- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1 0/2] genirq: introduce handle_fasteoi_edge_irq flow handler
by Yipeng Zou 18 Jun '24

18 Jun '24

Rebase to here Yipeng Zou (2): genirq: introduce handle_fasteoi_edge_irq flow handler genirq: introduce handle_fasteoi_edge_irq for phytium drivers/irqchip/irq-gic-phytium-2500.c | 2 +- drivers/irqchip/irq-gic-v3.c | 2 +- include/linux/irq.h | 1 + kernel/irq/chip.c | 67 ++++++++++++++++++++++++++ 4 files changed, 70 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/3] A Solution to Re-enable hugetlb vmemmap optimize on ARM64
by Nanyong Sun 18 Jun '24

18 Jun '24

HVO was previously disabled on arm64 [1] due to the lack of necessary BBM(break-before-make) logic when changing page tables. This set of patches fix this by adding necessary BBM sequence when changing page table, and supporting vmemmap page fault handling to fixup kernel address translation fault if vmemmap is concurrently accessed. I have tested this patch set with concurrently accessing the vmemmap address when do BBM and can recover by vmemmap fault handler. Also tested under the config of 2/3/4 pgtable levels with 4K/64K page size and all works well. [1] commit 060a2c92d1b6 ("arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP") Mark Rutland (1): arm64: mm: kfence: only handle translation faults Nanyong Sun (2): mm: HVO: introduce helper function to update and flush pgtable arm64: mm: HVO: support BBM of vmemmap pgtable safely arch/arm64/include/asm/esr.h | 4 ++ arch/arm64/include/asm/pgtable.h | 6 ++ arch/arm64/include/asm/tlbflush.h | 16 +++++ arch/arm64/mm/fault.c | 98 +++++++++++++++++++++++++++++-- arch/arm64/mm/mmu.c | 29 +++++++++ mm/sparse-vmemmap.c | 49 +++++++++++++--- 6 files changed, 189 insertions(+), 13 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 0/2] genirq: introduce handle_fasteoi_edge_irq flow handler
by Yipeng Zou 18 Jun '24

18 Jun '24

Rebase to here Yipeng Zou (2): genirq: introduce handle_fasteoi_edge_irq flow handler genirq: introduce handle_fasteoi_edge_irq for phytium drivers/irqchip/irq-gic-phytium-2500.c | 2 +- drivers/irqchip/irq-gic-v3.c | 2 +- include/linux/irq.h | 1 + kernel/irq/chip.c | 67 ++++++++++++++++++++++++++ 4 files changed, 70 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/xfs/scrub/common.c | 4 +--- fs/xfs/xfs_aops.c | 7 ------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 4 files changed, 7 insertions(+), 21 deletions(-) diff --git a/fs/xfs/scrub/common.c b/fs/xfs/scrub/common.c index 23944fcc1a6c..08e292485268 100644 --- a/fs/xfs/scrub/common.c +++ b/fs/xfs/scrub/common.c @@ -978,9 +978,7 @@ xchk_irele( struct xfs_scrub *sc, struct xfs_inode *ip) { - if (current->journal_info != NULL) { - ASSERT(current->journal_info == sc->tp); - + if (sc->tp) { /* * If we are in a transaction, we /cannot/ drop the inode * ourselves, because the VFS will trigger writeback, which diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index a2e1f73f84dd..82f18f28c1c1 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -477,13 +477,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index f4971bd1de05..370c0df1a7a5 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2037,8 +2037,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2046,7 +2048,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 4e38357237c3..ead65f5f8dc3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -277,19 +277,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -297,10 +292,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

2 1

[PATCH OLK-5.10] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/scrub/common.c fs/xfs/xfs_aops.c [ a03297a0ca9f2("xfs: manage inode DONTCACHE status at irele time") is not applied. 21b4ee7029c90("xfs: drop ->writepage completely") is not applied.] Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/xfs/xfs_aops.c | 13 ------------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 3 files changed, 6 insertions(+), 24 deletions(-) diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index ef7db9defef1..e751cf34ccba 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -552,12 +552,6 @@ xfs_vm_writepage( { struct xfs_writepage_ctx wpc = { }; - if (WARN_ON_ONCE(current->journal_info)) { - redirty_page_for_writepage(wbc, page); - unlock_page(page); - return 0; - } - return iomap_writepage(page, wbc, &wpc.ctx, &xfs_writeback_ops); } @@ -568,13 +562,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index bdf55ed88680..fae443e0d120 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2043,8 +2043,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2052,7 +2054,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 731af3f04c83..d512fdd5f7c3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -271,19 +271,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -291,10 +286,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

2 1

[PATCH OLK-5.10] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/scrub/common.c fs/xfs/xfs_aops.c [ a03297a0ca9f2("xfs: manage inode DONTCACHE status at irele time") is not applied. 21b4ee7029c90("xfs: drop ->writepage completely") is not applied.] Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/xfs/xfs_aops.c | 13 ------------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 3 files changed, 6 insertions(+), 24 deletions(-) diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index ef7db9defef1..e751cf34ccba 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -552,12 +552,6 @@ xfs_vm_writepage( { struct xfs_writepage_ctx wpc = { }; - if (WARN_ON_ONCE(current->journal_info)) { - redirty_page_for_writepage(wbc, page); - unlock_page(page); - return 0; - } - return iomap_writepage(page, wbc, &wpc.ctx, &xfs_writeback_ops); } @@ -568,13 +562,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index bdf55ed88680..fae443e0d120 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2043,8 +2043,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2052,7 +2054,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 731af3f04c83..d512fdd5f7c3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -271,19 +271,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -291,10 +286,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

1 0

[PATCH OLK-6.6] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/xfs/scrub/common.c | 4 +--- fs/xfs/xfs_aops.c | 7 ------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 4 files changed, 7 insertions(+), 21 deletions(-) diff --git a/fs/xfs/scrub/common.c b/fs/xfs/scrub/common.c index 23944fcc1a6c..08e292485268 100644 --- a/fs/xfs/scrub/common.c +++ b/fs/xfs/scrub/common.c @@ -978,9 +978,7 @@ xchk_irele( struct xfs_scrub *sc, struct xfs_inode *ip) { - if (current->journal_info != NULL) { - ASSERT(current->journal_info == sc->tp); - + if (sc->tp) { /* * If we are in a transaction, we /cannot/ drop the inode * ourselves, because the VFS will trigger writeback, which diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index a2e1f73f84dd..82f18f28c1c1 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -477,13 +477,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index f4971bd1de05..370c0df1a7a5 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2037,8 +2037,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2046,7 +2048,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 4e38357237c3..ead65f5f8dc3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -277,19 +277,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -297,10 +292,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

1 0

[PATCH openEuler-22.03-LTS-SP1] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/scrub/common.c fs/xfs/xfs_aops.c [ a03297a0ca9f2("xfs: manage inode DONTCACHE status at irele time") is not applied. 21b4ee7029c90("xfs: drop ->writepage completely") is not applied.] Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/xfs/xfs_aops.c | 13 ------------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 3 files changed, 6 insertions(+), 24 deletions(-) diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index ef7db9defef1..e751cf34ccba 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -552,12 +552,6 @@ xfs_vm_writepage( { struct xfs_writepage_ctx wpc = { }; - if (WARN_ON_ONCE(current->journal_info)) { - redirty_page_for_writepage(wbc, page); - unlock_page(page); - return 0; - } - return iomap_writepage(page, wbc, &wpc.ctx, &xfs_writeback_ops); } @@ -568,13 +562,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index bdf55ed88680..fae443e0d120 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2043,8 +2043,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2052,7 +2054,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 731af3f04c83..d512fdd5f7c3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -271,19 +271,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -291,10 +286,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 11561/22966] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 18 Jun '24

18 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 26bfb7d9b0ef31487312e8e9e6eb097acaf5d739 commit: fb55aa477dfa7f488f112a8b87116962d623ff63 [11561/22966] net: hns3: place cae regconfig-related implementations in an independent file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240618/202406181827.cAEjNIex-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240618/202406181827.cAEjNIex-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406181827.cAEjNIex-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:51:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:52:13: sparse: sparse: symbol 'g_hns3_cae_cdev' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:55:5: sparse: sparse: symbol 'g_hns3_cae_init_flag' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:56:5: sparse: sparse: symbol 'g_hns3_cae_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: got void *in_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: got void *out_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: sparse: sparse: symbol 'hns3_cae_get_commit_id' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: got void * drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: expected unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: warning: no previous prototype for 'hns3_cae_get_commit_id' [-Wmissing-prototypes] 224 | int hns3_cae_get_commit_id(struct hnae3_handle *handle, u8 *commit_id, | ^~~~~~~~~~~~~~~~~~~~~~ vim +597 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c 558 559 int hns3_cae_common_cmd_send(struct hns3_nic_priv *net_priv, void *buf_in, 560 u32 in_size, void *buf_out, u32 out_size) 561 { 562 #define MAX_DESC_DATA_LEN 6 563 struct cmd_desc_param *param_in; 564 struct hclge_vport *vport; 565 struct hclge_dev *hdev; 566 struct hclge_desc desc; 567 bool check; 568 int ret; 569 int i; 570 571 check = !buf_in || in_size < sizeof(struct cmd_desc_param); 572 vport = hns3_cae_get_vport(net_priv->ae_handle); 573 hdev = vport->back; 574 575 param_in = (struct cmd_desc_param *)buf_in; 576 hns3_cae_cmd_setup_basic_desc(&desc, param_in->fw_dw_opcode, 577 param_in->is_read); 578 for (i = 0; i < MAX_DESC_DATA_LEN; i++) 579 desc.data[i] = param_in->reg_desc.data[i]; 580 ret = hns3_cae_cmd_send(hdev, &desc, 1); 581 if (ret) { 582 dev_err(&hdev->pdev->dev, "%s, ret is %d.\n", __func__, 583 ret); 584 return ret; 585 } 586 if (param_in->is_read) { 587 struct cmd_desc_param *param_out = 588 (struct cmd_desc_param *)buf_out; 589 590 check = !buf_out || out_size < sizeof(struct cmd_desc_param); 591 if (check) { 592 pr_err("input param buf_out error in %s function\n", 593 __func__); 594 return -EFAULT; 595 } 596 for (i = 0; i < MAX_DESC_DATA_LEN; i++) > 597 param_out->reg_desc.data[i] = desc.data[i]; -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2023-52791
by Kaixiong Yu 18 Jun '24

18 Jun '24

Benjamin Bara (2): i2c: core: Run atomic i2c xfer when !preemptible i2c: core: Fix atomic xfer check for non-preempt config drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] block: check io size before submit discard
by Li Nan 18 Jun '24

18 Jun '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K0H3 -------------------------------- In __blkdev_issue_discard(), q->limits.discard_granularity is read multi times. WARN_ON_ONCE(!q->limits.discard_granularity) [1] ... q->limits.discard_granularity >> SECTOR_SHIFT [2] ... bio_aligned_discard_max_sectors [3] It can be changed to 0 after check [1], such as submitting ioctl 'LOOP_SET_STATUS'. This is undesirable. If 'discard_granularity' is set to 0, BUG_ON might be triggered and the loop of 'while(nr_sects)' will never exit(see fixes commit). Fix it by checking 'req_sects' before submit io, return error code directly if it is 0. Fixes: b35fd7422c2f ("block: check queue's limits.discard_granularity in __blkdev_issue_discard()") Signed-off-by: Li Nan <linan122(a)huawei.com> --- block/blk-lib.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/block/blk-lib.c b/block/blk-lib.c index e90614fd8d6a..59ff99bc4698 100644 --- a/block/blk-lib.c +++ b/block/blk-lib.c @@ -27,7 +27,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, struct bio **biop) { struct request_queue *q = bdev_get_queue(bdev); - struct bio *bio = *biop; + struct bio *bio = NULL; unsigned int op; sector_t bs_mask, part_offset = 0; @@ -92,6 +92,17 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, req_sects = min_t(sector_t, nr_sects, granularity_aligned_lba - sector_mapped); + if (!req_sects) { + /* just put the bio allocated in this function */ + if (bio) { + bio_io_error(bio); + bio_put(bio); + } + return -EOPNOTSUPP; + } + if (!bio) + bio = *biop; + WARN_ON_ONCE((req_sects << 9) > UINT_MAX); bio = blk_next_bio(bio, 0, gfp_mask); -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2023-52791
by Kaixiong Yu 18 Jun '24

18 Jun '24

Benjamin Bara (2): i2c: core: Run atomic i2c xfer when !preemptible i2c: core: Fix atomic xfer check for non-preempt config drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-52791
by Kaixiong Yu 18 Jun '24

18 Jun '24

Benjamin Bara (2): i2c: core: Run atomic i2c xfer when !preemptible i2c: core: Fix atomic xfer check for non-preempt config drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-52791
by Kaixiong Yu 18 Jun '24

18 Jun '24

Benjamin Bara (2): i2c: core: Run atomic i2c xfer when !preemptible i2c: core: Fix atomic xfer check for non-preempt config drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS v2] atl1c: Work around the DMA RX overflow issue
by Dong Chenchen 18 Jun '24

18 Jun '24

From: Sieng-Piaw Liew <liew.s.piaw(a)gmail.com> mainline inclusion from mainline-v6.7-rc1 commit 86565682e9053e5deb128193ea9e88531bbae9cf category: bugfix bugzilla: 190056, https://gitee.com/src-openeuler/kernel/issues/I9REDN CVE: CVE-2023-52834 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This is based on alx driver commit 881d0327db37 ("net: alx: Work around the DMA RX overflow issue"). The alx and atl1c drivers had RX overflow error which was why a custom allocator was created to avoid certain addresses. The simpler workaround then created for alx driver, but not for atl1c due to lack of tester. Instead of using a custom allocator, check the allocated skb address and use skb_reserve() to move away from problematic 0x...fc0 address. Tested on AR8131 on Acer 4540. Signed-off-by: Sieng-Piaw Liew <liew.s.piaw(a)gmail.com> Link: https://lore.kernel.org/r/20230912010711.12036-1-liew.s.piaw@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/ethernet/atheros/atl1c/atl1c.h drivers/net/ethernet/atheros/atl1c/atl1c_main.c [commit 8042824a3c0b and 057f4af2b171 support multiple rx queues for atk1c driver, which lead to context conflicts. commit a9d6df642dc8 use napi_alloc_skb() to optimize performance in NAPI context, which not merged] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/atheros/atl1c/atl1c.h | 3 -- .../net/ethernet/atheros/atl1c/atl1c_main.c | 52 +++++-------------- 2 files changed, 12 insertions(+), 43 deletions(-) diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c.h b/drivers/net/ethernet/atheros/atl1c/atl1c.h index c46b489ce9b4..366a8ab6ecfe 100644 --- a/drivers/net/ethernet/atheros/atl1c/atl1c.h +++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h @@ -519,9 +519,6 @@ struct atl1c_adapter { struct net_device *netdev; struct pci_dev *pdev; struct napi_struct napi; - struct page *rx_page; - unsigned int rx_page_offset; - unsigned int rx_frag_size; struct atl1c_hw hw; struct atl1c_hw_stats hw_stats; struct mii_if_info mii; /* MII interface info */ diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c index 7087b88550db..d8eb7dcf278f 100644 --- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c @@ -480,15 +480,10 @@ static int atl1c_set_mac_addr(struct net_device *netdev, void *p) static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter, struct net_device *dev) { - unsigned int head_size; int mtu = dev->mtu; adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ? roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE; - - head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) + - SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); - adapter->rx_frag_size = roundup_pow_of_two(head_size); } static netdev_features_t atl1c_fix_features(struct net_device *netdev, @@ -960,10 +955,6 @@ static void atl1c_free_ring_resources(struct atl1c_adapter *adapter) kfree(adapter->tpd_ring[0].buffer_info); adapter->tpd_ring[0].buffer_info = NULL; } - if (adapter->rx_page) { - put_page(adapter->rx_page); - adapter->rx_page = NULL; - } } /** @@ -1666,36 +1657,6 @@ static inline void atl1c_rx_checksum(struct atl1c_adapter *adapter, skb_checksum_none_assert(skb); } -static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter) -{ - struct sk_buff *skb; - struct page *page; - - if (adapter->rx_frag_size > PAGE_SIZE) - return netdev_alloc_skb(adapter->netdev, - adapter->rx_buffer_len); - - page = adapter->rx_page; - if (!page) { - adapter->rx_page = page = alloc_page(GFP_ATOMIC); - if (unlikely(!page)) - return NULL; - adapter->rx_page_offset = 0; - } - - skb = build_skb(page_address(page) + adapter->rx_page_offset, - adapter->rx_frag_size); - if (likely(skb)) { - skb_reserve(skb, NET_SKB_PAD); - adapter->rx_page_offset += adapter->rx_frag_size; - if (adapter->rx_page_offset >= PAGE_SIZE) - adapter->rx_page = NULL; - else - get_page(page); - } - return skb; -} - static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter) { struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring; @@ -1717,13 +1678,24 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter) while (next_info->flags & ATL1C_BUFFER_FREE) { rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use); - skb = atl1c_alloc_skb(adapter); + /* When DMA RX address is set to something like + * 0x....fc0, it will be very likely to cause DMA + * RFD overflow issue. + * + * To work around it, we apply rx skb with 64 bytes + * longer space, and offset the address whenever + * 0x....fc0 is detected. + */ + skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len + 64); if (unlikely(!skb)) { if (netif_msg_rx_err(adapter)) dev_warn(&pdev->dev, "alloc rx buffer failed\n"); break; } + if (((unsigned long)skb->data & 0xfff) == 0xfc0) + skb_reserve(skb, 64); + /* * Make buffer alignment 2 beyond a 16 byte boundary * this will result in a 16 byte aligned IP header after -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] fix function cast warnings
by Chen Ridong 18 Jun '24

18 Jun '24

*** BLURB HERE *** Arnd Bergmann (1): crypto: arm/sha - fix function cast warnings arch/arm/crypto/sha256_glue.c | 13 +++++-------- arch/arm/crypto/sha512-glue.c | 12 +++++------- 2 files changed, 10 insertions(+), 15 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] i2c: core: Run atomic i2c xfer when !preemptible
by Kaixiong Yu 18 Jun '24

18 Jun '24

Benjamin Bara (2): i2c: core: Run atomic i2c xfer when !preemptible i2c: core: Fix atomic xfer check for non-preempt config drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] serial: 8250_exar: Don't remove GPIO device on suspend
by Yi Yang 18 Jun '24

18 Jun '24

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> stable inclusion from stable-v4.19.311 commit 787e2620d1574196f10193a7c3693d95958254cb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6BE4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 73b5a5c00be39e23b194bad10e1ea8bb73eee176 ] It seems a copy&paste mistake that suspend callback removes the GPIO device. There is no counterpart of this action, means once suspended there is no more GPIO device available untile full unbind-bind cycle is performed. Remove suspicious GPIO device removal in suspend. Fixes: d0aeaa83f0b0 ("serial: exar: split out the exar code from 8250_pci") Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Link: https://lore.kernel.org/r/20240219150627.2101198-2-andriy.shevchenko@linux.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/8250/8250_exar.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c index 18a373d89480..c1444b140015 100644 --- a/drivers/tty/serial/8250/8250_exar.c +++ b/drivers/tty/serial/8250/8250_exar.c @@ -535,6 +535,7 @@ static void exar_pci_remove(struct pci_dev *pcidev) for (i = 0; i < priv->nr; i++) serial8250_unregister_port(priv->line[i]); + /* Ensure that every init quirk is properly torn down */ if (priv->board->exit) priv->board->exit(pcidev); } @@ -549,10 +550,6 @@ static int __maybe_unused exar_suspend(struct device *dev) if (priv->line[i] >= 0) serial8250_suspend_port(priv->line[i]); - /* Ensure that every init quirk is properly torn down */ - if (priv->board->exit) - priv->board->exit(pcidev); - return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] fix function cast warnings
by Chen Ridong 18 Jun '24

18 Jun '24

*** BLURB HERE *** Arnd Bergmann (1): crypto: arm/sha - fix function cast warnings arch/arm/crypto/sha256_glue.c | 13 +++++-------- arch/arm/crypto/sha512-glue.c | 12 +++++------- 2 files changed, 10 insertions(+), 15 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 v2 0/2] CVE-2023-52810
by Li Nan 18 Jun '24

18 Jun '24

V2: fix bugzilla tag. Juntong Deng (1): fs/jfs: Add check for negative db_l2nbperpage Siddh Raman Pant (1): jfs: jfs_dmap: Validate db_l2nbperpage while mounting fs/jfs/jfs_filsys.h | 2 ++ fs/jfs/jfs_dmap.c | 7 +++++++ 2 files changed, 9 insertions(+) -- 2.39.2

2 3

[PATCH OLK-6.6 0/1] Fix allmodconfig build frame size error
by Shuai Wu 18 Jun '24

18 Jun '24

Fix allmodconfig build frame size is large than 2048 bytes error in hiroce3 driver. Fixes: 5bc8dbb5fdf5 ("infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver") Shuai Wu (1): net/ethernet/huawei/hiroce3: Fix allmodconfig build frame size error drivers/infiniband/hw/hiroce3/dfx/roce_dfx_query.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH openEuler-1.0-LTS v2 0/2] CVE-2024-36971
by Liu Jian 18 Jun '24

18 Jun '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 4 ++++ include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 33 insertions(+), 46 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 11555/22961] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 18 Jun '24

18 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 74cd1e5b892070aee2e2ce11eae993856552e98c commit: 8ad07513042c8fef5a03b404f0bbf066f603c101 [11555/22961] net: hns3: place dcqcn implementations in an ind file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240618/202406181426.ygyn6idN-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240618/202406181426.ygyn6idN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406181426.ygyn6idN-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:42:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:42:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:42:22: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:43:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:43:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:43:22: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:44:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:44:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:44:22: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:53:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:53:23: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:53:23: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:255:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_rx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:255:42: sparse: expected unsigned int [usertype] dcqcn_rx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:255:42: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:256:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_tx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:256:42: sparse: expected unsigned int [usertype] dcqcn_tx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:256:42: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:257:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_db_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:257:42: sparse: expected unsigned int [usertype] dcqcn_db_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:257:42: sparse: got restricted __le32 vim +39 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c 15 16 static int hns3_dcqcn_rw(struct hns3_nic_priv *net_priv, 17 u32 offset, u32 *data, u32 rw_type) 18 { 19 struct hnae3_handle *h = net_priv->ae_handle; 20 struct hclge_vport *vport; 21 struct hclge_dev *hdev; 22 struct hclge_desc desc; 23 int ret; 24 25 if (!data) 26 return -EFAULT; 27 28 vport = container_of(h, struct hclge_vport, nic); 29 hdev = vport->back; 30 31 if (rw_type == DEVMEM_CFG_READ) { 32 hns3_cae_cmd_setup_basic_desc(&desc, 33 HCLGE_OPC_DCQCN_TEMPLATE_CFG, 34 true); 35 } else { 36 hns3_cae_cmd_setup_basic_desc(&desc, 37 HCLGE_OPC_DCQCN_TEMPLATE_CFG, 38 false); > 39 desc.data[2] = *data; 40 } 41 > 42 desc.data[0] = SCC_TEMP_LOW_ADDR + offset; > 43 desc.data[1] = SCC_TEMP_HIGH_ADDR; 44 desc.data[4] = 32; 45 46 ret = hns3_cae_cmd_send(hdev, &desc, 1); 47 if (ret) { 48 dev_err(&hdev->pdev->dev, "disable net lane failed %d\n", ret); 49 return ret; 50 } 51 52 if (rw_type == DEVMEM_CFG_READ) > 53 *data = desc.data[2]; 54 55 return 0; 56 } 57 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 v2 0/3] CVE-2024-36971
by Liu Jian 18 Jun '24

18 Jun '24

CVE-2024-36971 Eric Dumazet (2): net: annotate data-races around sk->sk_dst_pending_confirm net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 3 ++- include/net/sock.h | 17 +++++------------ net/core/sock.c | 2 +- net/ipv4/route.c | 22 ++++++++-------------- net/ipv4/tcp_output.c | 2 +- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 7 files changed, 35 insertions(+), 51 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 v2 0/2] CVE-2024-36971
by Liu Jian 18 Jun '24

18 Jun '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 3 ++- include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 31 insertions(+), 47 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] i2c: core: Run atomic i2c xfer when !preemptible
by Kaixiong Yu 18 Jun '24

18 Jun '24

fix CVE-2023-52791 Benjamin Bara (2): i2c: core: Run atomic i2c xfer when !preemptible i2c: core: Fix atomic xfer check for non-preempt config drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] net: ethernet: fix potential use-after-free in ec_bhf_remove
by Kaixiong Yu 18 Jun '24

18 Jun '24

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v4.19.196 commit 0260916843cc74f3906acf8b6f256693e01530a2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4HZ CVE: CVE-2021-47235 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9cca0c2d70149160407bda9a9446ce0c29b6e6c6 ] static void ec_bhf_remove(struct pci_dev *dev) { ... struct ec_bhf_priv *priv = netdev_priv(net_dev); unregister_netdev(net_dev); free_netdev(net_dev); pci_iounmap(dev, priv->dma_io); pci_iounmap(dev, priv->io); ... } priv is netdev private data, but it is used after free_netdev(). It can cause use-after-free when accessing priv pointer. So, fix it by moving free_netdev() after pci_iounmap() calls. Fixes: 6af55ff52b02 ("Driver for Beckhoff CX5020 EtherCAT master module.") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/net/ethernet/ec_bhf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/ec_bhf.c b/drivers/net/ethernet/ec_bhf.c index d71cba0842c5..59dc20020c73 100644 --- a/drivers/net/ethernet/ec_bhf.c +++ b/drivers/net/ethernet/ec_bhf.c @@ -585,10 +585,12 @@ static void ec_bhf_remove(struct pci_dev *dev) struct ec_bhf_priv *priv = netdev_priv(net_dev); unregister_netdev(net_dev); - free_netdev(net_dev); pci_iounmap(dev, priv->dma_io); pci_iounmap(dev, priv->io); + + free_netdev(net_dev); + pci_release_regions(dev); pci_clear_master(dev); pci_disable_device(dev); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] mm: swap: fix race between free_swap_and_cache() and swapoff()
by Jinjiang Tu 18 Jun '24

