- Kernel - mailweb.openeuler.org

[PATCH v2 openEuler-22.03-LTS-SP1 3/5] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 2/5] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 20 Mar '24

20 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 1/5] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 0/5] mpt3sas bugfix
by Baogen Shang 20 Mar '24

20 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. v2: fix checkdepend fail Ranjan Kumar (2): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 scsi: mpt3sas: Fix loop logic Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 49 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++++- 3 files changed, 51 insertions(+), 15 deletions(-) -- 2.33.0

1 0

[openeuler:OLK-6.6 4026/4224] drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:3246:6: warning: no previous prototype for function 'rnpm_get_phy_statistics'
by kernel test robot 20 Mar '24

20 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b61688dbd28fa5eb9aa4e4109bc38543cd1d596f commit: 5deaf74c4b3edcf88f67f18aa352690deb9dc212 [4026/4224] drivers: initial support for rnpm drivers from Mucse Technology config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240320/202403201844.sT1rPTz4-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240320/202403201844.sT1rPTz4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403201844.sT1rPTz4-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1290:7: warning: variable 'autoneg_changed' set but not used [-Wunused-but-set-variable] 1290 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1290:32: warning: variable 'duplex_changed' set but not used [-Wunused-but-set-variable] 1290 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:2092:6: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2092 | u32 dma_ch; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:3246:6: warning: no previous prototype for function 'rnpm_get_phy_statistics' [-Wmissing-prototypes] 3246 | void rnpm_get_phy_statistics(struct net_device *netdev, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:3246:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3246 | void rnpm_get_phy_statistics(struct net_device *netdev, | ^ | static 4 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:976:5: warning: no previous prototype for function 'rnpm_get_vf_ringnum' [-Wmissing-prototypes] 976 | int rnpm_get_vf_ringnum(int vf, int num) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:976:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 976 | int rnpm_get_vf_ringnum(int vf, int num) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:986:9: warning: variable 'y' set but not used [-Wunused-but-set-variable] 986 | u64 x, y, result; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:983:5: warning: no previous prototype for function 'rnpm_setup_ring_maxrate' [-Wmissing-prototypes] 983 | int rnpm_setup_ring_maxrate(struct rnpm_adapter *adapter, int ring, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:983:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 983 | int rnpm_setup_ring_maxrate(struct rnpm_adapter *adapter, int ring, | ^ | static 3 warnings generated. vim +/rnpm_get_phy_statistics +3246 drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c 3245 > 3246 void rnpm_get_phy_statistics(struct net_device *netdev, 3247 struct ethtool_stats *stats, u64 *data) 3248 { 3249 struct rnpm_adapter *adapter = netdev_priv(netdev); 3250 struct rnpm_hw *hw = &adapter->hw; 3251 struct phy_statistics ps; 3252 3253 if (rnpm_mbx_get_phy_statistics(hw, (u8 *)&ps) != 0) 3254 return; 3255 3256 *data++ = ps.yt.pkg_ib_valid; 3257 *data++ = ps.yt.pkg_ib_os_good; 3258 *data++ = ps.yt.pkg_ib_us_good; 3259 *data++ = ps.yt.pkg_ib_err; 3260 *data++ = ps.yt.pkg_ib_os_bad; 3261 *data++ = ps.yt.pkg_ib_frag; 3262 *data++ = ps.yt.pkg_ib_nosfd; 3263 *data++ = ps.yt.pkg_ob_valid; 3264 *data++ = ps.yt.pkg_ob_os_good; 3265 *data++ = ps.yt.pkg_ob_us_good; 3266 *data++ = ps.yt.pkg_ob_err; 3267 *data++ = ps.yt.pkg_ob_os_bad; 3268 *data++ = ps.yt.pkg_ob_frag; 3269 *data++ = ps.yt.pkg_ob_nosfd; 3270 } 3271 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 4026/4224] drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1257: warning: expecting prototype for rnpm_update_mc_addr_list_generic(). Prototype was for rnpm_update_mutiport_mc_addr_list_generic() instead
by kernel test robot 20 Mar '24

