- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 20947/21930] net/netfilter/.tmp_nf_nat_proto.o: warning: objtool: missing symbol for section .text
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 25bf6ba385a44e446068067e861e1b843f6174e2 commit: 83abe3a3b85762720192809ac8695ff9255cfd23 [20947/21930] netfilter: nat: remove csum_recalc hook config: x86_64-buildonly-randconfig-004-20240323 (https://download.01.org/0day-ci/archive/20240323/202403232115.AU4CMSAJ-lkp@…) compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403232115.AU4CMSAJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403232115.AU4CMSAJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/netfilter/.tmp_nf_nat_proto.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 14628/30000] ld.lld: error: undefined symbol: proc_mm_idle_operations
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 459341c4b4845b283c7a884e6a0dc4bd8cdb89e6 commit: 4232d9005401d839ceeb1a02da34749b6dab1376 [14628/30000] etmem: add CONFIG_ETMEM macro definition for etmem feature config: x86_64-randconfig-072-20240323 (https://download.01.org/0day-ci/archive/20240323/202403231943.bTlhzqcv-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403231943.bTlhzqcv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403231943.bTlhzqcv-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: proc_mm_idle_operations >>> referenced by base.c >>> proc/base.o:(tid_base_stuff) in archive fs/built-in.a >>> referenced by base.c >>> proc/base.o:(tgid_base_stuff) in archive fs/built-in.a -- >> ld.lld: error: undefined symbol: proc_mm_swap_operations >>> referenced by base.c >>> proc/base.o:(tid_base_stuff) in archive fs/built-in.a >>> referenced by base.c >>> proc/base.o:(tgid_base_stuff) in archive fs/built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1770/6857] kernel/livepatch/core.c:1587:12: warning: no previous prototype for function 'arch_klp_check_activeness_func'
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 1b4212c630731d88b07d5b6e28ecaff1a76d3839 commit: 583e6e55fb6aa193b1a82909069e8028c5d5653d [1770/6857] livepatch/x86: Support livepatch without ftrace config: x86_64-randconfig-015-20240323 (https://download.01.org/0day-ci/archive/20240323/202403231944.DuQR0aQA-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403231944.DuQR0aQA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403231944.DuQR0aQA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/livepatch/core.c:1587:12: warning: no previous prototype for function 'arch_klp_check_activeness_func' [-Wmissing-prototypes] 1587 | int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, | ^ kernel/livepatch/core.c:1587:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1587 | int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, | ^ | static kernel/livepatch/core.c:1811:14: warning: no previous prototype for function 'arch_klp_mem_alloc' [-Wmissing-prototypes] 1811 | void __weak *arch_klp_mem_alloc(size_t size) | ^ kernel/livepatch/core.c:1811:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1811 | void __weak *arch_klp_mem_alloc(size_t size) | ^ | static kernel/livepatch/core.c:1816:13: warning: no previous prototype for function 'arch_klp_mem_free' [-Wmissing-prototypes] 1816 | void __weak arch_klp_mem_free(void *mem) | ^ kernel/livepatch/core.c:1816:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1816 | void __weak arch_klp_mem_free(void *mem) | ^ | static 3 warnings generated. vim +/arch_klp_check_activeness_func +1587 kernel/livepatch/core.c 1586 > 1587 int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, 1588 klp_add_func_t add_func, 1589 struct list_head *func_list) 1590 { 1591 int ret; 1592 unsigned long func_addr = 0; 1593 unsigned long func_size; 1594 struct klp_func_node *func_node = NULL; 1595 unsigned long old_func = (unsigned long)func->old_func; 1596 1597 func_node = func->func_node; 1598 /* Check func address in stack */ 1599 if (enable) { 1600 if (func->patched || func->force == KLP_ENFORCEMENT) 1601 return 0; 1602 /* 1603 * When enable, checking the currently active functions. 