18 Jun '24

From: Ryan Roberts <ryan.roberts(a)arm.com> stable inclusion from stable-v5.10.215 commit d85c11c97ecf92d47a4b29e3faca714dc1f18d0d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4RJ CVE: CVE-2024-26960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 82b1c07a0af603e3c47b906c8e991dc96f01688e ] There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_and_cache() was running in another thread. This could cause, amongst other bad possibilities, swap_page_trans_huge_swapped() (called by free_swap_and_cache()) to access the freed memory for swap_map. This is a theoretical problem and I haven't been able to provoke it from a test case. But there has been agreement based on code review that this is possible (see link below). Fix it by using get_swap_device()/put_swap_device(), which will stall swapoff(). There was an extra check in _swap_info_get() to confirm that the swap entry was not free. This isn't present in get_swap_device() because it doesn't make sense in general due to the race between getting the reference and swapoff. So I've added an equivalent check directly in free_swap_and_cache(). Details of how to provoke one possible issue (thanks to David Hildenbrand for deriving this): --8<----- __swap_entry_free() might be the last user and result in "count == SWAP_HAS_CACHE". swapoff->try_to_unuse() will stop as soon as soon as si->inuse_pages==0. So the question is: could someone reclaim the folio and turn si->inuse_pages==0, before we completed swap_page_trans_huge_swapped(). Imagine the following: 2 MiB folio in the swapcache. Only 2 subpages are still references by swap entries. Process 1 still references subpage 0 via swap entry. Process 2 still references subpage 1 via swap entry. Process 1 quits. Calls free_swap_and_cache(). -> count == SWAP_HAS_CACHE [then, preempted in the hypervisor etc.] Process 2 quits. Calls free_swap_and_cache(). -> count == SWAP_HAS_CACHE Process 2 goes ahead, passes swap_page_trans_huge_swapped(), and calls __try_to_reclaim_swap(). __try_to_reclaim_swap()->folio_free_swap()->delete_from_swap_cache()-> put_swap_folio()->free_swap_slot()->swapcache_free_entries()-> swap_entry_free()->swap_range_free()-> ... WRITE_ONCE(si->inuse_pages, si->inuse_pages - nr_entries); What stops swapoff to succeed after process 2 reclaimed the swap cache but before process1 finished its call to swap_page_trans_huge_swapped()? --8<----- Link: https://lkml.kernel.org/r/20240306140356.3974886-1-ryan.roberts@arm.com Fixes: 7c00bafee87c ("mm/swap: free swap slots in batch") Closes: https://lore.kernel.org/linux-mm/65a66eb9-41f8-4790-8db2-0c70ea15979f@redha… Signed-off-by: Ryan Roberts <ryan.roberts(a)arm.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: "Huang, Ying" <ying.huang(a)intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/swapfile.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/mm/swapfile.c b/mm/swapfile.c index a10c67728e46..2f8a099f014b 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -1373,6 +1373,11 @@ static unsigned char __swap_entry_free_locked(struct swap_info_struct *p, } /* + * Note that when only holding the PTL, swapoff might succeed immediately + * after freeing a swap entry. Therefore, immediately after + * __swap_entry_free(), the swap info might become stale and should not + * be touched without a prior get_swap_device(). + * * Check whether swap entry is valid in the swap device. If so, * return pointer to swap_info_struct, and keep the swap entry valid * via preventing the swap device from being swapoff, until @@ -1899,13 +1904,19 @@ int free_swap_and_cache(swp_entry_t entry) if (non_swap_entry(entry)) return 1; - p = _swap_info_get(entry); + p = get_swap_device(entry); if (p) { + if (WARN_ON(data_race(!p->swap_map[swp_offset(entry)]))) { + put_swap_device(p); + return 0; + } + count = __swap_entry_free(p, entry); if (count == SWAP_HAS_CACHE && !swap_page_trans_huge_swapped(p, entry)) __try_to_reclaim_swap(p, swp_offset(entry), TTRS_UNMAPPED | TTRS_FULL); + put_swap_device(p); } return p != NULL; } -- 2.25.1

2 1

[PATCH OLK-5.10] mm: swap: fix race between free_swap_and_cache() and swapoff()
by Jinjiang Tu 18 Jun '24

18 Jun '24

From: Ryan Roberts <ryan.roberts(a)arm.com> stable inclusion from stable-v5.10.215 commit d85c11c97ecf92d47a4b29e3faca714dc1f18d0d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4RJ CVE: CVE-2024-26960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 82b1c07a0af603e3c47b906c8e991dc96f01688e ] There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_and_cache() was running in another thread. This could cause, amongst other bad possibilities, swap_page_trans_huge_swapped() (called by free_swap_and_cache()) to access the freed memory for swap_map. This is a theoretical problem and I haven't been able to provoke it from a test case. But there has been agreement based on code review that this is possible (see link below). Fix it by using get_swap_device()/put_swap_device(), which will stall swapoff(). There was an extra check in _swap_info_get() to confirm that the swap entry was not free. This isn't present in get_swap_device() because it doesn't make sense in general due to the race between getting the reference and swapoff. So I've added an equivalent check directly in free_swap_and_cache(). Details of how to provoke one possible issue (thanks to David Hildenbrand for deriving this): --8<----- __swap_entry_free() might be the last user and result in "count == SWAP_HAS_CACHE". swapoff->try_to_unuse() will stop as soon as soon as si->inuse_pages==0. So the question is: could someone reclaim the folio and turn si->inuse_pages==0, before we completed swap_page_trans_huge_swapped(). Imagine the following: 2 MiB folio in the swapcache. Only 2 subpages are still references by swap entries. Process 1 still references subpage 0 via swap entry. Process 2 still references subpage 1 via swap entry. Process 1 quits. Calls free_swap_and_cache(). -> count == SWAP_HAS_CACHE [then, preempted in the hypervisor etc.] Process 2 quits. Calls free_swap_and_cache(). -> count == SWAP_HAS_CACHE Process 2 goes ahead, passes swap_page_trans_huge_swapped(), and calls __try_to_reclaim_swap(). __try_to_reclaim_swap()->folio_free_swap()->delete_from_swap_cache()-> put_swap_folio()->free_swap_slot()->swapcache_free_entries()-> swap_entry_free()->swap_range_free()-> ... WRITE_ONCE(si->inuse_pages, si->inuse_pages - nr_entries); What stops swapoff to succeed after process 2 reclaimed the swap cache but before process1 finished its call to swap_page_trans_huge_swapped()? --8<----- Link: https://lkml.kernel.org/r/20240306140356.3974886-1-ryan.roberts@arm.com Fixes: 7c00bafee87c ("mm/swap: free swap slots in batch") Closes: https://lore.kernel.org/linux-mm/65a66eb9-41f8-4790-8db2-0c70ea15979f@redha… Signed-off-by: Ryan Roberts <ryan.roberts(a)arm.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: "Huang, Ying" <ying.huang(a)intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/swapfile.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/mm/swapfile.c b/mm/swapfile.c index a10c67728e46..2f8a099f014b 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -1373,6 +1373,11 @@ static unsigned char __swap_entry_free_locked(struct swap_info_struct *p, } /* + * Note that when only holding the PTL, swapoff might succeed immediately + * after freeing a swap entry. Therefore, immediately after + * __swap_entry_free(), the swap info might become stale and should not + * be touched without a prior get_swap_device(). + * * Check whether swap entry is valid in the swap device. If so, * return pointer to swap_info_struct, and keep the swap entry valid * via preventing the swap device from being swapoff, until @@ -1899,13 +1904,19 @@ int free_swap_and_cache(swp_entry_t entry) if (non_swap_entry(entry)) return 1; - p = _swap_info_get(entry); + p = get_swap_device(entry); if (p) { + if (WARN_ON(data_race(!p->swap_map[swp_offset(entry)]))) { + put_swap_device(p); + return 0; + } + count = __swap_entry_free(p, entry); if (count == SWAP_HAS_CACHE && !swap_page_trans_huge_swapped(p, entry)) __try_to_reclaim_swap(p, swp_offset(entry), TTRS_UNMAPPED | TTRS_FULL); + put_swap_device(p); } return p != NULL; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
by Jinjiang Tu 18 Jun '24

18 Jun '24

From: Yongqiang Liu <liuyongqiang13(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit 0c66c6f4e21cb22220cbd8821c5c73fc157d20dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5E2 CVE: CVE-2024-26947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") changes the semantics of pfn_valid() to check presence of the memory map for a PFN. A valid page for an address which is reserved but not mapped by the kernel[1], the system crashed during some uio test with the following memory layout: node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff] node 0: [mem 0x00000000d0000000-0x00000000da1fffff] the uio layout is：0xc0900000, 0x100000 the crash backtrace like: Unable to handle kernel paging request at virtual address bff00000 [...] CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1 Hardware name: Generic DT based system PC is at b15_flush_kern_dcache_area+0x24/0x3c LR is at __sync_icache_dcache+0x6c/0x98 [...] (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98) (__sync_icache_dcache) from (set_pte_at+0x28/0x54) (set_pte_at) from (remap_pfn_range+0x1a0/0x274) (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio]) (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4) (__mmap_region) from (__do_mmap_mm+0x3ec/0x440) (__do_mmap_mm) from (do_mmap+0x50/0x58) (do_mmap) from (vm_mmap_pgoff+0xfc/0x188) (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4) (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c) Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e) ---[ end trace 09cf0734c3805d52 ]--- Kernel panic - not syncing: Fatal exception So check if PG_reserved was set to solve this issue. [1]: https://lore.kernel.org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/ Fixes: a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") Suggested-by: Mike Rapoport <rppt(a)linux.ibm.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Conflicts: arch/arm/mm/flush.c [Conflicts due to folio api.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- arch/arm/mm/flush.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c index 6d89db7895d1..ef848bf0df28 100644 --- a/arch/arm/mm/flush.c +++ b/arch/arm/mm/flush.c @@ -280,6 +280,9 @@ void __sync_icache_dcache(pte_t pteval) return; page = pfn_to_page(pfn); + if (PageReserved(page)) + return; + if (cache_is_vipt_aliasing()) mapping = page_mapping_file(page); else -- 2.25.1

2 1

[PATCH OLK-5.10] ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
by Jinjiang Tu 18 Jun '24

18 Jun '24

From: Yongqiang Liu <liuyongqiang13(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit 0c66c6f4e21cb22220cbd8821c5c73fc157d20dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5E2 CVE: CVE-2024-26947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") changes the semantics of pfn_valid() to check presence of the memory map for a PFN. A valid page for an address which is reserved but not mapped by the kernel[1], the system crashed during some uio test with the following memory layout: node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff] node 0: [mem 0x00000000d0000000-0x00000000da1fffff] the uio layout is：0xc0900000, 0x100000 the crash backtrace like: Unable to handle kernel paging request at virtual address bff00000 [...] CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1 Hardware name: Generic DT based system PC is at b15_flush_kern_dcache_area+0x24/0x3c LR is at __sync_icache_dcache+0x6c/0x98 [...] (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98) (__sync_icache_dcache) from (set_pte_at+0x28/0x54) (set_pte_at) from (remap_pfn_range+0x1a0/0x274) (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio]) (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4) (__mmap_region) from (__do_mmap_mm+0x3ec/0x440) (__do_mmap_mm) from (do_mmap+0x50/0x58) (do_mmap) from (vm_mmap_pgoff+0xfc/0x188) (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4) (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c) Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e) ---[ end trace 09cf0734c3805d52 ]--- Kernel panic - not syncing: Fatal exception So check if PG_reserved was set to solve this issue. [1]: https://lore.kernel.org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/ Fixes: a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") Suggested-by: Mike Rapoport <rppt(a)linux.ibm.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Conflicts: arch/arm/mm/flush.c [Conflicts due to folio api.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- arch/arm/mm/flush.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c index 6d89db7895d1..ef848bf0df28 100644 --- a/arch/arm/mm/flush.c +++ b/arch/arm/mm/flush.c @@ -280,6 +280,9 @@ void __sync_icache_dcache(pte_t pteval) return; page = pfn_to_page(pfn); + if (PageReserved(page)) + return; + if (cache_is_vipt_aliasing()) mapping = page_mapping_file(page); else -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] hsr: Prevent use after free in prp_create_tagged_frame()
by Yue Haibing 18 Jun '24

18 Jun '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.201 commit ddf4e04e946aaa6c458b8b6829617cc44af2bffd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9DFT4 CVE: CVE-2023-52846 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 876f8ab52363f649bcc74072157dfd7adfbabc0d ] The prp_fill_rct() function can fail. In that situation, it frees the skb and returns NULL. Meanwhile on the success path, it returns the original skb. So it's straight forward to fix bug by using the returned value. Fixes: 451d8123f897 ("net: prp: add packet handling support") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/57af1f28-7f57-4a96-bcd3-b7a0f2340845@moroto.mount… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/hsr/hsr_forward.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c index baf4765be6d7..4d1a2a48cf3f 100644 --- a/net/hsr/hsr_forward.c +++ b/net/hsr/hsr_forward.c @@ -294,9 +294,7 @@ struct sk_buff *prp_create_tagged_frame(struct hsr_frame_info *frame, skb = skb_copy_expand(frame->skb_std, 0, skb_tailroom(frame->skb_std) + HSR_HLEN, GFP_ATOMIC); - prp_fill_rct(skb, frame, port); - - return skb; + return prp_fill_rct(skb, frame, port); } static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev, -- 2.34.1

2 1

[PATCH OLK-6.6] arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
by Wei Li 18 Jun '24

18 Jun '24

mainline inclusion from mainline-v6.10-rc3 commit 14951beaec93696b092a906baa0f29322cf34004 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA67DS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- The function run_all_insn_set_hw_mode() is registered as startup callback of 'CPUHP_AP_ARM64_ISNDEP_STARTING', it invokes set_hw_mode() methods of all emulated instructions. As the STARTING callbacks are not expected to fail, if one of the set_hw_mode() fails, e.g. due to el0 mixed-endian is not supported for 'setend', it will report a warning: ``` CPU[2] cannot support the emulation of setend CPU 2 UP state arm64/isndep:starting (136) failed (-22) CPU2: Booted secondary processor 0x0000000002 [0x414fd0c1] ``` To fix it, add a check for INSN_UNAVAILABLE status and skip the process. Signed-off-by: Wei Li <liwei391(a)huawei.com> Tested-by: Huisong Li <lihuisong(a)huawei.com> Link: https://lore.kernel.org/r/20240423093501.3460764-1-liwei391@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> --- arch/arm64/kernel/armv8_deprecated.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c index fd0f291e215e..87ac0b9c0b4f 100644 --- a/arch/arm64/kernel/armv8_deprecated.c +++ b/arch/arm64/kernel/armv8_deprecated.c @@ -464,6 +464,9 @@ static int run_all_insn_set_hw_mode(unsigned int cpu) for (int i = 0; i < ARRAY_SIZE(insn_emulations); i++) { struct insn_emulation *insn = insn_emulations[i]; bool enable = READ_ONCE(insn->current_mode) == INSN_HW; + if (insn->status == INSN_UNAVAILABLE) + continue; + if (insn->set_hw_mode && insn->set_hw_mode(enable)) { pr_warn("CPU[%u] cannot support the emulation of %s", cpu, insn->name); -- 2.25.1

2 1

[PATCH OLK-5.10] arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process
by Wei Li 18 Jun '24

18 Jun '24

mainline inclusion from mainline-v6.10-rc3 commit 14951beaec93696b092a906baa0f29322cf34004 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA67DS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- The function run_all_insn_set_hw_mode() is registered as startup callback of 'CPUHP_AP_ARM64_ISNDEP_STARTING', it invokes set_hw_mode() methods of all emulated instructions. As the STARTING callbacks are not expected to fail, if one of the set_hw_mode() fails, e.g. due to el0 mixed-endian is not supported for 'setend', it will report a warning: ``` CPU[2] cannot support the emulation of setend CPU 2 UP state arm64/isndep:starting (136) failed (-22) CPU2: Booted secondary processor 0x0000000002 [0x414fd0c1] ``` To fix it, add a check for INSN_UNAVAILABLE status and skip the process. Signed-off-by: Wei Li <liwei391(a)huawei.com> Tested-by: Huisong Li <lihuisong(a)huawei.com> Link: https://lore.kernel.org/r/20240423093501.3460764-1-liwei391@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> --- arch/arm64/kernel/armv8_deprecated.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c index 637e57a4868e..cc736c5309fd 100644 --- a/arch/arm64/kernel/armv8_deprecated.c +++ b/arch/arm64/kernel/armv8_deprecated.c @@ -471,6 +471,9 @@ static int run_all_insn_set_hw_mode(unsigned int cpu) for (i = 0; i < ARRAY_SIZE(insn_emulations); i++) { struct insn_emulation *insn = insn_emulations[i]; bool enable = READ_ONCE(insn->current_mode) == INSN_HW; + if (insn->status == INSN_UNAVAILABLE) + continue; + if (insn->set_hw_mode && insn->set_hw_mode(enable)) { pr_warn("CPU[%u] cannot support the emulation of %s", cpu, insn->name); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-36971
by Liu Jian 18 Jun '24

18 Jun '24

CVE-2024-36971 Eric Dumazet (2): net: annotate data-races around sk->sk_dst_pending_confirm net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 4 ++++ include/net/sock.h | 17 +++++------------ net/core/sock.c | 2 +- net/ipv4/route.c | 22 ++++++++-------------- net/ipv4/tcp_output.c | 2 +- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 7 files changed, 37 insertions(+), 50 deletions(-) -- 2.34.1

2 4

[openeuler:openEuler-1.0-LTS 18309/22959] mm/share_pool.c:3736:12: warning: 'proc_overview_show' defined but not used
by kernel test robot 18 Jun '24

18 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f79871cf083fa1da67dce06a8cc2301cdddeab1b commit: 1cfc25ccec44c17c19c892bd31d00d8f6fb23f9b [18309/22959] share_pool: Add proc node to show process overview info config: arm64-randconfig-001-20240618 (https://download.01.org/0day-ci/archive/20240618/202406180519.p1XL1enF-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240618/202406180519.p1XL1enF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406180519.p1XL1enF-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/share_pool.c: In function 'sp_group_id_by_pid': mm/share_pool.c:840:29: warning: ordered comparison of pointer with integer zero [-Wextra] 840 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:2688:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 2688 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:2688:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:3824:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 3824 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:3837:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 3837 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:3859:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 3859 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:3861:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 3861 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c:3797:13: warning: variable 'node_id' set but not used [-Wunused-but-set-variable] 3797 | int node_id; | ^~~~~~~ mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:4018:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 4018 | page = hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:4018:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 4018 | page = hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:4018:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c: At top level: >> mm/share_pool.c:3736:12: warning: 'proc_overview_show' defined but not used [-Wunused-function] 3736 | static int proc_overview_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~~~~~ mm/share_pool.c:3693:12: warning: 'proc_stat_show' defined but not used [-Wunused-function] 3693 | static int proc_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~ mm/share_pool.c:3635:12: warning: 'spa_stat_show' defined but not used [-Wunused-function] 3635 | static int spa_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/proc_overview_show +3736 mm/share_pool.c 3735 > 3736 static int proc_overview_show(struct seq_file *seq, void *offset) 3737 { 3738 seq_printf(seq, "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n", 3739 "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES", 3740 "Non-SP_Shm", "VIRT"); 3741 3742 down_read(&sp_proc_stat_sem); 3743 idr_for_each(&sp_proc_stat_idr, idr_proc_overview_cb, seq); 3744 up_read(&sp_proc_stat_sem); 3745 return 0; 3746 } 3747 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21349/22959] drivers/mmc/host/phytium-mci-plat.c:169:23: error: lvalue required as unary '&' operand
by kernel test robot 18 Jun '24

18 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f79871cf083fa1da67dce06a8cc2301cdddeab1b commit: d65622e6edee11f7fcbd295bdb5aef86e12dfef3 [21349/22959] mmc: add support for Phytium MMC config: arm64-randconfig-004-20240618 (https://download.01.org/0day-ci/archive/20240618/202406180457.WkPIoFSW-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240618/202406180457.WkPIoFSW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406180457.WkPIoFSW-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/mmc/host/phytium-mci-plat.c:169:23: error: lvalue required as unary '&' operand 169 | .pm = &phytium_mci_dev_pm_ops, | ^ vim +169 drivers/mmc/host/phytium-mci-plat.c 161 162 static struct platform_driver phytium_mci_driver = { 163 .probe = phytium_mci_probe, 164 .remove = phytium_mci_remove, 165 .driver = { 166 .name = "phytium-mci-platform", 167 .of_match_table = phytium_mci_of_ids, 168 .acpi_match_table = phytium_mci_acpi_ids, > 169 .pm = &phytium_mci_dev_pm_ops, 170 }, 171 }; 172 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18183/22954] mm/share_pool.c:2121:12: warning: 'proc_stat_show' defined but not used
by kernel test robot 18 Jun '24

18 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 297a8114a17425dccc02597803b1c8049eb3b91b commit: 4a280fac30d27ae2aff096f9f99aa12d50f83426 [18183/22954] ascend: share_pool: support share pool features for ascend platform config: arm64-randconfig-001-20240618 (https://download.01.org/0day-ci/archive/20240618/202406180323.ePxYZgH5-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240618/202406180323.ePxYZgH5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406180323.ePxYZgH5-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ mm/share_pool.c: At top level: mm/share_pool.c:2235:12: warning: 'spa_stat_show' defined but not used [-Wunused-function] 2235 | static int spa_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~ >> mm/share_pool.c:2121:12: warning: 'proc_stat_show' defined but not used [-Wunused-function] 2121 | static int proc_stat_show(struct seq_file *seq, void *offset) | ^~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/proc_stat_show +2121 mm/share_pool.c 2120 > 2121 static int proc_stat_show(struct seq_file *seq, void *offset) 2122 { 2123 /* print the file header */ 2124 seq_printf(seq, "%-12s %-10s %-18s\n", 2125 "Process ID", "Group ID", "Aligned Apply(KB)"); 2126 /* print kthread buff_module_guard_work */ 2127 seq_printf(seq, "%-12s %-10s %-18ld\n", 2128 "guard", "-", byte2kb(kthread_stat.amount)); 2129 idr_for_each(&sp_stat_idr, idr_proc_stat_cb, seq); 2130 return 0; 2131 } 2132 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18311/22954] kernel/sysctl.c:1817:36: error: 'ten_thousand' undeclared here (not in a function); did you mean 'one_thousand'?
by kernel test robot 18 Jun '24

