R -------------------------------- Modified to be compatible with MPAM architecture version 1.x instead of version 1.0 only, otherwise the probe function would fail to initialize MPAM resource. Fixes: 2cf7960cc6e1 ("arm64/mpam: Probe the features resctrl supports") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 6 ++++-- arch/arm64/kernel/mpam/mpam_resource.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c8f2d66da051..deaf990d0c74 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -127,12 +127,14 @@ mpam_probe_update_sysprops(u16 max_partid, u16 max_pmg) static int mpam_device_probe(struct mpam_device *dev) { + u64 idr; u32 hwfeatures, part_sel; u16 max_intpartid = 0; u16 max_partid, max_pmg; - if (mpam_read_reg(dev, MPAMF_AIDR) != MPAM_ARCHITECTURE_V1) { - pr_err_once("device at 0x%llx does not match MPAM architecture v1.0\n", + idr = mpam_read_reg(dev, MPAMF_AIDR); + if ((idr & MPAMF_AIDR_ARCH_MAJOR_REV) != MPAM_ARCHITECTURE_V1) { + pr_err_once("device at 0x%llx does not match MPAM architecture v1.x\n", dev->hwpage_address); return -EIO; } diff --git a/arch/arm64/kernel/mpam/mpam_resource.h b/arch/arm64/kernel/mpam/mpam_resource.h index 93452498c8d1..7a644634c826 100644 --- a/arch/arm64/kernel/mpam/mpam_resource.h +++ b/arch/arm64/kernel/mpam/mpam_resource.h @@ -48,6 +48,10 @@ #define HAS_MSMON BIT(30) #define HAS_PARTID_NRW BIT(31) +/* MPAMF_AIDR - MPAM architecture ID register */ +#define MPAMF_AIDR_ARCH_MAJOR_REV GENMASK(7, 4) +#define MPAMF_AIDR_ARCH_MINOR_REV GENMASK(3, 0) + /* MPAMF_IDR */ #define MPAMF_IDR_PMG_MAX_MASK ((BIT(8) - 1) << 16) #define MPAMF_IDR_PMG_MAX_SHIFT 16 -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] md/raid1: don't free conf on raid0_run failure
by Zheng Qixing 14 Oct '24

14 Oct '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.11-rc1 commit 17f91ac0843b50462a9c9c8f18df962338bd3db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUQ97 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The core md code calls the ->free method which already frees conf. Fixes: 07f1a6850c5d ("md/raid1: fail run raid1 array when active disk less than one") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240604172607.3185916-3-hch@lst.de Conflicts: drivers/md/raid1.c [The conflicts here are due to inconsistencies in the context.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index d5737d91b48c..ee3826db193d 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -3090,7 +3090,6 @@ static struct r1conf *setup_conf(struct mddev *mddev) return ERR_PTR(err); } -static void raid1_free(struct mddev *mddev, void *priv); static int raid1_run(struct mddev *mddev) { struct r1conf *conf; @@ -3149,8 +3148,7 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(&conf->thread); - ret = -EINVAL; - goto abort; + return -EINVAL; } if (conf->raid_disks - mddev->degraded == 1) @@ -3183,14 +3181,8 @@ static int raid1_run(struct mddev *mddev) } ret = md_integrity_register(mddev); - if (ret) { + if (ret) md_unregister_thread(&mddev->thread); - goto abort; - } - return 0; - -abort: - raid1_free(mddev, conf); return ret; } -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Backport "ima: Avoid blocking in RCU read-side critical section"
by Gu Bowen 14 Oct '24

14 Oct '24

Revert self-developed solution and backport mainline one. GUO Zihua (1): ima: Avoid blocking in RCU read-side critical section Gu Bowen (1): Revert "ima: Avoid blocking in RCU read-side critical section" include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 5 +++-- kernel/auditfilter.c | 5 +++-- security/apparmor/audit.c | 6 +++--- security/apparmor/include/audit.h | 2 +- security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_policy.c | 15 +++++++++------ security/security.c | 6 ++++-- security/selinux/include/audit.h | 4 +++- security/selinux/ss/services.c | 5 +++-- security/smack/smack_lsm.c | 4 +++- 11 files changed, 34 insertions(+), 22 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-6.6 2170/14354] net/ipv4/tcp_comp.c:740:6: warning: no previous prototype for 'comp_stream_read'
by kernel test robot 13 Oct '24

13 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b52135712fc8eae0751505713e1caf086a1437d4 commit: c31dcf6c5ab41f07da38d3f270987807735ec93e [2170/14354] tcp_comp: implement tcp compression config: loongarch-allyesconfig (https://download.01.org/0day-ci/archive/20241013/202410132346.qPkj7PMR-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241013/202410132346.qPkj7PMR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410132346.qPkj7PMR-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/ipv4/tcp_comp.c:740:6: warning: no previous prototype for 'comp_stream_read' [-Wmissing-prototypes] 740 | bool comp_stream_read(struct sock *sk) | ^~~~~~~~~~~~~~~~ >> net/ipv4/tcp_comp.c:779:6: warning: no previous prototype for 'comp_setup_strp' [-Wmissing-prototypes] 779 | void comp_setup_strp(struct sock *sk, struct tcp_comp_context *ctx) | ^~~~~~~~~~~~~~~ vim +/comp_stream_read +740 net/ipv4/tcp_comp.c 739 > 740 bool comp_stream_read(struct sock *sk) 741 { 742 struct tcp_comp_context *ctx = comp_get_ctx(sk); 743 744 if (!ctx) 745 return false; 746 747 if (ctx->rx.pkt || ctx->rx.dpkt) 748 return true; 749 750 return false; 751 } 752 753 static void comp_data_ready(struct sock *sk) 754 { 755 struct tcp_comp_context *ctx = comp_get_ctx(sk); 756 757 strp_data_ready(&ctx->rx.strp); 758 } 759 760 static void comp_queue(struct strparser *strp, struct sk_buff *skb) 761 { 762 struct tcp_comp_context *ctx = comp_get_ctx(strp->sk); 763 764 ctx->rx.pkt = skb; 765 strp_pause(strp); 766 ctx->rx.saved_data_ready(strp->sk); 767 } 768 769 static int comp_read_size(struct strparser *strp, struct sk_buff *skb) 770 { 771 struct strp_msg *rxm = strp_msg(skb); 772 773 if (rxm->offset > skb->len) 774 return 0; 775 776 return skb->len - rxm->offset; 777 } 778 > 779 void comp_setup_strp(struct sock *sk, struct tcp_comp_context *ctx) 780 { 781 struct strp_callbacks cb; 782 783 memset(&cb, 0, sizeof(cb)); 784 cb.rcv_msg = comp_queue; 785 cb.parse_msg = comp_read_size; 786 strp_init(&ctx->rx.strp, sk, &cb); 787 788 write_lock_bh(&sk->sk_callback_lock); 789 ctx->rx.saved_data_ready = sk->sk_data_ready; 790 sk->sk_data_ready = comp_data_ready; 791 write_unlock_bh(&sk->sk_callback_lock); 792 793 strp_check_rcv(&ctx->rx.strp); 794 } 795 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9646/14354] drivers/iommu/iommu.c:1141: undefined reference to `iova_reserve_domain_addr'
by kernel test robot 13 Oct '24

13 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b52135712fc8eae0751505713e1caf086a1437d4 commit: 40c9fc02b0564bbcbc3fc6e14f3aea3639f0afa6 [9646/14354] iommu/vt-d: Add support for detecting ACPI namespace device in RMRR config: x86_64-randconfig-003-20241013 (https://download.01.org/0day-ci/archive/20241013/202410132114.NOaWoR8U-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241013/202410132114.NOaWoR8U-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410132114.NOaWoR8U-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/iommu/iommu.o: in function `iommu_create_device_direct_mappings': >> drivers/iommu/iommu.c:1141: undefined reference to `iova_reserve_domain_addr' vim +1141 drivers/iommu/iommu.c 1085 1086 static int iommu_create_device_direct_mappings(struct iommu_domain *domain, 1087 struct device *dev) 1088 { 1089 struct iommu_resv_region *entry; 1090 struct list_head mappings; 1091 unsigned long pg_size; 1092 int ret = 0; 1093 1094 pg_size = domain->pgsize_bitmap ? 1UL << __ffs(domain->pgsize_bitmap) : 0; 1095 INIT_LIST_HEAD(&mappings); 1096 1097 if (WARN_ON_ONCE(iommu_is_dma_domain(domain) && !pg_size)) 1098 return -EINVAL; 1099 1100 iommu_get_resv_regions(dev, &mappings); 1101 1102 /* We need to consider overlapping regions for different devices */ 1103 list_for_each_entry(entry, &mappings, list) { 1104 dma_addr_t start, end, addr; 1105 size_t map_size = 0; 1106 1107 if (entry->type == IOMMU_RESV_DIRECT) 1108 dev->iommu->require_direct = 1; 1109 1110 if ((entry->type != IOMMU_RESV_DIRECT && 1111 entry->type != IOMMU_RESV_DIRECT_RELAXABLE) || 1112 !iommu_is_dma_domain(domain)) 1113 continue; 1114 1115 start = ALIGN(entry->start, pg_size); 1116 end = ALIGN(entry->start + entry->length, pg_size); 1117 1118 for (addr = start; addr <= end; addr += pg_size) { 1119 phys_addr_t phys_addr; 1120 1121 if (addr == end) 1122 goto map_end; 1123 1124 phys_addr = iommu_iova_to_phys(domain, addr); 1125 if (!phys_addr) { 1126 map_size += pg_size; 1127 continue; 1128 } 1129 1130 map_end: 1131 if (map_size) { 1132 ret = iommu_map(domain, addr - map_size, 1133 addr - map_size, map_size, 1134 entry->prot, GFP_KERNEL); 1135 if (ret) 1136 goto out; 1137 map_size = 0; 1138 } 1139 } 1140 if (apply_zhaoxin_dmar_acpi_a_behavior()) > 1141 iova_reserve_domain_addr(domain, start, end); 1142 } 1143 1144 if (!list_empty(&mappings) && iommu_is_dma_domain(domain)) 1145 iommu_flush_iotlb_all(domain); 1146 1147 out: 1148 iommu_put_resv_regions(dev, &mappings); 1149 1150 return ret; 1151 } 1152 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION b52135712fc8eae0751505713e1caf086a1437d4
by kernel test robot 13 Oct '24