1604 */ 1605 if (list_empty(&func_node->func_stack)) { 1606 /* 1607 * Not patched on this function [the origin one] 1608 */ 1609 func_addr = old_func; 1610 func_size = func->old_size; 1611 } else { 1612 /* 1613 * Previously patched function [the active one] 1614 */ 1615 struct klp_func *prev; 1616 1617 prev = list_first_or_null_rcu(&func_node->func_stack, 1618 struct klp_func, stack_node); 1619 func_addr = (unsigned long)prev->new_func; 1620 func_size = prev->new_size; 1621 } 1622 /* 1623 * When preemption is disabled and the replacement area 1624 * does not contain a jump instruction, the migration 1625 * thread is scheduled to run stop machine only after the 1626 * execution of instructions to be replaced is complete. 1627 */ 1628 if (IS_ENABLED(CONFIG_PREEMPTION) || 1629 (func->force == KLP_NORMAL_FORCE) || 1630 arch_check_jump_insn(func_addr)) { 1631 ret = add_func(func_list, func_addr, func_size, 1632 func->old_name, func->force); 1633 if (ret) 1634 return ret; 1635 if (func_addr != old_func) { 1636 ret = add_func(func_list, old_func, KLP_MAX_REPLACE_SIZE, 1637 func->old_name, func->force); 1638 if (ret) 1639 return ret; 1640 } 1641 } 1642 } else { 1643 #ifdef CONFIG_PREEMPTION 1644 /* 1645 * No scheduling point in the replacement instructions. Therefore, 1646 * when preemption is not enabled, atomic execution is performed 1647 * and these instructions will not appear on the stack. 1648 */ 1649 if (list_is_singular(&func_node->func_stack)) { 1650 func_addr = old_func; 1651 func_size = func->old_size; 1652 } else { 1653 struct klp_func *prev; 1654 1655 prev = list_first_or_null_rcu( 1656 &func_node->func_stack, 1657 struct klp_func, stack_node); 1658 func_addr = (unsigned long)prev->new_func; 1659 func_size = prev->new_size; 1660 } 1661 ret = add_func(func_list, func_addr, 1662 func_size, func->old_name, 0); 1663 if (ret) 1664 return ret; 1665 if (func_addr != old_func) { 1666 ret = add_func(func_list, old_func, KLP_MAX_REPLACE_SIZE, 1667 func->old_name, 0); 1668 if (ret) 1669 return ret; 1670 } 1671 #endif 1672 1673 func_addr = (unsigned long)func->new_func; 1674 func_size = func->new_size; 1675 ret = add_func(func_list, func_addr, 1676 func_size, func->old_name, 0); 1677 if (ret) 1678 return ret; 1679 } 1680 return 0; 1681 } 1682 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3338/6857] crypto/asymmetric_keys/pgp_preload.c:63:10: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 1b4212c630731d88b07d5b6e28ecaff1a76d3839 commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [3338/6857] KEYS: Provide a function to load keys from a PGP keyring blob config: x86_64-randconfig-071-20240323 (https://download.01.org/0day-ci/archive/20240323/202403231835.9j4F9Ajt-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403231835.9j4F9Ajt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403231835.9j4F9Ajt-lkp@intel.com/ All warnings (new ones prefixed by >>): crypto/asymmetric_keys/pgp_preload.c:25:27: error: field has incomplete type 'struct pgp_parse_context' 25 | struct pgp_parse_context pgp; | ^ crypto/asymmetric_keys/pgp_preload.c:25:9: note: forward declaration of 'struct pgp_parse_context' 25 | struct pgp_parse_context pgp; | ^ >> crypto/asymmetric_keys/pgp_preload.c:63:10: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:63:25: error: variable has incomplete type 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:63:10: note: forward declaration of 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:107:36: error: use of undeclared identifier 'PGP_PKT_PUBLIC_KEY' 107 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); | ^ crypto/asymmetric_keys/pgp_preload.c:112:8: error: call to undeclared function 'pgp_parse_packets'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 112 | ret = pgp_parse_packets(pgpdata, pgpdatalen, &ctx.pgp); | ^ >> crypto/asymmetric_keys/pgp_preload.c:101:12: warning: no previous prototype for function 'preload_pgp_keys' [-Wmissing-prototypes] 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ crypto/asymmetric_keys/pgp_preload.c:101:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ | static 2 warnings and 4 errors generated. -- crypto/asymmetric_keys/pgp_public_key.c:37:27: error: field has incomplete type 'struct pgp_parse_context' 37 | struct pgp_parse_context pgp; | ^ crypto/asymmetric_keys/pgp_public_key.c:37:9: note: forward declaration of 'struct pgp_parse_context' 37 | struct pgp_parse_context pgp; | ^ crypto/asymmetric_keys/pgp_public_key.c:50:18: warning: declaration of 'struct pgp_parse_pubkey' will not be visible outside of this function [-Wvisibility] 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:63:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 63 | kenter(""); | ^ crypto/asymmetric_keys/pgp_public_key.c:65:10: error: incomplete