18 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 297a8114a17425dccc02597803b1c8049eb3b91b commit: 5a2c074184137763d604ffb3f0178da26bee5260 [18311/22954] share_pool: Add sp_alloc trace config: arm64-randconfig-004-20240618 (https://download.01.org/0day-ci/archive/20240618/202406180227.YzvSYbqW-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240618/202406180227.YzvSYbqW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406180227.YzvSYbqW-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/sysctl.c:1817:36: error: 'ten_thousand' undeclared here (not in a function); did you mean 'one_thousand'? 1817 | .extra2 = &ten_thousand, | ^~~~~~~~~~~~ | one_thousand vim +1817 kernel/sysctl.c 1274 1275 static struct ctl_table vm_table[] = { 1276 { 1277 .procname = "overcommit_memory", 1278 .data = &sysctl_overcommit_memory, 1279 .maxlen = sizeof(sysctl_overcommit_memory), 1280 .mode = 0644, 1281 .proc_handler = proc_dointvec_minmax, 1282 .extra1 = &zero, 1283 .extra2 = &two, 1284 }, 1285 { 1286 .procname = "panic_on_oom", 1287 .data = &sysctl_panic_on_oom, 1288 .maxlen = sizeof(sysctl_panic_on_oom), 1289 .mode = 0644, 1290 .proc_handler = proc_dointvec_minmax, 1291 .extra1 = &zero, 1292 .extra2 = &two, 1293 }, 1294 #ifdef CONFIG_ASCEND_OOM 1295 { 1296 /* 0: diasable, 1: enable, 2: disable and panic on oom */ 1297 .procname = "enable_oom_killer", 1298 .data = &sysctl_enable_oom_killer, 1299 .maxlen = sizeof(sysctl_enable_oom_killer), 1300 .mode = 0644, 1301 .proc_handler = proc_dointvec_minmax, 1302 .extra1 = &zero, 1303 .extra2 = &two, 1304 }, 1305 #endif 1306 { 1307 .procname = "oom_kill_allocating_task", 1308 .data = &sysctl_oom_kill_allocating_task, 1309 .maxlen = sizeof(sysctl_oom_kill_allocating_task), 1310 .mode = 0644, 1311 .proc_handler = proc_dointvec, 1312 }, 1313 { 1314 .procname = "oom_dump_tasks", 1315 .data = &sysctl_oom_dump_tasks, 1316 .maxlen = sizeof(sysctl_oom_dump_tasks), 1317 .mode = 0644, 1318 .proc_handler = proc_dointvec, 1319 }, 1320 { 1321 .procname = "overcommit_ratio", 1322 .data = &sysctl_overcommit_ratio, 1323 .maxlen = sizeof(sysctl_overcommit_ratio), 1324 .mode = 0644, 1325 .proc_handler = overcommit_ratio_handler, 1326 }, 1327 { 1328 .procname = "overcommit_kbytes", 1329 .data = &sysctl_overcommit_kbytes, 1330 .maxlen = sizeof(sysctl_overcommit_kbytes), 1331 .mode = 0644, 1332 .proc_handler = overcommit_kbytes_handler, 1333 }, 1334 { 1335 .procname = "page-cluster", 1336 .data = &page_cluster, 1337 .maxlen = sizeof(int), 1338 .mode = 0644, 1339 .proc_handler = proc_dointvec_minmax, 1340 .extra1 = &zero, 1341 }, 1342 { 1343 .procname = "dirty_background_ratio", 1344 .data = &dirty_background_ratio, 1345 .maxlen = sizeof(dirty_background_ratio), 1346 .mode = 0644, 1347 .proc_handler = dirty_background_ratio_handler, 1348 .extra1 = &zero, 1349 .extra2 = &one_hundred, 1350 }, 1351 { 1352 .procname = "dirty_background_bytes", 1353 .data = &dirty_background_bytes, 1354 .maxlen = sizeof(dirty_background_bytes), 1355 .mode = 0644, 1356 .proc_handler = dirty_background_bytes_handler, 1357 .extra1 = &one_ul, 1358 }, 1359 { 1360 .procname = "dirty_ratio", 1361 .data = &vm_dirty_ratio, 1362 .maxlen = sizeof(vm_dirty_ratio), 1363 .mode = 0644, 1364 .proc_handler = dirty_ratio_handler, 1365 .extra1 = &zero, 1366 .extra2 = &one_hundred, 1367 }, 1368 { 1369 .procname = "dirty_bytes", 1370 .data = &vm_dirty_bytes, 1371 .maxlen = sizeof(vm_dirty_bytes), 1372 .mode = 0644, 1373 .proc_handler = dirty_bytes_handler, 1374 .extra1 = &dirty_bytes_min, 1375 }, 1376 { 1377 .procname = "dirty_writeback_centisecs", 1378 .data = &dirty_writeback_interval, 1379 .maxlen = sizeof(dirty_writeback_interval), 1380 .mode = 0644, 1381 .proc_handler = dirty_writeback_centisecs_handler, 1382 }, 1383 { 1384 .procname = "dirty_expire_centisecs", 1385 .data = &dirty_expire_interval, 1386 .maxlen = sizeof(dirty_expire_interval), 1387 .mode = 0644, 1388 .proc_handler = proc_dointvec_minmax, 1389 .extra1 = &zero, 1390 }, 1391 { 1392 .procname = "dirtytime_expire_seconds", 1393 .data = &dirtytime_expire_interval, 1394 .maxlen = sizeof(dirtytime_expire_interval), 1395 .mode = 0644, 1396 .proc_handler = dirtytime_interval_handler, 1397 .extra1 = &zero, 1398 }, 1399 { 1400 .procname = "swappiness", 1401 .data = &vm_swappiness, 1402 .maxlen = sizeof(vm_swappiness), 1403 .mode = 0644, 1404 .proc_handler = proc_dointvec_minmax, 1405 .extra1 = &zero, 1406 .extra2 = &one_hundred, 1407 }, 1408 #ifdef CONFIG_SHRINK_PAGECACHE 1409 { 1410 .procname = "cache_reclaim_s", 1411 .data = &vm_cache_reclaim_s, 1412 .maxlen = sizeof(vm_cache_reclaim_s), 1413 .mode = 0644, 1414 .proc_handler = cache_reclaim_sysctl_handler, 1415 .extra1 = &vm_cache_reclaim_s_min, 1416 .extra2 = &vm_cache_reclaim_s_max, 1417 }, 1418 { 1419 .procname = "cache_reclaim_weight", 1420 .data = &vm_cache_reclaim_weight, 1421 .maxlen = sizeof(vm_cache_reclaim_weight), 1422 .mode = 0644, 1423 .proc_handler = proc_dointvec_minmax, 1424 .extra1 = &vm_cache_reclaim_weight_min, 1425 .extra2 = &vm_cache_reclaim_weight_max, 1426 }, 1427 { 1428 .procname = "cache_reclaim_enable", 1429 .data = &vm_cache_reclaim_enable, 1430 .maxlen = sizeof(vm_cache_reclaim_enable), 1431 .mode = 0644, 1432 .proc_handler = cache_reclaim_enable_handler, 1433 .extra1 = &zero, 1434 .extra2 = &one, 1435 }, 1436 #endif 1437 #ifdef CONFIG_HUGETLB_PAGE 1438 { 1439 .procname = "nr_hugepages", 1440 .data = NULL, 1441 .maxlen = sizeof(unsigned long), 1442 .mode = 0644, 1443 .proc_handler = hugetlb_sysctl_handler, 1444 }, 1445 #ifdef CONFIG_NUMA 1446 { 1447 .procname = "nr_hugepages_mempolicy", 1448 .data = NULL, 1449 .maxlen = sizeof(unsigned long), 1450 .mode = 0644, 1451 .proc_handler = &hugetlb_mempolicy_sysctl_handler, 1452 }, 1453 { 1454 .procname = "numa_stat", 1455 .data = &sysctl_vm_numa_stat, 1456 .maxlen = sizeof(int), 1457 .mode = 0644, 1458 .proc_handler = sysctl_vm_numa_stat_handler, 1459 .extra1 = &zero, 1460 .extra2 = &one, 1461 }, 1462 #endif 1463 { 1464 .procname = "hugetlb_shm_group", 1465 .data = &sysctl_hugetlb_shm_group, 1466 .maxlen = sizeof(gid_t), 1467 .mode = 0644, 1468 .proc_handler = proc_dointvec, 1469 }, 1470 { 1471 .procname = "nr_overcommit_hugepages", 1472 .data = NULL, 1473 .maxlen = sizeof(unsigned long), 1474 .mode = 0644, 1475 .proc_handler = hugetlb_overcommit_handler, 1476 }, 1477 #endif 1478 #ifdef CONFIG_MEMCG_QOS 1479 { 1480 .procname = "memcg_qos_enable", 1481 .data = &sysctl_memcg_qos_stat, 1482 .maxlen = sizeof(int), 1483 .mode = 0644, 1484 .proc_handler = sysctl_memcg_qos_handler, 1485 .extra1 = &zero, 1486 .extra2 = &one, 1487 }, 1488 #endif 1489 { 1490 .procname = "lowmem_reserve_ratio", 1491 .data = &sysctl_lowmem_reserve_ratio, 1492 .maxlen = sizeof(sysctl_lowmem_reserve_ratio), 1493 .mode = 0644, 1494 .proc_handler = lowmem_reserve_ratio_sysctl_handler, 1495 }, 1496 { 1497 .procname = "drop_caches", 1498 .data = &sysctl_drop_caches, 1499 .maxlen = sizeof(int), 1500 .mode = 0200, 1501 .proc_handler = drop_caches_sysctl_handler, 1502 .extra1 = &one, 1503 .extra2 = &four, 1504 }, 1505 { 1506 .procname = "drop_caches_loop_limit", 1507 .data = &drop_caches_loop_limit, 1508 .maxlen = sizeof(unsigned int), 1509 .mode = 0644, 1510 .proc_handler = proc_douintvec, 1511 }, 1512 1513 #ifdef CONFIG_COMPACTION 1514 { 1515 .procname = "compact_memory", 1516 .data = &sysctl_compact_memory, 1517 .maxlen = sizeof(int), 1518 .mode = 0200, 1519 .proc_handler = sysctl_compaction_handler, 1520 }, 1521 { 1522 .procname = "extfrag_threshold", 1523 .data = &sysctl_extfrag_threshold, 1524 .maxlen = sizeof(int), 1525 .mode = 0644, 1526 .proc_handler = sysctl_extfrag_handler, 1527 .extra1 = &min_extfrag_threshold, 1528 .extra2 = &max_extfrag_threshold, 1529 }, 1530 { 1531 .procname = "compact_unevictable_allowed", 1532 .data = &sysctl_compact_unevictable_allowed, 1533 .maxlen = sizeof(int), 1534 .mode = 0644, 1535 .proc_handler = proc_dointvec, 1536 .extra1 = &zero, 1537 .extra2 = &one, 1538 }, 1539 1540 #endif /* CONFIG_COMPACTION */ 1541 { 1542 .procname = "min_free_kbytes", 1543 .data = &min_free_kbytes, 1544 .maxlen = sizeof(min_free_kbytes), 1545 .mode = 0644, 1546 .proc_handler = min_free_kbytes_sysctl_handler, 1547 .extra1 = &zero, 1548 }, 1549 { 1550 .procname = "watermark_scale_factor", 1551 .data = &watermark_scale_factor, 1552 .maxlen = sizeof(watermark_scale_factor), 1553 .mode = 0644, 1554 .proc_handler = watermark_scale_factor_sysctl_handler, 1555 .extra1 = &one, 1556 .extra2 = &one_thousand, 1557 }, 1558 { 1559 .procname = "percpu_pagelist_fraction", 1560 .data = &percpu_pagelist_fraction, 1561 .maxlen = sizeof(percpu_pagelist_fraction), 1562 .mode = 0644, 1563 .proc_handler = percpu_pagelist_fraction_sysctl_handler, 1564 .extra1 = &zero, 1565 }, 1566 #ifdef CONFIG_MMU 1567 { 1568 .procname = "max_map_count", 1569 .data = &sysctl_max_map_count, 1570 .maxlen = sizeof(sysctl_max_map_count), 1571 .mode = 0644, 1572 .proc_handler = proc_dointvec_minmax, 1573 .extra1 = &zero, 1574 }, 1575 #else 1576 { 1577 .procname = "nr_trim_pages", 1578 .data = &sysctl_nr_trim_pages, 1579 .maxlen = sizeof(sysctl_nr_trim_pages), 1580 .mode = 0644, 1581 .proc_handler = proc_dointvec_minmax, 1582 .extra1 = &zero, 1583 }, 1584 #endif 1585 { 1586 .procname = "laptop_mode", 1587 .data = &laptop_mode, 1588 .maxlen = sizeof(laptop_mode), 1589 .mode = 0644, 1590 .proc_handler = proc_dointvec_jiffies, 1591 }, 1592 { 1593 .procname = "block_dump", 1594 .data = &block_dump, 1595 .maxlen = sizeof(block_dump), 1596 .mode = 0644, 1597 .proc_handler = proc_dointvec, 1598 .extra1 = &zero, 1599 }, 1600 { 1601 .procname = "vfs_cache_pressure", 1602 .data = &sysctl_vfs_cache_pressure, 1603 .maxlen = sizeof(sysctl_vfs_cache_pressure), 1604 .mode = 0644, 1605 .proc_handler = proc_dointvec, 1606 .extra1 = &zero, 1607 }, 1608 #ifdef HAVE_ARCH_PICK_MMAP_LAYOUT 1609 { 1610 .procname = "legacy_va_layout", 1611 .data = &sysctl_legacy_va_layout, 1612 .maxlen = sizeof(sysctl_legacy_va_layout), 1613 .mode = 0644, 1614 .proc_handler = proc_dointvec, 1615 .extra1 = &zero, 1616 }, 1617 #endif 1618 #ifdef CONFIG_NUMA 1619 { 1620 .procname = "zone_reclaim_mode", 1621 .data = &node_reclaim_mode, 1622 .maxlen = sizeof(node_reclaim_mode), 1623 .mode = 0644, 1624 .proc_handler = proc_dointvec, 1625 .extra1 = &zero, 1626 }, 1627 { 1628 .procname = "min_unmapped_ratio", 1629 .data = &sysctl_min_unmapped_ratio, 1630 .maxlen = sizeof(sysctl_min_unmapped_ratio), 1631 .mode = 0644, 1632 .proc_handler = sysctl_min_unmapped_ratio_sysctl_handler, 1633 .extra1 = &zero, 1634 .extra2 = &one_hundred, 1635 }, 1636 { 1637 .procname = "min_slab_ratio", 1638 .data = &sysctl_min_slab_ratio, 1639 .maxlen = sizeof(sysctl_min_slab_ratio), 1640 .mode = 0644, 1641 .proc_handler = sysctl_min_slab_ratio_sysctl_handler, 1642 .extra1 = &zero, 1643 .extra2 = &one_hundred, 1644 }, 1645 #endif 1646 #ifdef CONFIG_SMP 1647 { 1648 .procname = "stat_interval", 1649 .data = &sysctl_stat_interval, 1650 .maxlen = sizeof(sysctl_stat_interval), 1651 .mode = 0644, 1652 .proc_handler = proc_dointvec_jiffies, 1653 }, 1654 { 1655 .procname = "stat_refresh", 1656 .data = NULL, 1657 .maxlen = 0, 1658 .mode = 0600, 1659 .proc_handler = vmstat_refresh, 1660 }, 1661 #endif 1662 #ifdef CONFIG_MMU 1663 { 1664 .procname = "mmap_min_addr", 1665 .data = &dac_mmap_min_addr, 1666 .maxlen = sizeof(unsigned long), 1667 .mode = 0644, 1668 .proc_handler = mmap_min_addr_handler, 1669 }, 1670 #endif 1671 #ifdef CONFIG_NUMA 1672 { 1673 .procname = "numa_zonelist_order", 1674 .data = &numa_zonelist_order, 1675 .maxlen = NUMA_ZONELIST_ORDER_LEN, 1676 .mode = 0644, 1677 .proc_handler = numa_zonelist_order_handler, 1678 }, 1679 #endif 1680 #if (defined(CONFIG_X86_32) && !defined(CONFIG_UML))|| \ 1681 (defined(CONFIG_SUPERH) && defined(CONFIG_VSYSCALL)) 1682 { 1683 .procname = "vdso_enabled", 1684 #ifdef CONFIG_X86_32 1685 .data = &vdso32_enabled, 1686 .maxlen = sizeof(vdso32_enabled), 1687 #else 1688 .data = &vdso_enabled, 1689 .maxlen = sizeof(vdso_enabled), 1690 #endif 1691 .mode = 0644, 1692 .proc_handler = proc_dointvec, 1693 .extra1 = &zero, 1694 }, 1695 #endif 1696 #ifdef CONFIG_HIGHMEM 1697 { 1698 .procname = "highmem_is_dirtyable", 1699 .data = &vm_highmem_is_dirtyable, 1700 .maxlen = sizeof(vm_highmem_is_dirtyable), 1701 .mode = 0644, 1702 .proc_handler = proc_dointvec_minmax, 1703 .extra1 = &zero, 1704 .extra2 = &one, 1705 }, 1706 #endif 1707 #ifdef CONFIG_MEMORY_FAILURE 1708 { 1709 .procname = "memory_failure_early_kill", 1710 .data = &sysctl_memory_failure_early_kill, 1711 .maxlen = sizeof(sysctl_memory_failure_early_kill), 1712 .mode = 0644, 1713 .proc_handler = proc_dointvec_minmax, 1714 .extra1 = &zero, 1715 .extra2 = &one, 1716 }, 1717 { 1718 .procname = "memory_failure_recovery", 1719 .data = &sysctl_memory_failure_recovery, 1720 .maxlen = sizeof(sysctl_memory_failure_recovery), 1721 .mode = 0644, 1722 .proc_handler = proc_dointvec_minmax, 1723 .extra1 = &zero, 1724 .extra2 = &one, 1725 }, 1726 #endif 1727 { 1728 .procname = "user_reserve_kbytes", 1729 .data = &sysctl_user_reserve_kbytes, 1730 .maxlen = sizeof(sysctl_user_reserve_kbytes), 1731 .mode = 0644, 1732 .proc_handler = proc_doulongvec_minmax, 1733 }, 1734 { 1735 .procname = "admin_reserve_kbytes", 1736 .data = &sysctl_admin_reserve_kbytes, 1737 .maxlen = sizeof(sysctl_admin_reserve_kbytes), 1738 .mode = 0644, 1739 .proc_handler = proc_doulongvec_minmax, 1740 }, 1741 #ifdef CONFIG_HAVE_ARCH_MMAP_RND_BITS 1742 { 1743 .procname = "mmap_rnd_bits", 1744 .data = &mmap_rnd_bits, 1745 .maxlen = sizeof(mmap_rnd_bits), 1746 .mode = 0600, 1747 .proc_handler = proc_dointvec_minmax, 1748 .extra1 = (void *)&mmap_rnd_bits_min, 1749 .extra2 = (void *)&mmap_rnd_bits_max, 1750 }, 1751 #endif 1752 #ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS 1753 { 1754 .procname = "mmap_rnd_compat_bits", 1755 .data = &mmap_rnd_compat_bits, 1756 .maxlen = sizeof(mmap_rnd_compat_bits), 1757 .mode = 0600, 1758 .proc_handler = proc_dointvec_minmax, 1759 .extra1 = (void *)&mmap_rnd_compat_bits_min, 1760 .extra2 = (void *)&mmap_rnd_compat_bits_max, 1761 }, 1762 #endif 1763 #ifdef CONFIG_ASCEND_SHARE_POOL 1764 { 1765 .procname = "sharepool_ac_mode", 1766 .data = &sysctl_ac_mode, 1767 .maxlen = sizeof(sysctl_ac_mode), 1768 .mode = 0600, 1769 .proc_handler = proc_dointvec_minmax, 1770 .extra1 = &zero, 1771 .extra2 = &one, 1772 }, 1773 { 1774 .procname = "sharepool_debug_mode", 1775 .data = &sysctl_sp_debug_mode, 1776 .maxlen = sizeof(sysctl_sp_debug_mode), 1777 .mode = 0600, 1778 .proc_handler = proc_dointvec_minmax, 1779 .extra1 = &zero, 1780 .extra2 = &one, 1781 }, 1782 { 1783 /* 0: map_unlock, 1: map_lock */ 1784 .procname = "share_pool_map_lock_enable", 1785 .data = &sysctl_share_pool_map_lock_enable, 1786 .maxlen = sizeof(int), 1787 .mode = 0644, 1788 .proc_handler = proc_dointvec_minmax, 1789 .extra1 = &zero, 1790 .extra2 = &one, 1791 }, 1792 { 1793 .procname = "sharepool_compact_enable", 1794 .data = &sysctl_sp_compact_enable, 1795 .maxlen = sizeof(sysctl_sp_compact_enable), 1796 .mode = 0600, 1797 .proc_handler = proc_dointvec_minmax, 1798 .extra1 = &zero, 1799 .extra2 = &one, 1800 }, 1801 { 1802 .procname = "sharepool_compact_interval", 1803 .data = &sysctl_sp_compact_interval, 1804 .maxlen = sizeof(sysctl_sp_compact_interval), 1805 .mode = 0600, 1806 .proc_handler = proc_doulongvec_minmax, 1807 .extra1 = &zero_ul, 1808 .extra2 = &sysctl_sp_compact_interval_max, 1809 }, 1810 { 1811 .procname = "sharepool_perf_alloc", 1812 .data = &sysctl_sp_perf_alloc, 1813 .maxlen = sizeof(sysctl_sp_perf_alloc), 1814 .mode = 0600, 1815 .proc_handler = proc_dointvec_minmax, 1816 .extra1 = &zero, > 1817 .extra2 = &ten_thousand, 1818 }, 1819 #endif 1820 { } 1821 }; 1822 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 11543/22946] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 18 Jun '24