13 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b52135712fc8eae0751505713e1caf086a1437d4 !12087 arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410122155.DIPX3Kfh-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410131602.KKBCfYOV-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410131713.fXxBznh8-lkp@intel.com arch/loongarch/kernel/efi.c:79:33: error: incompatible types when assigning to type 'pmd_t' from type 'int' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1026:42: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:105:12: error: invalid use of undefined type 'struct ieee_ets' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:16: error: variable 'pfc' has initializer but incomplete type drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: error: storage size of 'pfc' isn't known drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: warning: unused variable 'pfc' [-Wunused-variable] drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:32: warning: excess elements in struct initializer drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_pfc' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:118:12: error: invalid use of undefined type 'struct ieee_pfc' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1294:25: error: storage size of 'back_ets' isn't known drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1294:25: warning: unused variable 'back_ets' [-Wunused-variable] drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1432:14: error: 'DCB_NUMTCS_ATTR_PG' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1435:14: error: 'DCB_NUMTCS_ATTR_PFC' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1477:22: error: 'DCB_CAP_DCBX_LLD_MANAGED' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1519:14: error: variable 'hinic_dcbnl_ops' has initializer but incomplete type drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1519:29: error: storage size of 'hinic_dcbnl_ops' isn't known drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_getets' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setets' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_getpfc' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setpfc' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getstate' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setstate' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpermhwaddr' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgtx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgbwgcfgtx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgrx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgbwgcfgrx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgtccfgtx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgbwgcfgtx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1536:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgtccfgrx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1537:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgbwgcfgrx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1538:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpfccfg' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1539:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpfccfg' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1540:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setall' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1541:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getcap' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1542:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getnumtcs' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1543:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setnumtcs' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1544:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpfcstate' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1545:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpfcstate' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1548:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getdcbx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1549:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setdcbx' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:29: error: 'DCB_CAP_DCBX_HOST' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:49: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:475:21: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:689:14: error: 'DCB_CAP_ATTR_PG' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:692:14: error: 'DCB_CAP_ATTR_PFC' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:695:14: error: 'DCB_CAP_ATTR_UP2TC' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:698:14: error: 'DCB_CAP_ATTR_PG_TCS' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:701:14: error: 'DCB_CAP_ATTR_PFC_TCS' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:704:14: error: 'DCB_CAP_ATTR_GSP' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:707:14: error: 'DCB_CAP_ATTR_BCN' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_dcb.c:710:14: error: 'DCB_CAP_ATTR_DCBX' undeclared (first use in this function) drivers/net/ethernet/huawei/hinic/hinic_main.c:182:5: warning: no previous prototype for 'hinic_netdev_event' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic/hinic_main.c:2291:40: error: 'struct net_device' has no member named 'dcbnl_ops' drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-003-20241013 | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_ATTR_VALUE_UNDEFINED-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_BCN-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_DCBX-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_GSP-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PFC-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PFC_TCS-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PG-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PG_TCS-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_UP2TC-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_HOST-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_LLD_MANAGED-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_VER_CEE-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_VER_IEEE-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_NUMTCS_ATTR_PFC-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_NUMTCS_ATTR_PG-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getcap | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getdcbx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getnumtcs | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpermhwaddr | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpfccfg | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpfcstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgbwgcfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgbwgcfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgtccfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgtccfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_getets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_getpfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_setets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_setpfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setall | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setdcbx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setnumtcs | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpfccfg | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpfcstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgbwgcfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgbwgcfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgtccfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgtccfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-incomplete-type-struct-ieee_ets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-incomplete-type-struct-ieee_pfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-use-of-undefined-type-struct-ieee_ets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-use-of-undefined-type-struct-ieee_pfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:storage-size-of-back_ets-isn-t-known | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:storage-size-of-hinic_dcbnl_ops-isn-t-known | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:storage-size-of-pfc-isn-t-known | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:variable-hinic_dcbnl_ops-has-initializer-but-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:variable-pfc-has-initializer-but-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:warning:excess-elements-in-struct-initializer | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:warning:unused-variable-back_ets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:warning:unused-variable-pfc | |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:error:struct-net_device-has-no-member-named-dcbnl_ops | |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:warning:no-previous-prototype-for-hinic_netdev_event | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-hinic_ieee_ets-has-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-hinic_ieee_ets_default-has-incomplete-type | `-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-hinic_ieee_pfc-has-incomplete-type |-- loongarch-allmodconfig | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-002-20241013 | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- x86_64-allyesconfig | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-randconfig-001-20241013 | `-- include-linux-psp-hygon.h:error:conflicting-types-for-vpsp_try_do_cmd |-- x86_64-randconfig-r122-20241012 | |-- drivers-crypto-ccp-hygon-hct.c:sparse:sparse:symbol-hct_noiommu_fops-was-not-declared.-Should-it-be-static | `-- drivers-crypto-ccp-hygon-hct.c:sparse:sparse:symbol-hct_noiommu_misc-was-not-declared.-Should-it-be-static |-- x86_64-rhel-8.3 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-func | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-kselftests | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst `-- x86_64-rhel-8.3-rust |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst elapsed time: 1516m configs tested: 24 configs skipped: 133 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241013 clang-20 arm64 randconfig-002-20241013 gcc-14.1.0 arm64 randconfig-003-20241013 gcc-14.1.0 arm64 randconfig-004-20241013 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20241013 gcc-14.1.0 loongarch randconfig-002-20241013 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241013 gcc-12 x86_64 buildonly-randconfig-002-20241013 gcc-12 x86_64 buildonly-randconfig-003-20241013 gcc-12 x86_64 buildonly-randconfig-004-20241013 gcc-12 x86_64 buildonly-randconfig-005-20241013 clang-18 x86_64 buildonly-randconfig-006-20241013 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20241013 clang-18 x86_64 randconfig-003-20241013 gcc-12 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION caaf346be46cf898a60d036ab7717cead0e3c264
by kernel test robot 13 Oct '24

13 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: caaf346be46cf898a60d036ab7717cead0e3c264 !12045 s390/dasd: fix error recovery leading to data corruption on ESE devices Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410122048.jVj2RUuh-lkp@intel.com ld.lld: error: duplicate symbol: debug Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-003-20241013 | |-- drivers-irqchip-irq-mbigen.c:warning:is_mbigen_vtimer_bypass_enabled-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_chip_match_cpu-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_chip_read_aff3-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_set_kvm_info-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_set_regs-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_set_type-defined-but-not-used | |-- drivers-irqchip-irq-mbigen.c:warning:vtimer_mbigen_should_probe-defined-but-not-used | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-allyesconfig | |-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-sched_setsteal | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-tg_change_steal | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-buildonly-randconfig-001-20241013 | `-- arch-x86-kernel-paravirt.c:warning:control-reaches-end-of-non-void-function |-- x86_64-buildonly-randconfig-003-20241013 | |-- arch-x86-kernel-paravirt.c:warning:control-reaches-end-of-non-void-function | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-kexec | `-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction |-- x86_64-randconfig-102-20241013 | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target |-- x86_64-rhel-8.3 | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target |-- x86_64-rhel-8.3-func | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target `-- x86_64-rhel-8.3-kselftests `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target elapsed time: 1475m configs tested: 16 configs skipped: 127 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241013 clang-20 arm64 randconfig-002-20241013 gcc-14.1.0 arm64 randconfig-003-20241013 gcc-14.1.0 arm64 randconfig-004-20241013 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241013 gcc-12 x86_64 buildonly-randconfig-002-20241013 gcc-12 x86_64 buildonly-randconfig-003-20241013 gcc-12 x86_64 buildonly-randconfig-004-20241013 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3971/14354] drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type
by kernel test robot 13 Oct '24