definition of type 'struct pgp_parse_pubkey' 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:50:18: note: forward declaration of 'struct pgp_parse_pubkey' 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:65:22: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^ crypto/asymmetric_keys/pgp_public_key.c:67:9: error: call to undeclared function 'mpi_key_length'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 67 | ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); | ^ crypto/asymmetric_keys/pgp_public_key.c:87:25: error: incomplete definition of type 'struct pgp_parse_pubkey' 87 | digest_putc(digest, pgp->version); | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:50:18: note: forward declaration of 'struct pgp_parse_pubkey' 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:89:11: error: incomplete definition of type 'struct pgp_parse_pubkey' 89 | a32 = pgp->creation_time; | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:50:18: note: forward declaration of 'struct pgp_parse_pubkey' 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:95:9: error: incomplete definition of type 'struct pgp_parse_pubkey' 95 | if (pgp->version < PGP_KEY_VERSION_4) { | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:50:18: note: forward declaration of 'struct pgp_parse_pubkey' 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:95:21: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 95 | if (pgp->version < PGP_KEY_VERSION_4) { | ^ crypto/asymmetric_keys/pgp_public_key.c:98:10: error: incomplete definition of type 'struct pgp_parse_pubkey' 98 | if (pgp->expires_at) | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:50:18: note: forward declaration of 'struct pgp_parse_pubkey' 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:99:14: error: incomplete definition of type 'struct pgp_parse_pubkey' 99 | a16 = (pgp->expires_at - pgp->creation_time) / 86400UL; | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:50:18: note: forward declaration of 'struct pgp_parse_pubkey' 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:99:32: error: incomplete definition of type 'struct pgp_parse_pubkey' 99 | a16 = (pgp->expires_at - pgp->creation_time) / 86400UL; | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:50:18: note: forward declaration of 'struct pgp_parse_pubkey' 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:106:25: error: incomplete definition of type 'struct pgp_parse_pubkey' 106 | digest_putc(digest, pgp->pubkey_algo); | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:50:18: note: forward declaration of 'struct pgp_parse_pubkey' 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:115:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 115 | kleave(" = %d", ret); | ^ crypto/asymmetric_keys/pgp_public_key.c:123:16: warning: declaration of 'struct pgp_parse_pubkey' will not be visible outside of this function [-Wvisibility] 123 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:134:30: error: incomplete definition of type 'struct pgp_parse_pubkey' 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:123:16: note: forward declaration of 'struct pgp_parse_pubkey' 123 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:134:42: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^ crypto/asymmetric_keys/pgp_public_key.c:150:36: error: incompatible pointer types passing 'struct pgp_parse_pubkey *' to parameter of type 'struct pgp_parse_pubkey *' [-Werror,-Wincompatible-pointer-types] 150 | ret = pgp_calc_pkey_keyid(digest, pgp, pub); | ^~~ crypto/asymmetric_keys/pgp_public_key.c:50:36: note: passing argument to parameter 'pgp' here 50 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:191:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 191 | kleave(" = %d", ret); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:199:12: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:199:27: error: variable has incomplete type 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:199:12: note: forward declaration of 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ fatal error: too many errors emitted, stopping now [-ferror-limit=] 3 warnings and 20 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for DRM_I915_DEBUG_GEM Depends on [n]: HAS_IOMEM [=y] && DRM_I915 [=y] && EXPERT [=y] && DRM_I915_WERROR [=n] Selected by [y]: - DRM_I915_DEBUG [=y] && HAS_IOMEM [=y] && DRM_I915 [=y] && EXPERT [=y] && !COMPILE_TEST [=n] WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +63 crypto/asymmetric_keys/pgp_preload.c 58 59 /* 60 * Extract a public key or subkey from the PGP stream. 