18 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a0395933d53f0828dc53b5f46a63a06f024156b1 commit: ed046b8a9bc5f5836ece3a3efa29c54f0fc904e7 [11543/22946] net: hns3: rename hns3_cae's files and remove send_cmdq config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240618/202406180051.YLZ6CGij-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240618/202406180051.YLZ6CGij-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406180051.YLZ6CGij-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:85:14: sparse: sparse: symbol 'g_nictool_class' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:86:13: sparse: sparse: symbol 'g_nictool_cdev' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:89:5: sparse: sparse: symbol 'g_nictool_init_flag' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:90:5: sparse: sparse: symbol 'g_nictool_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:128:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:128:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:128:43: sparse: got void *in_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:171:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:171:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:171:32: sparse: got void *out_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:258:5: sparse: sparse: symbol 'hns3_test_chs_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:302:5: sparse: sparse: symbol 'hns3_test_chs_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:355:5: sparse: sparse: symbol 'hns3_test_chs_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:412:5: sparse: sparse: symbol 'hns_test_get_commit_id' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:485:5: sparse: sparse: symbol 'hns3_test_clean_stats' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:518:5: sparse: sparse: symbol 'hns3_nic_reset' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:566:5: sparse: sparse: symbol 'hns3_nic_timeout_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:599:5: sparse: sparse: symbol 'hns3_gro_age_handle' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:670:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:670:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:670:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: got unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:674:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:674:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:674:22: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:675:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:675:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:675:22: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:684:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:684:23: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:684:23: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:689:5: sparse: sparse: symbol 'hns3_nic_dcqcn' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:878:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_rx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:878:42: sparse: expected unsigned int [usertype] dcqcn_rx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:878:42: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:879:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_tx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:879:42: sparse: expected unsigned int [usertype] dcqcn_tx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:879:42: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:880:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_db_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:880:42: sparse: expected unsigned int [usertype] dcqcn_db_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:880:42: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:852:5: sparse: sparse: symbol 'hns3_dcqcn_get_msg_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:973:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:973:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:973:38: sparse: got void * drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1050:5: sparse: sparse: symbol 'nictool_k_mmap' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1073:5: sparse: sparse: symbol 'if_nictool_exist' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:258:5: warning: no previous prototype for 'hns3_test_chs_set' [-Wmissing-prototypes] 258 | int hns3_test_chs_set(struct hclge_dev *hdev, u8 chs_type, u8 enable) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:302:5: warning: no previous prototype for 'hns3_test_chs_get' [-Wmissing-prototypes] 302 | int hns3_test_chs_get(struct hclge_dev *hdev, u8 chs_type, u8 *enable) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:355:5: warning: no previous prototype for 'hns3_test_chs_cfg' [-Wmissing-prototypes] 355 | int hns3_test_chs_cfg(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:412:5: warning: no previous prototype for 'hns_test_get_commit_id' [-Wmissing-prototypes] 412 | int hns_test_get_commit_id(struct hnae3_handle *handle, u8 *commit_id, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c: In function 'get_driver_ver': drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:480:53: warning: argument to 'sizeof' in 'strncpy' call is the same expression as the source; did you mean to use the size of the destination? [-Wsizeof-pointer-memaccess] 480 | strncpy(buf_out, HNAE_DRIVER_VERSION, sizeof(HNAE_DRIVER_VERSION)); | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c: At top level: drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:485:5: warning: no previous prototype for 'hns3_test_clean_stats' [-Wmissing-prototypes] 485 | int hns3_test_clean_stats(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:518:5: warning: no previous prototype for 'hns3_nic_reset' [-Wmissing-prototypes] 518 | int hns3_nic_reset(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:566:5: warning: no previous prototype for 'hns3_nic_timeout_cfg' [-Wmissing-prototypes] 566 | int hns3_nic_timeout_cfg(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:599:5: warning: no previous prototype for 'hns3_gro_age_handle' [-Wmissing-prototypes] 599 | int hns3_gro_age_handle(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:689:5: warning: no previous prototype for 'hns3_nic_dcqcn' [-Wmissing-prototypes] 689 | int hns3_nic_dcqcn(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:852:5: warning: no previous prototype for 'hns3_dcqcn_get_msg_cnt' [-Wmissing-prototypes] 852 | int hns3_dcqcn_get_msg_cnt(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1050:5: warning: no previous prototype for 'nictool_k_mmap' [-Wmissing-prototypes] 1050 | int nictool_k_mmap(struct file *filp, struct vm_area_struct *vma) | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1073:5: warning: no previous prototype for 'if_nictool_exist' [-Wmissing-prototypes] 1073 | int if_nictool_exist(void) | ^~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:27:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:27:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:27:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:28:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:28:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:28:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:29:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:29:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:29:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:37:32: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:37:53: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:41:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:41:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:41:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:42:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:42:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:42:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:43:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:43:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:43:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:44:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:44:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:44:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:45:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:45:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:45:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:74:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:74:18: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:74:18: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:75:17: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:75:17: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:75:17: sparse: got restricted __le32 -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:5: sparse: sparse: symbol 'hclge_test_send_generic_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:5: sparse: sparse: symbol 'hclge_test_send_allocate_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:5: sparse: sparse: symbol 'hclge_test_send_key_cfg_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:5: sparse: sparse: symbol 'hclge_test_send_tcam_op_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:5: sparse: sparse: symbol 'hclge_test_send_ad_op_cmd' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:280:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] cnt_idx @@ got restricted __le32 [usertype] idx @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:280:22: sparse: expected restricted __le16 [usertype] cnt_idx drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:280:22: sparse: got restricted __le32 [usertype] idx drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:5: sparse: sparse: symbol 'hclge_test_send_cnt_op_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:5: warning: no previous prototype for 'hclge_test_send_generic_cmd' [-Wmissing-prototypes] 20 | int hclge_test_send_generic_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:5: warning: no previous prototype for 'hclge_test_send_allocate_cmd' [-Wmissing-prototypes] 62 | int hclge_test_send_allocate_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:5: warning: no previous prototype for 'hclge_test_send_key_cfg_cmd' [-Wmissing-prototypes] 100 | int hclge_test_send_key_cfg_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:5: warning: no previous prototype for 'hclge_test_send_tcam_op_cmd' [-Wmissing-prototypes] 153 | int hclge_test_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:5: warning: no previous prototype for 'hclge_test_send_ad_op_cmd' [-Wmissing-prototypes] 224 | int hclge_test_send_ad_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:5: warning: no previous prototype for 'hclge_test_send_cnt_op_cmd' [-Wmissing-prototypes] 267 | int hclge_test_send_cnt_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:38:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:38:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:38:46: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:54:55: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:55:54: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:90:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:90:45: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:90:45: sparse: got unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:137:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:137:45: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:137:45: sparse: got unsigned int -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:32:67: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] his_link_machine_state @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:32:67: sparse: expected unsigned int [usertype] his_link_machine_state drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:32:67: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:35:46: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:39:67: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] cur_link_machine_state @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:39:67: sparse: expected unsigned int [usertype] cur_link_machine_state drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:39:67: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:42:46: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:6: sparse: sparse: symbol 'fill_port_info' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:6: warning: no previous prototype for 'fill_port_info' [-Wmissing-prototypes] 19 | void fill_port_info(struct hclge_port_info *get_port_info_out, | ^~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:5: sparse: sparse: symbol 'hns3_read_promisc_mode_cfg' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:5: sparse: sparse: symbol 'hns3_set_promisc_mode_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:5: warning: no previous prototype for 'hns3_read_promisc_mode_cfg' [-Wmissing-prototypes] 6 | int hns3_read_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:5: warning: no previous prototype for 'hns3_set_promisc_mode_cfg' [-Wmissing-prototypes] 44 | int hns3_set_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:18: sparse: sparse: symbol 'get_val_hdev' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:5: sparse: sparse: symbol 'hns3_cmd_rx_priv_wl_config' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:5: sparse: sparse: symbol 'hns3_cmd_common_thrd_config' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:5: sparse: sparse: symbol 'hns3_cmd_common_wl_config' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:229:35: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] high_wl @@ got restricted __le16 [usertype] high @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:229:35: sparse: expected unsigned int [usertype] high_wl drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:229:35: sparse: got restricted __le16 [usertype] high >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:230:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] low_wl @@ got restricted __le16 [usertype] low @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:230:34: sparse: expected unsigned int [usertype] low_wl drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:230:34: sparse: got restricted __le16 [usertype] low >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:273:48: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short @@ got restricted __le16 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:273:48: sparse: expected unsigned short drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:273:48: sparse: got restricted __le16 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:275:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] share_buff @@ got restricted __le16 [usertype] shared_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:275:38: sparse: expected unsigned short [usertype] share_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:275:38: sparse: got restricted __le16 [usertype] shared_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:318:48: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short @@ got restricted __le16 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:318:48: sparse: expected unsigned short drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:318:48: sparse: got restricted __le16 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:366:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] high @@ got restricted __le16 [usertype] high @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:366:53: sparse: expected unsigned short [usertype] high drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:366:53: sparse: got restricted __le16 [usertype] high >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:367:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] low @@ got restricted __le16 [usertype] low @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:367:52: sparse: expected unsigned short [usertype] low drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:367:52: sparse: got restricted __le16 [usertype] low drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:416:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] high @@ got restricted __le16 [usertype] high @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:416:53: sparse: expected unsigned short [usertype] high drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:416:53: sparse: got restricted __le16 [usertype] high drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:417:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] low @@ got restricted __le16 [usertype] low @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:417:52: sparse: expected unsigned short [usertype] low drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:417:52: sparse: got restricted __le16 [usertype] low >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:450:28: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:452:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:452:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:452:22: sparse: got unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:19: warning: no previous prototype for 'get_val_hdev' [-Wmissing-prototypes] 9 | struct hclge_dev *get_val_hdev(struct hns3_nic_priv *net_priv) | ^~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:5: warning: no previous prototype for 'hns3_cmd_rx_priv_wl_config' [-Wmissing-prototypes] 19 | int hns3_cmd_rx_priv_wl_config(struct hclge_dev *hdev, u16 tc, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:5: warning: no previous prototype for 'hns3_cmd_common_thrd_config' [-Wmissing-prototypes] 89 | int hns3_cmd_common_thrd_config(struct hclge_dev *hdev, u16 tc, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:5: warning: no previous prototype for 'hns3_cmd_common_wl_config' [-Wmissing-prototypes] 161 | int hns3_cmd_common_wl_config(struct hclge_dev *hdev, u32 high, u32 low, u32 en) | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:6:30: sparse: sparse: symbol 'hns3_ring_stats_name' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:149:21: sparse: sparse: cast to restricted __le64 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:105:5: sparse: sparse: symbol 'hns3_read_stat_mode_cfg' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:192:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __le64 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:192:14: sparse: expected unsigned long long [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:192:14: sparse: got restricted __le64 [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:154:5: sparse: sparse: symbol 'hns3_set_stat_mode_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:105:5: warning: no previous prototype for 'hns3_read_stat_mode_cfg' [-Wmissing-prototypes] 105 | int hns3_read_stat_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:154:5: warning: no previous prototype for 'hns3_set_stat_mode_cfg' [-Wmissing-prototypes] 154 | int hns3_set_stat_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:25:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:25:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:25:30: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:45:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned char [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:45:23: sparse: expected unsigned char [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:45:23: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:50:5: sparse: sparse: symbol 'hns3_test_tm_q_to_qs_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:75:29: sparse: sparse: restricted __le16 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:63:5: sparse: sparse: symbol 'hns3_test_tm_q_to_qs_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:80:5: sparse: sparse: symbol 'hns3_test_tm_qs_to_pri_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:94:5: sparse: sparse: symbol 'hns3_test_tm_qs_to_pri_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:110:5: sparse: sparse: symbol 'hns3_test_tm_qs_weight_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:123:5: sparse: sparse: symbol 'hns3_test_tm_qs_weight_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:139:5: sparse: sparse: symbol 'hns3_test_tm_pri_weight_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:152:5: sparse: sparse: symbol 'hns3_test_tm_pri_weight_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:175:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned char [usertype] pg_id @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:175:20: sparse: expected unsigned char [usertype] pg_id drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:175:20: sparse: got restricted __le16 [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:168:5: sparse: sparse: symbol 'hns3_test_tm_pri_pg_bitmap_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:190:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned char [usertype] pg_id @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:190:20: sparse: expected unsigned char [usertype] pg_id drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:190:20: sparse: got restricted __le16 [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:181:5: sparse: sparse: symbol 'hns3_test_tm_pri_pg_bitmap_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:212:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] qs_bit_map @@ got unsigned int [usertype] map @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:212:38: sparse: expected restricted __le32 [usertype] qs_bit_map drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:212:38: sparse: got unsigned int [usertype] map drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:200:5: sparse: sparse: symbol 'hns3_test_tm_qs_bp_bitmap_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:233:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] qs_bit_map @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:233:14: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:233:14: sparse: got restricted __le32 [usertype] qs_bit_map drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:217:5: sparse: sparse: symbol 'hns3_test_tm_qs_bp_bitmap_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:250:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] pri_shapping_para @@ got unsigned int [usertype] shaper @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:250:41: sparse: expected restricted __le32 [usertype] pri_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:250:41: sparse: got unsigned int [usertype] shaper drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:237:5: sparse: sparse: symbol 'hns3_test_tm_pri_shapping_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:270:17: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] pri_shapping_para @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:270:17: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:270:17: sparse: got restricted __le32 [usertype] pri_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:255:5: sparse: sparse: symbol 'hns3_test_tm_pri_shapping_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:275:5: sparse: sparse: symbol 'hns3_test_tm_pg_weight_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:288:5: sparse: sparse: symbol 'hns3_test_tm_pg_weight_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:317:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] pg_shapping_para @@ got unsigned int [usertype] shaper @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:317:40: sparse: expected restricted __le32 [usertype] pg_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:317:40: sparse: got unsigned int [usertype] shaper drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:304:5: sparse: sparse: symbol 'hns3_test_tm_pg_shapping_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:338:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] pg_shapping_para @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:338:25: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:338:25: sparse: got restricted __le32 [usertype] pg_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:322:5: sparse: sparse: symbol 'hns3_test_tm_pg_shapping_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:352:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] port_shapping_para @@ got unsigned int [usertype] shaper @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:352:42: sparse: expected restricted __le32 [usertype] port_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:352:42: sparse: got unsigned int [usertype] shaper drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:343:5: sparse: sparse: symbol 'hns3_test_tm_port_shapping_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:369:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] port_shapping_para @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:369:25: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:369:25: sparse: got restricted __le32 [usertype] port_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:357:5: sparse: sparse: symbol 'hns3_test_tm_port_shapping_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:421:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:421:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:421:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:422:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:422:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:422:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:423:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:423:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:423:30: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:431:27: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:431:48: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:435:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:435:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:435:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:436:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:436:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:436:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:437:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:437:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:437:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:438:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:438:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:438:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:439:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:439:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:439:30: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:50:5: warning: no previous prototype for 'hns3_test_tm_q_to_qs_set' [-Wmissing-prototypes] 50 | int hns3_test_tm_q_to_qs_set(struct hclge_dev *hdev, u16 q_id, u16 qs_id) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:63:5: warning: no previous prototype for 'hns3_test_tm_q_to_qs_get' [-Wmissing-prototypes] 63 | int hns3_test_tm_q_to_qs_get(struct hclge_dev *hdev, u16 q_id, u16 *qs_id) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:80:5: warning: no previous prototype for 'hns3_test_tm_qs_to_pri_set' [-Wmissing-prototypes] 80 | int hns3_test_tm_qs_to_pri_set(struct hclge_dev *hdev, u16 qs_id, u8 pri) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:94:5: warning: no previous prototype for 'hns3_test_tm_qs_to_pri_get' [-Wmissing-prototypes] 94 | int hns3_test_tm_qs_to_pri_get(struct hclge_dev *hdev, u16 qs_id, u8 *pri) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:110:5: warning: no previous prototype for 'hns3_test_tm_qs_weight_set' [-Wmissing-prototypes] 110 | int hns3_test_tm_qs_weight_set(struct hclge_dev *hdev, u16 qs_id, u8 dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:123:5: warning: no previous prototype for 'hns3_test_tm_qs_weight_get' [-Wmissing-prototypes] 123 | int hns3_test_tm_qs_weight_get(struct hclge_dev *hdev, u16 qs_id, u8 *dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:139:5: warning: no previous prototype for 'hns3_test_tm_pri_weight_set' [-Wmissing-prototypes] 139 | int hns3_test_tm_pri_weight_set(struct hclge_dev *hdev, u8 pri_id, u8 dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:152:5: warning: no previous prototype for 'hns3_test_tm_pri_weight_get' [-Wmissing-prototypes] 152 | int hns3_test_tm_pri_weight_get(struct hclge_dev *hdev, u8 pri_id, u8 *dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:168:5: warning: no previous prototype for 'hns3_test_tm_pri_pg_bitmap_set' [-Wmissing-prototypes] 168 | int hns3_test_tm_pri_pg_bitmap_set(struct hclge_dev *hdev, u8 pg_id, u8 bitmap) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:181:5: warning: no previous prototype for 'hns3_test_tm_pri_pg_bitmap_get' [-Wmissing-prototypes] 181 | int hns3_test_tm_pri_pg_bitmap_get(struct hclge_dev *hdev, u8 pg_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:200:5: warning: no previous prototype for 'hns3_test_tm_qs_bp_bitmap_set' [-Wmissing-prototypes] 200 | int hns3_test_tm_qs_bp_bitmap_set(struct hclge_dev *hdev, u8 tc, u8 gp_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:217:5: warning: no previous prototype for 'hns3_test_tm_qs_bp_bitmap_get' [-Wmissing-prototypes] 217 | int hns3_test_tm_qs_bp_bitmap_get(struct hclge_dev *hdev, u8 tc, u8 gp_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:237:5: warning: no previous prototype for 'hns3_test_tm_pri_shapping_set' [-Wmissing-prototypes] 237 | int hns3_test_tm_pri_shapping_set(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:255:5: warning: no previous prototype for 'hns3_test_tm_pri_shapping_get' [-Wmissing-prototypes] 255 | int hns3_test_tm_pri_shapping_get(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:275:5: warning: no previous prototype for 'hns3_test_tm_pg_weight_set' [-Wmissing-prototypes] 275 | int hns3_test_tm_pg_weight_set(struct hclge_dev *hdev, u8 pg_id, u8 dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:288:5: warning: no previous prototype for 'hns3_test_tm_pg_weight_get' [-Wmissing-prototypes] 288 | int hns3_test_tm_pg_weight_get(struct hclge_dev *hdev, u8 pg_id, u8 *dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:304:5: warning: no previous prototype for 'hns3_test_tm_pg_shapping_set' [-Wmissing-prototypes] 304 | int hns3_test_tm_pg_shapping_set(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:322:5: warning: no previous prototype for 'hns3_test_tm_pg_shapping_get' [-Wmissing-prototypes] 322 | int hns3_test_tm_pg_shapping_get(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:343:5: warning: no previous prototype for 'hns3_test_tm_port_shapping_set' [-Wmissing-prototypes] 343 | int hns3_test_tm_port_shapping_set(struct hclge_dev *hdev, u32 shaper) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:357:5: warning: no previous prototype for 'hns3_test_tm_port_shapping_get' [-Wmissing-prototypes] 357 | int hns3_test_tm_port_shapping_get(struct hclge_dev *hdev, u32 *shaper) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:54:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:54:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:54:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:55:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:55:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:55:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:59:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:59:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:59:38: sparse: right side has type unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:61:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:61:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:61:38: sparse: right side has type int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:70:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ti2oupm @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:70:43: sparse: expected unsigned int [usertype] ti2oupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:70:43: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:71:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] tv2pupm @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:71:43: sparse: expected unsigned int [usertype] tv2pupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:71:43: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:75:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:75:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:75:38: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:76:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:76:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:76:38: sparse: right side has type int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:85:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] tp2nupm @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:85:43: sparse: expected unsigned int [usertype] tp2nupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:85:43: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:86:54: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:87:41: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:96:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:96:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:96:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:97:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:97:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:97:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:100:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:100:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:100:38: sparse: right side has type unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:102:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:102:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:102:38: sparse: right side has type int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:113:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] ti2oupm @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:113:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:113:46: sparse: got unsigned int [usertype] ti2oupm >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:115:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] tv2pupm @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:115:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:115:46: sparse: got unsigned int [usertype] tv2pupm >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:126:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:126:38: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:126:38: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:127:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:127:38: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:127:38: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:138:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] tp2nupm @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:138:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:138:46: sparse: got unsigned int [usertype] tp2nupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:140:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:140:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:140:46: sparse: got int -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:56:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:56:41: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:56:41: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:126:5: sparse: sparse: symbol 'hns3_set_sfp_state' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:126:5: warning: no previous prototype for 'hns3_set_sfp_state' [-Wmissing-prototypes] 126 | int hns3_set_sfp_state(struct hnae3_handle *handle, bool en) | ^~~~~~~~~~~~~~~~~~ vim +673 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 648 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 649 static int hns3_dcqcn_rw(struct hns3_nic_priv *net_priv, d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 650 u32 offset, u32 *data, u32 rw_type) d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 651 { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 652 struct hnae3_handle *h = net_priv->ae_handle; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 653 struct hclge_vport *vport; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 654 struct hclge_dev *hdev; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 655 struct hclge_desc desc; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 656 int ret; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 657 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 658 if (!data) d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 659 return -EFAULT; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 660 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 661 vport = container_of(h, struct hclge_vport, nic); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 662 hdev = vport->back; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 663 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 664 if (rw_type == DEVMEM_CFG_READ) { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 665 hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_DCQCN_TEMPLATE_CFG, d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 666 true); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 667 } else { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 668 hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_DCQCN_TEMPLATE_CFG, d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 669 false); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 670 desc.data[2] = *data; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 671 } d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 672 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 @673 desc.data[0] = SCC_TEMP_LOW_ADDR + offset; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 674 desc.data[1] = SCC_TEMP_HIGH_ADDR; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 675 desc.data[4] = 32; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 676 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 677 ret = hclge_cmd_send(&hdev->hw, &desc, 1); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 678 if (ret) { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 679 dev_err(&hdev->pdev->dev, "disable net lane failed %d\n", ret); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 680 return ret; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 681 } d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 682 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 683 if (rw_type == DEVMEM_CFG_READ) d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 684 *data = desc.data[2]; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 685 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 686 return 0; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 687 } d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 688 :::::: The code at line 673 was first introduced by commit :::::: d02033616da9f2fca85e2e8cb73bdd04c46f21e9 net: hns3: add hns3 cae drivers to kernel :::::: TO: Weiwei <dengweiwei(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
by Kaixiong Yu 17 Jun '24

17 Jun '24

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.219 commit bca19bb2dc2d89ce60c4a4a6e59609d4cf2e13ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S27V CVE: CVE-2021-47571 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b535917c51acc97fb0761b1edec85f1f3d02bda4 upstream. The free_rtllib() function frees the "dev" pointer so there is use after free on the next line. Re-arrange things to avoid that. Fixes: 66898177e7e5 ("staging: rtl8192e: Fix unload/reload problem") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/20211117072016.GA5237@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c index 7cdced0b0581..da73998bc5f7 100644 --- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c @@ -2579,13 +2579,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev) free_irq(dev->irq, dev); priv->irq = 0; } - free_rtllib(dev); if (dev->mem_start != 0) { iounmap((void __iomem *)dev->mem_start); release_mem_region(pci_resource_start(pdev, 1), pci_resource_len(pdev, 1)); } + + free_rtllib(dev); } else { priv = rtllib_priv(dev); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: ethernet: fix potential use-after-free in ec_bhf_remove
by Kaixiong Yu 17 Jun '24

17 Jun '24

From: Pavel Skripkin <paskripkin(a)gmail.com> [ Upstream commit 9cca0c2d70149160407bda9a9446ce0c29b6e6c6 ] static void ec_bhf_remove(struct pci_dev *dev) { ... struct ec_bhf_priv *priv = netdev_priv(net_dev); unregister_netdev(net_dev); free_netdev(net_dev); pci_iounmap(dev, priv->dma_io); pci_iounmap(dev, priv->io); ... } priv is netdev private data, but it is used after free_netdev(). It can cause use-after-free when accessing priv pointer. So, fix it by moving free_netdev() after pci_iounmap() calls. Fixes: 6af55ff52b02 ("Driver for Beckhoff CX5020 EtherCAT master module.") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/net/ethernet/ec_bhf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/ec_bhf.c b/drivers/net/ethernet/ec_bhf.c index d71cba0842c5..59dc20020c73 100644 --- a/drivers/net/ethernet/ec_bhf.c +++ b/drivers/net/ethernet/ec_bhf.c @@ -585,10 +585,12 @@ static void ec_bhf_remove(struct pci_dev *dev) struct ec_bhf_priv *priv = netdev_priv(net_dev); unregister_netdev(net_dev); - free_netdev(net_dev); pci_iounmap(dev, priv->dma_io); pci_iounmap(dev, priv->io); + + free_netdev(net_dev); + pci_release_regions(dev); pci_clear_master(dev); pci_disable_device(dev); -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-36971
by Liu Jian 17 Jun '24

17 Jun '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 4 ++++ include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 33 insertions(+), 46 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] CVE-2024-36971
by Liu Jian 17 Jun '24

17 Jun '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 4 ++++ include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 33 insertions(+), 46 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/3] PCI: aardvark: Fix kernel panic during PIO transfer
by Zeng Heng 17 Jun '24

17 Jun '24

Pali Rohár (2): PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response PCI: aardvark: Fix kernel panic during PIO transfer Remi Pommarel (1): PCI: aardvark: Don't rely on jiffies while holding spinlock drivers/pci/controller/pci-aardvark.c | 59 ++++++++++++++++++++------- 1 file changed, 45 insertions(+), 14 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] sched/fair: Avoid flase sharing in struct task_group
by Li Zetao 17 Jun '24

17 Jun '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/IA63KX?from=project-issue -------------------------------- When running the context1 test case in the unixbench test suite, the tool reports the presence of flase sharing in task_group: Cache Line PA PC Function Count Percent 2099e66900 56345 24.2% 2099e66918 ffd584306f7690 calc_group_shares+0x10 2099e66940 ffd584306f7730 calc_group_shares+0xb0 2099e66910 ffd584306e94b0 set_task_cpu+0xc8 2099e66950 ffd584306e94f0 set_task_cpu+0x108 2099e66908 ffd584306e94d8 set_task_cpu+0xf0 After analysis, it was found that some members of the struct task_group share LLC cacheline, such as members se and load_avg. load_avg is modified frequently, resulting in frequent updates of the LLC cacheline, affecting the read efficiency of other members. Here provide the UnixBench test result as below: 1) Run the command of "perf stat -d -d -d -- ./Run -c `nproc` -i 10 context1" 10 times and take the average. Performance counter stats for './Run -c 128 -i 10 context1': Without Patch With Patch Diff TopDownL1 # retiring 0.08 0.18 125% # backend_bound 0.67 0.39 -41% L1-dcache-loads # 257.714 M/s 594.973 M/s 130% L1-dcache-load-misses # 0.86% 0.38% 55% System Benchmarks Partial Index INDEX INDEX System Benchmarks Index Score (Partial Only) 10141.8 28338.5 179% 2) Run the command of "./Run -c `nproc` -i 10" 10 times and take the average. Without Patch With Patch Diff Dhrystone 2 using register variables 477300.9 477476.9 0.03% Double-Precision Whetstone 102026.2 102025.3 -0.08% Execl Throughput 6457.9 6369.6 -1.37% File Copy 1024 bufsize 2000 maxblocks 1260.4 1274.7 1.13% File Copy 256 bufsize 500 maxblocks 827.9 811.5 -1.98% File Copy 4096 bufsize 8000 maxblocks 2669.8 2427.0 -9.09% Pipe Throughput 77295.8 68384.2 -11.5% Pipe-based Context Switching 6733.1 21636.8 221% Process Creation 5466.4 5495.0 0.05% Shell Scripts (1 concurrent) 25669.0 25649.9 -0.07% Shell Scripts (8 concurrent) 24760.7 24544.6 -0.87% System Call Overhead 1735.4 1747.2 0.68% ======== ======== System Benchmarks Index Score 10879.3 11755.8 8.06% Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- kernel/sched/sched.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 9de2bac6444f0..1d19f4a9fd1d7 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -419,6 +419,11 @@ struct task_group { int idle; #ifdef CONFIG_SMP +#ifdef CONFIG_ARCH_LLC_128_LINE_SIZE + /* load_avg is modified frequently, put it in a separate LLC cacheline. */ + CACHELINE_PADDING(_pad1_); + u8 padding[1]; +#endif /* * load_avg can be heavily contended at clock tick time, so put * it in its own cacheline separated from the fields above which -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] batman-adv: Avoid WARN_ON timing related checks
by h00567597 17 Jun '24

17 Jun '24

From: Sven Eckelmann <sven(a)narfation.org> mainline inclusion from mainline-v5.13-rc7 commit 9f460ae31c4435fd022c443a6029352217a16ac1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4GZ CVE: CVE-2021-47252 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The soft/batadv interface for a queued OGM can be changed during the time the OGM was queued for transmission and when the OGM is actually transmitted by the worker. But WARN_ON must be used to denote kernel bugs and not to print simple warnings. A warning can simply be printed using pr_warn. Reported-by: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Reported-by: syzbot+c0b807de416427ff3dd1(a)syzkaller.appspotmail.com Fixes: ef0a937f7a14 ("batman-adv: consider outgoing interface in OGM sending") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- net/batman-adv/bat_iv_ogm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index f5941837c3ad..cf86438edb2e 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -594,8 +594,10 @@ static void batadv_iv_ogm_emit(struct batadv_forw_packet *forw_packet) if (WARN_ON(!forw_packet->if_outgoing)) return; - if (WARN_ON(forw_packet->if_outgoing->soft_iface != soft_iface)) + if (forw_packet->if_outgoing->soft_iface != soft_iface) { + pr_warn("%s: soft interface switch for queued OGM\n", __func__); return; + } if (forw_packet->if_incoming->if_status != BATADV_IF_ACTIVE) return; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] IB/qib: Protect from buffer
by Zeng Heng 17 Jun '24

17 Jun '24

José Expósito (1): IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() Mike Marciniszyn (1): IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields drivers/infiniband/hw/qib/qib_user_sdma.c | 32 ++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/8] Backport some optimizing patches for kunpeng920
by Zheng Zengkai 17 Jun '24

17 Jun '24

Backport some optimizing patches for kunpeng920 from upstream, including Five pre-patches from Mark to make some preparations before unmasking DAIF for arm64 syscall. One patch from Guo Hui for optimizing unixbench syscall. Two patches from Barry Song for optimizing test_idle_cores() and barrier handling in gic_ipi_send_mask(). Barry Song (2): sched/fair: Optimize test_idle_cores() for !SMT irqchip/gic-v3: Use dsb(ishst) to order writes with ICC_SGI1R_EL1 accesses Guo Hui (1): arm64: syscall: unmask DAIF for tracing status Mark Rutland (5): thread_info: Add helpers to snapshot thread flags x86: Snapshot thread flags entry: Snapshot thread flags sched: Snapshot thread flags arm64: Snapshot thread flags arch/arm64/kernel/ptrace.c | 4 ++-- arch/arm64/kernel/signal.c | 2 +- arch/arm64/kernel/syscall.c | 6 ++---- arch/x86/kernel/process.c | 8 ++++---- arch/x86/kernel/process.h | 4 ++-- arch/x86/mm/tlb.c | 2 +- drivers/irqchip/irq-gic-v3.c | 2 +- include/linux/entry-kvm.h | 2 +- include/linux/thread_info.h | 15 +++++++++++++++ kernel/entry/common.c | 4 ++-- kernel/entry/kvm.c | 4 ++-- kernel/sched/core.c | 2 +- kernel/sched/fair.c | 8 +++++--- 13 files changed, 39 insertions(+), 24 deletions(-) -- 2.20.1

2 9

[PATCH openEuler-1.0-LTS 0/2] IB/qib: Protect from buffer overflow
by Zeng Heng 17 Jun '24

17 Jun '24

José Expósito (1): IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() Mike Marciniszyn (1): IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields drivers/infiniband/hw/qib/qib_user_sdma.c | 32 ++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] maple_tree: fix mas_empty_area_rev() null pointer dereference
by Zheng Yejian 17 Jun '24

17 Jun '24

From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com> stable inclusion from stable-v6.6.31 commit 6c9c7c1e63b198a8b979ad963eb21410f10ccb00 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TXID CVE: CVE-2024-36891 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 955a923d2809803980ff574270f81510112be9cf upstream. Currently the code calls mas_start() followed by mas_data_end() if the maple state is MA_START, but mas_start() may return with the maple state node == NULL. This will lead to a null pointer dereference when checking information in the NULL node, which is done in mas_data_end(). Avoid setting the offset if there is no node by waiting until after the maple state is checked for an empty or single entry state. A user could trigger the events to cause a kernel oops by unmapping all vmas to produce an empty maple tree, then mapping a vma that would cause the scenario described above. Link: https://lkml.kernel.org/r/20240422203349.2418465-1-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Reported-by: Marius Fleischer <fleischermarius(a)gmail.com> Closes: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW… Link: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW… Tested-by: Marius Fleischer <fleischermarius(a)gmail.com> Tested-by: Sidhartha Kumar <sidhartha.kumar(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian(a)huaweicloud.com> --- lib/maple_tree.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/lib/maple_tree.c b/lib/maple_tree.c index da227397e4d8..1af83414877a 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -5108,18 +5108,18 @@ int mas_empty_area_rev(struct ma_state *mas, unsigned long min, if (size == 0 || max - min < size - 1) return -EINVAL; - if (mas_is_start(mas)) { + if (mas_is_start(mas)) mas_start(mas); - mas->offset = mas_data_end(mas); - } else if (mas->offset >= 2) { - mas->offset -= 2; - } else if (!mas_rewind_node(mas)) { + else if ((mas->offset < 2) && (!mas_rewind_node(mas))) return -EBUSY; - } - /* Empty set. */ - if (mas_is_none(mas) || mas_is_ptr(mas)) + if (unlikely(mas_is_none(mas) || mas_is_ptr(mas))) return mas_sparse_area(mas, min, max, size, false); + else if (mas->offset >= 2) + mas->offset -= 2; + else + mas->offset = mas_data_end(mas); + /* The start of the window can only be within these values. */ mas->index = min; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ksmbd: no response from compound read
by Cai Xinchen 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.5-rc4 commit e202a1e8634b186da38cbbff85382ea2b9e297cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA5YWA CVE: CVE-2023-39179 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ksmbd doesn't support compound read. If client send read-read in compound to ksmbd, there can be memory leak from read buffer. Windows and linux clients doesn't send it to server yet. For now, No response from compound read. compound read will be supported soon. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-21587, ZDI-CAN-21588 Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [smb2_read function is not move to fs/smb/server/smb2pdu.c.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..215ea7f83d09 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6249,6 +6249,11 @@ int smb2_read(struct ksmbd_work *work) int err = 0; WORK_BUFFERS(work, req, rsp); + if (work->next_smb2_rcv_hdr_off) { + work->send_no_response = 1; + err = -EOPNOTSUPP; + goto out; + } if (test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_PIPE)) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] IB/qib: Protect from buffer overflow
by Zeng Heng 17 Jun '24