20 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b61688dbd28fa5eb9aa4e4109bc38543cd1d596f commit: 5deaf74c4b3edcf88f67f18aa352690deb9dc212 [4026/4224] drivers: initial support for rnpm drivers from Mucse Technology config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240320/202403201702.oUv4biQv-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240320/202403201702.oUv4biQv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403201702.oUv4biQv-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpm/rnpm_common.c:694: warning: Function parameter or member 'count' not described in 'rnpm_shift_in_eeprom_bits' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:717: warning: Function parameter or member 'eec' not described in 'rnpm_lower_eeprom_clk' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:717: warning: Excess function parameter 'eecd' description in 'rnpm_lower_eeprom_clk' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:933: warning: Function parameter or member 'mc_addr' not described in 'rnpm_set_mta' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:933: warning: Excess function parameter 'hash_value' description in 'rnpm_set_mta' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1182: warning: Function parameter or member 'mode' not described in 'rnpm_mta_vector' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1182: warning: Excess function parameter 'hw' description in 'rnpm_mta_vector' >> drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1257: warning: expecting prototype for rnpm_update_mc_addr_list_generic(). Prototype was for rnpm_update_mutiport_mc_addr_list_generic() instead >> drivers/net/ethernet/mucse/rnpm/rnpm_common.c:1812: warning: expecting prototype for rnpm_enable_rx_buff(). Prototype was for rnpm_enable_rx_buff_generic() instead drivers/net/ethernet/mucse/rnpm/rnpm_common.c:2179: warning: Function parameter or member 'vf' not described in 'rnpm_set_vlan_anti_spoofing' drivers/net/ethernet/mucse/rnpm/rnpm_common.c:2179: warning: Excess function parameter 'pf' description in 'rnpm_set_vlan_anti_spoofing' -- drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c: In function 'rnpm_set_link_ksettings': drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1290:39: warning: variable 'duplex_changed' set but not used [-Wunused-but-set-variable] 1290 | bool autoneg_changed = false, duplex_changed = false; | ^~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1290:14: warning: variable 'autoneg_changed' set but not used [-Wunused-but-set-variable] 1290 | bool autoneg_changed = false, duplex_changed = false; | ^~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c: In function 'rnpm_get_strings': drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:2092:13: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2092 | u32 dma_ch; | ^~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c: At top level: >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:3246:6: warning: no previous prototype for 'rnpm_get_phy_statistics' [-Wmissing-prototypes] 3246 | void rnpm_get_phy_statistics(struct net_device *netdev, | ^~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/mucse/rnpm/rnpm_debugfs.c:260: warning: expecting prototype for rnpm_dbg_reg_ops_write(). Prototype was for rnpm_dbg_phy_ops_write() instead drivers/net/ethernet/mucse/rnpm/rnpm_debugfs.c:367: warning: Function parameter or member 'adapter' not described in 'rnpm_dbg_adapter_exit' drivers/net/ethernet/mucse/rnpm/rnpm_debugfs.c:367: warning: Excess function parameter 'pf' description in 'rnpm_dbg_adapter_exit' -- >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1185:6: warning: no previous prototype for 'rnpm_setup_layer2_remapping' [-Wmissing-prototypes] 1185 | void rnpm_setup_layer2_remapping(struct rnpm_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1209:6: warning: no previous prototype for 'rnpm_setup_tuple5_remapping' [-Wmissing-prototypes] 1209 | void rnpm_setup_tuple5_remapping(struct rnpm_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1280:6: warning: no previous prototype for 'rnpm_setup_tuple5_remapping_tcam' [-Wmissing-prototypes] 1280 | void rnpm_setup_tuple5_remapping_tcam(struct rnpm_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:256:6: warning: no previous prototype for 'rnpm_pf_service_event_schedule' [-Wmissing-prototypes] 256 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1137:5: warning: no previous prototype for 'rnpm_rx_ring_reinit' [-Wmissing-prototypes] 1137 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: In function 'rnpm_clean_rx_irq': drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2015:14: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 2015 | bool xdp_xmit = false; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: At top level: >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2207:6: warning: no previous prototype for 'rnpm_write_eitr' [-Wmissing-prototypes] 