61 */ 62 static int __init found_pgp_key(struct pgp_parse_context *context, > 63 enum pgp_packet_tag type, u8 headerlen, 64 const u8 *data, size_t datalen) 65 { 66 struct preload_pgp_keys_context *ctx = 67 container_of(context, struct preload_pgp_keys_context, pgp); 68 int ret; 69 70 if (ctx->found_key) { 71 ctx->key_end = data - headerlen; 72 ret = create_pgp_key(ctx); 73 if (ret < 0) 74 return ret; 75 } 76 77 ctx->key_start = data - headerlen; 78 ctx->found_key = true; 79 return 0; 80 } 81 82 /** 83 * preload_pgp_keys - Load keys from a PGP keyring blob 84 * @pgpdata: The PGP keyring blob containing the keys. 85 * @pgpdatalen: The size of the @pgpdata blob. 86 * @keyring: The keyring to add the new keys to. 87 * 88 * Preload a pack of keys from a PGP keyring blob. 89 * 90 * The keys have their descriptions generated from the user ID and fingerprint 91 * in the PGP stream. Since keys can be matched on their key IDs independently 92 * of the key description, the description is mostly irrelevant apart from the 93 * fact that keys of the same description displace one another from a keyring. 94 * 95 * The caller should override the current creds if they want the keys to be 96 * owned by someone other than the current process's owner. Keys will not be 97 * accounted towards the owner's quota. 98 * 99 * This function may only be called whilst the kernel is booting. 100 */ > 101 int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, 102 struct key *keyring) 103 { 104 struct preload_pgp_keys_context ctx; 105 int ret; 106 107 ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); 108 ctx.pgp.process_packet = found_pgp_key; 109 ctx.keyring = make_key_ref(keyring, 1); 110 ctx.found_key = false; 111 112 ret = pgp_parse_packets(pgpdata, pgpdatalen, &ctx.pgp); 113 if (ret < 0) 114 return ret; 115 116 if (ctx.found_key) { 117 ctx.key_end = pgpdata + pgpdatalen; 118 return create_pgp_key(&ctx); 119 } 120 return 0; 121 } 122 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 10038/30000] ld.lld: error: undefined symbol: sk_msg_alloc
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 459341c4b4845b283c7a884e6a0dc4bd8cdb89e6 commit: e9ce37bbceb2779c0015fcac54cc8df7a2ec8b76 [10038/30000] tcp_comp: implement sendmsg for tcp compression config: x86_64-randconfig-001-20240323 (https://download.01.org/0day-ci/archive/20240323/202403231836.Ys5ZDZ5J-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403231836.Ys5ZDZ5J-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403231836.Ys5ZDZ5J-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: sk_msg_alloc >>> referenced by tcp_comp.c:148 (net/ipv4/tcp_comp.c:148) >>> ipv4/tcp_comp.o:(tcp_comp_sendmsg) in archive net/built-in.a -- >> ld.lld: error: undefined symbol: sk_msg_trim >>> referenced by tcp_comp.c:236 (net/ipv4/tcp_comp.c:236) >>> ipv4/tcp_comp.o:(tcp_comp_sendmsg) in archive net/built-in.a Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 25152/30000] drivers/net/ub/dev/ubl.c:92:1: warning: 'static' is not at beginning of declaration
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 459341c4b4845b283c7a884e6a0dc4bd8cdb89e6 commit: eb44201ee79cffdcf1b16759a54940dca047aae5 [25152/30000] ubl: add CONFIG_UBL definition and UBL interface config: x86_64-randconfig-103-20240323 (https://download.01.org/0day-ci/archive/20240323/202403231743.sBKdJNRn-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403231743.sBKdJNRn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403231743.sBKdJNRn-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ub/dev/ubl.c:92:1: warning: 'static' is not at beginning of declaration [-Wold-style-declaration] 92 | const static struct header_ops ubl_header_ops ____cacheline_aligned = { | ^~~~~ vim +/static +92 drivers/net/ub/dev/ubl.c 91 > 92 const static struct header_ops ubl_header_ops ____cacheline_aligned = { 93 .create = ubl_create_header, 94 .parse_protocol = ubl_header_parse_protocol, 95 }; 96 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/11] Backport Introduce __mt_dup() to improve the performance of fork()
by Peng Zhang 23 Mar '24

23 Mar '24