17 Jun '24

José Expósito (1): IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() Mike Marciniszyn (1): IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields drivers/infiniband/hw/qib/qib_user_sdma.c | 32 ++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-sp1] ksmbd: no response from compound read
by Cai Xinchen 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.5-rc4 commit e202a1e8634b186da38cbbff85382ea2b9e297cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA5YWA CVE: CVE-2023-39179 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ksmbd doesn't support compound read. If client send read-read in compound to ksmbd, there can be memory leak from read buffer. Windows and linux clients doesn't send it to server yet. For now, No response from compound read. compound read will be supported soon. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-21587, ZDI-CAN-21588 Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [smb2_read function is not move to fs/smb/server/smb2pdu.c.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..215ea7f83d09 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6249,6 +6249,11 @@ int smb2_read(struct ksmbd_work *work) int err = 0; WORK_BUFFERS(work, req, rsp); + if (work->next_smb2_rcv_hdr_off) { + work->send_no_response = 1; + err = -EOPNOTSUPP; + goto out; + } if (test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_PIPE)) { -- 2.34.1

2 1

[PATCH OLK-5.10] ksmbd: no response from compound read
by Cai Xinchen 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.5-rc4 commit e202a1e8634b186da38cbbff85382ea2b9e297cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA5YWA CVE: CVE-2023-39179 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ksmbd doesn't support compound read. If client send read-read in compound to ksmbd, there can be memory leak from read buffer. Windows and linux clients doesn't send it to server yet. For now, No response from compound read. compound read will be supported soon. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-21587, ZDI-CAN-21588 Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [smb2_read function is not move to fs/smb/server/smb2pdu.c.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..215ea7f83d09 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6249,6 +6249,11 @@ int smb2_read(struct ksmbd_work *work) int err = 0; WORK_BUFFERS(work, req, rsp); + if (work->next_smb2_rcv_hdr_off) { + work->send_no_response = 1; + err = -EOPNOTSUPP; + goto out; + } if (test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_PIPE)) { -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 11564/22941] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:53:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static?
by kernel test robot 17 Jun '24

17 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: efc3f2d315da751c5630099aab8580248002c483 commit: 9e1cec03a3abb934592272fc19603d00bb62f7cb [11564/22941] net: hns3: place cae entrance procedure implementations in a separate file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240617/202406171449.ubzd3IZW-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240617/202406171449.ubzd3IZW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406171449.ubzd3IZW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:53:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:54:13: sparse: sparse: symbol 'g_hns3_cae_cdev' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:57:5: sparse: sparse: symbol 'g_hns3_cae_init_flag' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:58:5: sparse: sparse: symbol 'g_hns3_cae_ref_cnt' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:96:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:96:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:96:43: sparse: got void *in_buff >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:139:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:139:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:139:32: sparse: got void *out_buf >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:318:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:318:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:318:38: sparse: got void * vim +/g_hns3_cae_class +53 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c 52 > 53 struct class *g_hns3_cae_class; > 54 struct cdev g_hns3_cae_cdev; 55 static const char hns3_driver_name[] = "hns3"; 56 > 57 int g_hns3_cae_init_flag; > 58 int g_hns3_cae_ref_cnt; 59 60 typedef int (*driv_module) (struct hns3_nic_priv *nic_dev, void *buf_in, 61 u32 in_size, void *buf_out, u32 out_size); 62 63 struct drv_module_handle { 64 enum driver_cmd_type driv_cmd_name; 65 driv_module driv_func; 66 }; 67 68 static void free_buff_in(void *buf_in) 69 { 70 if (!buf_in) 71 return; 72 73 kfree(buf_in); 74 } 75 76 static int alloc_buff_in(struct msg_module *nt_msg, u32 in_size, void **buf_in) 77 { 78 void *msg_buf; 79 80 if (!in_size) 81 return 0; 82 83 if (in_size > MAX_MSG_IN_SIZE) { 84 pr_err("msg in size(%u) more than %u\n", 85 in_size, MAX_MSG_IN_SIZE); 86 return -ENOMEM; 87 } 88 89 msg_buf = kzalloc((unsigned long)in_size, GFP_KERNEL); 90 *buf_in = msg_buf; 91 if (ZERO_OR_NULL_PTR(*buf_in)) { 92 pr_err("alloc buf_in failed\n"); 93 return -ENOMEM; 94 } 95 > 96 if (copy_from_user(msg_buf, nt_msg->in_buff, (unsigned long)in_size)) { 97 pr_err("Copy from user failed in %s function\n", __func__); 98 kfree(msg_buf); 99 return -EFAULT; 100 } 101 102 return 0; 103 } 104 105 static void free_buff_out(void *buf_out) 106 { 107 if (!buf_out) 108 return; 109 110 kfree(buf_out); 111 } 112 113 static int alloc_buff_out(u32 out_size, void **buf_out) 114 { 115 if (!out_size) 116 return 0; 117 118 if (out_size > MAX_MSG_OUT_SIZE) { 119 pr_err("msg out size(%u) more than %u\n", 120 out_size, MAX_MSG_OUT_SIZE); 121 return -ENOMEM; 122 } 123 124 *buf_out = kzalloc((unsigned long)out_size, GFP_KERNEL); 125 if (ZERO_OR_NULL_PTR(*buf_out)) { 126 pr_err("alloc buf_out failed\n"); 127 return -ENOMEM; 128 } 129 130 return 0; 131 } 132 133 static int copy_buf_out_to_user(struct msg_module *nt_msg, u32 out_size, 134 void **buf_out) 135 { 136 int ret = 0; 137 void *msg_out = buf_out; 138 > 139 if (copy_to_user(nt_msg->out_buf, msg_out, out_size)) 140 ret = -EFAULT; 141 142 return ret; 143 } 144 145 static int hns3_cae_netdev_match_check(struct net_device *netdev) 146 { 147 struct ethtool_drvinfo drv_info; 148 149 if (netdev->ethtool_ops->get_drvinfo) 150 netdev->ethtool_ops->get_drvinfo(netdev, &drv_info); 151 152 if (!strncmp(drv_info.driver, hns3_driver_name, 153 strlen(hns3_driver_name))) 154 return 0; 155 156 netdev_err(netdev, "match hns3 driver name(%s) failed\n", 157 drv_info.driver); 158 return -1; 159 } 160 161 #if (KERNEL_VERSION(4, 16, 0) < LINUX_VERSION_CODE) 162 static int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg) 163 { 164 mm_segment_t oldfs = get_fs(); 165 int err; 166 167 set_fs(KERNEL_DS); 168 err = sock->ops->ioctl(sock, cmd, arg); 169 set_fs(oldfs); 170 171 return err; 172 } 173 #endif 174 175 static struct net_device *get_netdev_by_ifname(char *ifname) 176 { 177 struct socket *temp_sock = NULL; 178 struct net_device *netdev = NULL; 179 struct ifreq ifr; 180 int err; 181 182 err = sock_create(PF_INET, SOCK_DGRAM, 0, &temp_sock); 183 if (err < 0) { 184 pr_err("fail to enter sock_create, err = %d\n", err); 185 return NULL; 186 } 187 188 strncpy(ifr.ifr_ifrn.ifrn_name, ifname, (unsigned long)IFNAMSIZ); 189 kernel_sock_ioctl(temp_sock, SIOCSIFNAME, (unsigned long)&ifr); 190 netdev = dev_get_by_name(sock_net(temp_sock->sk), ifname); 191 if (!netdev) 192 goto out; 193 194 dev_put(netdev); 195 196 out: 197 sock_release(temp_sock); 198 return netdev; 199 } 200 201 static int hns3_cae_k_get_netdev_by_ifname(char *ifname, 202 struct hns3_nic_priv **nic_dev) 203 { 204 struct net_device *netdev = NULL; 205 206 netdev = get_netdev_by_ifname(ifname); 207 if (!netdev) { 208 pr_err("not find the netdevice(%s)!\n", ifname); 209 return -EFAULT; 210 } 211 212 if (hns3_cae_netdev_match_check(netdev)) { 213 netdev_err(netdev, "netdevice is not hns device.\n"); 214 return -EFAULT; 215 } 216 217 *nic_dev = (struct hns3_nic_priv *)netdev_priv(netdev); 218 if (!(*nic_dev)) { 219 netdev_err(netdev, "no private data\n"); 220 return -EFAULT; 221 } 222 223 return 0; 224 } 225 > 226 struct drv_module_handle driv_module_cmd_handle[] = { 227 {FW_VER, hns3_cae_get_fw_ver}, 228 {DRIVER_VER, hns3_cae_get_driver_ver}, 229 {CHECKSUM_CFG, hns3_cae_chs_cfg}, 230 {TM_QUEUE_CFG, hns3_cae_queue_cfg}, 231 {TM_QSET_CFG, hns3_cae_qs_cfg}, 232 {TM_PRI_CFG, hns3_cae_pri_cfg}, 233 {TM_PG_CFG, hns3_cae_pg_cfg}, 234 {TM_PORT_CFG, hns3_cae_port_cfg}, 235 {TM_ETS_CFG, hns3_cae_ets_cfg}, 236 {DCB_MODE_CFG, hns3_cae_dcb_cfg}, 237 {ETS_MODE_CFG, hns3_cae_dcb_ets_cfg}, 238 {PFC_MODE_CFG, hns3_cae_dcb_pfc_cfg}, 239 {MAC_LOOP_CFG, hns3_cae_mac_loop_cfg}, 240 {DFX_INFO_CMD, hns3_cae_get_dfx_info}, 241 {DFX_READ_CMD, hns3_cae_read_dfx_info}, 242 {EVENT_INJECTION_CMD, hns3_cae_event_injection}, 243 {SEND_PKT, hns3_cae_send_pkt}, 244 {RX_PRIV_BUFF_WL_CFG, hns3_cae_rx_priv_buff_wl_cfg}, 245 {RX_COMMON_THRD_CFG, hns3_cae_common_thrd_cfg}, 246 {RX_COMMON_WL_CFG, hns3_cae_common_wl_cfg}, 247 {SHOW_RX_PRIV_WL, hns3_cae_show_rx_priv_wl}, 248 {SHOW_RX_COMM_THRES, hns3_cae_show_comm_thres}, 249 {QCN_EN_CFG, hns3_cae_qcn_cfg}, 250 {RX_BUFF_CFG, hns3_cae_rx_buff_cfg}, 251 {TX_BUFF_CFG, hns3_cae_tx_buff_cfg}, 252 {RESET_CFG, hns3_cae_nic_reset}, 253 {TIMEOUT_CFG, hns3_cae_nic_timeout_cfg}, 254 {PROMISC_MODE_CFG, hns3_promisc_mode_cfg}, 255 {QINFO_CFG, hns3_cae_qinfo_cfg}, 256 #ifdef CONFIG_IT_VALIDATION 257 {MACTABLE_CFG, hns3_cae_opt_mactbl}, 258 #endif 259 {CLEAN_STATS, hns3_cae_clean_stats}, 260 {FD_CFG, hns3_cae_fd_cfg}, 261 {RSS_GENERIC_CFG, hns3_cae_rss_cfg}, 262 {REG_CFG, hns3_cae_reg_cfg}, 263 {COM_REG_CFG, hns3_cae_common_cmd_send}, 264 {GRO_CFG, hns3_gro_age_handle}, 265 {M7_CMD_MODE_CFG, hns3_m7_cmd_handle}, 266 {QRES_CFG, hns3_cae_qres_cfg}, 267 {STAT_CFG, hns3_stat_mode_cfg}, 268 {IRQ_CFG, hns3_irq_lli_cfg}, 269 {VLAN_UPMAPPING, hns3_cae_upmapping_cfg}, 270 #ifdef CONFIG_EXT_TEST 271 {LAMP_CFG, hns3_lamp_cfg}, 272 {EXTERN_INTERFACE_CFG, hns3_ext_interface_test}, 273 #endif 274 {XSFP_CFG, hns3_xsfp_cfg}, 275 {SHOW_PORT_INFO, hns3_get_port_info}, 276 {SHOW_HILINK_PARAM, hns3_get_hilink_param}, 277 {DCQCN_PARM_CFG, hns3_nic_dcqcn}, 278 {DCQCN_GET_MSG_CNT_CMD, hns3_dcqcn_get_msg_cnt} 279 }; 280 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/9] sync hulk-5.10 patches
by Yu Kuai 17 Jun '24

17 Jun '24

Changes in v5: - rebase Changes in v4: - just resend Changes in v3: - modify openeuler_defconfig for disabled new config in patch 1,2 Changes in v2: - fix head in commit message Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (7): block: add a switch to enable hungtask check for io blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (7): block: add a switch to enable hungtask check for io blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue arch/arm64/configs/openeuler_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 3 + block/Kconfig | 37 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 97 +++++++++++++++++++++--- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 11 +++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 +- block/blk-sysfs.c | 82 +++++++++++++++++--- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 7 +- kernel/trace/blktrace.c | 3 - 18 files changed, 264 insertions(+), 41 deletions(-) -- 2.39.2

2 10

[PATCH OLK-6.6] ext4: Skip moving extents if page writeback failed
by Zhihao Cheng 17 Jun '24

17 Jun '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5XLM CVE: NA -------------------------------- Ext4 should check the return value of ext4_disable_buffered_iomap_aops() before moving extents, otherwise the EXT4_STATE_BUFFERED_IOMAP state is not cleared from the inode, which could trigger the WARNON in function _ext4_get_block(). Fixes: 2a158d544250 ("ext4: fall back to buffer_head path for defrag") Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/move_extent.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index f58c0cb4dd76..afd7869cae9a 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -640,10 +640,16 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, inode_dio_wait(donor_inode); /* Fallback to buffer_head aops for inodes with buffered iomap aops */ - if (ext4_test_inode_state(orig_inode, EXT4_STATE_BUFFERED_IOMAP)) - ext4_disable_buffered_iomap_aops(orig_inode); - if (ext4_test_inode_state(donor_inode, EXT4_STATE_BUFFERED_IOMAP)) - ext4_disable_buffered_iomap_aops(donor_inode); + if (ext4_test_inode_state(orig_inode, EXT4_STATE_BUFFERED_IOMAP)) { + ret = ext4_disable_buffered_iomap_aops(orig_inode); + if (ret) + goto out_unlock; + } + if (ext4_test_inode_state(donor_inode, EXT4_STATE_BUFFERED_IOMAP)) { + ret = ext4_disable_buffered_iomap_aops(donor_inode); + if (ret) + goto out_unlock; + } /* Protect extent tree against block allocations via delalloc */ ext4_double_down_write_data_sem(orig_inode, donor_inode); @@ -728,6 +734,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, ext4_free_ext_path(path); ext4_double_up_write_data_sem(orig_inode, donor_inode); +out_unlock: unlock_two_nondirectories(orig_inode, donor_inode); return ret; -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 11561/22937] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 17 Jun '24

17 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: fb55aa477dfa7f488f112a8b87116962d623ff63 [11561/22937] net: hns3: place cae regconfig-related implementations in an independent file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240617/202406171104.ZG6iVFTd-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240617/202406171104.ZG6iVFTd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406171104.ZG6iVFTd-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:51:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:52:13: sparse: sparse: symbol 'g_hns3_cae_cdev' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:55:5: sparse: sparse: symbol 'g_hns3_cae_init_flag' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:56:5: sparse: sparse: symbol 'g_hns3_cae_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: got void *in_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: got void *out_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: sparse: sparse: symbol 'hns3_cae_get_commit_id' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: got void * drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: expected unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: warning: no previous prototype for 'hns3_cae_get_commit_id' [-Wmissing-prototypes] 224 | int hns3_cae_get_commit_id(struct hnae3_handle *handle, u8 *commit_id, | ^~~~~~~~~~~~~~~~~~~~~~ vim +597 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c 558 559 int hns3_cae_common_cmd_send(struct hns3_nic_priv *net_priv, void *buf_in, 560 u32 in_size, void *buf_out, u32 out_size) 561 { 562 #define MAX_DESC_DATA_LEN 6 563 struct cmd_desc_param *param_in; 564 struct hclge_vport *vport; 565 struct hclge_dev *hdev; 566 struct hclge_desc desc; 567 bool check; 568 int ret; 569 int i; 570 571 check = !buf_in || in_size < sizeof(struct cmd_desc_param); 572 vport = hns3_cae_get_vport(net_priv->ae_handle); 573 hdev = vport->back; 574 575 param_in = (struct cmd_desc_param *)buf_in; 576 hns3_cae_cmd_setup_basic_desc(&desc, param_in->fw_dw_opcode, 577 param_in->is_read); 578 for (i = 0; i < MAX_DESC_DATA_LEN; i++) 579 desc.data[i] = param_in->reg_desc.data[i]; 580 ret = hns3_cae_cmd_send(hdev, &desc, 1); 581 if (ret) { 582 dev_err(&hdev->pdev->dev, "%s, ret is %d.\n", __func__, 583 ret); 584 return ret; 585 } 586 if (param_in->is_read) { 587 struct cmd_desc_param *param_out = 588 (struct cmd_desc_param *)buf_out; 589 590 check = !buf_out || out_size < sizeof(struct cmd_desc_param); 591 if (check) { 592 pr_err("input param buf_out error in %s function\n", 593 __func__); 594 return -EFAULT; 595 } 596 for (i = 0; i < MAX_DESC_DATA_LEN; i++) > 597 param_out->reg_desc.data[i] = desc.data[i]; -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v5 0/9] sync hulk-5.10 patches
by Yu Kuai 17 Jun '24

17 Jun '24

Changes in v5: - rebase Changes in v4: - just resend Changes in v3: - modify openeuler_defconfig for disabled new config in patch 1,2 Changes in v2: - fix head in commit message Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (7): block: add a switch to enable hungtask check for io blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue arch/arm64/configs/openeuler_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 3 + block/Kconfig | 37 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 97 +++++++++++++++++++++--- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 11 +++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 +- block/blk-sysfs.c | 82 +++++++++++++++++--- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 7 +- kernel/trace/blktrace.c | 3 - 18 files changed, 264 insertions(+), 41 deletions(-) -- 2.39.2

2 10

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
by Zhengchao Shao 17 Jun '24

17 Jun '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.10-rc1 commit a5b862c6a221459d54e494e88965b48dcfa6cc44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA3COJ CVE: CVE-2024-36968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_conn.c net/bluetooth/hci_event.c net/bluetooth/l2cap_core.c net/bluetooth/sco.c net/bluetooth/iso.c [The conflict occurs because the commit eca0ae4aea66("Bluetooth: Add initial implementation of BIS connections") and 26afbd826ee3("Bluetooth: Add initial implementation of CIS connections") and 181a42edddf5(" Bluetooth: Make handle of hci_conn be unique") and c8992cffbe74(" Bluetooth: hci_event: Use of a function table to handle Command Complete") and e7b02296fb40 ("Bluetooth: Remove BT_HS") and ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") are not merged. In the hci_conn_add function, if the MTU is abnormal, NULL is returned. No adaptation is required in subsequent interfaces] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/net/bluetooth/hci.h | 9 +++++++++ include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 26 ++++++++++++++++++++++++++ net/bluetooth/hci_event.c | 8 ++++++++ net/bluetooth/l2cap_core.c | 17 +++-------------- net/bluetooth/sco.c | 6 +++--- 6 files changed, 50 insertions(+), 17 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index ede7a153c69a..e6dfbeb4f663 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1430,6 +1430,15 @@ struct hci_cp_le_set_event_mask { __u8 mask[8]; } __packed; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E + * 7.8.2 LE Read Buffer Size command + * MAX_LE_MTU is 0xffff. + * 0 is also valid. It means that no dedicated LE Buffer exists. + * It should use the HCI_Read_Buffer_Size command and mtu is shared + * between BR/EDR and LE. + */ +#define HCI_MIN_LE_MTU 0x001b + #define HCI_OP_LE_READ_BUFFER_SIZE 0x2002 struct hci_rp_le_read_buffer_size { __u8 status; diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 33873266b2bc..202367e98eea 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -607,6 +607,7 @@ struct hci_conn { __u8 resp_addr_type; __u16 handle; __u16 state; + __u16 mtu; __u8 mode; __u8 type; __u8 role; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 52e512f41da3..de1e47b70d0e 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -520,6 +520,27 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, { struct hci_conn *conn; + switch (type) { + case ACL_LINK: + if (!hdev->acl_mtu) + return NULL; + break; + case LE_LINK: + if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) + return NULL; + if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) + return NULL; + break; + case SCO_LINK: + case ESCO_LINK: + if (!hdev->sco_pkts) + /* Controller does not support SCO or eSCO over HCI */ + return NULL; + break; + default: + return NULL; + } + BT_DBG("%s dst %pMR", hdev->name, dst); conn = kzalloc(sizeof(*conn), GFP_KERNEL); @@ -553,10 +574,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, switch (type) { case ACL_LINK: conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; + conn->mtu = hdev->acl_mtu; break; case LE_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; case SCO_LINK: if (lmp_esco_capable(hdev)) @@ -564,9 +587,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, (hdev->esco_type & EDR_ESCO_MASK); else conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; + + conn->mtu = hdev->sco_mtu; break; case ESCO_LINK: conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; + conn->mtu = hdev->sco_mtu; break; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 4027c79786fd..e01159d8fabf 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -731,6 +731,10 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) if (rp->status) return; + if (!__le16_to_cpu(rp->acl_mtu) || + !__le16_to_cpu(rp->acl_max_pkt)) + return; + hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); hdev->sco_mtu = rp->sco_mtu; hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); @@ -1020,6 +1024,10 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev, if (rp->status) return; + if (__le16_to_cpu(rp->le_mtu) && + __le16_to_cpu(rp->le_mtu) < HCI_MIN_LE_MTU) + return; + hdev->le_mtu = __le16_to_cpu(rp->le_mtu); hdev->le_pkts = rp->le_max_pkt; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 8ac9adb2b28b..6f93e2a7bf91 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -7241,7 +7241,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; return l2cap_resegment(chan); } @@ -7312,7 +7312,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; err = l2cap_resegment(chan); @@ -7863,18 +7863,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); - switch (hcon->type) { - case LE_LINK: - if (hcon->hdev->le_mtu) { - conn->mtu = hcon->hdev->le_mtu; - break; - } - fallthrough; - default: - conn->mtu = hcon->hdev->acl_mtu; - break; - } - + conn->mtu = hcon->mtu; conn->feat_mask = 0; conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index f9a2993fd452..1e5daa03155f 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -127,7 +127,6 @@ static void sco_sock_clear_timer(struct sock *sk) /* ---- SCO connections ---- */ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) { - struct hci_dev *hdev = hcon->hdev; struct sco_conn *conn = hcon->sco_data; if (conn) @@ -142,9 +141,10 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) hcon->sco_data = conn; conn->hcon = hcon; + conn->mtu = hcon->mtu; - if (hdev->sco_mtu > 0) - conn->mtu = hdev->sco_mtu; + if (hcon->mtu > 0) + conn->mtu = hcon->mtu; else conn->mtu = 60; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
by Zhengchao Shao 17 Jun '24

17 Jun '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.10-rc1 commit a5b862c6a221459d54e494e88965b48dcfa6cc44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA3COJ CVE: CVE-2024-36968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_conn.c net/bluetooth/hci_event.c net/bluetooth/l2cap_core.c net/bluetooth/sco.c net/bluetooth/iso.c [The conflict occurs because the commit eca0ae4aea66("Bluetooth: Add initial implementation of BIS connections") and 26afbd826ee3("Bluetooth: Add initial implementation of CIS connections") and 181a42edddf5(" Bluetooth: Make handle of hci_conn be unique") and c8992cffbe74(" Bluetooth: hci_event: Use of a function table to handle Command Complete") and e7b02296fb40 ("Bluetooth: Remove BT_HS") and ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") are not merged. In the hci_conn_add function, if the MTU is abnormal, NULL is returned. No adaptation is required in subsequent interfaces] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/net/bluetooth/hci.h | 9 +++++++++ include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 26 ++++++++++++++++++++++++++ net/bluetooth/hci_event.c | 8 ++++++++ net/bluetooth/l2cap_core.c | 17 +++-------------- net/bluetooth/sco.c | 6 +++--- 6 files changed, 50 insertions(+), 17 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index ede7a153c69a..e6dfbeb4f663 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1430,6 +1430,15 @@ struct hci_cp_le_set_event_mask { __u8 mask[8]; } __packed; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E + * 7.8.2 LE Read Buffer Size command + * MAX_LE_MTU is 0xffff. + * 0 is also valid. It means that no dedicated LE Buffer exists. + * It should use the HCI_Read_Buffer_Size command and mtu is shared + * between BR/EDR and LE. + */ +#define HCI_MIN_LE_MTU 0x001b + #define HCI_OP_LE_READ_BUFFER_SIZE 0x2002 struct hci_rp_le_read_buffer_size { __u8 status; diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 11a92bb4d7a9..5d8b6bd87495 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -602,6 +602,7 @@ struct hci_conn { __u8 resp_addr_type; __u16 handle; __u16 state; + __u16 mtu; __u8 mode; __u8 type; __u8 role; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 140d9764c77e..9478e63f10ef 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -522,6 +522,27 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, { struct hci_conn *conn; + switch (type) { + case ACL_LINK: + if (!hdev->acl_mtu) + return NULL; + break; + case LE_LINK: + if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) + return NULL; + if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) + return NULL; + break; + case SCO_LINK: + case ESCO_LINK: + if (!hdev->sco_pkts) + /* Controller does not support SCO or eSCO over HCI */ + return NULL; + break; + default: + return NULL; + } + BT_DBG("%s dst %pMR", hdev->name, dst); conn = kzalloc(sizeof(*conn), GFP_KERNEL); @@ -555,10 +576,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, switch (type) { case ACL_LINK: conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; + conn->mtu = hdev->acl_mtu; break; case LE_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; case SCO_LINK: if (lmp_esco_capable(hdev)) @@ -566,9 +589,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, (hdev->esco_type & EDR_ESCO_MASK); else conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; + + conn->mtu = hdev->sco_mtu; break; case ESCO_LINK: conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; + conn->mtu = hdev->sco_mtu; break; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 954b29605c94..ea83c75da095 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -729,6 +729,10 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) if (rp->status) return; + if (!__le16_to_cpu(rp->acl_mtu) || + !__le16_to_cpu(rp->acl_max_pkt)) + return; + hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); hdev->sco_mtu = rp->sco_mtu; hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); @@ -1018,6 +1022,10 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev, if (rp->status) return; + if (__le16_to_cpu(rp->le_mtu) && + __le16_to_cpu(rp->le_mtu) < HCI_MIN_LE_MTU) + return; + hdev->le_mtu = __le16_to_cpu(rp->le_mtu); hdev->le_pkts = rp->le_max_pkt; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 1677cbb77578..c3b6a416119e 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -7204,7 +7204,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; return l2cap_resegment(chan); } @@ -7275,7 +7275,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; err = l2cap_resegment(chan); @@ -7826,18 +7826,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); - switch (hcon->type) { - case LE_LINK: - if (hcon->hdev->le_mtu) { - conn->mtu = hcon->hdev->le_mtu; - break; - } - fallthrough; - default: - conn->mtu = hcon->hdev->acl_mtu; - break; - } - + conn->mtu = hcon->mtu; conn->feat_mask = 0; conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index f9a2993fd452..1e5daa03155f 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -127,7 +127,6 @@ static void sco_sock_clear_timer(struct sock *sk) /* ---- SCO connections ---- */ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) { - struct hci_dev *hdev = hcon->hdev; struct sco_conn *conn = hcon->sco_data; if (conn) @@ -142,9 +141,10 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) hcon->sco_data = conn; conn->hcon = hcon; + conn->mtu = hcon->mtu; - if (hdev->sco_mtu > 0) - conn->mtu = hdev->sco_mtu; + if (hcon->mtu > 0) + conn->mtu = hcon->mtu; else conn->mtu = 60; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
by Zhengchao Shao 17 Jun '24