2207 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3013:5: warning: no previous prototype for 'rnpm_xmit_nop_frame_ring' [-Wmissing-prototypes] 3013 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3037:5: warning: no previous prototype for 'rnpm_xmit_nop_frame_ring_temp' [-Wmissing-prototypes] 3037 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3909:6: warning: no previous prototype for 'rnpm_vlan_stags_flag' [-Wmissing-prototypes] 3909 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:4031:6: warning: no previous prototype for 'control_mac_rx' [-Wmissing-prototypes] 4031 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5803:6: warning: no previous prototype for 'rnpm_pf_service_timer' [-Wmissing-prototypes] 5803 | void rnpm_pf_service_timer(struct timer_list *t) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5821:6: warning: no previous prototype for 'rnpm_service_timer' [-Wmissing-prototypes] 5821 | void rnpm_service_timer(struct timer_list *t) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5962:21: warning: no previous prototype for 'wait_all_port_resetting' [-Wmissing-prototypes] 5962 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5974:21: warning: no previous prototype for 'clean_all_port_resetting' [-Wmissing-prototypes] 5974 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6185:5: warning: no previous prototype for 'rnpm_check_mc_addr' [-Wmissing-prototypes] 6185 | int rnpm_check_mc_addr(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6211:6: warning: no previous prototype for 'update_pf_vlan' [-Wmissing-prototypes] 6211 | void update_pf_vlan(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6262:6: warning: no previous prototype for 'rnpm_pf_service_task' [-Wmissing-prototypes] 6262 | void rnpm_pf_service_task(struct work_struct *work) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7528:6: warning: no previous prototype for 'rnpm_clear_udp_tunnel_port' [-Wmissing-prototypes] 7528 | void rnpm_clear_udp_tunnel_port(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7692:6: warning: no previous prototype for 'rnpm_assign_netdev_ops' [-Wmissing-prototypes] 7692 | void rnpm_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7785:6: warning: no previous prototype for 'rnpm_fix_queue_number' [-Wmissing-prototypes] 7785 | void rnpm_fix_queue_number(struct rnpm_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8760:5: warning: no previous prototype for 'rnpm_can_rpu_start' [-Wmissing-prototypes] 8760 | int rnpm_can_rpu_start(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: In function 'rnpm_request_msix_irqs': >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2911:43: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] 2911 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2911:34: note: directive argument in the range [0, 65535] 2911 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ^~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2910:25: note: 'snprintf' output between 10 and 31 bytes into a destination of size 24 2910 | snprintf(q_vector->name, sizeof(q_vector->name) - 1, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2911 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2912 | q_vector->v_idx); | ~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/mucse/rnpm/rnpm_main.c:297: warning: Function parameter or member 'rnpm_queue' not described in 'rnpm_set_ring_vector' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:297: warning: Function parameter or member 'rnpm_msix_vector' not described in 'rnpm_set_ring_vector' >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:297: warning: expecting prototype for rnpm_set_ivar(). Prototype was for rnpm_set_ring_vector() instead drivers/net/ethernet/mucse/rnpm/rnpm_main.c:441: warning: Function parameter or member 'napi_budget' not described in 'rnpm_clean_tx_irq' >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:988: warning: expecting prototype for rnp_is_non_eop(). Prototype was for rnpm_is_non_eop() instead drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1138: warning: Function parameter or member 'adapter' not described in 'rnpm_rx_ring_reinit' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2208: warning: Function parameter or member 'is_rxframe' not described in 'rnpm_write_eitr' >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2208: warning: expecting prototype for ixgbe_write_eitr(). Prototype was for rnpm_write_eitr() instead >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2869: warning: expecting prototype for rnp_irq_affinity_notify(). Prototype was for rnpm_irq_affinity_notify() instead >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2885: warning: expecting prototype for rnp_irq_affinity_release(). Prototype was for rnpm_irq_affinity_release() instead drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3070: warning: Function parameter or member 'adapter' not described in 