From: ZhangPeng <zhangpeng362(a)huawei.com> This series introduces __mt_dup() to improve the performance of fork(). Also backport a bugfix to avoid conflicts. Liam R. Howlett (1): radix tree test suite: fix allocation calculation in kmem_cache_alloc_bulk() Peng Zhang (10): maple_tree: add mt_free_one() and mt_attr() helpers maple_tree: introduce {mtree,mas}_lock_nested() maple_tree: introduce interfaces __mt_dup() and mtree_dup() radix tree test suite: align kmem_cache_alloc_bulk() with kernel behavior. maple_tree: add test for mtree_dup() maple_tree: update the documentation of maple tree maple_tree: skip other tests when BENCH is enabled maple_tree: update check_forking() and bench_forking() maple_tree: preserve the tree attributes when destroying maple tree fork: use __mt_dup() to duplicate maple tree in dup_mmap() Documentation/core-api/maple_tree.rst | 4 + include/linux/maple_tree.h | 7 + include/linux/mm.h | 11 + kernel/fork.c | 40 ++- lib/maple_tree.c | 288 +++++++++++++++++++- lib/test_maple_tree.c | 123 +++++---- mm/internal.h | 11 - mm/memory.c | 7 +- mm/mmap.c | 9 +- tools/include/linux/rwsem.h | 4 + tools/include/linux/spinlock.h | 1 + tools/testing/radix-tree/linux.c | 49 +++- tools/testing/radix-tree/maple.c | 363 ++++++++++++++++++++++++++ 13 files changed, 813 insertions(+), 104 deletions(-) -- 2.25.1

2 12

[PATCH OLK-5.10] mm/sparsemem: fix race in accessing memory_section->usage
by Peng Zhang 23 Mar '24

23 Mar '24

From: Charan Teja Kalla <quic_charante(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit 5ec8e8ea8b7783fab150cf86404fc38cb4db8800 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NHX CVE: CVE-2023-52489 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are such that [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since normal zone start and end pfn contains the device memory PFN's as well, the compaction triggered will try on the device memory PFN's too though they end up in NOP(because pfn_to_online_page() returns NULL for ZONE_DEVICE memory sections). When from other core, the section mappings are being removed for the ZONE_DEVICE region, that the PFN in question belongs to, on which compaction is currently being operated is resulting into the kernel crash with CONFIG_SPASEMEM_VMEMAP enabled. The crash logs can be seen at [1]. compact_zone() memunmap_pages ------------- --------------- __pageblock_pfn_to_page ...... (a)pfn_valid(): valid_section()//return true (b)__remove_pages()-> sparse_remove_section()-> section_deactivate(): [Free the array ms->usage and set ms->usage = NULL] pfn_section_valid() [Access ms->usage which is NULL] NOTE: From the above it can be said that the race is reduced to between the pfn_valid()/pfn_section_valid() and the section deactivate with SPASEMEM_VMEMAP enabled. The commit b943f045a9af("mm/sparse: fix kernel crash with pfn_section_valid check") tried to address the same problem by clearing the SECTION_HAS_MEM_MAP with the expectation of valid_section() returns false thus ms->usage is not accessed. Fix this issue by the below steps: a) Clear SECTION_HAS_MEM_MAP before freeing the ->usage. b) RCU protected read side critical section will either return NULL when SECTION_HAS_MEM_MAP is cleared or can successfully access ->usage. c) Free the ->usage with kfree_rcu() and set ms->usage = NULL. No attempt will be made to access ->usage after this as the SECTION_HAS_MEM_MAP is cleared thus valid_section() return false. Thanks to David/Pavan for their inputs on this patch. [1] https://lore.kernel.org/linux-mm/994410bb-89aa-d987-1f50-f514903c55aa@quici… On Snapdragon SoC, with the mentioned memory configuration of PFN's as [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of issues daily while testing on a device farm. For this particular issue below is the log. Though the below log is not directly pointing to the pfn_section_valid(){ ms->usage;}, when we loaded this dump on T32 lauterbach tool, it is pointing. [ 540.578056] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 540.578068] Mem abort info: [ 540.578070] ESR = 0x0000000096000005 [ 540.578073] EC = 0x25: DABT (current EL), IL = 32 bits [ 540.578077] SET = 0, FnV = 0 [ 540.578080] EA = 0, S1PTW = 0 [ 540.578082] FSC = 0x05: level 1 translation fault [ 540.578085] Data abort info: [ 540.578086] ISV = 0, ISS = 0x00000005 [ 540.578088] CM = 0, WnR = 0 [ 540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBSBTYPE=--) [ 540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c [ 540.579454] lr : compact_zone+0x994/0x1058 [ 540.579460] sp : ffffffc03579b510 [ 540.579463] x29: ffffffc03579b510 x28: 0000000000235800 