17 Jun '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.10-rc1 commit a5b862c6a221459d54e494e88965b48dcfa6cc44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA3COJ CVE: CVE-2024-36968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_conn.c net/bluetooth/hci_event.c net/bluetooth/l2cap_core.c net/bluetooth/sco.c [The conflict occurs because the commit eca0ae4aea66("Bluetooth: Add initial implementation of BIS connections") and 26afbd826ee3("Bluetooth: Add initial implementation of CIS connections") and 181a42edddf5(" Bluetooth: Make handle of hci_conn be unique") and c8992cffbe74(" Bluetooth: hci_event: Use of a function table to handle Command Complete") and e7b02296fb40 ("Bluetooth: Remove BT_HS") are not merged In the hci_conn_add function, if the MTU is abnormal, NULL is returned. No adaptation is required in subsequent interfaces] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/net/bluetooth/hci.h | 9 +++++++++ include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 26 ++++++++++++++++++++++++++ net/bluetooth/hci_event.c | 8 ++++++++ net/bluetooth/l2cap_core.c | 17 +++-------------- net/bluetooth/sco.c | 6 +++--- 6 files changed, 50 insertions(+), 17 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index ede7a153c69a..e6dfbeb4f663 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1430,6 +1430,15 @@ struct hci_cp_le_set_event_mask { __u8 mask[8]; } __packed; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E + * 7.8.2 LE Read Buffer Size command + * MAX_LE_MTU is 0xffff. + * 0 is also valid. It means that no dedicated LE Buffer exists. + * It should use the HCI_Read_Buffer_Size command and mtu is shared + * between BR/EDR and LE. + */ +#define HCI_MIN_LE_MTU 0x001b + #define HCI_OP_LE_READ_BUFFER_SIZE 0x2002 struct hci_rp_le_read_buffer_size { __u8 status; diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 11a92bb4d7a9..5d8b6bd87495 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -602,6 +602,7 @@ struct hci_conn { __u8 resp_addr_type; __u16 handle; __u16 state; + __u16 mtu; __u8 mode; __u8 type; __u8 role; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 140d9764c77e..9478e63f10ef 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -522,6 +522,27 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, { struct hci_conn *conn; + switch (type) { + case ACL_LINK: + if (!hdev->acl_mtu) + return NULL; + break; + case LE_LINK: + if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) + return NULL; + if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) + return NULL; + break; + case SCO_LINK: + case ESCO_LINK: + if (!hdev->sco_pkts) + /* Controller does not support SCO or eSCO over HCI */ + return NULL; + break; + default: + return NULL; + } + BT_DBG("%s dst %pMR", hdev->name, dst); conn = kzalloc(sizeof(*conn), GFP_KERNEL); @@ -555,10 +576,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, switch (type) { case ACL_LINK: conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; + conn->mtu = hdev->acl_mtu; break; case LE_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; case SCO_LINK: if (lmp_esco_capable(hdev)) @@ -566,9 +589,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, (hdev->esco_type & EDR_ESCO_MASK); else conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; + + conn->mtu = hdev->sco_mtu; break; case ESCO_LINK: conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; + conn->mtu = hdev->sco_mtu; break; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 954b29605c94..ea83c75da095 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -729,6 +729,10 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) if (rp->status) return; + if (!__le16_to_cpu(rp->acl_mtu) || + !__le16_to_cpu(rp->acl_max_pkt)) + return; + hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); hdev->sco_mtu = rp->sco_mtu; hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); @@ -1018,6 +1022,10 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev, if (rp->status) return; + if (__le16_to_cpu(rp->le_mtu) && + __le16_to_cpu(rp->le_mtu) < HCI_MIN_LE_MTU) + return; + hdev->le_mtu = __le16_to_cpu(rp->le_mtu); hdev->le_pkts = rp->le_max_pkt; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 1677cbb77578..c3b6a416119e 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -7204,7 +7204,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; return l2cap_resegment(chan); } @@ -7275,7 +7275,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; err = l2cap_resegment(chan); @@ -7826,18 +7826,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); - switch (hcon->type) { - case LE_LINK: - if (hcon->hdev->le_mtu) { - conn->mtu = hcon->hdev->le_mtu; - break; - } - fallthrough; - default: - conn->mtu = hcon->hdev->acl_mtu; - break; - } - + conn->mtu = hcon->mtu; conn->feat_mask = 0; conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index f9a2993fd452..1e5daa03155f 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -127,7 +127,6 @@ static void sco_sock_clear_timer(struct sock *sk) /* ---- SCO connections ---- */ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) { - struct hci_dev *hdev = hcon->hdev; struct sco_conn *conn = hcon->sco_data; if (conn) @@ -142,9 +141,10 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) hcon->sco_data = conn; conn->hcon = hcon; + conn->mtu = hcon->mtu; - if (hdev->sco_mtu > 0) - conn->mtu = hdev->sco_mtu; + if (hcon->mtu > 0) + conn->mtu = hcon->mtu; else conn->mtu = 60; -- 2.34.1

1 0

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
by Zhengchao Shao 17 Jun '24

17 Jun '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.10-rc1 commit a5b862c6a221459d54e494e88965b48dcfa6cc44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA3COJ CVE: CVE-2024-36968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_conn.c net/bluetooth/hci_event.c net/bluetooth/l2cap_core.c net/bluetooth/sco.c [The conflict occurs because the commit eca0ae4aea66("Bluetooth: Add initial implementation of BIS connections") and 26afbd826ee3("Bluetooth: Add initial implementation of CIS connections") and 181a42edddf5(" Bluetooth: Make handle of hci_conn be unique") and c8992cffbe74(" Bluetooth: hci_event: Use of a function table to handle Command Complete") and e7b02296fb40 ("Bluetooth: Remove BT_HS") are not merged In the hci_conn_add function, if the MTU is abnormal, NULL is returned. No adaptation is required in subsequent interfaces] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/net/bluetooth/hci.h | 9 +++++++++ include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 26 ++++++++++++++++++++++++++ net/bluetooth/hci_event.c | 8 ++++++++ net/bluetooth/l2cap_core.c | 17 +++-------------- net/bluetooth/sco.c | 6 +++--- 6 files changed, 50 insertions(+), 17 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index ede7a153c69a..e6dfbeb4f663 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1430,6 +1430,15 @@ struct hci_cp_le_set_event_mask { __u8 mask[8]; } __packed; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E + * 7.8.2 LE Read Buffer Size command + * MAX_LE_MTU is 0xffff. + * 0 is also valid. It means that no dedicated LE Buffer exists. + * It should use the HCI_Read_Buffer_Size command and mtu is shared + * between BR/EDR and LE. + */ +#define HCI_MIN_LE_MTU 0x001b + #define HCI_OP_LE_READ_BUFFER_SIZE 0x2002 struct hci_rp_le_read_buffer_size { __u8 status; diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 33873266b2bc..202367e98eea 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -607,6 +607,7 @@ struct hci_conn { __u8 resp_addr_type; __u16 handle; __u16 state; + __u16 mtu; __u8 mode; __u8 type; __u8 role; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 52e512f41da3..de1e47b70d0e 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -520,6 +520,27 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, { struct hci_conn *conn; + switch (type) { + case ACL_LINK: + if (!hdev->acl_mtu) + return NULL; + break; + case LE_LINK: + if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) + return NULL; + if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) + return NULL; + break; + case SCO_LINK: + case ESCO_LINK: + if (!hdev->sco_pkts) + /* Controller does not support SCO or eSCO over HCI */ + return NULL; + break; + default: + return NULL; + } + BT_DBG("%s dst %pMR", hdev->name, dst); conn = kzalloc(sizeof(*conn), GFP_KERNEL); @@ -553,10 +574,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, switch (type) { case ACL_LINK: conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; + conn->mtu = hdev->acl_mtu; break; case LE_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; case SCO_LINK: if (lmp_esco_capable(hdev)) @@ -564,9 +587,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, (hdev->esco_type & EDR_ESCO_MASK); else conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; + + conn->mtu = hdev->sco_mtu; break; case ESCO_LINK: conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; + conn->mtu = hdev->sco_mtu; break; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 4027c79786fd..e01159d8fabf 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -731,6 +731,10 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) if (rp->status) return; + if (!__le16_to_cpu(rp->acl_mtu) || + !__le16_to_cpu(rp->acl_max_pkt)) + return; + hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); hdev->sco_mtu = rp->sco_mtu; hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); @@ -1020,6 +1024,10 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev, if (rp->status) return; + if (__le16_to_cpu(rp->le_mtu) && + __le16_to_cpu(rp->le_mtu) < HCI_MIN_LE_MTU) + return; + hdev->le_mtu = __le16_to_cpu(rp->le_mtu); hdev->le_pkts = rp->le_max_pkt; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 8ac9adb2b28b..6f93e2a7bf91 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -7241,7 +7241,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; return l2cap_resegment(chan); } @@ -7312,7 +7312,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; err = l2cap_resegment(chan); @@ -7863,18 +7863,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); - switch (hcon->type) { - case LE_LINK: - if (hcon->hdev->le_mtu) { - conn->mtu = hcon->hdev->le_mtu; - break; - } - fallthrough; - default: - conn->mtu = hcon->hdev->acl_mtu; - break; - } - + conn->mtu = hcon->mtu; conn->feat_mask = 0; conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index f9a2993fd452..1e5daa03155f 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -127,7 +127,6 @@ static void sco_sock_clear_timer(struct sock *sk) /* ---- SCO connections ---- */ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) { - struct hci_dev *hdev = hcon->hdev; struct sco_conn *conn = hcon->sco_data; if (conn) @@ -142,9 +141,10 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) hcon->sco_data = conn; conn->hcon = hcon; + conn->mtu = hcon->mtu; - if (hdev->sco_mtu > 0) - conn->mtu = hdev->sco_mtu; + if (hcon->mtu > 0) + conn->mtu = hcon->mtu; else conn->mtu = 60; -- 2.34.1

2 1

[PATCH v2 OLK-5.10] fs/open: use unlikely modification of filp_close anomaly detection branch
by liwei 17 Jun '24

17 Jun '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/IA5PIS --------------------------- The probability of obtaining file_count() equal to 0 in filp_close() is relatively small. Using unlikely modification can improve efficiency. Signed-off-by: liwei <liwei728(a)huawei.com> --- fs/open.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/open.c b/fs/open.c index 8092178ceab0..68de475df5ec 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1285,7 +1285,7 @@ int filp_close(struct file *filp, fl_owner_t id) { int retval = 0; - if (!file_count(filp)) { + if (unlikely(!file_count(filp))) { printk(KERN_ERR "VFS: Close: file count is 0\n"); return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
by Long Li 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.9-rc4 commit 17cf0c2794bdb6f39671265aa18aea5c22ee8c4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4XI CVE: CVE-2024-26936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..7937f860ea8f 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -539,6 +539,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) if (cmd == SMB2_QUERY_INFO_HE) { struct smb2_query_info_req *req; + if (get_rfc1002_len(work->request_buf) < + offsetof(struct smb2_query_info_req, OutputBufferLength)) + return -EINVAL; + req = smb2_get_msg(work->request_buf); if ((req->InfoType == SMB2_O_INFO_FILE && (req->FileInfoClass == FILE_FULL_EA_INFORMATION || -- 2.39.2

2 1

[PATCH OLK-5.10 v2] ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
by Long Li 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.9-rc4 commit 17cf0c2794bdb6f39671265aa18aea5c22ee8c4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4XI CVE: CVE-2024-26936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..7937f860ea8f 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -539,6 +539,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) if (cmd == SMB2_QUERY_INFO_HE) { struct smb2_query_info_req *req; + if (get_rfc1002_len(work->request_buf) < + offsetof(struct smb2_query_info_req, OutputBufferLength)) + return -EINVAL; + req = smb2_get_msg(work->request_buf); if ((req->InfoType == SMB2_O_INFO_FILE && (req->FileInfoClass == FILE_FULL_EA_INFORMATION || -- 2.39.2

2 1

[PATCH] fs/open: use unlikely modification of filp_close anomaly detection branch
by liwei 17 Jun '24

17 Jun '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/IA5PIS --------------------------- The probability of obtaining file_count() equal to 0 in filp_close() is relatively small. Using unlikely modification can improve efficiency. Signed-off-by: liwei <liwei728(a)huawei.com> --- fs/open.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/open.c b/fs/open.c index 8092178ceab0..68de475df5ec 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1285,7 +1285,7 @@ int filp_close(struct file *filp, fl_owner_t id) { int retval = 0; - if (!file_count(filp)) { + if (unlikely(!file_count(filp))) { printk(KERN_ERR "VFS: Close: file count is 0\n"); return 0; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] RDMA/cma: Fix rdma_resolve_route() memory leak
by Zhao Wenhui 17 Jun '24

17 Jun '24

From: Gerd Rausch <gerd.rausch(a)oracle.com> stable inclusion from stable-v4.19.198 commit 4893c938f2a140a74be91779e45e4a7fa111198f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ER CVE: CVE-2021-47345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ] Fix a memory leak when "mda_resolve_route() is called more than once on the same "rdma_cm_id". This is possible if cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and allows rdma_resolve_route() to be called again. Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com Signed-off-by: Gerd Rausch <gerd.rausch(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..127ebd481689 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2547,7 +2547,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms) cma_init_resolve_route_work(work, id_priv); - route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); + if (!route->path_rec) + route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); if (!route->path_rec) { ret = -ENOMEM; goto err1; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
by Long Li 17 Jun '24

17 Jun '24

From: Yang Xiongwei <yangxiongwei6(a)huawei.com> mainline inclusion from mainline-v6.9-rc4 commit 17cf0c2794bdb6f39671265aa18aea5c22ee8c4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4XI CVE: CVE-2024-26936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..7937f860ea8f 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -539,6 +539,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) if (cmd == SMB2_QUERY_INFO_HE) { struct smb2_query_info_req *req; + if (get_rfc1002_len(work->request_buf) < + offsetof(struct smb2_query_info_req, OutputBufferLength)) + return -EINVAL; + req = smb2_get_msg(work->request_buf); if ((req->InfoType == SMB2_O_INFO_FILE && (req->FileInfoClass == FILE_FULL_EA_INFORMATION || -- 2.39.2

2 1

[PATCH OLK-5.10] ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
by Long Li 17 Jun '24

17 Jun '24

From: Yang Xiongwei <yangxiongwei6(a)huawei.com> mainline inclusion from mainline-v6.9-rc4 commit 17cf0c2794bdb6f39671265aa18aea5c22ee8c4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4XI CVE: CVE-2024-26936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..7937f860ea8f 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -539,6 +539,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) if (cmd == SMB2_QUERY_INFO_HE) { struct smb2_query_info_req *req; + if (get_rfc1002_len(work->request_buf) < + offsetof(struct smb2_query_info_req, OutputBufferLength)) + return -EINVAL; + req = smb2_get_msg(work->request_buf); if ((req->InfoType == SMB2_O_INFO_FILE && (req->FileInfoClass == FILE_FULL_EA_INFORMATION || -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] fs/9p: fix uninitialized values during inode evict
by Long Li 17 Jun '24

17 Jun '24

From: Eric Van Hensbergen <ericvh(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 6630036b7c228f57c7893ee0403e92c2db2cd21d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U997 CVE: CVE-2024-36923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made. This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways). Reported-by: syzbot+eb83fe1cce5833cd66a0(a)syzkaller.appspotmail.com Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Conflicts: fs/9p/vfs_inode.c [v9fs_evict_inode() function has been changed] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/9p/vfs_inode.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 88ca5015f987..483d777a8617 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -376,15 +376,19 @@ void v9fs_evict_inode(struct inode *inode) { struct v9fs_inode *v9inode = V9FS_I(inode); - truncate_inode_pages_final(&inode->i_data); - clear_inode(inode); - filemap_fdatawrite(&inode->i_data); - - v9fs_cache_inode_put_cookie(inode); - /* clunk the fid stashed in writeback_fid */ - if (v9inode->writeback_fid) { - p9_client_clunk(v9inode->writeback_fid); - v9inode->writeback_fid = NULL; + if (!is_bad_inode(inode)) { + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + filemap_fdatawrite(&inode->i_data); + + v9fs_cache_inode_put_cookie(inode); + /* clunk the fid stashed in writeback_fid */ + if (v9inode->writeback_fid) { + p9_client_clunk(v9inode->writeback_fid); + v9inode->writeback_fid = NULL; + } + } else { + clear_inode(inode); } } -- 2.39.2

2 1

[PATCH OLK-5.10] fs/9p: fix uninitialized values during inode evict
by Long Li 17 Jun '24

17 Jun '24

From: Eric Van Hensbergen <ericvh(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 6630036b7c228f57c7893ee0403e92c2db2cd21d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U997 CVE: CVE-2024-36923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made. This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways). Reported-by: syzbot+eb83fe1cce5833cd66a0(a)syzkaller.appspotmail.com Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Conflicts: fs/9p/vfs_inode.c [v9fs_evict_inode() function has been changed] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/9p/vfs_inode.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 88ca5015f987..483d777a8617 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -376,15 +376,19 @@ void v9fs_evict_inode(struct inode *inode) { struct v9fs_inode *v9inode = V9FS_I(inode); - truncate_inode_pages_final(&inode->i_data); - clear_inode(inode); - filemap_fdatawrite(&inode->i_data); - - v9fs_cache_inode_put_cookie(inode); - /* clunk the fid stashed in writeback_fid */ - if (v9inode->writeback_fid) { - p9_client_clunk(v9inode->writeback_fid); - v9inode->writeback_fid = NULL; + if (!is_bad_inode(inode)) { + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + filemap_fdatawrite(&inode->i_data); + + v9fs_cache_inode_put_cookie(inode); + /* clunk the fid stashed in writeback_fid */ + if (v9inode->writeback_fid) { + p9_client_clunk(v9inode->writeback_fid); + v9inode->writeback_fid = NULL; + } + } else { + clear_inode(inode); } } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v2] dhugetlb: use rcu lock to protect hpool
by Liu Shixin 17 Jun '24

17 Jun '24

hulk inclusion category: bugfix bugzilla: 46904, https://gitee.com/openeuler/kernel/issues/IA5JXN -------------------------------- In freeing process, set memcg->hpool or dpool_global_hpool to NULL and then freeing it. To avoid UAF problem of hpool, we have to make sure the users that already hold pointer to hpool don't use the pointer after freeing hpool. The freeing of hpool should block until make sure all such users don't use hpool. Since anyone who want to use hpool have to increase its refcount at first. Use rcu_read_lock() and synchronize_rcu() to guarantee all such users failed to get hpool before freeing hpool. Fixes: 0bc0d0d57eda ("dhugetlb: backport dynamic hugetlb feature") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/hugetlb.c | 6 ++++++ mm/memcontrol.c | 11 ++++++++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 4be708677ce6..18dd5bcd13a3 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3360,6 +3360,7 @@ void dhugetlb_pool_put(struct dhugetlb_pool *hpool) if (atomic_dec_and_test(&hpool->refcnt)) { css_put(&hpool->attach_memcg->css); + synchronize_rcu(); kfree(hpool); } } @@ -3500,9 +3501,14 @@ struct dhugetlb_pool *get_dhugetlb_pool_from_task(struct task_struct *tsk) rcu_read_lock(); memcg = mem_cgroup_from_task(tsk); + if (!memcg || !css_tryget(&memcg->css)) { + rcu_read_unlock(); + return NULL; + } rcu_read_unlock(); hpool = get_dhugetlb_pool_from_memcg(memcg); + css_put(&memcg->css); return hpool; } diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7dc68b1792ef..4ecb6f09b68b 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4701,14 +4701,19 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, struct dhugetlb_pool *get_dhugetlb_pool_from_memcg(struct mem_cgroup *memcg) { struct mem_cgroup_extension *memcg_ext; + struct dhugetlb_pool *hpool; if (!memcg) return NULL; + rcu_read_lock(); memcg_ext = container_of(memcg, struct mem_cgroup_extension, memcg); - if (dhugetlb_pool_get(memcg_ext->hpool)) - return memcg_ext->hpool; - return NULL; + hpool = memcg_ext->hpool; + if (!dhugetlb_pool_get(hpool)) + hpool = NULL; + rcu_read_unlock(); + + return hpool; } static void set_dhugetlb_pool_to_memcg(struct mem_cgroup *memcg, -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 7438/22937] drivers/net/phy/.tmp_ax88796b.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 17 Jun '24

17 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: 56e625aa545a24e8d3fa44b5fbcdedd88e443dcc [7438/22937] net: phy: rename Asix Electronics PHY driver config: x86_64-buildonly-randconfig-004-20240614 (https://download.01.org/0day-ci/archive/20240617/202406170809.fyaOQ9ZM-lkp@…) compiler: gcc-8 (Ubuntu 8.4.0-3ubuntu2) 8.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240617/202406170809.fyaOQ9ZM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406170809.fyaOQ9ZM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/phy/.tmp_ax88796b.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 11555/22937] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 17 Jun '24

17 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: 8ad07513042c8fef5a03b404f0bbf066f603c101 [11555/22937] net: hns3: place dcqcn implementations in an ind file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240617/202406170627.RHMdP5Jc-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240617/202406170627.RHMdP5Jc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406170627.RHMdP5Jc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:42:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:42:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:42:22: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:43:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:43:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:43:22: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:44:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:44:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:44:22: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:53:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:53:23: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:53:23: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:255:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_rx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:255:42: sparse: expected unsigned int [usertype] dcqcn_rx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:255:42: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:256:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_tx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:256:42: sparse: expected unsigned int [usertype] dcqcn_tx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:256:42: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:257:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_db_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:257:42: sparse: expected unsigned int [usertype] dcqcn_db_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:257:42: sparse: got restricted __le32 vim +39 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c 15 16 static int hns3_dcqcn_rw(struct hns3_nic_priv *net_priv, 17 u32 offset, u32 *data, u32 rw_type) 18 { 19 struct hnae3_handle *h = net_priv->ae_handle; 20 struct hclge_vport *vport; 21 struct hclge_dev *hdev; 22 struct hclge_desc desc; 23 int ret; 24 25 if (!data) 26 return -EFAULT; 27 28 vport = container_of(h, struct hclge_vport, nic); 29 hdev = vport->back; 30 31 if (rw_type == DEVMEM_CFG_READ) { 32 hns3_cae_cmd_setup_basic_desc(&desc, 33 HCLGE_OPC_DCQCN_TEMPLATE_CFG, 34 true); 35 } else { 36 hns3_cae_cmd_setup_basic_desc(&desc, 37 HCLGE_OPC_DCQCN_TEMPLATE_CFG, 38 false); > 39 desc.data[2] = *data; 40 } 41 > 42 desc.data[0] = SCC_TEMP_LOW_ADDR + offset; > 43 desc.data[1] = SCC_TEMP_HIGH_ADDR; 44 desc.data[4] = 32; 45 46 ret = hns3_cae_cmd_send(hdev, &desc, 1); 47 if (ret) { 48 dev_err(&hdev->pdev->dev, "disable net lane failed %d\n", ret); 49 return ret; 50 } 51 52 if (rw_type == DEVMEM_CFG_READ) > 53 *data = desc.data[2]; 54 55 return 0; 56 } 57 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 11543/22937] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 16 Jun '24