'rnpm_tx_maxrate_own' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3070: warning: Excess function parameter 'netdev' description in 'rnpm_tx_maxrate_own' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3070: warning: Excess function parameter 'maxrate' description in 'rnpm_tx_maxrate_own' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3856: warning: Excess function parameter 'pb' description in 'rnpm_lpbthresh' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:4607: warning: Function parameter or member 'txqueue' not described in 'rnpm_tx_timeout' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:4780: warning: Function parameter or member 'adapter' not described in 'rnpm_setup_tx_resources' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:4878: warning: Function parameter or member 'adapter' not described in 'rnpm_setup_rx_resources' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5560: warning: Excess function parameter 'link_speed' description in 'rnpm_watchdog_update_link' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5804: warning: Function parameter or member 't' not described in 'rnpm_pf_service_timer' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5804: warning: Excess function parameter 'data' description in 'rnpm_pf_service_timer' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5822: warning: Function parameter or member 't' not described in 'rnpm_service_timer' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5822: warning: Excess function parameter 'data' description in 'rnpm_service_timer' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7253: warning: Function parameter or member 'dev' not described in 'rnpm_setup_tc' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7253: warning: Excess function parameter 'netdev' description in 'rnpm_setup_tc' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7711: warning: Function parameter or member 'adapter' not described in 'rnpm_wol_supported' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7711: warning: Function parameter or member 'subdevice_id' not described in 'rnpm_wol_supported' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7711: warning: Excess function parameter 'hw' description in 'rnpm_wol_supported' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7711: warning: Excess function parameter 'subdev_id' description in 'rnpm_wol_supported' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8783: warning: Function parameter or member 'id' not described in 'rnpm_probe' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8783: warning: Excess function parameter 'ent' description in 'rnpm_probe' -- >> drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:446:5: warning: no previous prototype for 'rnpm_reset_pipeline_n10' [-Wmissing-prototypes] 446 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c: In function 'rnpm_reset_hw_n10': drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:501:13: warning: variable 'status' set but not used [-Wunused-but-set-variable] 501 | s32 status = 0; | ^~~~~~ -- drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:223: warning: Function parameter or member 'input' not described in 'rnpm_atr_compute_sig_hash_n10' drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:223: warning: Function parameter or member 'common' not described in 'rnpm_atr_compute_sig_hash_n10' drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:223: warning: Excess function parameter 'stream' description in 'rnpm_atr_compute_sig_hash_n10' >> drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:238: warning: expecting prototype for rnpm_atr_add_signature_filter_n10(). Prototype was for rnpm_fdir_add_signature_filter_n10() instead drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:264: warning: Function parameter or member 'input' not described in 'rnpm_atr_compute_perfect_hash_n10' drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:264: warning: Excess function parameter 'atr_input' description in 'rnpm_atr_compute_perfect_hash_n10' -- >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:15:24: warning: no previous prototype for 'mbx_cookie_zalloc' [-Wmissing-prototypes] 15 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:29:5: warning: no previous prototype for 'rnpm_mbx_write_posted_locked' [-Wmissing-prototypes] 29 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:73:6: warning: no previous prototype for 'rnpm_link_stat_mark_disable' [-Wmissing-prototypes] 73 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:78:5: warning: no previous prototype for 'rnpm_mbx_fw_post_req' [-Wmissing-prototypes] 78 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req, | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:138:5: warning: no previous prototype for 'rnpm_fw_send_cmd_wait' [-Wmissing-prototypes] 138 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:619:5: warning: no previous prototype for 