x27:000000000000000c [ 540.579470] x26: 0000000000235c00 x25: 0000000000000068 x24:ffffffc03579b640 [ 540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000 [ 540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140 [ 540.579489] x17: 00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff [ 540.579495] x14: 0000008000000000 x13: 0000000000000000 x12:0000000000000001 [ 540.579501] x11: 0000000000000000 x10: 0000000000000000 x9 :ffffff897d2cd440 [ 540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4 [ 540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000001 [ 540.579518] x2 : ffffffdebf7e3940 x1 : 0000000000235c00 x0 :0000000000235800 [ 540.579524] Call trace: [ 540.579527] __pageblock_pfn_to_page+0x6c/0x14c [ 540.579533] compact_zone+0x994/0x1058 [ 540.579536] try_to_compact_pages+0x128/0x378 [ 540.579540] __alloc_pages_direct_compact+0x80/0x2b0 [ 540.579544] __alloc_pages_slowpath+0x5c0/0xe10 [ 540.579547] __alloc_pages+0x250/0x2d0 [ 540.579550] __iommu_dma_alloc_noncontiguous+0x13c/0x3fc [ 540.579561] iommu_dma_alloc+0xa0/0x320 [ 540.579565] dma_alloc_attrs+0xd4/0x108 [quic_charante(a)quicinc.com: use kfree_rcu() in place of synchronize_rcu(), per David] Link: https://lkml.kernel.org/r/1698403778-20938-1-git-send-email-quic_charante@q… Link: https://lkml.kernel.org/r/1697202267-23600-1-git-send-email-quic_charante@q… Fixes: f46edbd1b151 ("mm/sparsemem: add helpers track active portions of a section at boot") Signed-off-by: Charan Teja Kalla <quic_charante(a)quicinc.com> Cc: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/mmzone.h Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- include/linux/mmzone.h | 15 ++++++++++++--- mm/sparse.c | 17 +++++++++-------- 2 files changed, 21 insertions(+), 11 deletions(-) diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h index 0a70b4bdd236..5398656315e1 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h @@ -1229,6 +1229,7 @@ struct mem_section_usage { #ifdef CONFIG_SPARSEMEM_VMEMMAP DECLARE_BITMAP(subsection_map, SUBSECTIONS_PER_SECTION); #endif + KABI_EXTEND(struct rcu_head rcu) /* See declaration of similar field in struct zone */ unsigned long pageblock_flags[0]; }; @@ -1391,7 +1392,7 @@ static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) { int idx = subsection_map_index(pfn); - return test_bit(idx, ms->usage->subsection_map); + return test_bit(idx, READ_ONCE(ms->usage)->subsection_map); } #else static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) @@ -1404,17 +1405,25 @@ static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) static inline int pfn_valid(unsigned long pfn) { struct mem_section *ms; + int ret; if (pfn_to_section_nr(pfn) >= NR_MEM_SECTIONS) return 0; ms = __nr_to_section(pfn_to_section_nr(pfn)); - if (!valid_section(ms)) + rcu_read_lock(); + if (!valid_section(ms)) { + rcu_read_unlock(); return 0; + } + /* * Traditionally early sections always returned pfn_valid() for * the entire section-sized span. */ - return early_section(ms) || pfn_section_valid(ms, pfn); + ret = early_section(ms) || pfn_section_valid(ms, pfn); + rcu_read_unlock(); + + return ret; } #endif diff --git a/mm/sparse.c b/mm/sparse.c index d92a29000d66..45b3571091a8 100644 --- a/mm/sparse.c +++ b/mm/sparse.c @@ -809,6 +809,13 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, if (empty) { unsigned long section_nr = pfn_to_section_nr(pfn); + /* + * Mark the section invalid so that valid_section() + * return false. This prevents code from dereferencing + * ms->usage array. + */ + ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; + /* * When removing an early section, the usage map is kept (as the * usage maps of other sections fall into the same page). It @@ -817,16 +824,10 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, * was allocated during boot. */ if (!PageReserved(virt_to_page(ms->usage))) { - kfree(ms->usage); - ms->usage = NULL; + kfree_rcu(ms->usage, rcu); + WRITE_ONCE(ms->usage, NULL); } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); - /* - * Mark the section invalid so that valid_section() - * return false. This prevents code from dereferencing - * ms->usage array. - */ - ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; } /* -- 2.25.1

2 1

[openeuler:OLK-5.10 21053/30000] drivers/net/ethernet/nebula-matrix/m1600/debug.c:564:39: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size 9
by kernel test robot 23 Mar '24