16 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: ed046b8a9bc5f5836ece3a3efa29c54f0fc904e7 [11543/22937] net: hns3: rename hns3_cae's files and remove send_cmdq config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240616/202406161000.Y3tDDJ9e-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240616/202406161000.Y3tDDJ9e-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406161000.Y3tDDJ9e-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:85:14: sparse: sparse: symbol 'g_nictool_class' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:86:13: sparse: sparse: symbol 'g_nictool_cdev' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:89:5: sparse: sparse: symbol 'g_nictool_init_flag' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:90:5: sparse: sparse: symbol 'g_nictool_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:128:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:128:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:128:43: sparse: got void *in_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:171:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:171:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:171:32: sparse: got void *out_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:258:5: sparse: sparse: symbol 'hns3_test_chs_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:302:5: sparse: sparse: symbol 'hns3_test_chs_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:355:5: sparse: sparse: symbol 'hns3_test_chs_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:412:5: sparse: sparse: symbol 'hns_test_get_commit_id' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:485:5: sparse: sparse: symbol 'hns3_test_clean_stats' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:518:5: sparse: sparse: symbol 'hns3_nic_reset' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:566:5: sparse: sparse: symbol 'hns3_nic_timeout_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:599:5: sparse: sparse: symbol 'hns3_gro_age_handle' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:670:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:670:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:670:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: got unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:674:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:674:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:674:22: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:675:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:675:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:675:22: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:684:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:684:23: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:684:23: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:689:5: sparse: sparse: symbol 'hns3_nic_dcqcn' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:878:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_rx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:878:42: sparse: expected unsigned int [usertype] dcqcn_rx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:878:42: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:879:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_tx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:879:42: sparse: expected unsigned int [usertype] dcqcn_tx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:879:42: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:880:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_db_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:880:42: sparse: expected unsigned int [usertype] dcqcn_db_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:880:42: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:852:5: sparse: sparse: symbol 'hns3_dcqcn_get_msg_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:973:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:973:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:973:38: sparse: got void * drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1050:5: sparse: sparse: symbol 'nictool_k_mmap' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1073:5: sparse: sparse: symbol 'if_nictool_exist' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:258:5: warning: no previous prototype for 'hns3_test_chs_set' [-Wmissing-prototypes] 258 | int hns3_test_chs_set(struct hclge_dev *hdev, u8 chs_type, u8 enable) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:302:5: warning: no previous prototype for 'hns3_test_chs_get' [-Wmissing-prototypes] 302 | int hns3_test_chs_get(struct hclge_dev *hdev, u8 chs_type, u8 *enable) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:355:5: warning: no previous prototype for 'hns3_test_chs_cfg' [-Wmissing-prototypes] 355 | int hns3_test_chs_cfg(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:412:5: warning: no previous prototype for 'hns_test_get_commit_id' [-Wmissing-prototypes] 412 | int hns_test_get_commit_id(struct hnae3_handle *handle, u8 *commit_id, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c: In function 'get_driver_ver': drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:480:53: warning: argument to 'sizeof' in 'strncpy' call is the same expression as the source; did you mean to use the size of the destination? [-Wsizeof-pointer-memaccess] 480 | strncpy(buf_out, HNAE_DRIVER_VERSION, sizeof(HNAE_DRIVER_VERSION)); | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c: At top level: drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:485:5: warning: no previous prototype for 'hns3_test_clean_stats' [-Wmissing-prototypes] 485 | int hns3_test_clean_stats(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:518:5: warning: no previous prototype for 'hns3_nic_reset' [-Wmissing-prototypes] 518 | int hns3_nic_reset(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:566:5: warning: no previous prototype for 'hns3_nic_timeout_cfg' [-Wmissing-prototypes] 566 | int hns3_nic_timeout_cfg(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:599:5: warning: no previous prototype for 'hns3_gro_age_handle' [-Wmissing-prototypes] 599 | int hns3_gro_age_handle(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:689:5: warning: no previous prototype for 'hns3_nic_dcqcn' [-Wmissing-prototypes] 689 | int hns3_nic_dcqcn(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:852:5: warning: no previous prototype for 'hns3_dcqcn_get_msg_cnt' [-Wmissing-prototypes] 852 | int hns3_dcqcn_get_msg_cnt(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1050:5: warning: no previous prototype for 'nictool_k_mmap' [-Wmissing-prototypes] 1050 | int nictool_k_mmap(struct file *filp, struct vm_area_struct *vma) | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1073:5: warning: no previous prototype for 'if_nictool_exist' [-Wmissing-prototypes] 1073 | int if_nictool_exist(void) | ^~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:27:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:27:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:27:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:28:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:28:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:28:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:29:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:29:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:29:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:37:32: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:37:53: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:41:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:41:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:41:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:42:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:42:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:42:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:43:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:43:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:43:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:44:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:44:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:44:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:45:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:45:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:45:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:74:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:74:18: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:74:18: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:75:17: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:75:17: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:75:17: sparse: got restricted __le32 -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:5: sparse: sparse: symbol 'hclge_test_send_generic_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:5: sparse: sparse: symbol 'hclge_test_send_allocate_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:5: sparse: sparse: symbol 'hclge_test_send_key_cfg_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:5: sparse: sparse: symbol 'hclge_test_send_tcam_op_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:5: sparse: sparse: symbol 'hclge_test_send_ad_op_cmd' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:280:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] cnt_idx @@ got restricted __le32 [usertype] idx @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:280:22: sparse: expected restricted __le16 [usertype] cnt_idx drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:280:22: sparse: got restricted __le32 [usertype] idx drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:5: sparse: sparse: symbol 'hclge_test_send_cnt_op_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:5: warning: no previous prototype for 'hclge_test_send_generic_cmd' [-Wmissing-prototypes] 20 | int hclge_test_send_generic_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:5: warning: no previous prototype for 'hclge_test_send_allocate_cmd' [-Wmissing-prototypes] 62 | int hclge_test_send_allocate_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:5: warning: no previous prototype for 'hclge_test_send_key_cfg_cmd' [-Wmissing-prototypes] 100 | int hclge_test_send_key_cfg_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:5: warning: no previous prototype for 'hclge_test_send_tcam_op_cmd' [-Wmissing-prototypes] 153 | int hclge_test_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:5: warning: no previous prototype for 'hclge_test_send_ad_op_cmd' [-Wmissing-prototypes] 224 | int hclge_test_send_ad_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:5: warning: no previous prototype for 'hclge_test_send_cnt_op_cmd' [-Wmissing-prototypes] 267 | int hclge_test_send_cnt_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:38:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:38:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:38:46: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:54:55: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:55:54: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:90:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:90:45: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:90:45: sparse: got unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:137:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:137:45: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:137:45: sparse: got unsigned int -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:32:67: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] his_link_machine_state @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:32:67: sparse: expected unsigned int [usertype] his_link_machine_state drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:32:67: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:35:46: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:39:67: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] cur_link_machine_state @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:39:67: sparse: expected unsigned int [usertype] cur_link_machine_state drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:39:67: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:42:46: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:6: sparse: sparse: symbol 'fill_port_info' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:6: warning: no previous prototype for 'fill_port_info' [-Wmissing-prototypes] 19 | void fill_port_info(struct hclge_port_info *get_port_info_out, | ^~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:5: sparse: sparse: symbol 'hns3_read_promisc_mode_cfg' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:5: sparse: sparse: symbol 'hns3_set_promisc_mode_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:5: warning: no previous prototype for 'hns3_read_promisc_mode_cfg' [-Wmissing-prototypes] 6 | int hns3_read_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:5: warning: no previous prototype for 'hns3_set_promisc_mode_cfg' [-Wmissing-prototypes] 44 | int hns3_set_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:18: sparse: sparse: symbol 'get_val_hdev' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:5: sparse: sparse: symbol 'hns3_cmd_rx_priv_wl_config' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:5: sparse: sparse: symbol 'hns3_cmd_common_thrd_config' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:5: sparse: sparse: symbol 'hns3_cmd_common_wl_config' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:229:35: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] high_wl @@ got restricted __le16 [usertype] high @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:229:35: sparse: expected unsigned int [usertype] high_wl drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:229:35: sparse: got restricted __le16 [usertype] high >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:230:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] low_wl @@ got restricted __le16 [usertype] low @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:230:34: sparse: expected unsigned int [usertype] low_wl drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:230:34: sparse: got restricted __le16 [usertype] low >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:273:48: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short @@ got restricted __le16 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:273:48: sparse: expected unsigned short drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:273:48: sparse: got restricted __le16 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:275:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] share_buff @@ got restricted __le16 [usertype] shared_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:275:38: sparse: expected unsigned short [usertype] share_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:275:38: sparse: got restricted __le16 [usertype] shared_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:318:48: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short @@ got restricted __le16 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:318:48: sparse: expected unsigned short drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:318:48: sparse: got restricted __le16 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:366:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] high @@ got restricted __le16 [usertype] high @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:366:53: sparse: expected unsigned short [usertype] high drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:366:53: sparse: got restricted __le16 [usertype] high >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:367:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] low @@ got restricted __le16 [usertype] low @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:367:52: sparse: expected unsigned short [usertype] low drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:367:52: sparse: got restricted __le16 [usertype] low drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:416:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] high @@ got restricted __le16 [usertype] high @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:416:53: sparse: expected unsigned short [usertype] high drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:416:53: sparse: got restricted __le16 [usertype] high drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:417:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] low @@ got restricted __le16 [usertype] low @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:417:52: sparse: expected unsigned short [usertype] low drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:417:52: sparse: got restricted __le16 [usertype] low >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:450:28: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:452:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:452:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:452:22: sparse: got unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:19: warning: no previous prototype for 'get_val_hdev' [-Wmissing-prototypes] 9 | struct hclge_dev *get_val_hdev(struct hns3_nic_priv *net_priv) | ^~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:5: warning: no previous prototype for 'hns3_cmd_rx_priv_wl_config' [-Wmissing-prototypes] 19 | int hns3_cmd_rx_priv_wl_config(struct hclge_dev *hdev, u16 tc, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:5: warning: no previous prototype for 'hns3_cmd_common_thrd_config' [-Wmissing-prototypes] 89 | int hns3_cmd_common_thrd_config(struct hclge_dev *hdev, u16 tc, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:5: warning: no previous prototype for 'hns3_cmd_common_wl_config' [-Wmissing-prototypes] 161 | int hns3_cmd_common_wl_config(struct hclge_dev *hdev, u32 high, u32 low, u32 en) | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:6:30: sparse: sparse: symbol 'hns3_ring_stats_name' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:149:21: sparse: sparse: cast to restricted __le64 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:105:5: sparse: sparse: symbol 'hns3_read_stat_mode_cfg' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:192:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __le64 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:192:14: sparse: expected unsigned long long [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:192:14: sparse: got restricted __le64 [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:154:5: sparse: sparse: symbol 'hns3_set_stat_mode_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:105:5: warning: no previous prototype for 'hns3_read_stat_mode_cfg' [-Wmissing-prototypes] 105 | int hns3_read_stat_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:154:5: warning: no previous prototype for 'hns3_set_stat_mode_cfg' [-Wmissing-prototypes] 154 | int hns3_set_stat_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:25:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:25:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:25:30: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:45:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned char [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:45:23: sparse: expected unsigned char [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:45:23: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:50:5: sparse: sparse: symbol 'hns3_test_tm_q_to_qs_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:75:29: sparse: sparse: restricted __le16 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:63:5: sparse: sparse: symbol 'hns3_test_tm_q_to_qs_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:80:5: sparse: sparse: symbol 'hns3_test_tm_qs_to_pri_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:94:5: sparse: sparse: symbol 'hns3_test_tm_qs_to_pri_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:110:5: sparse: sparse: symbol 'hns3_test_tm_qs_weight_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:123:5: sparse: sparse: symbol 'hns3_test_tm_qs_weight_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:139:5: sparse: sparse: symbol 'hns3_test_tm_pri_weight_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:152:5: sparse: sparse: symbol 'hns3_test_tm_pri_weight_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:175:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned char [usertype] pg_id @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:175:20: sparse: expected unsigned char [usertype] pg_id drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:175:20: sparse: got restricted __le16 [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:168:5: sparse: sparse: symbol 'hns3_test_tm_pri_pg_bitmap_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:190:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned char [usertype] pg_id @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:190:20: sparse: expected unsigned char [usertype] pg_id drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:190:20: sparse: got restricted __le16 [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:181:5: sparse: sparse: symbol 'hns3_test_tm_pri_pg_bitmap_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:212:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] qs_bit_map @@ got unsigned int [usertype] map @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:212:38: sparse: expected restricted __le32 [usertype] qs_bit_map drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:212:38: sparse: got unsigned int [usertype] map drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:200:5: sparse: sparse: symbol 'hns3_test_tm_qs_bp_bitmap_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:233:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] qs_bit_map @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:233:14: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:233:14: sparse: got restricted __le32 [usertype] qs_bit_map drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:217:5: sparse: sparse: symbol 'hns3_test_tm_qs_bp_bitmap_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:250:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] pri_shapping_para @@ got unsigned int [usertype] shaper @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:250:41: sparse: expected restricted __le32 [usertype] pri_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:250:41: sparse: got unsigned int [usertype] shaper drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:237:5: sparse: sparse: symbol 'hns3_test_tm_pri_shapping_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:270:17: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] pri_shapping_para @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:270:17: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:270:17: sparse: got restricted __le32 [usertype] pri_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:255:5: sparse: sparse: symbol 'hns3_test_tm_pri_shapping_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:275:5: sparse: sparse: symbol 'hns3_test_tm_pg_weight_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:288:5: sparse: sparse: symbol 'hns3_test_tm_pg_weight_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:317:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] pg_shapping_para @@ got unsigned int [usertype] shaper @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:317:40: sparse: expected restricted __le32 [usertype] pg_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:317:40: sparse: got unsigned int [usertype] shaper drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:304:5: sparse: sparse: symbol 'hns3_test_tm_pg_shapping_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:338:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] pg_shapping_para @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:338:25: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:338:25: sparse: got restricted __le32 [usertype] pg_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:322:5: sparse: sparse: symbol 'hns3_test_tm_pg_shapping_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:352:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] port_shapping_para @@ got unsigned int [usertype] shaper @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:352:42: sparse: expected restricted __le32 [usertype] port_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:352:42: sparse: got unsigned int [usertype] shaper drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:343:5: sparse: sparse: symbol 'hns3_test_tm_port_shapping_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:369:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] port_shapping_para @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:369:25: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:369:25: sparse: got restricted __le32 [usertype] port_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:357:5: sparse: sparse: symbol 'hns3_test_tm_port_shapping_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:421:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:421:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:421:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:422:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:422:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:422:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:423:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:423:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:423:30: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:431:27: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:431:48: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:435:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:435:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:435:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:436:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:436:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:436:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:437:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:437:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:437:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:438:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:438:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:438:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:439:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:439:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:439:30: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:50:5: warning: no previous prototype for 'hns3_test_tm_q_to_qs_set' [-Wmissing-prototypes] 50 | int hns3_test_tm_q_to_qs_set(struct hclge_dev *hdev, u16 q_id, u16 qs_id) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:63:5: warning: no previous prototype for 'hns3_test_tm_q_to_qs_get' [-Wmissing-prototypes] 63 | int hns3_test_tm_q_to_qs_get(struct hclge_dev *hdev, u16 q_id, u16 *qs_id) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:80:5: warning: no previous prototype for 'hns3_test_tm_qs_to_pri_set' [-Wmissing-prototypes] 80 | int hns3_test_tm_qs_to_pri_set(struct hclge_dev *hdev, u16 qs_id, u8 pri) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:94:5: warning: no previous prototype for 'hns3_test_tm_qs_to_pri_get' [-Wmissing-prototypes] 94 | int hns3_test_tm_qs_to_pri_get(struct hclge_dev *hdev, u16 qs_id, u8 *pri) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:110:5: warning: no previous prototype for 'hns3_test_tm_qs_weight_set' [-Wmissing-prototypes] 110 | int hns3_test_tm_qs_weight_set(struct hclge_dev *hdev, u16 qs_id, u8 dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:123:5: warning: no previous prototype for 'hns3_test_tm_qs_weight_get' [-Wmissing-prototypes] 123 | int hns3_test_tm_qs_weight_get(struct hclge_dev *hdev, u16 qs_id, u8 *dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:139:5: warning: no previous prototype for 'hns3_test_tm_pri_weight_set' [-Wmissing-prototypes] 139 | int hns3_test_tm_pri_weight_set(struct hclge_dev *hdev, u8 pri_id, u8 dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:152:5: warning: no previous prototype for 'hns3_test_tm_pri_weight_get' [-Wmissing-prototypes] 152 | int hns3_test_tm_pri_weight_get(struct hclge_dev *hdev, u8 pri_id, u8 *dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:168:5: warning: no previous prototype for 'hns3_test_tm_pri_pg_bitmap_set' [-Wmissing-prototypes] 168 | int hns3_test_tm_pri_pg_bitmap_set(struct hclge_dev *hdev, u8 pg_id, u8 bitmap) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:181:5: warning: no previous prototype for 'hns3_test_tm_pri_pg_bitmap_get' [-Wmissing-prototypes] 181 | int hns3_test_tm_pri_pg_bitmap_get(struct hclge_dev *hdev, u8 pg_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:200:5: warning: no previous prototype for 'hns3_test_tm_qs_bp_bitmap_set' [-Wmissing-prototypes] 200 | int hns3_test_tm_qs_bp_bitmap_set(struct hclge_dev *hdev, u8 tc, u8 gp_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:217:5: warning: no previous prototype for 'hns3_test_tm_qs_bp_bitmap_get' [-Wmissing-prototypes] 217 | int hns3_test_tm_qs_bp_bitmap_get(struct hclge_dev *hdev, u8 tc, u8 gp_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:237:5: warning: no previous prototype for 'hns3_test_tm_pri_shapping_set' [-Wmissing-prototypes] 237 | int hns3_test_tm_pri_shapping_set(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:255:5: warning: no previous prototype for 'hns3_test_tm_pri_shapping_get' [-Wmissing-prototypes] 255 | int hns3_test_tm_pri_shapping_get(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:275:5: warning: no previous prototype for 'hns3_test_tm_pg_weight_set' [-Wmissing-prototypes] 275 | int hns3_test_tm_pg_weight_set(struct hclge_dev *hdev, u8 pg_id, u8 dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:288:5: warning: no previous prototype for 'hns3_test_tm_pg_weight_get' [-Wmissing-prototypes] 288 | int hns3_test_tm_pg_weight_get(struct hclge_dev *hdev, u8 pg_id, u8 *dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:304:5: warning: no previous prototype for 'hns3_test_tm_pg_shapping_set' [-Wmissing-prototypes] 304 | int hns3_test_tm_pg_shapping_set(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:322:5: warning: no previous prototype for 'hns3_test_tm_pg_shapping_get' [-Wmissing-prototypes] 322 | int hns3_test_tm_pg_shapping_get(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:343:5: warning: no previous prototype for 'hns3_test_tm_port_shapping_set' [-Wmissing-prototypes] 343 | int hns3_test_tm_port_shapping_set(struct hclge_dev *hdev, u32 shaper) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:357:5: warning: no previous prototype for 'hns3_test_tm_port_shapping_get' [-Wmissing-prototypes] 357 | int hns3_test_tm_port_shapping_get(struct hclge_dev *hdev, u32 *shaper) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:54:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:54:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:54:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:55:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:55:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:55:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:59:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:59:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:59:38: sparse: right side has type unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:61:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:61:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:61:38: sparse: right side has type int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:70:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ti2oupm @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:70:43: sparse: expected unsigned int [usertype] ti2oupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:70:43: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:71:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] tv2pupm @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:71:43: sparse: expected unsigned int [usertype] tv2pupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:71:43: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:75:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:75:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:75:38: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:76:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:76:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:76:38: sparse: right side has type int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:85:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] tp2nupm @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:85:43: sparse: expected unsigned int [usertype] tp2nupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:85:43: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:86:54: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:87:41: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:96:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:96:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:96:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:97:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:97:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:97:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:100:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:100:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:100:38: sparse: right side has type unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:102:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:102:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:102:38: sparse: right side has type int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:113:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] ti2oupm @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:113:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:113:46: sparse: got unsigned int [usertype] ti2oupm >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:115:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] tv2pupm @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:115:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:115:46: sparse: got unsigned int [usertype] tv2pupm >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:126:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:126:38: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:126:38: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:127:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:127:38: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:127:38: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:138:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] tp2nupm @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:138:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:138:46: sparse: got unsigned int [usertype] tp2nupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:140:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:140:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:140:46: sparse: got int -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:56:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:56:41: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:56:41: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:126:5: sparse: sparse: symbol 'hns3_set_sfp_state' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:126:5: warning: no previous prototype for 'hns3_set_sfp_state' [-Wmissing-prototypes] 126 | int hns3_set_sfp_state(struct hnae3_handle *handle, bool en) | ^~~~~~~~~~~~~~~~~~ vim +673 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 648 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 649 static int hns3_dcqcn_rw(struct hns3_nic_priv *net_priv, d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 650 u32 offset, u32 *data, u32 rw_type) d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 651 { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 652 struct hnae3_handle *h = net_priv->ae_handle; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 653 struct hclge_vport *vport; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 654 struct hclge_dev *hdev; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 655 struct hclge_desc desc; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 656 int ret; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 657 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 658 if (!data) d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 659 return -EFAULT; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 660 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 661 vport = container_of(h, struct hclge_vport, nic); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 662 hdev = vport->back; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 663 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 664 if (rw_type == DEVMEM_CFG_READ) { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 665 hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_DCQCN_TEMPLATE_CFG, d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 666 true); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 667 } else { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 668 hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_DCQCN_TEMPLATE_CFG, d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 669 false); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 670 desc.data[2] = *data; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 671 } d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 672 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 @673 desc.data[0] = SCC_TEMP_LOW_ADDR + offset; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 674 desc.data[1] = SCC_TEMP_HIGH_ADDR; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 675 desc.data[4] = 32; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 676 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 677 ret = hclge_cmd_send(&hdev->hw, &desc, 1); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 678 if (ret) { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 679 dev_err(&hdev->pdev->dev, "disable net lane failed %d\n", ret); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 680 return ret; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 681 } d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 682 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 683 if (rw_type == DEVMEM_CFG_READ) d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 684 *data = desc.data[2]; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 685 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 686 return 0; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 687 } d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 688 :::::: The code at line 673 was first introduced by commit :::::: d02033616da9f2fca85e2e8cb73bdd04c46f21e9 net: hns3: add hns3 cae drivers to kernel :::::: TO: Weiwei <dengweiwei(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1606/22937] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2626:5: sparse: sparse: symbol 'hclge_set_all_vf_rst' was not declared. Should it be static?
by kernel test robot 16 Jun '24

16 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: 09262653590358d6bd64c121600490fcfa3312b3 [1606/22937] driver: hns3: update hns3 driver from drivers config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240616/202406160405.uc8O581O-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240616/202406160405.uc8O581O-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406160405.uc8O581O-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:39:22: sparse: sparse: symbol 'ae_algo' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:238:34: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:239:34: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2220:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] sfp_speed @@ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2220:16: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2220:16: sparse: got restricted __le32 [usertype] sfp_speed >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2626:5: sparse: sparse: symbol 'hclge_set_all_vf_rst' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3098:6: sparse: sparse: symbol 'hclge_reset_fail' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:8088:21: sparse: sparse: symbol 'hclge_ops' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2626:5: warning: no previous prototype for 'hclge_set_all_vf_rst' [-Wmissing-prototypes] 2626 | int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3098:6: warning: no previous prototype for 'hclge_reset_fail' [-Wmissing-prototypes] 3098 | bool hclge_reset_fail(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:8176:5: warning: no previous prototype for 'hclge_init' [-Wmissing-prototypes] 8176 | int hclge_init(void) | ^~~~~~~~~~ vim +/hclge_set_all_vf_rst +2626 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c 2625 > 2626 int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) 2627 { 2628 int i; 2629 2630 for (i = hdev->num_vmdq_vport + 1; i < hdev->num_alloc_vport; i++) { 2631 struct hclge_vport *vport = &hdev->vport[i]; 2632 int ret; 2633 2634 /* Send cmd to set/clear VF's FUNC_RST_ING */ 2635 ret = hclge_set_vf_rst(hdev, vport->vport_id, reset); 2636 if (ret) { 2637 dev_err(&hdev->pdev->dev, 2638 "set vf(%d) rst failded %d!\n", 2639 vport->vport_id, ret); 2640 return ret; 2641 } 2642 2643 if (!reset) 2644 continue; 2645 2646 /* Inform VF to process the reset. 2647 * hclge_inform_reset_assert_to_vf may fail if VF 2648 * driver is not loaded. 2649 */ 2650 ret = hclge_inform_reset_assert_to_vf(vport); 2651 if (ret) 2652 dev_warn(&hdev->pdev->dev, 2653 "inform reset to vf(%d) failded %d!\n", 2654 vport->vport_id, ret); 2655 } 2656 2657 return 0; 2658 } 2659 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS a11258126817cb686678871ccc7cea4e9601ae7a
by kernel test robot 16 Jun '24

16 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: a11258126817cb686678871ccc7cea4e9601ae7a !9084 v5 xfs: atomic writes for xfs Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-randconfig-051-20240615 | |-- Documentation-devicetree-bindings-iio-addac-adi-ad74413r.yaml:channel:Missing-additionalProperties-unevaluatedProperties-constraint | `-- Documentation-devicetree-bindings-sound-amlogic-gx-sound-card.yaml:codec(-):Missing-additionalProperties-unevaluatedProperties-constraint `-- x86_64-allnoconfig |-- drivers-arm-spe-spe.c:linux-perf-arm_pmu.h-is-included-more-than-once. |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:common-qp.h-is-included-more-than-once. |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 1688m configs tested: 35 configs skipped: 145 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-13.2.0 arm64 defconfig gcc-13.2.0 arm64 randconfig-001-20240615 clang-19 arm64 randconfig-002-20240615 gcc-13.2.0 arm64 randconfig-003-20240615 clang-17 arm64 randconfig-004-20240615 gcc-13.2.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240615 gcc-9 x86_64 buildonly-randconfig-002-20240615 clang-18 x86_64 buildonly-randconfig-003-20240615 clang-18 x86_64 buildonly-randconfig-004-20240615 clang-18 x86_64 buildonly-randconfig-005-20240615 gcc-9 x86_64 buildonly-randconfig-006-20240615 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240615 gcc-13 x86_64 randconfig-002-20240615 gcc-8 x86_64 randconfig-003-20240615 gcc-13 x86_64 randconfig-004-20240615 gcc-13 x86_64 randconfig-005-20240615 gcc-13 x86_64 randconfig-006-20240615 gcc-8 x86_64 randconfig-011-20240615 clang-18 x86_64 randconfig-012-20240615 gcc-13 x86_64 randconfig-013-20240615 clang-18 x86_64 randconfig-014-20240615 clang-18 x86_64 randconfig-015-20240615 clang-18 x86_64 randconfig-016-20240615 clang-18 x86_64 randconfig-071-20240615 clang-18 x86_64 randconfig-072-20240615 clang-18 x86_64 randconfig-073-20240615 gcc-7 x86_64 randconfig-074-20240615 gcc-13 x86_64 randconfig-075-20240615 clang-18 x86_64 randconfig-076-20240615 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Kaixiong Yu 16 Jun '24

16 Jun '24

*** BLURB HERE *** Benjamin Bara (2): i2c: core: Run atomic i2c xfer when !preemptible i2c: core: Fix atomic xfer check for non-preempt config drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
by Kaixiong Yu 15 Jun '24

15 Jun '24

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.219 commit bca19bb2dc2d89ce60c4a4a6e59609d4cf2e13ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S27V CVE: CVE-2021-47571 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b535917c51acc97fb0761b1edec85f1f3d02bda4 upstream. The free_rtllib() function frees the "dev" pointer so there is use after free on the next line. Re-arrange things to avoid that. Fixes: 66898177e7e5 ("staging: rtl8192e: Fix unload/reload problem") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/20211117072016.GA5237@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c index 7cdced0b0581..da73998bc5f7 100644 --- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c @@ -2579,13 +2579,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev) free_irq(dev->irq, dev); priv->irq = 0; } - free_rtllib(dev); if (dev->mem_start != 0) { iounmap((void __iomem *)dev->mem_start); release_mem_region(pci_resource_start(pdev, 1), pci_resource_len(pdev, 1)); } + + free_rtllib(dev); } else { priv = rtllib_priv(dev); } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 745a3c567e1c329d131a8896642475f3916d020a
by kernel test robot 15 Jun '24