13 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b52135712fc8eae0751505713e1caf086a1437d4 commit: 9c1c9598010fbb9daa1e2a67d23830092fb6246a [3971/14354] net/hinic: Update Huawei Intelligent Network Card Driver: hinic config: arm64-randconfig-003-20241013 (https://download.01.org/0day-ci/archive/20241013/202410131713.fXxBznh8-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241013/202410131713.fXxBznh8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410131713.fXxBznh8-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/huawei/hinic/hinic_ethtool.c:34: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_ethtool.c:271:5: warning: no previous prototype for 'hinic_get_io_stats_size' [-Wmissing-prototypes] 271 | u32 hinic_get_io_stats_size(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_ethtool.c:318:6: warning: no previous prototype for 'hinic_get_io_stats' [-Wmissing-prototypes] 318 | void hinic_get_io_stats(struct hinic_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_ethtool.c:1858:6: warning: no previous prototype for 'hinic_lp_test' [-Wmissing-prototypes] 1858 | void hinic_lp_test(struct net_device *netdev, struct ethtool_test *eth_test, | ^~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_nictool.c:28: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:698:5: warning: no previous prototype for 'get_pfc_info' [-Wmissing-prototypes] 698 | int get_pfc_info(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:720:5: warning: no previous prototype for 'set_pfc_control' [-Wmissing-prototypes] 720 | int set_pfc_control(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:752:5: warning: no previous prototype for 'set_ets' [-Wmissing-prototypes] 752 | int set_ets(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:827:5: warning: no previous prototype for 'get_support_up' [-Wmissing-prototypes] 827 | int get_support_up(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:855:5: warning: no previous prototype for 'get_support_tc' [-Wmissing-prototypes] 855 | int get_support_tc(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:875:5: warning: no previous prototype for 'get_ets_info' [-Wmissing-prototypes] 875 | int get_ets_info(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:893:5: warning: no previous prototype for 'set_pfc_priority' [-Wmissing-prototypes] 893 | int set_pfc_priority(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_lld.c:36: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:447:6: warning: no previous prototype for 'hinic_init_syncfw_timer' [-Wmissing-prototypes] 447 | void hinic_init_syncfw_timer(struct hinic_pcidev *pci_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:462:6: warning: no previous prototype for 'hinic_destroy_syncfw_timer' [-Wmissing-prototypes] 462 | void hinic_destroy_syncfw_timer(struct hinic_pcidev *pci_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:550:5: warning: no previous prototype for 'hinic_version_cmp' [-Wmissing-prototypes] 550 | int hinic_version_cmp(char *ver1, char *ver2) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:1139:7: warning: no previous prototype for 'hinic_get_ppf_hwdev_by_pdev' [-Wmissing-prototypes] 1139 | void *hinic_get_ppf_hwdev_by_pdev(struct pci_dev *pdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:1296:6: warning: no previous prototype for 'hinic_get_card_func_info_by_card_name' [-Wmissing-prototypes] 1296 | void hinic_get_card_func_info_by_card_name(const char *chip_name, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:1896:6: warning: no previous prototype for 'hinic_event_process' [-Wmissing-prototypes] 1896 | void hinic_event_process(void *adapter, struct hinic_event_info *event) | ^~~~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_rx.c:39: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:171:6: warning: no previous prototype for 'hinic_rx_free_buffers' [-Wmissing-prototypes] 171 | void hinic_rx_free_buffers(struct hinic_rxq *rxq) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:513:5: warning: no previous prototype for 'recv_one_pkt' [-Wmissing-prototypes] 513 | int recv_one_pkt(struct hinic_rxq *rxq, struct hinic_rq_cqe *rx_cqe, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:560:6: warning: no previous prototype for 'rx_pass_super_cqe' [-Wmissing-prototypes] 560 | void rx_pass_super_cqe(struct hinic_rxq *rxq, u32 index, u32 pkt_num, | ^~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:35: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_tx.c:39: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:913:5: warning: no previous prototype for 'hinic_setup_tx_wqe' [-Wmissing-prototypes] 913 | int hinic_setup_tx_wqe(struct hinic_txq *txq) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:1100:5: warning: no previous prototype for 'hinic_stop_sq' [-Wmissing-prototypes] 1100 | int hinic_stop_sq(struct hinic_txq *txq) | ^~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_main.c:182:5: warning: no previous prototype for 'hinic_netdev_event' [-Wmissing-prototypes] 182 | int hinic_netdev_event(struct notifier_block *notifier, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_main.c: In function 'hinic_assign_netdev_ops': >> drivers/net/ethernet/huawei/hinic/hinic_main.c:2291:40: error: 'struct net_device' has no member named 'dcbnl_ops' 2291 | adapter->netdev->dcbnl_ops = &hinic_dcbnl_ops; | ^~ drivers/net/ethernet/huawei/hinic/hinic_main.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_main.c:3058:6: warning: no previous prototype for 'nic_event' [-Wmissing-prototypes] 3058 | void nic_event(struct hinic_lld_dev *lld_dev, void *adapter, | ^~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_dcb.c:32: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:62:6: warning: no previous prototype for 'hinic_dcb_config_init' [-Wmissing-prototypes] 62 | void hinic_dcb_config_init(struct hinic_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:95:6: warning: no previous prototype for 'hinic_init_ieee_settings' [-Wmissing-prototypes] 95 | void hinic_init_ieee_settings(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/string.h:294, from include/linux/uuid.h:11, from include/linux/mod_devicetable.h:14, from include/linux/pci.h:27, from drivers/net/ethernet/huawei/hinic/hinic_dcb.c:18: drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_init_ieee_settings': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 103 | memset(ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:514:42: note: in definition of macro '__fortify_memset_chk' 514 | size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:9: note: in expansion of macro 'memset' 103 | memset(ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:54: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:514:42: note: in definition of macro '__fortify_memset_chk' 514 | size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:9: note: in expansion of macro 'memset' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:515:65: warning: left-hand operand of comma expression has no effect [-Wunused-value] 515 | fortify_memset_chk(__fortify_size, p_size, p_size_field), \ | ^ include/linux/fortify-string.h:524:25: note: in expansion of macro '__fortify_memset_chk' 524 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \ | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:9: note: in expansion of macro 'memset' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:105:12: error: invalid use of undefined type 'struct ieee_ets' 105 | ets->ets_cap = dcb_cfg->pg_tcs; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:108:20: error: invalid use of undefined type 'struct ieee_ets' 108 | ets->tc_tsa[i] = tc_attr->prio_type ? | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:110:20: error: invalid use of undefined type 'struct ieee_ets' 110 | ets->tc_tx_bw[i] = nic_dev->dcb_cfg.bw_pct[HINIC_DCB_CFG_TX][i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:111:20: error: invalid use of undefined type 'struct ieee_ets' 111 | ets->tc_rx_bw[i] = nic_dev->dcb_cfg.bw_pct[HINIC_DCB_CFG_RX][i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:112:20: error: invalid use of undefined type 'struct ieee_ets' 112 | ets->prio_tc[i] = hinic_dcb_get_tc(dcb_cfg, | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:115:54: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 115 | memcpy(&nic_dev->hinic_ieee_ets, ets, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:115:9: note: in expansion of macro 'memcpy' 115 | memcpy(&nic_dev->hinic_ieee_ets, ets, sizeof(struct ieee_ets)); | ^~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_pfc' 117 | memset(pfc, 0x0, sizeof(struct ieee_pfc)); | ^~~~~~ include/linux/fortify-string.h:514:42: note: in definition of macro '__fortify_memset_chk' 514 | size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:9: note: in expansion of macro 'memset' 117 | memset(pfc, 0x0, sizeof(struct ieee_pfc)); | ^~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:118:12: error: invalid use of undefined type 'struct ieee_pfc' 118 | pfc->pfc_cap = dcb_cfg->pfc_tcs; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:121:28: error: invalid use of undefined type 'struct ieee_pfc' 121 | pfc->pfc_en |= (u8)BIT(i); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcb_init': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:29: error: 'DCB_CAP_DCBX_HOST' undeclared (first use in this function) 244 | nic_dev->dcbx_cap = DCB_CAP_DCBX_HOST | DCB_CAP_DCBX_VER_CEE; | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:29: note: each undeclared identifier is reported only once for each function it appears in >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:49: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 244 | nic_dev->dcbx_cap = DCB_CAP_DCBX_HOST | DCB_CAP_DCBX_VER_CEE; | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_dcb.c:258:6: warning: no previous prototype for 'hinic_set_prio_tc_map' [-Wmissing-prototypes] 258 | void hinic_set_prio_tc_map(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_state': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:380:35: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 380 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_pg_tc_cfg_tx': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:475:21: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) 475 | if (prio != DCB_ATTR_VALUE_UNDEFINED) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_pg_tc_cfg_rx': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:507:21: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) 507 | if (prio != DCB_ATTR_VALUE_UNDEFINED) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_getcap': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:689:14: error: 'DCB_CAP_ATTR_PG' undeclared (first use in this function) 689 | case DCB_CAP_ATTR_PG: | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:692:14: error: 'DCB_CAP_ATTR_PFC' undeclared (first use in this function) 692 | case DCB_CAP_ATTR_PFC: | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:695:14: error: 'DCB_CAP_ATTR_UP2TC' undeclared (first use in this function) 695 | case DCB_CAP_ATTR_UP2TC: | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:698:14: error: 'DCB_CAP_ATTR_PG_TCS' undeclared (first use in this function) 698 | case DCB_CAP_ATTR_PG_TCS: | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:701:14: error: 'DCB_CAP_ATTR_PFC_TCS' undeclared (first use in this function) 701 | case DCB_CAP_ATTR_PFC_TCS: | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:704:14: error: 'DCB_CAP_ATTR_GSP' undeclared (first use in this function) 704 | case DCB_CAP_ATTR_GSP: | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:707:14: error: 'DCB_CAP_ATTR_BCN' undeclared (first use in this function) 707 | case DCB_CAP_ATTR_BCN: | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:710:14: error: 'DCB_CAP_ATTR_DCBX' undeclared (first use in this function) 710 | case DCB_CAP_ATTR_DCBX: | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function '__set_hw_ets': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1026:42: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1026 | if ((nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) { | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1027:44: error: invalid use of undefined type 'struct ieee_ets' 1027 | up_tc[cos] = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1028:46: error: invalid use of undefined type 'struct ieee_ets' 1028 | up_pgid[cos] = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1031:40: error: invalid use of undefined type 'struct ieee_ets' 1031 | (my_ets->tc_tsa[cos] == IEEE8021Q_TSA_STRICT) ? | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1049:42: error: invalid use of undefined type 'struct ieee_ets' 1049 | pg_bw[i] = my_ets->tc_tx_bw[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_df_ieee_cfg': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:16: error: variable 'pfc' has initializer but incomplete type 1126 | struct ieee_pfc pfc = {0}; | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:32: warning: excess elements in struct initializer 1126 | struct ieee_pfc pfc = {0}; | ^ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:32: note: (near initialization for 'pfc') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: error: storage size of 'pfc' isn't known 1126 | struct ieee_pfc pfc = {0}; | ^~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1131:35: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1131 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1134:48: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1134 | if (memcmp(my_ets, ets_default, sizeof(struct ieee_ets))) | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1137:19: error: invalid use of undefined type 'struct ieee_pfc' 1137 | if (my_pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1149:52: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1149 | memcpy(my_ets, ets_default, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1149:17: note: in expansion of macro 'memcpy' 1149 | memcpy(my_ets, ets_default, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1153:23: error: invalid use of undefined type 'struct ieee_pfc' 1153 | my_pfc->pfc_en = 0; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: warning: unused variable 'pfc' [-Wunused-variable] 1126 | struct ieee_pfc pfc = {0}; | ^~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1201:4: warning: no previous prototype for 'hinic_dcbnl_set_all' [-Wmissing-prototypes] 1201 | u8 hinic_dcbnl_set_all(struct net_device *netdev) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_all': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1208:35: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 1208 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_get_ets': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1279:12: error: invalid use of undefined type 'struct ieee_ets' 1279 | ets->ets_cap = my_ets->ets_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1279:30: error: invalid use of undefined type 'struct ieee_ets' 1279 | ets->ets_cap = my_ets->ets_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:59: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:19: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:637:34: note: in definition of macro '__fortify_memcpy_chk' 637 | const size_t __p_size = (p_size); \ | ^~~~~~ include/linux/fortify-string.h:694:17: note: in expansion of macro '__struct_size' 694 | __struct_size(p), __struct_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:37: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:638:34: note: in definition of macro '__fortify_memcpy_chk' 638 | const size_t __q_size = (q_size); \ | ^~~~~~ include/linux/fortify-string.h:694:35: note: in expansion of macro '__struct_size' 694 | __struct_size(p), __struct_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:19: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:639:40: note: in definition of macro '__fortify_memcpy_chk' 639 | const size_t __p_size_field = (p_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:17: note: in expansion of macro '__member_size' 695 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:37: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:640:40: note: in definition of macro '__fortify_memcpy_chk' 640 | const size_t __q_size_field = (q_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:35: note: in expansion of macro '__member_size' vim +/hinic_ieee_ets_default +210 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h 153 154 struct hinic_nic_dev { 155 struct pci_dev *pdev; 156 struct net_device *netdev; 157 void *hwdev; 158 159 int poll_weight; 160 161 unsigned long *vlan_bitmap; 162 163 u16 num_qps; 164 u16 max_qps; 165 166 u32 msg_enable; 167 unsigned long flags; 168 169 u16 sq_depth; 170 u16 rq_depth; 171 172 /* mapping from priority */ 173 u8 sq_cos_mapping[HINIC_DCB_UP_MAX]; 174 u8 default_cos_id; 175 struct hinic_txq *txqs; 176 struct hinic_rxq *rxqs; 177 178 struct nic_service_cap nic_cap; 179 180 struct irq_info *qps_irq_info; 181 struct hinic_irq *irq_cfg; 182 struct work_struct rx_mode_work; 183 struct delayed_work moderation_task; 184 struct workqueue_struct *workq; 185 186 struct list_head uc_filter_list; 187 struct list_head mc_filter_list; 188 unsigned long rx_mod_state; 189 int netdev_uc_cnt; 190 int netdev_mc_cnt; 191 int lb_test_rx_idx; 192 int lb_pkt_len; 193 u8 *lb_test_rx_buf; 194 195 u8 rss_tmpl_idx; 196 u16 num_rss; 197 u16 rss_limit; 198 u8 rss_hash_engine; 199 struct nic_rss_type rss_type; 200 u8 *rss_hkey_user; 201 /* hkey in big endian */ 202 u32 *rss_hkey_user_be; 203 u32 *rss_indir_user; 204 205 u8 dcbx_cap; 206 u32 dcb_changes; 207 u8 max_cos; 208 u8 up_valid_bitmap; 209 u8 up_cos[HINIC_DCB_UP_MAX]; > 210 struct ieee_ets hinic_ieee_ets_default; > 211 struct ieee_ets hinic_ieee_ets; > 212 struct ieee_pfc hinic_ieee_pfc; 213 struct hinic_dcb_config dcb_cfg; 214 struct hinic_dcb_config tmp_dcb_cfg; 215 struct hinic_dcb_config save_dcb_cfg; 216 unsigned long dcb_flags; 217 int disable_port_cnt; 218 /* lock for disable or enable traffic flow */ 219 struct semaphore dcb_sem; 220 221 bool heart_status; 222 223 struct hinic_intr_coal_info *intr_coalesce; 224 unsigned long last_moder_jiffies; 225 u32 adaptive_rx_coal; 226 u8 intr_coal_set_flag; 227 u32 his_link_speed; 228 /* interrupt coalesce must be different in virtual machine */ 229 bool in_vm; 230 bool is_vm_slave; 231 int is_bm_slave; 232 struct hinic_nic_stats stats; 233 /* lock for nic resource */ 234 struct mutex nic_mutex; 235 bool force_port_disable; 236 struct semaphore port_state_sem; 237 u8 link_status; 238 239 struct hinic_environment_info env_info; 240 struct hinic_adaptive_cfg adaptive_cfg; 241 242 /* pangea cpu affinity setting */ 243 bool force_affinity; 244 cpumask_t affinity_mask; 245 246 u32 lro_replenish_thld; 247 u16 rx_buff_len; 248 u32 page_order; 249 }; 250 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 28917/30000] drivers/irqchip/irq-mbigen.c:693:12: warning: 'vtimer_mbigen_set_regs' defined but not used
by kernel test robot 13 Oct '24