23 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 459341c4b4845b283c7a884e6a0dc4bd8cdb89e6 commit: 01e6e2075c432fde7fb5a66202b41bbd469de620 [21053/30000] Net: m1600: Add m1600-driver for nebula-matrix m1600 series smart NIC. config: x86_64-randconfig-075-20240323 (https://download.01.org/0day-ci/archive/20240323/202403231156.PXmnaRGK-lkp@…) compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240323/202403231156.PXmnaRGK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403231156.PXmnaRGK-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/nebula-matrix/m1600/debug.c:18:0: drivers/net/ethernet/nebula-matrix/m1600/ethtool.h:131:19: warning: 'nbl_priv_flags' defined but not used [-Wunused-const-variable=] static const char nbl_priv_flags[][ETH_GSTRING_LEN] = { ^~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/ethtool.h:116:19: warning: 'nbl_gstrings_test' defined but not used [-Wunused-const-variable=] static const char nbl_gstrings_test[][ETH_GSTRING_LEN] = { ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/ethtool.h:57:39: warning: 'nbl_gstrings_stats' defined but not used [-Wunused-const-variable=] static const struct nbl_ethtool_stats nbl_gstrings_stats[] = { ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/ethtool.h:13:18: warning: 'nbl_regs_dump_list' defined but not used [-Wunused-const-variable=] static const u32 nbl_regs_dump_list[] = { ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/debug.c: In function 'nbl_debugfs_hw_init': >> drivers/net/ethernet/nebula-matrix/m1600/debug.c:564:39: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size 9 [-Wformat-truncation=] snprintf(buf, sizeof(buf), "txring-%d", i); ^~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:564:31: note: directive argument in the range [0, 2147483646] snprintf(buf, sizeof(buf), "txring-%d", i); ^~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:564:4: note: 'snprintf' output between 9 and 18 bytes into a destination of size 16 snprintf(buf, sizeof(buf), "txring-%d", i); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:573:39: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size 9 [-Wformat-truncation=] snprintf(buf, sizeof(buf), "rxring-%d", i); ^~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:573:31: note: directive argument in the range [0, 2147483646] snprintf(buf, sizeof(buf), "rxring-%d", i); ^~~~~~~~~~~ drivers/net/ethernet/nebula-matrix/m1600/debug.c:573:4: note: 'snprintf' output between 9 and 18 bytes into a destination of size 16 snprintf(buf, sizeof(buf), "rxring-%d", i); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +564 drivers/net/ethernet/nebula-matrix/m1600/debug.c 534 535 /* function init and cleanup */ 536 void nbl_debugfs_hw_init(struct nbl_hw *hw) 537 { 538 int i; 539 char buf[16]; 540 struct nbl_adapter *adapter; 541 542 adapter = (struct nbl_adapter *)hw->back; 543 544 if (!nblx4_debug_root) 545 return; 546 547 snprintf(buf, sizeof(buf), "%04x:%02x:%02x.%x", 548 pci_domain_nr(adapter->pdev->bus), hw->bus, hw->devid, hw->function); 549 hw->nbl_debug_root = debugfs_create_dir(buf, nblx4_debug_root); 550 551 if (is_af(hw)) { 552 debugfs_create_file("dvn", 0444, 553 hw->nbl_debug_root, hw, &dvn_fops); 554 debugfs_create_file("uvn", 0644, 555 hw->nbl_debug_root, hw, &uvn_fops); 556 debugfs_create_file("nic-statistics", 0444, 557 hw->nbl_debug_root, hw, &nic_statistics_fops); 558 debugfs_create_file("tables", 0644, 559 hw->nbl_debug_root, hw, &tables_fops); 560 } 561 562 if (adapter->num_txq) { 563 for (i = 0; i < adapter->num_txq; i++) { > 564 snprintf(buf, sizeof(buf), "txring-%d", i); 565 debugfs_create_file(buf, 0444, 566 hw->nbl_debug_root, 567 adapter->tx_rings[i], &ring_fops); 568 } 569 } 570 571 if (adapter->num_rxq) { 572 for (i = 0; i < adapter->num_rxq; i++) { 573 snprintf(buf, sizeof(buf), "rxring-%d", i); 574 debugfs_create_file(buf, 0444, 575 hw->nbl_debug_root, 576 adapter->rx_rings[i], &ring_fops); 577 } 578 } 579 580 debugfs_create_file("bar", 0444, hw->nbl_debug_root, hw, &bar_fops); 581 582 hw->debugfs_reg_bar = 0; 583 hw->debugfs_reg_offset = 0; 584 hw->debugfs_reg_length = 8; 585 debugfs_create_file("reg", 0444, hw->nbl_debug_root, hw, &reg_fops); 586 } 587 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] llc: make llc_ui_sendmsg() more robust against bonding changes
by Liu Jian 23 Mar '24