'rnpm_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 619 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:933:5: warning: no previous prototype for 'rnpm_mbx_pluginout_evt_en' [-Wmissing-prototypes] 933 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:962:5: warning: no previous prototype for 'rnpm_fw_get_capablity' [-Wmissing-prototypes] 962 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: In function 'rnpm_mbx_get_temp': drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1146:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1146 | int err; | ^~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: At top level: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1178:5: warning: no previous prototype for 'rnpm_fw_reg_read' [-Wmissing-prototypes] 1178 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: In function 'rnpm_fw_reg_read': drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1182:13: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1182 | int value; | ^~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: In function 'rnpm_mbx_fw_req_handler': drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1250:25: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 1250 | struct rnpm_hw *hw; | ^~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: At top level: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1470:5: warning: no previous prototype for 'rnpm_get_port_stats2' [-Wmissing-prototypes] 1470 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c: In function 'rnpm_mbx_reg_write': >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:600:9: warning: 'build_writereg_req' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=] 600 | build_writereg_req(&req, NULL, fw_reg, 4, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:600:9: note: referencing argument 5 of type 'int[4]' In file included from drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:11: drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:805:20: note: in a call to function 'build_writereg_req' 805 | static inline void build_writereg_req(struct mbx_fw_cmd_req *req, void *cookie, | ^~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:782: warning: Cannot understand *@speed : on line 782 - I thought it was a doc line -- >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:976:5: warning: no previous prototype for 'rnpm_get_vf_ringnum' [-Wmissing-prototypes] 976 | int rnpm_get_vf_ringnum(int vf, int num) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:983:5: warning: no previous prototype for 'rnpm_setup_ring_maxrate' [-Wmissing-prototypes] 983 | int rnpm_setup_ring_maxrate(struct rnpm_adapter *adapter, int ring, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c: In function 'rnpm_setup_ring_maxrate': >> drivers/net/ethernet/mucse/rnpm/rnpm_sriov.c:986:16: warning: variable 'y' set but not used [-Wunused-but-set-variable] 986 | u64 x, y, result; | ^ .. vim +1257 drivers/net/ethernet/mucse/rnpm/rnpm_common.c 1244 1245 /** 1246 * rnpm_update_mc_addr_list_generic - Updates MAC list of multicast addresses 1247 * @hw: pointer to hardware structure 1248 * @netdev: pointer to net device structure 1249 * 1250 * The given list replaces any existing list. Clears the MC addrs from receive 1251 * address registers and the multicast table. Uses unused receive address 1252 * registers for the first multicast addresses, and hashes the rest into the 1253 * multicast table. 1254 **/ 1255 s32 rnpm_update_mutiport_mc_addr_list_generic(struct rnpm_hw *hw, 1256 struct net_device *netdev) > 1257 { 1258 #ifdef NETDEV_HW_ADDR_T_MULTICAST 1259 struct netdev_hw_addr *ha; 1260 #endif 1261 struct rnpm_adapter *adapter = (struct rnpm_adapter *)hw->back; 1262 struct rnpm_pf_adapter *pf_adapter = adapter->pf_adapter; 1263 u32 i; 1264 u32 v; 1265 u8 port = adapter->port; 1266 int addr_count = 0; 1267 u8 *addr_list = NULL; 1268 unsigned long flags; 1269 1270 /* Set the new number of MC addresses that we are being requested to 1271 * use. 1272 */ 1273 pf_adapter->num_mc_addrs[port] = netdev_mc_count(netdev); 1274 pf_adapter->mta_in_use[port] = 0; 1275 1276 hw->addr_ctrl.num_mc_addrs = netdev_mc_count(netdev); 1277 hw->addr_ctrl.mta_in_use = 0; 1278 1279 /* Clear share mta_shadow only not in mutiport mode */ 1280 if (!(adapter->flags & RNPM_FLAG_MUTIPORT_ENABLED)) { 1281 hw_dbg(hw, " Clearing MTA(multicast table)\n"); 1282 memset(&pf_adapter->mta_shadow, 0, 1283 sizeof(pf_adapter->mta_shadow)); 1284 } 1285 /* clear own mta_shadow */ 1286 memset(&hw->mac.mta_shadow, 0, sizeof(hw->mac.mta_shadow)); 1287 1288 spin_lock_irqsave(&pf_adapter->mc_setup_lock, flags); 1289 /* Update mta shadow */ 1290 hw_dbg(hw, "port %d Updating MTA..\n", port); 1291 // netdev_for_each_mc_addr(ha, netdev) { 1292 // rnpm_set_mta(hw, ha->addr); 1293 // } 1294 addr_count = netdev_mc_count(netdev); 1295 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47131
by Ziyang Xuan 20 Mar '24