13 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: caaf346be46cf898a60d036ab7717cead0e3c264 commit: a8af21a94f6331eb77ca486a511cbbb548de94df [28917/30000] mbigen: add kvm dependency config: arm64-randconfig-003-20241013 (https://download.01.org/0day-ci/archive/20241013/202410131716.kAGt5y1E-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241013/202410131716.kAGt5y1E-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410131716.kAGt5y1E-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/irqchip/irq-mbigen.c:875:36: warning: 'mbigen_acpi_match' defined but not used [-Wunused-const-variable=] 875 | static const struct acpi_device_id mbigen_acpi_match[] = { | ^~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:693:12: warning: 'vtimer_mbigen_set_regs' defined but not used [-Wunused-function] 693 | static int vtimer_mbigen_set_regs(struct platform_device *pdev) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:651:13: warning: 'vtimer_mbigen_should_probe' defined but not used [-Wunused-function] 651 | static bool vtimer_mbigen_should_probe(struct mbigen_device *mgn_chip) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:636:13: warning: 'is_mbigen_vtimer_bypass_enabled' defined but not used [-Wunused-function] 636 | static bool is_mbigen_vtimer_bypass_enabled(struct mbigen_device *mgn_chip) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:597:12: warning: 'vtimer_mbigen_chip_match_cpu' defined but not used [-Wunused-function] 597 | static int vtimer_mbigen_chip_match_cpu(struct vtimer_mbigen_device *chip) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:588:12: warning: 'vtimer_mbigen_chip_read_aff3' defined but not used [-Wunused-function] 588 | static int vtimer_mbigen_chip_read_aff3(struct vtimer_mbigen_device *chip) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:581:13: warning: 'vtimer_mbigen_set_kvm_info' defined but not used [-Wunused-function] 581 | static void vtimer_mbigen_set_kvm_info(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/irqchip/irq-mbigen.c:268:12: warning: 'vtimer_mbigen_set_type' defined but not used [-Wunused-function] 268 | static int vtimer_mbigen_set_type(unsigned int cpu_id) | ^~~~~~~~~~~~~~~~~~~~~~ vim +/vtimer_mbigen_set_regs +693 drivers/irqchip/irq-mbigen.c f907c515ffb06e Hanjun Guo 2017-03-28 580 212e82b2357f91 Kunkun Jiang 2023-12-06 @581 static void vtimer_mbigen_set_kvm_info(void) 212e82b2357f91 Kunkun Jiang 2023-12-06 582 { 212e82b2357f91 Kunkun Jiang 2023-12-06 583 struct arch_timer_kvm_info *info = arch_timer_get_kvm_info(); 212e82b2357f91 Kunkun Jiang 2023-12-06 584 212e82b2357f91 Kunkun Jiang 2023-12-06 585 info->irqbypass_flag |= VT_EXPANDDEV_PROBED; 212e82b2357f91 Kunkun Jiang 2023-12-06 586 } 212e82b2357f91 Kunkun Jiang 2023-12-06 587 212e82b2357f91 Kunkun Jiang 2023-12-06 @588 static int vtimer_mbigen_chip_read_aff3(struct vtimer_mbigen_device *chip) 212e82b2357f91 Kunkun Jiang 2023-12-06 589 { 212e82b2357f91 Kunkun Jiang 2023-12-06 590 void __iomem *base = chip->base; 212e82b2357f91 Kunkun Jiang 2023-12-06 591 void __iomem *addr = base + MBIGEN_CTLR; 212e82b2357f91 Kunkun Jiang 2023-12-06 592 u32 val = readl_relaxed(addr); 212e82b2357f91 Kunkun Jiang 2023-12-06 593 212e82b2357f91 Kunkun Jiang 2023-12-06 594 return ((val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT); 212e82b2357f91 Kunkun Jiang 2023-12-06 595 } 212e82b2357f91 Kunkun Jiang 2023-12-06 596 212e82b2357f91 Kunkun Jiang 2023-12-06 @597 static int vtimer_mbigen_chip_match_cpu(struct vtimer_mbigen_device *chip) 212e82b2357f91 Kunkun Jiang 2023-12-06 598 { 212e82b2357f91 Kunkun Jiang 2023-12-06 599 int cpu; 212e82b2357f91 Kunkun Jiang 2023-12-06 600 212e82b2357f91 Kunkun Jiang 2023-12-06 601 chip->cpu_base = -1; 212e82b2357f91 Kunkun Jiang 2023-12-06 602 chip->cpu_num = 0; 212e82b2357f91 Kunkun Jiang 2023-12-06 603 212e82b2357f91 Kunkun Jiang 2023-12-06 604 for_each_possible_cpu(cpu) { 212e82b2357f91 Kunkun Jiang 2023-12-06 605 int mpidr_aff3 = MPIDR_AFFINITY_LEVEL(cpu_logical_map(cpu), 3); 212e82b2357f91 Kunkun Jiang 2023-12-06 606 212e82b2357f91 Kunkun Jiang 2023-12-06 607 if (chip->mpidr_aff3 == mpidr_aff3) { 212e82b2357f91 Kunkun Jiang 2023-12-06 608 /* get the first cpu attached to the mbigen */ 212e82b2357f91 Kunkun Jiang 2023-12-06 609 if (chip->cpu_base == -1) { 212e82b2357f91 Kunkun Jiang 2023-12-06 610 /* Make sure cpu_base is attached to PIN0 */ 212e82b2357f91 Kunkun Jiang 2023-12-06 611 u64 mpidr = cpu_logical_map(cpu); 212e82b2357f91 Kunkun Jiang 2023-12-06 612 if (!MPIDR_AFFINITY_LEVEL(mpidr, 2) && 212e82b2357f91 Kunkun Jiang 2023-12-06 613 !MPIDR_AFFINITY_LEVEL(mpidr, 1) && 212e82b2357f91 Kunkun Jiang 2023-12-06 614 !MPIDR_AFFINITY_LEVEL(mpidr, 0)) 212e82b2357f91 Kunkun Jiang 2023-12-06 615 chip->cpu_base = cpu; 212e82b2357f91 Kunkun Jiang 2023-12-06 616 } 212e82b2357f91 Kunkun Jiang 2023-12-06 617 212e82b2357f91 Kunkun Jiang 2023-12-06 618 chip->cpu_num++; 212e82b2357f91 Kunkun Jiang 2023-12-06 619 /* 212e82b2357f91 Kunkun Jiang 2023-12-06 620 * check if this cpu has already 212e82b2357f91 Kunkun Jiang 2023-12-06 621 * attached to another mbigen 212e82b2357f91 Kunkun Jiang 2023-12-06 622 */ 212e82b2357f91 Kunkun Jiang 2023-12-06 623 if (cpumask_test_and_set_cpu(cpu, &vtimer_cpu_mask)) { 212e82b2357f91 Kunkun Jiang 2023-12-06 624 WARN_ON_ONCE(1); 212e82b2357f91 Kunkun Jiang 2023-12-06 625 return -EINVAL; 212e82b2357f91 Kunkun Jiang 2023-12-06 626 } 212e82b2357f91 Kunkun Jiang 2023-12-06 627 } 212e82b2357f91 Kunkun Jiang 2023-12-06 628 } 212e82b2357f91 Kunkun Jiang 2023-12-06 629 212e82b2357f91 Kunkun Jiang 2023-12-06 630 if (chip->cpu_base == -1 || chip->cpu_num > IRQS_PER_MBIGEN_NODE) 212e82b2357f91 Kunkun Jiang 2023-12-06 631 return -EINVAL; 212e82b2357f91 Kunkun Jiang 2023-12-06 632 212e82b2357f91 Kunkun Jiang 2023-12-06 633 return 0; 212e82b2357f91 Kunkun Jiang 2023-12-06 634 } 212e82b2357f91 Kunkun Jiang 2023-12-06 635 212e82b2357f91 Kunkun Jiang 2023-12-06 @636 static bool is_mbigen_vtimer_bypass_enabled(struct mbigen_device *mgn_chip) 212e82b2357f91 Kunkun Jiang 2023-12-06 637 { 212e82b2357f91 Kunkun Jiang 2023-12-06 638 void __iomem *base = mgn_chip->base; 212e82b2357f91 Kunkun Jiang 2023-12-06 639 void __iomem *addr = base + MBIGEN_NODE_CFG_OFFSET; 212e82b2357f91 Kunkun Jiang 2023-12-06 640 u32 val = readl_relaxed(addr); 212e82b2357f91 Kunkun Jiang 2023-12-06 641 212e82b2357f91 Kunkun Jiang 2023-12-06 642 return ((val & MBIGEN_TYPE_MASK) >> MBIGEN_TYPE_SHIFT) 212e82b2357f91 Kunkun Jiang 2023-12-06 643 == TYPE_VTIMER_ENABLED; 212e82b2357f91 Kunkun Jiang 2023-12-06 644 } 212e82b2357f91 Kunkun Jiang 2023-12-06 645 212e82b2357f91 Kunkun Jiang 2023-12-06 646 /** 212e82b2357f91 Kunkun Jiang 2023-12-06 647 * MBIX_VPPI_ITS_TA: Indicates the address of the ITS corresponding 212e82b2357f91 Kunkun Jiang 2023-12-06 648 * to the mbigen. 212e82b2357f91 Kunkun Jiang 2023-12-06 649 */ 212e82b2357f91 Kunkun Jiang 2023-12-06 650 #define MBIX_VPPI_ITS_TA 0x0038 212e82b2357f91 Kunkun Jiang 2023-12-06 @651 static bool vtimer_mbigen_should_probe(struct mbigen_device *mgn_chip) 212e82b2357f91 Kunkun Jiang 2023-12-06 652 { 212e82b2357f91 Kunkun Jiang 2023-12-06 653 unsigned int mpidr_aff3; 212e82b2357f91 Kunkun Jiang 2023-12-06 654 struct vtimer_mbigen_device *chip; 212e82b2357f91 Kunkun Jiang 2023-12-06 655 void __iomem *addr; 212e82b2357f91 Kunkun Jiang 2023-12-06 656 u32 val; 212e82b2357f91 Kunkun Jiang 2023-12-06 657 212e82b2357f91 Kunkun Jiang 2023-12-06 658 /* find the valid mbigen */ 212e82b2357f91 Kunkun Jiang 2023-12-06 659 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 212e82b2357f91 Kunkun Jiang 2023-12-06 660 val = readl_relaxed(addr); 212e82b2357f91 Kunkun Jiang 2023-12-06 661 if (!val) 212e82b2357f91 Kunkun Jiang 2023-12-06 662 return false; 212e82b2357f91 Kunkun Jiang 2023-12-06 663 212e82b2357f91 Kunkun Jiang 2023-12-06 664 addr = mgn_chip->base + MBIGEN_CTLR; 212e82b2357f91 Kunkun Jiang 2023-12-06 665 val = readl_relaxed(addr); 212e82b2357f91 Kunkun Jiang 2023-12-06 666 mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; 212e82b2357f91 Kunkun Jiang 2023-12-06 667 list_for_each_entry(chip, &vtimer_mgn_list, entry) { 212e82b2357f91 Kunkun Jiang 2023-12-06 668 if (chip->mpidr_aff3 == mpidr_aff3) 212e82b2357f91 Kunkun Jiang 2023-12-06 669 return false; 212e82b2357f91 Kunkun Jiang 2023-12-06 670 } 212e82b2357f91 Kunkun Jiang 2023-12-06 671 212e82b2357f91 Kunkun Jiang 2023-12-06 672 return true; 212e82b2357f91 Kunkun Jiang 2023-12-06 673 } 212e82b2357f91 Kunkun Jiang 2023-12-06 674 473e1b802231d7 Kunkun Jiang 2023-12-06 675 #define CHIP0_TA_MBIGEN_PHY_BASE 0x4604400000 473e1b802231d7 Kunkun Jiang 2023-12-06 676 #define CHIP0_TA_MBIGEN_ITS_BASE 0x84028 473e1b802231d7 Kunkun Jiang 2023-12-06 677 #define CHIP0_TA_PERI_PHY_BASE 0x4614002018 473e1b802231d7 Kunkun Jiang 2023-12-06 678 473e1b802231d7 Kunkun Jiang 2023-12-06 679 #define CHIP0_TB_MBIGEN_PHY_BASE 0xc604400000 473e1b802231d7 Kunkun Jiang 2023-12-06 680 #define CHIP0_TB_PERI_PHY_BASE 0xc614002018 473e1b802231d7 Kunkun Jiang 2023-12-06 681 #define CHIP0_TB_MBIGEN_ITS_BASE 0x4028 473e1b802231d7 Kunkun Jiang 2023-12-06 682 473e1b802231d7 Kunkun Jiang 2023-12-06 683 #define CHIP1_TA_MBIGEN_PHY_BASE 0x204604400000 473e1b802231d7 Kunkun Jiang 2023-12-06 684 #define CHIP1_TA_PERI_PHY_BASE 0x204614002018 473e1b802231d7 Kunkun Jiang 2023-12-06 685 #define CHIP1_TA_MBIGEN_ITS_BASE 0x2084028 473e1b802231d7 Kunkun Jiang 2023-12-06 686 473e1b802231d7 Kunkun Jiang 2023-12-06 687 #define CHIP1_TB_MBIGEN_PHY_BASE 0x20c604400000 473e1b802231d7 Kunkun Jiang 2023-12-06 688 #define CHIP1_TB_MBIGEN_ITS_BASE 0x2004028 473e1b802231d7 Kunkun Jiang 2023-12-06 689 #define CHIP1_TB_PERI_PHY_BASE 0x20c614002018 473e1b802231d7 Kunkun Jiang 2023-12-06 690 473e1b802231d7 Kunkun Jiang 2023-12-06 691 extern bool vtimer_irqbypass; 473e1b802231d7 Kunkun Jiang 2023-12-06 692 473e1b802231d7 Kunkun Jiang 2023-12-06 @693 static int vtimer_mbigen_set_regs(struct platform_device *pdev) 473e1b802231d7 Kunkun Jiang 2023-12-06 694 { 473e1b802231d7 Kunkun Jiang 2023-12-06 695 struct mbigen_device *mgn_chip = platform_get_drvdata(pdev); 473e1b802231d7 Kunkun Jiang 2023-12-06 696 struct resource *res; 473e1b802231d7 Kunkun Jiang 2023-12-06 697 void __iomem *addr; 473e1b802231d7 Kunkun Jiang 2023-12-06 698 unsigned int mpidr_aff3; 473e1b802231d7 Kunkun Jiang 2023-12-06 699 u32 val; 473e1b802231d7 Kunkun Jiang 2023-12-06 700 struct vtimer_mbigen_device *chip; 473e1b802231d7 Kunkun Jiang 2023-12-06 701 473e1b802231d7 Kunkun Jiang 2023-12-06 702 addr = mgn_chip->base + MBIGEN_CTLR; 473e1b802231d7 Kunkun Jiang 2023-12-06 703 val = readl_relaxed(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 704 mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; 473e1b802231d7 Kunkun Jiang 2023-12-06 705 list_for_each_entry(chip, &vtimer_mgn_list, entry) { 473e1b802231d7 Kunkun Jiang 2023-12-06 706 if (chip->mpidr_aff3 == mpidr_aff3) 473e1b802231d7 Kunkun Jiang 2023-12-06 707 return 0; 473e1b802231d7 Kunkun Jiang 2023-12-06 708 } 473e1b802231d7 Kunkun Jiang 2023-12-06 709 473e1b802231d7 Kunkun Jiang 2023-12-06 710 res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 473e1b802231d7 Kunkun Jiang 2023-12-06 711 if (!mgn_chip) 473e1b802231d7 Kunkun Jiang 2023-12-06 712 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 713 473e1b802231d7 Kunkun Jiang 2023-12-06 714 if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { 473e1b802231d7 Kunkun Jiang 2023-12-06 715 addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); 473e1b802231d7 Kunkun Jiang 2023-12-06 716 if (!addr) { 473e1b802231d7 Kunkun Jiang 2023-12-06 717 pr_err("Unable to map CHIP0-TA-PERI\n"); 473e1b802231d7 Kunkun Jiang 2023-12-06 718 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 719 } 473e1b802231d7 Kunkun Jiang 2023-12-06 720 473e1b802231d7 Kunkun Jiang 2023-12-06 721 writel_relaxed(1, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 722 iounmap(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 723 473e1b802231d7 Kunkun Jiang 2023-12-06 724 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 473e1b802231d7 Kunkun Jiang 2023-12-06 725 writel_relaxed(CHIP0_TA_MBIGEN_ITS_BASE, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 726 } 473e1b802231d7 Kunkun Jiang 2023-12-06 727 473e1b802231d7 Kunkun Jiang 2023-12-06 728 if (res->start == CHIP0_TB_MBIGEN_PHY_BASE) { 473e1b802231d7 Kunkun Jiang 2023-12-06 729 addr = ioremap(CHIP0_TB_PERI_PHY_BASE, 4); 473e1b802231d7 Kunkun Jiang 2023-12-06 730 if (!addr) { 473e1b802231d7 Kunkun Jiang 2023-12-06 731 pr_err("Unable to map CHIP0-TB-PERI\n"); 473e1b802231d7 Kunkun Jiang 2023-12-06 732 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 733 } 473e1b802231d7 Kunkun Jiang 2023-12-06 734 473e1b802231d7 Kunkun Jiang 2023-12-06 735 writel_relaxed(1, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 736 iounmap(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 737 473e1b802231d7 Kunkun Jiang 2023-12-06 738 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 473e1b802231d7 Kunkun Jiang 2023-12-06 739 writel_relaxed(CHIP0_TB_MBIGEN_ITS_BASE, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 740 } 473e1b802231d7 Kunkun Jiang 2023-12-06 741 473e1b802231d7 Kunkun Jiang 2023-12-06 742 if (res->start == CHIP1_TA_MBIGEN_PHY_BASE) { 473e1b802231d7 Kunkun Jiang 2023-12-06 743 addr = ioremap(CHIP1_TA_PERI_PHY_BASE, 4); 473e1b802231d7 Kunkun Jiang 2023-12-06 744 if (!addr) { 473e1b802231d7 Kunkun Jiang 2023-12-06 745 pr_err("Unable to map CHIP1-TA-PERI\n"); 473e1b802231d7 Kunkun Jiang 2023-12-06 746 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 747 } 473e1b802231d7 Kunkun Jiang 2023-12-06 748 473e1b802231d7 Kunkun Jiang 2023-12-06 749 writel_relaxed(1, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 750 iounmap(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 751 473e1b802231d7 Kunkun Jiang 2023-12-06 752 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 473e1b802231d7 Kunkun Jiang 2023-12-06 753 writel_relaxed(CHIP1_TA_MBIGEN_ITS_BASE, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 754 } 473e1b802231d7 Kunkun Jiang 2023-12-06 755 473e1b802231d7 Kunkun Jiang 2023-12-06 756 if (res->start == CHIP1_TB_MBIGEN_PHY_BASE) { 473e1b802231d7 Kunkun Jiang 2023-12-06 757 addr = ioremap(CHIP1_TB_PERI_PHY_BASE, 4); 473e1b802231d7 Kunkun Jiang 2023-12-06 758 if (!addr) { 473e1b802231d7 Kunkun Jiang 2023-12-06 759 pr_err("Unable to map CHIP1-TB-PERI\n"); 473e1b802231d7 Kunkun Jiang 2023-12-06 760 return -ENOMEM; 473e1b802231d7 Kunkun Jiang 2023-12-06 761 } 473e1b802231d7 Kunkun Jiang 2023-12-06 762 473e1b802231d7 Kunkun Jiang 2023-12-06 763 writel_relaxed(1, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 764 iounmap(addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 765 473e1b802231d7 Kunkun Jiang 2023-12-06 766 addr = mgn_chip->base + MBIX_VPPI_ITS_TA; 473e1b802231d7 Kunkun Jiang 2023-12-06 767 writel_relaxed(CHIP1_TB_MBIGEN_ITS_BASE, addr); 473e1b802231d7 Kunkun Jiang 2023-12-06 768 } 473e1b802231d7 Kunkun Jiang 2023-12-06 769 473e1b802231d7 Kunkun Jiang 2023-12-06 770 return 0; 473e1b802231d7 Kunkun Jiang 2023-12-06 771 } 473e1b802231d7 Kunkun Jiang 2023-12-06 772 :::::: The code at line 693 was first introduced by commit :::::: 473e1b802231d790ba8eb31c0597d5b8eba306d6 mbigen: Sets the regs related to vtimer irqbypass :::::: TO: Kunkun Jiang <jiangkunkun(a)huawei.com> :::::: CC: Dongxu Sun <sundongxu3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 776/14354] arch/loongarch/kernel/efi.c:79:33: error: incompatible types when assigning to type 'pmd_t' from type 'int'
by kernel test robot 13 Oct '24