23 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit 04f2a74b562f3a7498be0399309669f342793d8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JVI CVE: CVE-2024-26636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit dad555c816a50c6a6a8a86be1f9177673918c647 ] syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ethernet header [1] Like some others, llc_ui_sendmsg() releases the socket lock before calling sock_alloc_send_skb(). Then it acquires it again, but does not redo all the sanity checks that were performed. This fix: - Uses LL_RESERVED_SPACE() to reserve space. - Check all conditions again after socket lock is held again. - Do not account Ethernet header for mtu limitation. [1] skbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0 kernel BUG at net/core/skbuff.c:193 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:189 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 lr : skb_panic net/core/skbuff.c:189 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 sp : ffff800096f97000 x29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000 x26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2 x23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0 x20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce x17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001 x14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400 x8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089 Call trace: skb_panic net/core/skbuff.c:189 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 skb_push+0xf0/0x108 net/core/skbuff.c:2451 eth_header+0x44/0x1f8 net/ethernet/eth.c:83 dev_hard_header include/linux/netdevice.h:3188 [inline] llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33 llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85 llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline] llc_sap_next_state net/llc/llc_sap.c:182 [inline] llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209 llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270 llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_sendmsg+0x194/0x274 net/socket.c:767 splice_to_socket+0x7cc/0xd58 fs/splice.c:881 do_splice_from fs/splice.c:933 [inline] direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142 splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088 do_splice_direct+0x20c/0x348 fs/splice.c:1194 do_sendfile+0x4bc/0xc70 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1322 [inline] __se_sys_sendfile64 fs/read_write.c:1308 [inline] __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595 Code: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+2a7024e9502df538e8ef(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240118183625.4007013-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/llc/af_llc.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index 90a32864401c..dae978badd26 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -929,14 +929,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, */ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) { + DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); struct sock *sk = sock->sk; struct llc_sock *llc = llc_sk(sk); - DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); int flags = msg->msg_flags; int noblock = flags & MSG_DONTWAIT; + int rc = -EINVAL, copied = 0, hdrlen, hh_len; struct sk_buff *skb = NULL; + struct net_device *dev; size_t size = 0; - int rc = -EINVAL, copied = 0, hdrlen; dprintk("%s: sending from %02X to %02X\n", __func__, llc->laddr.lsap, llc->daddr.lsap); @@ -956,22 +957,29 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) if (rc) goto out; } - hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr); + dev = llc->dev; + hh_len = LL_RESERVED_SPACE(dev); + hdrlen = llc_ui_header_len(sk, addr); size = hdrlen + len; - if (size > llc->dev->mtu) - size = llc->dev->mtu; + size = min_t(size_t, size, READ_ONCE(dev->mtu)); copied = size - hdrlen; rc = -EINVAL; if (copied < 0) goto out; release_sock(sk); - skb = sock_alloc_send_skb(sk, size, noblock, &rc); + skb = sock_alloc_send_skb(sk, hh_len + size, noblock, &rc); lock_sock(sk); if (!skb) goto out; - skb->dev = llc->dev; + if (sock_flag(sk, SOCK_ZAPPED) || + llc->dev != dev || + hdrlen != llc_ui_header_len(sk, addr) || + hh_len != LL_RESERVED_SPACE(dev) || + size > READ_ONCE(dev->mtu)) + goto out; + skb->dev = dev; skb->protocol = llc_proto_type(addr->sllc_arphrd); - skb_reserve(skb, hdrlen); + skb_reserve(skb, hh_len + hdrlen); rc = memcpy_from_msg(skb_put(skb, copied), msg, copied); if (rc) goto out; -- 2.34.1

2 1