20 Mar '24

Patchset for CVE-2021-47131. Maxim Mikityanskiy (2): net/tls: Replace TLS_RX_SYNC_RUNNING with RCU net/tls: Fix use-after-free after the TLS device goes down and up include/net/tls.h | 11 ++++++- net/tls/tls_device.c | 61 ++++++++++++++++++++++++++++------- net/tls/tls_device_fallback.c | 7 ++++ net/tls/tls_main.c | 1 + 4 files changed, 68 insertions(+), 12 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] nbd: always initialize struct msghdr completely
by Li Nan 20 Mar '24

20 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit 78fbb92af27d0982634116c7a31065f24d092826 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JST CVE: CVE-2024-26638 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always make sure their values is zero by default. [1] BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 kthread+0x3ed/0x540 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Local variable msg created at: __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: nbd5-recv recv_work Fixes: f94fd25cb0aa ("tcp: pass back data left in socket after receive") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: stable(a)vger.kernel.org Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: linux-block(a)vger.kernel.org Cc: nbd(a)other.debian.org Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240112132657.647112-1-edumazet@google.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/nbd.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 7fce5f3b40df..780a7daf7bbc 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -510,7 +510,7 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, struct iov_iter *iter, int msg_flags, int *sent) { int result; - struct msghdr msg; + struct msghdr msg = {} ; unsigned int noreclaim_flag; if (unlikely(!sock)) { @@ -526,10 +526,6 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, do { sock->sk->sk_allocation = GFP_NOIO | __GFP_MEMALLOC; sock->sk->sk_use_task_frag = false; - msg.msg_name = NULL; - msg.msg_namelen = 0; - msg.msg_control = NULL; - msg.msg_controllen = 0; msg.msg_flags = msg_flags | MSG_NOSIGNAL; if (send) -- 2.39.2

2 1

[PATCH OLK-6.6] block: Fix iterating over an empty bio with bio_for_each_folio_all
by Li Nan 20 Mar '24

20 Mar '24

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> mainline inclusion from mainline-v6.8-rc1 commit 7bed6f3d08b7af27b7015da8dc3acf2b9c1f21d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JYB CVE: CVE-2024-26632 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the bio contains no data, bio_first_folio() calls page_folio() on a NULL pointer and oopses. Move the test that we've reached the end of the bio from bio_next_folio() to bio_first_folio(). Reported-by: syzbot+8b23309d5788a79d3eea(a)syzkaller.appspotmail.com Reported-by: syzbot+004c1e0fced2b4bc3dcc(a)syzkaller.appspotmail.com Fixes: 640d1930bef4 ("block: Add bio_for_each_folio_all()") Cc: stable(a)vger.kernel.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Link: https://lore.kernel.org/r/20240116212959.3413014-1-willy@infradead.org [axboe: add unlikely() to error case] Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Nan <linan122(a)huawei.com> --- include/linux/bio.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/include/linux/bio.h b/include/linux/bio.h index ebb008300489..819e189523f2 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -287,6 +287,11 @@ static inline void bio_first_folio(struct folio_iter *fi, struct bio *bio, { struct bio_vec *bvec = bio_first_bvec_all(bio) + i; + if (unlikely(i >= bio->bi_vcnt)) { + fi->folio = NULL; + return; + } + fi->folio = page_folio(bvec->bv_page); fi->offset = bvec->bv_offset + PAGE_SIZE * (bvec->bv_page - &fi->folio->page); @@ -304,10 +309,8 @@ static inline void bio_next_folio(struct folio_iter *fi, struct bio *bio) fi->offset = 0; fi->length = min(folio_size(fi->folio), fi->_seg_count); fi->_next = folio_next(fi->folio); - } else if (fi->_i + 1 < bio->bi_vcnt) { - bio_first_folio(fi, bio, fi->_i + 1); } else { - fi->folio = NULL; + bio_first_folio(fi, bio, fi->_i + 1); } } -- 2.39.2

2 1

[PATCH OLK-6.6] nbd: always initialize struct msghdr completely
by Li Nan 20 Mar '24

20 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.8-rc1 commit 78fbb92af27d0982634116c7a31065f24d092826 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JYB CVE: CVE-2024-26632 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always make sure their values is zero by default. [1] BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 kthread+0x3ed/0x540 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Local variable msg created at: __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: nbd5-recv recv_work Fixes: f94fd25cb0aa ("tcp: pass back data left in socket after receive") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: stable(a)vger.kernel.org Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: linux-block(a)vger.kernel.org Cc: nbd(a)other.debian.org Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240112132657.647112-1-edumazet@google.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/nbd.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 7fce5f3b40df..780a7daf7bbc 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -510,7 +510,7 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, struct iov_iter *iter, int msg_flags, int *sent) { int result; - struct msghdr msg; + struct msghdr msg = {} ; unsigned int noreclaim_flag; if (unlikely(!sock)) { @@ -526,10 +526,6 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, do { sock->sk->sk_allocation = GFP_NOIO | __GFP_MEMALLOC; sock->sk->sk_use_task_frag = false; - msg.msg_name = NULL; - msg.msg_namelen = 0; - msg.msg_control = NULL; - msg.msg_controllen = 0; msg.msg_flags = msg_flags | MSG_NOSIGNAL; if (send) -- 2.39.2

2 1