13 Oct '24

Hi liuyun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b52135712fc8eae0751505713e1caf086a1437d4 commit: 221e2e8bdbb851a519df0bac5a44298dae2b4612 [776/14354] LoongArch: add kernel setvirtmap for runtime config: loongarch-allnoconfig (https://download.01.org/0day-ci/archive/20241013/202410131602.KKBCfYOV-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241013/202410131602.KKBCfYOV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410131602.KKBCfYOV-lkp@intel.com/ All errors (new ones prefixed by >>): arch/loongarch/kernel/efi.c: In function 'efimap_populate_hugepages': arch/loongarch/kernel/efi.c:79:33: error: implicit declaration of function 'pmd_mkhuge'; did you mean 'pte_mkhuge'? [-Wimplicit-function-declaration] 79 | entry = pmd_mkhuge(entry); | ^~~~~~~~~~ | pte_mkhuge >> arch/loongarch/kernel/efi.c:79:33: error: incompatible types when assigning to type 'pmd_t' from type 'int' vim +79 arch/loongarch/kernel/efi.c 54 55 static int __init efimap_populate_hugepages( 56 unsigned long start, unsigned long end, 57 pgprot_t prot) 58 { 59 unsigned long addr; 60 unsigned long next; 61 pmd_t entry; 62 pud_t *pud; 63 pmd_t *pmd; 64 65 for (addr = start; addr < end; addr = next) { 66 next = pmd_addr_end(addr, end); 67 pud = pud_offset((p4d_t *)pgd_efi + pgd_index(addr), addr); 68 if (pud_none(*pud)) { 69 void *p = memblock_alloc_low(PAGE_SIZE, PAGE_SIZE); 70 71 if (!p) 72 return -1; 73 pmd_init(p); 74 pud_populate(&init_mm, pud, p); 75 } 76 pmd = pmd_offset(pud, addr); 77 if (pmd_none(*pmd)) { 78 entry = pfn_pmd((addr >> PAGE_SHIFT), prot); > 79 entry = pmd_mkhuge(entry); 80 set_pmd_at(&init_mm, addr, pmd, entry); 81 } 82 } 83 return 0; 84 } 85 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13480/14354] drivers/crypto/ccp/hygon/hct.c:2175:30: sparse: sparse: symbol 'hct_noiommu_fops' was not declared. Should it be static?
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b52135712fc8eae0751505713e1caf086a1437d4 commit: 6e2db6d2859f5c41ff51b696235dc3971f4bcd22 [13480/14354] hct: supporting memory encryption in host and wb set in vm config: x86_64-randconfig-r122-20241012 (https://download.01.org/0day-ci/archive/20241012/202410122155.DIPX3Kfh-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410122155.DIPX3Kfh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410122155.DIPX3Kfh-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/crypto/ccp/hygon/hct.c:246:18: sparse: sparse: symbol 'hct_mdev_type' was not declared. Should it be static? drivers/crypto/ccp/hygon/hct.c:250:18: sparse: sparse: symbol 'hct_mdev_types' was not declared. Should it be static? drivers/crypto/ccp/hygon/hct.c:472:23: sparse: sparse: cast to restricted __le32 drivers/crypto/ccp/hygon/hct.c:1217:20: sparse: sparse: symbol 'hct_mdev_driver' was not declared. Should it be static? drivers/crypto/ccp/hygon/hct.c:1346:13: sparse: sparse: symbol 'hct_pin_memory' was not declared. Should it be static? drivers/crypto/ccp/hygon/hct.c:2080:6: sparse: sparse: symbol 'hct_noiommu_set_memory_wb' was not declared. Should it be static? >> drivers/crypto/ccp/hygon/hct.c:2175:30: sparse: sparse: symbol 'hct_noiommu_fops' was not declared. Should it be static? >> drivers/crypto/ccp/hygon/hct.c:2180:19: sparse: sparse: symbol 'hct_noiommu_misc' was not declared. Should it be static? vim +/hct_noiommu_fops +2175 drivers/crypto/ccp/hygon/hct.c 2174 > 2175 const struct file_operations hct_noiommu_fops = { 2176 .owner = THIS_MODULE, 2177 .unlocked_ioctl = hct_noiommu_ioctl, 2178 }; 2179 > 2180 struct miscdevice hct_noiommu_misc = { 2181 .minor = MISC_DYNAMIC_MINOR, 2182 .name = "hct_noiommu", 2183 .fops = &hct_noiommu_fops, 2184 }; 2185 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 1467/30000] ld.lld: error: duplicate symbol: debug
by kernel test robot 12 Oct '24

12 Oct '24

Hi Qi, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: caaf346be46cf898a60d036ab7717cead0e3c264 commit: 8e695222e0638bf3867561a1e7342d20fd9683a1 [1467/30000] Huawei BMA: Adding Huawei BMA driver: cdev_veth_drv config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20241012/202410122048.jVj2RUuh-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410122048.jVj2RUuh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410122048.jVj2RUuh-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: duplicate symbol: debug >>> defined at bma_pci.c >>> net/ethernet/huawei/bma/edma_drv/bma_pci.o:(debug) in archive drivers/built-in.a >>> defined at virtual_cdev_eth_net.c >>> net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.o:(.bss+0x0) in archive drivers/built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13479/14352] drivers/crypto/ccp/hygon/hct.c:233:18: sparse: sparse: symbol 'hct_mdev_type' was not declared. Should it be static?
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0fac4b66f365181375364ed55678bc5faa6940ff commit: c74ae2c5da57becf3f41c596d79b3dd30fa1baa6 [13479/14352] hct: add mediated ccp driver support for hygon crypto technology. config: x86_64-randconfig-r122-20241012 (https://download.01.org/0day-ci/archive/20241012/202410121833.1SampNGd-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410121833.1SampNGd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410121833.1SampNGd-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/crypto/ccp/hygon/hct.c:233:18: sparse: sparse: symbol 'hct_mdev_type' was not declared. Should it be static? >> drivers/crypto/ccp/hygon/hct.c:237:18: sparse: sparse: symbol 'hct_mdev_types' was not declared. Should it be static? >> drivers/crypto/ccp/hygon/hct.c:459:23: sparse: sparse: cast to restricted __le32 >> drivers/crypto/ccp/hygon/hct.c:1204:20: sparse: sparse: symbol 'hct_mdev_driver' was not declared. Should it be static? >> drivers/crypto/ccp/hygon/hct.c:1333:13: sparse: sparse: symbol 'hct_pin_memory' was not declared. Should it be static? vim +/hct_mdev_type +233 drivers/crypto/ccp/hygon/hct.c 232 > 233 struct mdev_type hct_mdev_type = { 234 .sysfs_name = "1", 235 .pretty_name = "hct mdev type" 236 }; > 237 struct mdev_type *hct_mdev_types[] = { 238 &hct_mdev_type 239 }; 240 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/3] Backport patches of hns RoCE to OLK-6.6
by Chengchang Tang 12 Oct '24

12 Oct '24

Backport patches of hns RoCE to OLK-6.6 Chengchang Tang (2): RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset Xinghai Cen (1): Revert "RDMA/hns: Fix missing resetting notify" drivers/infiniband/core/ib_core_uverbs.c | 29 +++++++++++----------- drivers/infiniband/core/rdma_core.h | 2 ++ drivers/infiniband/core/uverbs.h | 2 ++ drivers/infiniband/core/uverbs_main.c | 12 ++++++++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 20 ++++++++++----- drivers/infiniband/hw/hns/hns_roce_main.c | 5 ++++ include/rdma/ib_verbs.h | 13 +++++++++- 7 files changed, 60 insertions(+), 23 deletions(-) -- 2.33.0

2 4

[openeuler:openEuler-1.0-LTS 15383/23827] fs/proc/etmem_scan.c:244:18: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: bad4d8833739acc8eef306e7ad5c7877f9f4f0fb [15383/23827] etmem: add etmem-scan feature config: x86_64-randconfig-121-20241012 (https://download.01.org/0day-ci/archive/20241012/202410121701.6pXRhoNA-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410121701.6pXRhoNA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410121701.6pXRhoNA-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/proc/etmem_scan.c:244:18: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] <asn:1> *buf @@ got void *buf @@ fs/proc/etmem_scan.c:244:18: sparse: expected void [noderef] <asn:1> *buf fs/proc/etmem_scan.c:244:18: sparse: got void *buf fs/proc/etmem_scan.c:1032:40: sparse: sparse: incorrect type in assignment (incompatible argument 2 (different address spaces)) @@ expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) @@ got long ( * )( ... ) @@ fs/proc/etmem_scan.c:1032:40: sparse: expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) fs/proc/etmem_scan.c:1032:40: sparse: got long ( * )( ... ) fs/proc/etmem_scan.c:425:46: sparse: sparse: self-comparison always evaluates to false In file included from fs/proc/etmem_scan.c:2: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. vim +244 fs/proc/etmem_scan.c 240 241 static void setup_page_idle_ctrl(struct page_idle_ctrl *pic, void *buf, 242 int buf_size, unsigned int flags) 243 { > 244 pic->buf = buf; 245 pic->buf_size = buf_size; 246 pic->bytes_copied = 0; 247 pic->next_hva = 0; 248 pic->gpa_to_hva = 0; 249 pic->restart_gpa = 0; 250 pic->last_va = 0; 251 pic->flags = flags; 252 } 253 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ALSA: line6: Fix racy access to midibuf
by Yuan Can 12 Oct '24

12 Oct '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.224 commit e7e7d2b180d8f297cea6db43ea72402fd33e1a29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ4 CVE: CVE-2024-44954 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 15b7a03205b31bc5623378c190d22b7ff60026f1 upstream. There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races. Reported-by: syzbot+78eccfb8b3c9a85fc6c5(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/00000000000000949c061df288c5@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20240805130129.10872-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/usb/line6/driver.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index b67617b68e50..07fd47da8954 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -286,12 +286,14 @@ static void line6_data_received(struct urb *urb) { struct usb_line6 *line6 = (struct usb_line6 *)urb->context; struct midi_buffer *mb = &line6->line6midi->midibuf_in; + unsigned long flags; int done; if (urb->status == -ESHUTDOWN) return; if (line6->properties->capabilities & LINE6_CAP_CONTROL_MIDI) { + spin_lock_irqsave(&line6->line6midi->lock, flags); done = line6_midibuf_write(mb, urb->transfer_buffer, urb->actual_length); @@ -300,12 +302,15 @@ static void line6_data_received(struct urb *urb) dev_dbg(line6->ifcdev, "%d %d buffer overflow - message skipped\n", done, urb->actual_length); } + spin_unlock_irqrestore(&line6->line6midi->lock, flags); for (;;) { + spin_lock_irqsave(&line6->line6midi->lock, flags); done = line6_midibuf_read(mb, line6->buffer_message, LINE6_MIDI_MESSAGE_MAXLEN, LINE6_MIDIBUF_READ_RX); + spin_unlock_irqrestore(&line6->line6midi->lock, flags); if (done <= 0) break; -- 2.17.1

2 1

[PATCH OLK-6.6] net/hinic3: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWIA2 CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Fixes: 3b469ecc9cb3 ("Add Huawei Intelligent Network Card Driver: hinic3") Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-6.6] bpf: Remove tst_run from lwt_seg6local_prog_ops.
by Liu Jian 12 Oct '24

12 Oct '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit c13fda93aca118b8e5cd202e339046728ee7dddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX44 CVE: CVE-2024-46754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL. Suggested-by: Martin KaFai Lau <martin.lau(a)linux.dev> Reported-by: syzbot+608a2acde8c5a101d07d(a)syzkaller.appspotmail.com Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.") Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index aa4cd4143ac7..e16d746c23da 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -11094,7 +11094,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = { }; const struct bpf_prog_ops lwt_seg6local_prog_ops = { - .test_run = bpf_prog_test_run_skb, }; const struct bpf_verifier_ops cg_sock_verifier_ops = { -- 2.34.1

2 7

[PATCH OLK-5.10] bpf: Remove tst_run from lwt_seg6local_prog_ops.
by Liu Jian 12 Oct '24

12 Oct '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit c13fda93aca118b8e5cd202e339046728ee7dddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX44 CVE: CVE-2024-46754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL. Suggested-by: Martin KaFai Lau <martin.lau(a)linux.dev> Reported-by: syzbot+608a2acde8c5a101d07d(a)syzkaller.appspotmail.com Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.") Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index a4d96f0231b2..62d09520a55d 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -9990,7 +9990,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = { }; const struct bpf_prog_ops lwt_seg6local_prog_ops = { - .test_run = bpf_prog_test_run_skb, }; const struct bpf_verifier_ops cg_sock_verifier_ops = { -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/7] CVE-2022-48878
by Yuan Can 12 Oct '24

12 Oct '24

Fix patch of CVE-2022-48878 and its pre requests and new fix patches. Krzysztof Kozlowski (1): Bluetooth: hci_qca: Fix driver shutdown on closed serdev Venkata Lakshmi Narayana Gubba (4): Bluetooth: hci_qca: Wait for timeout during suspend Bluetooth: hci_qca: Wait for SSR completion during suspend Bluetooth: hci_qca: check for SSR triggered flag while suspend Bluetooth: hci_qca: Fixed issue during suspend Yang Yingliang (1): Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Zijun Hu (1): Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot drivers/bluetooth/hci_qca.c | 82 ++++++++++++++++++++++++++++++++----- 1 file changed, 72 insertions(+), 10 deletions(-) -- 2.17.1

2 8

[PATCH OLK-5.10] arm64/mpam: Be compatible with MPAM architecture v1.x
by Zeng Heng 12 Oct '24

12 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWM0R -------------------------------- Modified to be compatible with MPAM architecture version 1.x instead of version 1.0 only, otherwise the probe function would fail to initialize MPAM resource. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 6 ++++-- arch/arm64/kernel/mpam/mpam_resource.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c8f2d66da051..deaf990d0c74 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -127,12 +127,14 @@ mpam_probe_update_sysprops(u16 max_partid, u16 max_pmg) static int mpam_device_probe(struct mpam_device *dev) { + u64 idr; u32 hwfeatures, part_sel; u16 max_intpartid = 0; u16 max_partid, max_pmg; - if (mpam_read_reg(dev, MPAMF_AIDR) != MPAM_ARCHITECTURE_V1) { - pr_err_once("device at 0x%llx does not match MPAM architecture v1.0\n", + idr = mpam_read_reg(dev, MPAMF_AIDR); + if ((idr & MPAMF_AIDR_ARCH_MAJOR_REV) != MPAM_ARCHITECTURE_V1) { + pr_err_once("device at 0x%llx does not match MPAM architecture v1.x\n", dev->hwpage_address); return -EIO; } diff --git a/arch/arm64/kernel/mpam/mpam_resource.h b/arch/arm64/kernel/mpam/mpam_resource.h index 93452498c8d1..7a644634c826 100644 --- a/arch/arm64/kernel/mpam/mpam_resource.h +++ b/arch/arm64/kernel/mpam/mpam_resource.h @@ -48,6 +48,10 @@ #define HAS_MSMON BIT(30) #define HAS_PARTID_NRW BIT(31) +/* MPAMF_AIDR - MPAM architecture ID register */ +#define MPAMF_AIDR_ARCH_MAJOR_REV GENMASK(7, 4) +#define MPAMF_AIDR_ARCH_MINOR_REV GENMASK(3, 0) + /* MPAMF_IDR */ #define MPAMF_IDR_PMG_MAX_MASK ((BIT(8) - 1) << 16) #define MPAMF_IDR_PMG_MAX_SHIFT 16 -- 2.25.1

2 1

[PATCH OLK-5.10] arm64/mpam: Be compatible with MPAM architecture v1.x
by Zeng Heng 12 Oct '24

12 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWM0R -------------------------------- Modified to be compatible with MPAM architecture version 1.x instead of just version 1.0, otherwise the probe function would fail to initialize MPAM resource. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 6 ++++-- arch/arm64/kernel/mpam/mpam_resource.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c8f2d66da051..deaf990d0c74 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -127,12 +127,14 @@ mpam_probe_update_sysprops(u16 max_partid, u16 max_pmg) static int mpam_device_probe(struct mpam_device *dev) { + u64 idr; u32 hwfeatures, part_sel; u16 max_intpartid = 0; u16 max_partid, max_pmg; - if (mpam_read_reg(dev, MPAMF_AIDR) != MPAM_ARCHITECTURE_V1) { - pr_err_once("device at 0x%llx does not match MPAM architecture v1.0\n", + idr = mpam_read_reg(dev, MPAMF_AIDR); + if ((idr & MPAMF_AIDR_ARCH_MAJOR_REV) != MPAM_ARCHITECTURE_V1) { + pr_err_once("device at 0x%llx does not match MPAM architecture v1.x\n", dev->hwpage_address); return -EIO; } diff --git a/arch/arm64/kernel/mpam/mpam_resource.h b/arch/arm64/kernel/mpam/mpam_resource.h index 93452498c8d1..7a644634c826 100644 --- a/arch/arm64/kernel/mpam/mpam_resource.h +++ b/arch/arm64/kernel/mpam/mpam_resource.h @@ -48,6 +48,10 @@ #define HAS_MSMON BIT(30) #define HAS_PARTID_NRW BIT(31) +/* MPAMF_AIDR - MPAM architecture ID register */ +#define MPAMF_AIDR_ARCH_MAJOR_REV GENMASK(7, 4) +#define MPAMF_AIDR_ARCH_MINOR_REV GENMASK(3, 0) + /* MPAMF_IDR */ #define MPAMF_IDR_PMG_MAX_MASK ((BIT(8) - 1) << 16) #define MPAMF_IDR_PMG_MAX_SHIFT 16 -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-43855
by Li Nan 12 Oct '24

12 Oct '24

Li Nan (1): md: ensure child flush IO does not affect origin bio->bi_status Yu Kuai (1): md: Remove flush handling drivers/md/md.h | 10 ---- drivers/md/md.c | 134 +++++++++++------------------------------------- 2 files changed, 31 insertions(+), 113 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP1] bpf: Remove tst_run from lwt_seg6local_prog_ops.
by Liu Jian 12 Oct '24

12 Oct '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit c13fda93aca118b8e5cd202e339046728ee7dddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX44 CVE: CVE-2024-46754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL. Suggested-by: Martin KaFai Lau <martin.lau(a)linux.dev> Reported-by: syzbot+608a2acde8c5a101d07d(a)syzkaller.appspotmail.com Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.") Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 8a61914d35c5..3cdca0279b2d 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -9881,7 +9881,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = { }; const struct bpf_prog_ops lwt_seg6local_prog_ops = { - .test_run = bpf_prog_test_run_skb, }; const struct bpf_verifier_ops cg_sock_verifier_ops = { -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-43855
by Li Nan 12 Oct '24

12 Oct '24

Li Nan (1): md: ensure child flush IO does not affect origin bio->bi_status Mikulas Patocka (1): md: fix a crash in mempool_free Yu Kuai (1): md: Remove flush handling drivers/md/md.h | 10 ---- drivers/md/md.c | 137 ++++++++++++------------------------------------ 2 files changed, 34 insertions(+), 113 deletions(-) -- 2.39.2

2 4

[PATCH OLK-5.10] md/raid1: don't free conf on raid0_run failure
by Zheng Qixing 12 Oct '24

12 Oct '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.11-rc1 commit 17f91ac0843b50462a9c9c8f18df962338bd3db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUQ97 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The core md code calls the ->free method which already frees conf. Fixes: 07f1a6850c5d ("md/raid1: fail run raid1 array when active disk less than one") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240604172607.3185916-3-hch@lst.de Conflicts: drivers/md/raid1.c [The conflicts here are due to inconsistencies in the context.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 4584fba5a010..333b611aa152 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -3069,7 +3069,6 @@ static struct r1conf *setup_conf(struct mddev *mddev) return ERR_PTR(err); } -static void raid1_free(struct mddev *mddev, void *priv); static int raid1_run(struct mddev *mddev) { struct r1conf *conf; @@ -3128,8 +3127,7 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(&conf->thread); - ret = -EINVAL; - goto abort; + return -EINVAL; } if (conf->raid_disks - mddev->degraded == 1) @@ -3162,14 +3160,8 @@ static int raid1_run(struct mddev *mddev) } ret = md_integrity_register(mddev); - if (ret) { + if (ret) md_unregister_thread(&mddev->thread); - goto abort; - } - return 0; - -abort: - raid1_free(mddev, conf); return ret; } -- 2.39.2

2 1

[PATCH OLK-5.10] fix: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAWGUW CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAWIA2 CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWIA2 CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10] fix: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWGUW CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[openeuler:openEuler-1.0-LTS 4034/23827] fs/file.c:368:17: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: 72ee1590dc860d0091f8e7714b467be5878d51ae [4034/23827] cgroups: Resource controller for open files config: x86_64-randconfig-123-20241012 (https://download.01.org/0day-ci/archive/20241012/202410120916.m0AjmQWh-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410120916.m0AjmQWh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410120916.m0AjmQWh-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) fs/file.c:339:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file **old_fds @@ got struct file [noderef] <asn:4> **fd @@ fs/file.c:339:17: sparse: expected struct file **old_fds fs/file.c:339:17: sparse: got struct file [noderef] <asn:4> **fd fs/file.c:340:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file **new_fds @@ got struct file [noderef] <asn:4> **fd @@ fs/file.c:340:17: sparse: expected struct file **new_fds fs/file.c:340:17: sparse: got struct file [noderef] <asn:4> **fd >> fs/file.c:368:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file **[assigned] new_fds @@ got struct file [noderef] <asn:4> **fd @@ fs/file.c:368:17: sparse: expected struct file **[assigned] new_fds fs/file.c:368:17: sparse: got struct file [noderef] <asn:4> **fd fs/file.c:409:54: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct file *file @@ got struct file [noderef] <asn:4> *[assigned] __ret @@ fs/file.c:409:54: sparse: expected struct file *file fs/file.c:409:54: sparse: got struct file [noderef] <asn:4> *[assigned] __ret fs/file.c:477:28: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct fdtable [noderef] <asn:4> *fdt @@ got struct fdtable * @@ fs/file.c:477:28: sparse: expected struct fdtable [noderef] <asn:4> *fdt fs/file.c:477:28: sparse: got struct fdtable * fs/file.c:666:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file *file @@ got struct file [noderef] <asn:4> * @@ fs/file.c:666:14: sparse: expected struct file *file fs/file.c:666:14: sparse: got struct file [noderef] <asn:4> * fs/file.c:701:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file *file @@ got struct file [noderef] <asn:4> * @@ fs/file.c:701:30: sparse: expected struct file *file fs/file.c:701:30: sparse: got struct file [noderef] <asn:4> * fs/file.c:868:16: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file *tofree @@ got struct file [noderef] <asn:4> * @@ fs/file.c:868:16: sparse: expected struct file *tofree fs/file.c:868:16: sparse: got struct file [noderef] <asn:4> * fs/file.o: warning: objtool: alloc_fdtable()+0x2d: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __fget()+0x2c3: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __put_unused_fd()+0x56: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __close_fd()+0x63: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: do_dup2()+0x62: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: iterate_fd.part.0()+0x187: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: expand_fdtable.constprop.0()+0x108: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: expand_files()+0x145: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: ksys_dup3()+0x148: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __se_sys_dup2()+0x1da: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: dup_fd()+0x87e: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __alloc_fd()+0x39e: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __fd_install()+0xb1: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: do_close_on_exec()+0x9d: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: set_close_on_exec()+0x97: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: get_close_on_exec()+0x141: sibling call from callable instruction with modified stack frame vim +368 fs/file.c 300 301 spin_lock(&oldf->file_lock); 302 old_fdt = files_fdtable(oldf); 303 open_files = count_open_files(old_fdt); 304 305 /* 306 * Check whether we need to allocate a larger fd array and fd set. 307 */ 308 while (unlikely(open_files > new_fdt->max_fds)) { 309 spin_unlock(&oldf->file_lock); 310 311 if (new_fdt != &newf->fdtab) 312 __free_fdtable(new_fdt); 313 314 new_fdt = alloc_fdtable(open_files - 1); 315 if (!new_fdt) { 316 *errorp = -ENOMEM; 317 goto out_release; 318 } 319 320 /* beyond sysctl_nr_open; nothing to do */ 321 if (unlikely(new_fdt->max_fds < open_files)) { 322 __free_fdtable(new_fdt); 323 *errorp = -EMFILE; 324 goto out_release; 325 } 326 327 /* 328 * Reacquire the oldf lock and a pointer to its fd table 329 * who knows it may have a new bigger fd table. We need 330 * the latest pointer. 331 */ 332 spin_lock(&oldf->file_lock); 333 old_fdt = files_fdtable(oldf); 334 open_files = count_open_files(old_fdt); 335 } 336 337 copy_fd_bitmaps(new_fdt, old_fdt, open_files); 338 339 old_fds = old_fdt->fd; 340 new_fds = new_fdt->fd; 341 342 for (i = open_files; i != 0; i--) { 343 struct file *f = *old_fds++; 344 if (f) { 345 get_file(f); 346 } else { 347 /* 348 * The fd may be claimed in the fd bitmap but not yet 349 * instantiated in the files array if a sibling thread 350 * is partway through open(). So make sure that this 351 * fd is available to the new process. 352 */ 353 __clear_open_fd(open_files - i, new_fdt); 354 } 355 rcu_assign_pointer(*new_fds++, f); 356 } 357 spin_unlock(&oldf->file_lock); 358 359 /* clear the remainder */ 360 memset(new_fds, 0, (new_fdt->max_fds - open_files) * sizeof(struct file *)); 361 362 rcu_assign_pointer(newf->fdt, new_fdt); 363 #ifdef CONFIG_CGROUP_FILES 364 if (!files_cgroup_alloc_fd(newf, files_cgroup_count_fds(newf))) 365 return newf; 366 367 /* could not get enough FD resources. Need to clean up. */ > 368 new_fds = new_fdt->fd; 369 for (i = open_files; i != 0; i--) { 370 struct file *f = *new_fds++; 371 372 if (f) 373 fput(f); 374 } 375 if (new_fdt != &newf->fdtab) 376 __free_fdtable(new_fdt); 377 *errorp = -EMFILE; 378 #else 379 return newf; 380 #endif 381 382 out_release: 383 #ifdef CONFIG_CGROUP_FILES 384 files_cgroup_remove(newf); 385 #endif 386 kmem_cache_free(files_cachep, newf); 387 out: 388 return NULL; 389 } 390 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20575/23827] drivers/char/hw_random/zhaoxin-rng.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 12 Oct '24

12 Oct '24

Hi leoliuoc, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: 050ff2f361bf733d1dde505dea8b0f5ecb23507c [20575/23827] hwrng: Add Zhaoxin rng driver config: x86_64-buildonly-randconfig-003-20241010 (https://download.01.org/0day-ci/archive/20241012/202410121153.VMwUxyGS-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410121153.VMwUxyGS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410121153.VMwUxyGS-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/char/hw_random/zhaoxin-rng.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 10655/14350] drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: .text: unexpected end of section
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: 241ad43fe7e9c24d5ba4cdd1ec22e731cdd22d14 [10655/14350] Compiler: Add clang's PGO support for kernel. config: x86_64-randconfig-121-20241012 (https://download.01.org/0day-ci/archive/20241012/202410120718.Pcw8jZBK-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410120718.Pcw8jZBK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410120718.Pcw8jZBK-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: .text: unexpected end of section Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17755/23827] drivers/dax/kmem.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: be13c6c633412a576f1a666c07dbaae19331b0fc [17755/23827] Intel: device-dax: "Hotplug" persistent memory for use like normal RAM config: x86_64-buildonly-randconfig-003-20241010 (https://download.01.org/0day-ci/archive/20241012/202410120614.DTc2PtdL-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410120614.DTc2PtdL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410120614.DTc2PtdL-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/dax/kmem.c:4: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/dax/kmem.c:17:5: warning: no previous prototype for function 'dev_dax_kmem_probe' [-Wmissing-prototypes] 17 | int dev_dax_kmem_probe(struct device *dev) | ^ drivers/dax/kmem.c:17:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 17 | int dev_dax_kmem_probe(struct device *dev) | ^ | static 2 warnings generated. >> drivers/dax/kmem.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-46826
by Gu Bowen 11 Oct '24

11 Oct '24

Fix CVE-2024-46826 Alexey Dobriyan (1): ELF: fix kernel.randomize_va_space double read Gu Bowen (1): ELF: Fix mixed declarations and code of "snapshot_randomize_va_space" fs/binfmt_elf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 5957/23827] include/linux/uaccess.h:112:17: warning: 'bind' may be used uninitialized
by kernel test robot 11 Oct '24

11 Oct '24

Hi Jean-Philippe, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: 2dd8345826607c5d2d6528de872118da554015b6 [5957/23827] vfio: Add support for Shared Virtual Addressing config: arm64-randconfig-004-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111943.njyjH1kd-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111943.njyjH1kd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111943.njyjH1kd-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from drivers/vfio/vfio_iommu_type1.c:31: include/linux/module.h:134:13: warning: 'init_module' specifies less restrictive attribute than its target 'vfio_iommu_type1_init': 'cold' [-Wmissing-attributes] 134 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2222:1: note: in expansion of macro 'module_init' 2222 | module_init(vfio_iommu_type1_init); | ^~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2212:19: note: 'init_module' target declared here 2212 | static int __init vfio_iommu_type1_init(void) | ^~~~~~~~~~~~~~~~~~~~~ include/linux/module.h:140:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'vfio_iommu_type1_cleanup': 'cold' [-Wmissing-attributes] 140 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2223:1: note: in expansion of macro 'module_exit' 2223 | module_exit(vfio_iommu_type1_cleanup); | ^~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2217:20: note: 'cleanup_module' target declared here 2217 | static void __exit vfio_iommu_type1_cleanup(void) | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compat.h:19, from drivers/vfio/vfio_iommu_type1.c:27: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_bind_process' at drivers/vfio/vfio_iommu_type1.c:1933:6: include/linux/uaccess.h:112:17: warning: 'params' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/asm-generic/div64.h:25, from ./arch/arm64/include/generated/asm/div64.h:1, from include/linux/math64.h:6, from include/linux/time64.h:5, from include/linux/compat_time.h:6, from include/linux/compat.h:10: include/linux/kasan-checks.h: In function 'vfio_iommu_type1_bind_process': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:1920:46: note: 'params' declared here 1920 | struct vfio_iommu_type1_bind_process params; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_unbind_process' at drivers/vfio/vfio_iommu_type1.c:2021:6: include/linux/uaccess.h:112:17: warning: 'params' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_unbind_process': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2014:46: note: 'params' declared here 2014 | struct vfio_iommu_type1_bind_process params; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2084:7: include/linux/uaccess.h:112:17: warning: 'info' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2080:46: note: 'info' declared here 2080 | struct vfio_iommu_type1_info info; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2104:7: include/linux/uaccess.h:112:17: warning: 'map' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2098:49: note: 'map' declared here 2098 | struct vfio_iommu_type1_dma_map map; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2118:7: include/linux/uaccess.h:112:17: warning: 'unmap' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2113:51: note: 'unmap' declared here 2113 | struct vfio_iommu_type1_dma_unmap unmap; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2136:7: >> include/linux/uaccess.h:112:17: warning: 'bind' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2132:46: note: 'bind' declared here 2132 | struct vfio_iommu_type1_bind bind; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2155:7: >> include/linux/uaccess.h:112:17: warning: 'bind' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2151:46: note: 'bind' declared here 2151 | struct vfio_iommu_type1_bind bind; | ^~~~ vim +/bind +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 d597580d373774 Al Viro 2017-03-20 124 #ifdef INLINE_COPY_TO_USER d597580d373774 Al Viro 2017-03-20 125 static inline unsigned long d597580d373774 Al Viro 2017-03-20 126 _copy_to_user(void __user *to, const void *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 127 { 9c5f6908de03a4 Al Viro 2017-06-29 128 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 129 if (access_ok(to, n)) { 9c5f6908de03a4 Al Viro 2017-06-29 130 kasan_check_read(from, n); d597580d373774 Al Viro 2017-03-20 131 n = raw_copy_to_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 132 } d597580d373774 Al Viro 2017-03-20 133 return n; d597580d373774 Al Viro 2017-03-20 134 } d597580d373774 Al Viro 2017-03-20 135 #else d597580d373774 Al Viro 2017-03-20 136 extern unsigned long d597580d373774 Al Viro 2017-03-20 137 _copy_to_user(void __user *, const void *, unsigned long); d597580d373774 Al Viro 2017-03-20 138 #endif d597580d373774 Al Viro 2017-03-20 139 d597580d373774 Al Viro 2017-03-20 140 static __always_inline unsigned long __must_check d597580d373774 Al Viro 2017-03-20 141 copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 142 { b0377fedb65280 Al Viro 2017-06-29 143 if (likely(check_copy_size(to, n, false))) d597580d373774 Al Viro 2017-03-20 @144 n = _copy_from_user(to, from, n); d597580d373774 Al Viro 2017-03-20 145 return n; d597580d373774 Al Viro 2017-03-20 146 } d597580d373774 Al Viro 2017-03-20 147 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29971/30000] drivers/net/ipvlan/ipvlan_main.c:431:19: warning: variable 'old_prog' set but not used
by kernel test robot 11 Oct '24

11 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 33a5644b70e15c265ec94eb3726216950a1476ef commit: 373ce97bdbb6378acf984656798aff4bb706a447 [29971/30000] ipvlan: support use xdp native mode config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20241011/202410111924.i3Aw2F5F-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111924.i3Aw2F5F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111924.i3Aw2F5F-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ipvlan/ipvlan_main.c:431:19: warning: variable 'old_prog' set but not used [-Wunused-but-set-variable] 431 | struct bpf_prog *old_prog; | ^ 1 warning generated. vim +/old_prog +431 drivers/net/ipvlan/ipvlan_main.c 426 427 static int ipvlan_xdp_set(struct net_device *dev, struct bpf_prog *prog, 428 struct netlink_ext_ack *extack) 429 { 430 struct ipvl_dev *priv = netdev_priv(dev); > 431 struct bpf_prog *old_prog; 432 433 old_prog = rtnl_dereference(priv->xdp_prog); 434 rcu_assign_pointer(priv->xdp_prog, prog); 435 return 0; 436 } 437 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 2962/23827] fs/pstore/inode.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 11 Oct '24

11 Oct '24

Hi Kees, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: 68bc9e8812a24c4a04fd18a9e1ede123eaff0420 [2962/23827] pstore: Centralize init/exit routines config: x86_64-buildonly-randconfig-005-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111843.JeVyH5TZ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111843.JeVyH5TZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111843.JeVyH5TZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/pstore/inode.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] fix: fix version showed in ethtool
by s00851154 11 Oct '24

11 Oct '24

From: Shi Jing <shijing34(a)huawei.com> Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10 V1] sched/fair: Fix the condition in overload_clear
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWDO4 ----------------------------------------- In the overload_clear function, there is a bug when setting the overload_cpus, that is, when the steal_task feature is globally enabled and rq->cfs.h_nr_running is less than 2, the need_clear should be set to true. Fixes: 433c0b725642 ("sched/fair: Count the number of tasks marked as steal_task on cfs_rq") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 38841d1d640a..a518d636f07f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -4492,11 +4492,10 @@ static void overload_clear(struct rq *rq) if (!steal_enabled()) return; - if (!group_steal_used() && rq->cfs.h_nr_running >= 2) - return; + if (rq->cfs.h_nr_running < 2) + need_clear = true; - if (group_steal_used() && - (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) + if (group_steal_used() && rq->cfs.steal_h_nr_running < 1) need_clear = true; if (!need_clear) -- 2.25.1

2 1

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 11 Oct '24

11 Oct '24

From: Shi Jing <shijing34(a)huawei.com> Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10 V1] sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWDPS ----------------------------------------- It would be more practical to put the statistics of h_nr_running and steal_h_nr_running in the per-cpu column. Fixes: 1f9456c873b7 ("sched/debug: Add h_nr_running/steal_h_nr_running in sched_debug") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/debug.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index ff2d6dc59c14..4275398bc713 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -594,11 +594,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq) SEQ_printf(m, " .%-30s: %d\n", "nr_spread_over", cfs_rq->nr_spread_over); SEQ_printf(m, " .%-30s: %d\n", "nr_running", cfs_rq->nr_running); -#ifdef CONFIG_SCHED_STEAL - SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", cfs_rq->h_nr_running); - SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", - cfs_rq->steal_h_nr_running); -#endif SEQ_printf(m, " .%-30s: %ld\n", "load", cfs_rq->load.weight); #ifdef CONFIG_SMP SEQ_printf(m, " .%-30s: %lu\n", "load_avg", @@ -714,6 +709,11 @@ do { \ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", #x, SPLIT_NS(rq->x)) P(nr_running); +#ifdef CONFIG_SCHED_STEAL + SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", rq->cfs.h_nr_running); + SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", + rq->cfs.steal_h_nr_running); +#endif P(nr_switches); P(nr_uninterruptible); PN(next_balance); -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2024-46826
by Gu Bowen 11 Oct '24

11 Oct '24

Fix CVE-2024-46826 Alexey Dobriyan (1): ELF: fix kernel.randomize_va_space double read Gu Bowen (1): ELF: Fix mixed declarations and code of "snapshot_randomize_va_space" fs/binfmt_elf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 20512/23827] drivers/md/md.o: warning: objtool: md_seq_show()+0x1087: unreachable instruction
by kernel test robot 11 Oct '24

11 Oct '24

Hi Logan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: a89f484219c9ea217d26908f16037d1ab55d4f17 [20512/23827] md: Ensure resync is reported after it starts config: x86_64-randconfig-001-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111657.HXras3Wj-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111657.HXras3Wj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111657.HXras3Wj-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/md/md.c:49: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/md.c:320:6: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 320 | int cpu; | ^ drivers/md/md.c:2231:24: warning: variable 'bi_rdev' set but not used [-Wunused-but-set-variable] 2231 | struct blk_integrity *bi_rdev; | ^ 3 warnings generated. >> drivers/md/md.o: warning: objtool: md_seq_show()+0x1087: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1 0/2] bugfix for cgroup steal task
by Cheng Yu 11 Oct '24

11 Oct '24

bugfix for cgroup steal task Cheng Yu (2): sched/fair: Fix the condition in overload_clear sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug kernel/sched/debug.c | 10 +++++----- kernel/sched/fair.c | 7 +++---- 2 files changed, 8 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 V1 1/2] sched/fair: Fix the condition in overload_clear
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQWPQ ----------------------------------------- In the overload_clear function, there is a bug when setting the overload_cpus, that is, when the steal_task feature is globally enabled and rq->cfs.h_nr_running is less than 2, the need_clear should be set to true. Fixes: 433c0b725642 ("sched/fair: Count the number of tasks marked as steal_task on cfs_rq") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 38841d1d640a..a518d636f07f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -4492,11 +4492,10 @@ static void overload_clear(struct rq *rq) if (!steal_enabled()) return; - if (!group_steal_used() && rq->cfs.h_nr_running >= 2) - return; + if (rq->cfs.h_nr_running < 2) + need_clear = true; - if (group_steal_used() && - (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) + if (group_steal_used() && rq->cfs.steal_h_nr_running < 1) need_clear = true; if (!need_clear) -- 2.25.1

2 1

[openeuler:OLK-6.6 777/14350] arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B
by kernel test robot 11 Oct '24

11 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: db5bb24abc8dd120fd81b7ce21819e96578d011e [777/14350] LoongArch: Old BPI compatibility config: loongarch-randconfig-r062-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111529.bqXXUCAv-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111529.bqXXUCAv-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B vim +439 arch/loongarch/kernel/legacy_boot.c 423 424 static struct fwnode_handle * __init parse_isa_base(u64 *cpu_addr) 425 { 426 struct device_node *np; 427 const __be32 *ranges = NULL; 428 int len; 429 struct device_node *node; 430 431 for_each_node_by_name(np, "isa") { 432 node = of_node_get(np); 433 434 if (!node) 435 break; 436 437 ranges = of_get_property(node, "ranges", &len); 438 > 439 if (!ranges || (ranges && len > 0)) 440 break; 441 } 442 if (ranges) { 443 ranges += 2; 444 *cpu_addr = of_translate_address(np, ranges); 445 return &np->fwnode; 446 } 447 448 return NULL; 449 } 450 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1 2/2] sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQWPQ ----------------------------------------- It would be more practical to put the statistics of h_nr_running and steal_h_nr_running in the per-cpu column. Fixes: 1f9456c873b7 ("sched/debug: Add h_nr_running/steal_h_nr_running in sched_debug") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/debug.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index ff2d6dc59c14..4275398bc713 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -594,11 +594,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq) SEQ_printf(m, " .%-30s: %d\n", "nr_spread_over", cfs_rq->nr_spread_over); SEQ_printf(m, " .%-30s: %d\n", "nr_running", cfs_rq->nr_running); -#ifdef CONFIG_SCHED_STEAL - SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", cfs_rq->h_nr_running); - SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", - cfs_rq->steal_h_nr_running); -#endif SEQ_printf(m, " .%-30s: %ld\n", "load", cfs_rq->load.weight); #ifdef CONFIG_SMP SEQ_printf(m, " .%-30s: %lu\n", "load_avg", @@ -714,6 +709,11 @@ do { \ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", #x, SPLIT_NS(rq->x)) P(nr_running); +#ifdef CONFIG_SCHED_STEAL + SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", rq->cfs.h_nr_running); + SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", + rq->cfs.steal_h_nr_running); +#endif P(nr_switches); P(nr_uninterruptible); PN(next_balance); -- 2.25.1

1 0