15 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 745a3c567e1c329d131a8896642475f3916d020a !9017 misc/libmasm/module: Fix two use after free in ibmasm_init_one Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202406150959.idZDT1QZ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202406151050.cbAafgsa-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/edac/skx_common.o: warning: objtool: missing symbol for section .text drivers/spi/spi-phytium-plat.c:186:34: warning: unused variable 'phytium_spi_of_match' [-Wunused-const-variable] kernel/livepatch/core.c:75:16: warning: no previous prototype for function 'klp_check_patch_kprobed' [-Wmissing-prototypes] mm/debug.c:143:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] mm/debug.c:174:3: warning: format specifies type 'void *' but the argument has type 'int' [-Wformat] mm/debug.c:175:18: warning: format specifies type 'unsigned long' but the argument has type 'const unsigned long *' [-Wformat] mm/debug.c:175:3: warning: format specifies type 'int' but the argument has type 'unsigned long' [-Wformat] Unverified Error/Warning (likely false positive, please contact us if interested): drivers/block/loop.c:1338 loop_set_status() warn: inconsistent returns '&loop_ctl_mutex'. Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- x86_64-buildonly-randconfig-001-20240615 | |-- drivers-edac-skx_common.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-buildonly-randconfig-005-20240615 `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text clang_recent_errors |-- x86_64-allyesconfig | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20240615 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20240615 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-randconfig-005-20240420 | |-- drivers-spi-spi-phytium-plat.c:warning:unused-variable-phytium_spi_of_match | |-- mm-debug.c:warning:format-specifies-type-int-but-the-argument-has-type-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-unsigned-long-but-the-argument-has-type-const-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-void-but-the-argument-has-type-int | `-- mm-debug.c:warning:more-conversions-than-data-arguments |-- x86_64-randconfig-073-20240521 | `-- kernel-livepatch-core.c:warning:no-previous-prototype-for-function-klp_check_patch_kprobed |-- x86_64-randconfig-103-20240609 | `-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. `-- x86_64-randconfig-161-20240430 `-- drivers-block-loop.c-loop_set_status()-warn:inconsistent-returns-loop_ctl_mutex-. elapsed time: 1596m configs tested: 35 configs skipped: 150 tested configs: arm64 allmodconfig gcc-13.2.0 arm64 allnoconfig gcc-13.2.0 arm64 defconfig gcc-13.2.0 arm64 randconfig-001-20240614 gcc-13.2.0 arm64 randconfig-002-20240614 gcc-13.2.0 arm64 randconfig-003-20240614 gcc-13.2.0 arm64 randconfig-004-20240614 gcc-13.2.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240615 gcc-9 x86_64 buildonly-randconfig-002-20240615 clang-18 x86_64 buildonly-randconfig-003-20240615 clang-18 x86_64 buildonly-randconfig-004-20240615 clang-18 x86_64 buildonly-randconfig-005-20240615 gcc-9 x86_64 buildonly-randconfig-006-20240615 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240615 gcc-13 x86_64 randconfig-002-20240615 gcc-8 x86_64 randconfig-003-20240615 gcc-13 x86_64 randconfig-004-20240615 gcc-13 x86_64 randconfig-005-20240615 gcc-13 x86_64 randconfig-006-20240615 gcc-8 x86_64 randconfig-011-20240615 clang-18 x86_64 randconfig-012-20240615 gcc-13 x86_64 randconfig-013-20240615 clang-18 x86_64 randconfig-014-20240615 clang-18 x86_64 randconfig-015-20240615 clang-18 x86_64 randconfig-016-20240615 clang-18 x86_64 randconfig-071-20240615 clang-18 x86_64 randconfig-072-20240615 clang-18 x86_64 randconfig-073-20240615 gcc-7 x86_64 randconfig-074-20240615 gcc-13 x86_64 randconfig-075-20240615 clang-18 x86_64 randconfig-076-20240615 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
by Kaixiong Yu 15 Jun '24

15 Jun '24

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.219 commit bca19bb2dc2d89ce60c4a4a6e59609d4cf2e13ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S27V CVE: CVE-2021-47571 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b535917c51acc97fb0761b1edec85f1f3d02bda4 upstream. The free_rtllib() function frees the "dev" pointer so there is use after free on the next line. Re-arrange things to avoid that. Fixes: 66898177e7e5 ("staging: rtl8192e: Fix unload/reload problem") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/20211117072016.GA5237@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c index 7cdced0b0581..da73998bc5f7 100644 --- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c @@ -2579,13 +2579,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev) free_irq(dev->irq, dev); priv->irq = 0; } - free_rtllib(dev); if (dev->mem_start != 0) { iounmap((void __iomem *)dev->mem_start); release_mem_region(pci_resource_start(pdev, 1), pci_resource_len(pdev, 1)); } + + free_rtllib(dev); } else { priv = rtllib_priv(dev); } -- 2.25.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
by Peng Zhang 15 Jun '24

15 Jun '24

From: ZhangPeng <zhangpeng362(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5OHG ------------------------------------------------------- CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for aarch64 is not updated. Make update_oedefconfig to fix checkdefconfig fail. Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ab1db78f049a..41a1ea231ed0 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7911,6 +7911,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 0c6fc6018c2c..4a979fcc1790 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9043,6 +9043,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.25.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
by Peng Zhang 15 Jun '24

15 Jun '24

From: ZhangPeng <zhangpeng362(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5OHG ------------------------------------------------------- CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for aarch64 is not updated. Make update_oedefconfig to fix checkdefconfig fail. Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ab1db78f049a..41a1ea231ed0 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7911,6 +7911,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 0c6fc6018c2c..4a979fcc1790 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9043,6 +9043,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.25.1

2 1

[OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
by Peng Zhang 15 Jun '24

15 Jun '24

From: ZhangPeng <zhangpeng362(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5OHG ------------------------------------------------------- CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for aarch64 is not updated. Make update_oedefconfig to fix checkdefconfig fail. Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ab1db78f049a..41a1ea231ed0 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7911,6 +7911,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 0c6fc6018c2c..4a979fcc1790 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9043,6 +9043,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-36971
by Liu Jian 15 Jun '24

15 Jun '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 4 ++++ include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 33 insertions(+), 46 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/cma: Fix rdma_resolve_route() memory leak
by Zhao Wenhui 15 Jun '24

15 Jun '24

From: Gerd Rausch <gerd.rausch(a)oracle.com> stable inclusion from stable-v4.19.198 commit 4893c938f2a140a74be91779e45e4a7fa111198f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ER CVE: CVE-2021-47345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ] Fix a memory leak when "mda_resolve_route() is called more than once on the same "rdma_cm_id". This is possible if cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and allows rdma_resolve_route() to be called again. Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com Signed-off-by: Gerd Rausch <gerd.rausch(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..127ebd481689 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2547,7 +2547,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms) cma_init_resolve_route_work(work, id_priv); - route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); + if (!route->path_rec) + route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); if (!route->path_rec) { ret = -ENOMEM; goto err1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/cma: Fix rdma_resolve_route() memory leak
by Zhao Wenhui 15 Jun '24

15 Jun '24

From: Gerd Rausch <gerd.rausch(a)oracle.com> stable inclusion from stable-v4.19.198 commit 4893c938f2a140a74be91779e45e4a7fa111198f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ER CVE: CVE-2021-47345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ] Fix a memory leak when "mda_resolve_route() is called more than once on the same "rdma_cm_id". This is possible if cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and allows rdma_resolve_route() to be called again. Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com Signed-off-by: Gerd Rausch <gerd.rausch(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..127ebd481689 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2547,7 +2547,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms) cma_init_resolve_route_work(work, id_priv); - route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); + if (!route->path_rec) + route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); if (!route->path_rec) { ret = -ENOMEM; goto err1; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] fs/9p: fix uninitialized values during inode evict
by Long Li 15 Jun '24

15 Jun '24

From: Eric Van Hensbergen <ericvh(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 6630036b7c228f57c7893ee0403e92c2db2cd21d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U997 CVE: CVE-2024-36923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made. This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways). Reported-by: syzbot+eb83fe1cce5833cd66a0(a)syzkaller.appspotmail.com Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Conflicts: fs/9p/vfs_inode.c [v9fs_evict_inode() function has been changed] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/9p/vfs_inode.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 88ca5015f987..483d777a8617 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -376,15 +376,19 @@ void v9fs_evict_inode(struct inode *inode) { struct v9fs_inode *v9inode = V9FS_I(inode); - truncate_inode_pages_final(&inode->i_data); - clear_inode(inode); - filemap_fdatawrite(&inode->i_data); - - v9fs_cache_inode_put_cookie(inode); - /* clunk the fid stashed in writeback_fid */ - if (v9inode->writeback_fid) { - p9_client_clunk(v9inode->writeback_fid); - v9inode->writeback_fid = NULL; + if (!is_bad_inode(inode)) { + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + filemap_fdatawrite(&inode->i_data); + + v9fs_cache_inode_put_cookie(inode); + /* clunk the fid stashed in writeback_fid */ + if (v9inode->writeback_fid) { + p9_client_clunk(v9inode->writeback_fid); + v9inode->writeback_fid = NULL; + } + } else { + clear_inode(inode); } } -- 2.39.2

2 1

[PATCH OLK-5.10] fs/9p: fix uninitialized values during inode evict
by Long Li 15 Jun '24

15 Jun '24

From: Eric Van Hensbergen <ericvh(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 6630036b7c228f57c7893ee0403e92c2db2cd21d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U997 CVE: CVE-2024-36923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made. This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways). Reported-by: syzbot+eb83fe1cce5833cd66a0(a)syzkaller.appspotmail.com Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Conflicts: fs/9p/vfs_inode.c [v9fs_evict_inode() function has been changed] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/9p/vfs_inode.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 88ca5015f987..483d777a8617 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -376,15 +376,19 @@ void v9fs_evict_inode(struct inode *inode) { struct v9fs_inode *v9inode = V9FS_I(inode); - truncate_inode_pages_final(&inode->i_data); - clear_inode(inode); - filemap_fdatawrite(&inode->i_data); - - v9fs_cache_inode_put_cookie(inode); - /* clunk the fid stashed in writeback_fid */ - if (v9inode->writeback_fid) { - p9_client_clunk(v9inode->writeback_fid); - v9inode->writeback_fid = NULL; + if (!is_bad_inode(inode)) { + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + filemap_fdatawrite(&inode->i_data); + + v9fs_cache_inode_put_cookie(inode); + /* clunk the fid stashed in writeback_fid */ + if (v9inode->writeback_fid) { + p9_client_clunk(v9inode->writeback_fid); + v9inode->writeback_fid = NULL; + } + } else { + clear_inode(inode); } } -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 17817/22937] drivers/edac/skx_common.o: warning: objtool: missing symbol for section .text
by kernel test robot 15 Jun '24

15 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: 0cfc819665b6124290e8d9ff7a52b8e0147eaa55 [17817/22937] Intel: EDAC, skx, i10nm: Make skx_common.c a pure library config: x86_64-buildonly-randconfig-001-20240615 (https://download.01.org/0day-ci/archive/20240615/202406151050.cbAafgsa-lkp@…) compiler: gcc-9 (Ubuntu 9.5.0-4ubuntu2) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240615/202406151050.cbAafgsa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406151050.cbAafgsa-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/edac/skx_common.c: In function 'skx_mce_output_error': drivers/edac/skx_common.c:478:8: warning: variable 'type' set but not used [-Wunused-but-set-variable] 478 | char *type, *optype; | ^~~~ drivers/edac/skx_common.c: In function 'skx_get_dimm_info': drivers/edac/skx_common.c:317:72: warning: '_DIMM#' directive output may be truncated writing 6 bytes into a region of size between 0 and 9 [-Wformat-truncation=] 317 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~ drivers/edac/skx_common.c:317:45: note: using the range [0, 4294967295] for directive argument 317 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/edac/skx_common.c:317:2: note: 'snprintf' output between 31 and 53 bytes into a destination of size 32 317 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 318 | imc->src_id, imc->lmc, chan, dimmno); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/edac/skx_common.c: In function 'skx_get_nvdimm_info': drivers/edac/skx_common.c:365:72: warning: '_DIMM#' directive output may be truncated writing 6 bytes into a region of size between 0 and 9 [-Wformat-truncation=] 365 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~ drivers/edac/skx_common.c:365:45: note: using the range [0, 4294967295] for directive argument 365 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/edac/skx_common.c:365:2: note: 'snprintf' output between 31 and 53 bytes into a destination of size 32 365 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 366 | imc->src_id, imc->lmc, chan, dimmno); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/edac/skx_common.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-36971
by Liu Jian 15 Jun '24

15 Jun '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 4 ++++ include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 33 insertions(+), 46 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 18534/22937] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 15 Jun '24

15 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [18534/22937] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-103-20240609 (https://download.01.org/0day-ci/archive/20240615/202406150959.idZDT1QZ-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406150959.idZDT1QZ-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v5 00/21] xfs: atomic writes for xfs
by Long Li 14 Jun '24

14 Jun '24

THis patch set support xfs atomic writes feature. Alan Adamson (1): nvme: Atomic write support Darrick J. Wong (3): fs: xfs: Introduce FORCEALIGN inode flag fs: xfs: Enable file data forcealign feature fs: xfs: Make file data allocations observe the 'forcealign' flag John Garry (11): block: Add core atomic write support fs: xfs: Do not free EOF blocks for forcealign fs: iomap: Sub-extent zeroing fs: xfs: iomap: Sub-extent zeroing fs: Add FS_XFLAG_ATOMICWRITES flag fs: iomap: Atomic write support fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign fs: xfs: Validate atomic writes fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE xfs: Update xfs_is_falloc_aligned() mask for forcealign xfs: Only free full extents for forcealign Long Li (5): block: get atomic write max sectors xfs: support atomic write ioctl xfs: fix set xflags fail when inode has extent hit xfs: make bunmapi observe forcealigin block: fix kabi in struct queue_limits Prasad Singamsetty (1): fs: Initial atomic write support Documentation/ABI/testing/sysfs-block | 52 ++++++++++++++ block/blk-core.c | 39 ++++++++++- block/blk-merge.c | 95 +++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-settings.c | 57 ++++++++++++++++ block/blk-sysfs.c | 34 ++++++++++ block/blk.h | 1 + drivers/md/dm-table.c | 5 +- drivers/md/dm.c | 4 +- drivers/nvme/host/core.c | 56 +++++++++++++++ fs/aio.c | 8 +-- fs/iomap/direct-io.c | 32 +++++++-- fs/read_write.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 24 ++++++- fs/xfs/libxfs/xfs_format.h | 15 +++- fs/xfs/libxfs/xfs_inode_buf.c | 40 +++++++++++ fs/xfs/libxfs/xfs_inode_buf.h | 3 + fs/xfs/libxfs/xfs_sb.c | 4 ++ fs/xfs/xfs_bmap_util.c | 10 ++- fs/xfs/xfs_file.c | 38 ++++++++++- fs/xfs/xfs_inode.c | 30 ++++++++ fs/xfs/xfs_inode.h | 11 +++ fs/xfs/xfs_ioctl.c | 98 ++++++++++++++++++++++++++- fs/xfs/xfs_iomap.c | 19 +++++- fs/xfs/xfs_mount.h | 5 ++ fs/xfs/xfs_super.c | 9 +++ include/linux/blk_types.h | 7 ++ include/linux/blkdev.h | 75 +++++++++++++++++++- include/linux/fs.h | 30 +++++++- include/linux/iomap.h | 1 + include/uapi/linux/fs.h | 9 ++- io_uring/io_uring.c | 2 +- 32 files changed, 776 insertions(+), 40 deletions(-) -- 2.31.1

2 22

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix not validating setsockopt user input
by Kaixiong Yu 14 Jun '24

14 Jun '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.8.7 commit 8ee0c132a61df9723813c40e742dc5321824daa9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRQE CVE: CVE-2024-35965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f3951242ace5efc7131932e2e01e6ac6baed846 ] Check user input length before copying data. Fixes: 33575df7be67 ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c") Fixes: 3ee7b7cd8390 ("Bluetooth: Add BT_MODE socket option") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_sock.c [The conflict occurs because the commit 54db3630deff566224de6cfb0767d2d398e68ed5 ("Bluetooth: Remove BT_HS"), which is from stable inclusion-v6.8.2, is not merged] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 54 +++++++++++++++----------------------- 1 file changed, 21 insertions(+), 33 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 756523e5402a..13afdc599b58 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -744,7 +744,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, struct sock *sk = sock->sk; struct l2cap_chan *chan = l2cap_pi(sk)->chan; struct l2cap_options opts; - int len, err = 0; + int err = 0; u32 opt; BT_DBG("sk %p", sk); @@ -771,11 +771,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, opts.max_tx = chan->max_tx; opts.txwin_size = chan->tx_win; - len = min_t(unsigned int, sizeof(opts), optlen); - if (copy_from_sockptr(&opts, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen); + if (err) break; - } if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { err = -EINVAL; @@ -818,10 +816,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, break; case L2CAP_LM: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt & L2CAP_LM_FIPS) { err = -EINVAL; @@ -902,7 +899,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, struct bt_security sec; struct bt_power pwr; struct l2cap_conn *conn; - int len, err = 0; + int err = 0; u32 opt; u16 mtu; u8 mode; @@ -928,11 +925,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, sec.level = BT_SECURITY_LOW; - len = min_t(unsigned int, sizeof(sec), optlen); - if (copy_from_sockptr(&sec, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen); + if (err) break; - } if (sec.level < BT_SECURITY_LOW || sec.level > BT_SECURITY_FIPS) { @@ -977,10 +972,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) { set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); @@ -992,10 +986,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_FLUSHABLE: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt > BT_FLUSHABLE_ON) { err = -EINVAL; @@ -1027,11 +1020,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; - len = min_t(unsigned int, sizeof(pwr), optlen); - if (copy_from_sockptr(&pwr, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen); + if (err) break; - } if (pwr.force_active) set_bit(FLAG_FORCE_ACTIVE, &chan->flags); @@ -1040,10 +1031,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_CHANNEL_POLICY: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; - break; - } + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) + break; if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) { err = -EINVAL; @@ -1088,10 +1078,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mtu, optval, sizeof(u16))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen); + if (err) break; - } if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && sk->sk_state == BT_CONNECTED) @@ -1119,10 +1108,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mode, optval, sizeof(u8))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen); + if (err) break; - } BT_DBG("mode %u", mode); -- 2.25.1

2 1

[PATCH v2 OLK-5.10] arm64: mm: Replace global variable in pbha with static key
by Wupeng Ma 14 Jun '24

14 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5L01 -------------------------------- During the lmbench test, it was observed that bw_mem experienced a degradation of 8% or more. To solve this issue, replacing the global variables with a static key. Fixes: 0d65528c8526 ("arm64: mm: Detect and enable PBHA bit0 at early startup") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- Changelog since v1: - add fix tag for bugfix --- drivers/soc/hisilicon/pbha.c | 17 +++++++++-------- include/linux/pbha.h | 13 ++++++++----- 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/soc/hisilicon/pbha.c b/drivers/soc/hisilicon/pbha.c index 57daa5c338b5..9e385c93bab5 100644 --- a/drivers/soc/hisilicon/pbha.c +++ b/drivers/soc/hisilicon/pbha.c @@ -17,8 +17,9 @@ #define HBM_MODE_CACHE 1 -bool __ro_after_init pbha_bit0_enabled; -bool __ro_after_init pbha_bit0_kernel_enabled; +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_enabled); +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + static bool pbha_enabled_phase_1; void __init early_pbha_bit0_init(void) @@ -191,15 +192,15 @@ static int __init setup_pbha(char *str) return 0; if (strcmp(str, "enable") == 0) { - pbha_bit0_enabled = true; - pbha_bit0_kernel_enabled = true; + static_branch_enable(&pbha_bit0_enabled); + static_branch_enable(&pbha_bit0_kernel_enabled); } else if (strcmp(str, "user") == 0) { - pbha_bit0_enabled = true; + static_branch_enable(&pbha_bit0_enabled); } - if (pbha_bit0_enabled) - pr_info("pbha bit_0 enabled, kernel: %d\n", - pbha_bit0_kernel_enabled); + if (static_branch_likely(&pbha_bit0_enabled)) + pr_info("pbha bit_0 enabled, kernel: %ld\n", + static_branch_likely(&pbha_bit0_kernel_enabled)); return 0; } diff --git a/include/linux/pbha.h b/include/linux/pbha.h index 45a4b07778bf..a8ac441628bd 100644 --- a/include/linux/pbha.h +++ b/include/linux/pbha.h @@ -20,20 +20,22 @@ #define HBM_MODE_CACHE 1 #ifdef CONFIG_ARM64_PBHA -extern bool __ro_after_init pbha_bit0_enabled; -extern bool __ro_after_init pbha_bit0_kernel_enabled; +DECLARE_STATIC_KEY_FALSE(pbha_bit0_enabled); +DECLARE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + extern struct mm_walk_ops pbha_bit0_walk_ops; extern void __init early_pbha_bit0_init(void); extern int pbha_bit0_update_vma(struct mm_struct *mm, int val); static inline bool system_support_pbha_bit0(void) { - return pbha_bit0_enabled; + return static_branch_unlikely(&pbha_bit0_enabled); } static inline pgprot_t pgprot_pbha_bit0(pgprot_t prot) { - if (!system_support_pbha_bit0() || !pbha_bit0_kernel_enabled) + if (!system_support_pbha_bit0() || + !static_branch_unlikely(&pbha_bit0_kernel_enabled)) return prot; return pgprot_pbha(prot, PBHA_VAL_BIT0); @@ -45,7 +47,8 @@ static inline pte_t maybe_mk_pbha_bit0(pte_t pte, struct vm_area_struct *vma) return pte; /* global init task will update pbha bit0 iff kernel can do this */ - if (unlikely(is_global_init(current)) && pbha_bit0_kernel_enabled && + if (unlikely(is_global_init(current)) && + static_branch_unlikely(&pbha_bit0_kernel_enabled) && !(vma->vm_flags & VM_PBHA_BIT0)) vma->vm_flags |= VM_PBHA_BIT0; -- 2.25.1

2 1

[PATCH v2 OLK-5.10] arm64: mm: Replace global variable in pbha with static key
by Wupeng Ma 14 Jun '24

14 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5L01 -------------------------------- During the lmbench test, it was observed that bw_mem experienced a degradation of 8% or more. To solve this issue, replacing the global variables with a static key. Fixes: 0d65528c8526 ("arm64: mm: Detect and enable PBHA bit0 at early startup") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- Changelog since v1: - add fix tag for bugfix --- drivers/soc/hisilicon/pbha.c | 17 +++++++++-------- include/linux/pbha.h | 13 ++++++++----- 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/soc/hisilicon/pbha.c b/drivers/soc/hisilicon/pbha.c index 57daa5c338b5..9e385c93bab5 100644 --- a/drivers/soc/hisilicon/pbha.c +++ b/drivers/soc/hisilicon/pbha.c @@ -17,8 +17,9 @@ #define HBM_MODE_CACHE 1 -bool __ro_after_init pbha_bit0_enabled; -bool __ro_after_init pbha_bit0_kernel_enabled; +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_enabled); +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + static bool pbha_enabled_phase_1; void __init early_pbha_bit0_init(void) @@ -191,15 +192,15 @@ static int __init setup_pbha(char *str) return 0; if (strcmp(str, "enable") == 0) { - pbha_bit0_enabled = true; - pbha_bit0_kernel_enabled = true; + static_branch_enable(&pbha_bit0_enabled); + static_branch_enable(&pbha_bit0_kernel_enabled); } else if (strcmp(str, "user") == 0) { - pbha_bit0_enabled = true; + static_branch_enable(&pbha_bit0_enabled); } - if (pbha_bit0_enabled) - pr_info("pbha bit_0 enabled, kernel: %d\n", - pbha_bit0_kernel_enabled); + if (static_branch_likely(&pbha_bit0_enabled)) + pr_info("pbha bit_0 enabled, kernel: %ld\n", + static_branch_likely(&pbha_bit0_kernel_enabled)); return 0; } diff --git a/include/linux/pbha.h b/include/linux/pbha.h index 45a4b07778bf..a8ac441628bd 100644 --- a/include/linux/pbha.h +++ b/include/linux/pbha.h @@ -20,20 +20,22 @@ #define HBM_MODE_CACHE 1 #ifdef CONFIG_ARM64_PBHA -extern bool __ro_after_init pbha_bit0_enabled; -extern bool __ro_after_init pbha_bit0_kernel_enabled; +DECLARE_STATIC_KEY_FALSE(pbha_bit0_enabled); +DECLARE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + extern struct mm_walk_ops pbha_bit0_walk_ops; extern void __init early_pbha_bit0_init(void); extern int pbha_bit0_update_vma(struct mm_struct *mm, int val); static inline bool system_support_pbha_bit0(void) { - return pbha_bit0_enabled; + return static_branch_unlikely(&pbha_bit0_enabled); } static inline pgprot_t pgprot_pbha_bit0(pgprot_t prot) { - if (!system_support_pbha_bit0() || !pbha_bit0_kernel_enabled) + if (!system_support_pbha_bit0() || + !static_branch_unlikely(&pbha_bit0_kernel_enabled)) return prot; return pgprot_pbha(prot, PBHA_VAL_BIT0); @@ -45,7 +47,8 @@ static inline pte_t maybe_mk_pbha_bit0(pte_t pte, struct vm_area_struct *vma) return pte; /* global init task will update pbha bit0 iff kernel can do this */ - if (unlikely(is_global_init(current)) && pbha_bit0_kernel_enabled && + if (unlikely(is_global_init(current)) && + static_branch_unlikely(&pbha_bit0_kernel_enabled) && !(vma->vm_flags & VM_PBHA_BIT0)) vma->vm_flags |= VM_PBHA_BIT0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: L2CAP: Fix not validating setsockopt user input
by Kaixiong Yu 14 Jun '24

14 Jun '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.8.7 commit 8ee0c132a61df9723813c40e742dc5321824daa9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRQE CVE: CVE-2024-35965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f3951242ace5efc7131932e2e01e6ac6baed846 ] Check user input length before copying data. Fixes: 33575df7be67 ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c") Fixes: 3ee7b7cd8390 ("Bluetooth: Add BT_MODE socket option") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_sock.c [The conflict occurs because the commit 54db3630deff566224de6cfb0767d2d398e68ed5 ("Bluetooth: Remove BT_HS"), which is from stable inclusion-v6.8.2, is not merged.] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 52 +++++++++++++++----------------------- 1 file changed, 20 insertions(+), 32 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 63bfbb5918fe..c91f4c190bbc 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -744,7 +744,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, struct sock *sk = sock->sk; struct l2cap_chan *chan = l2cap_pi(sk)->chan; struct l2cap_options opts; - int len, err = 0; + int err = 0; u32 opt; BT_DBG("sk %p", sk); @@ -771,11 +771,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, opts.max_tx = chan->max_tx; opts.txwin_size = chan->tx_win; - len = min_t(unsigned int, sizeof(opts), optlen); - if (copy_from_sockptr(&opts, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen); + if (err) break; - } if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { err = -EINVAL; @@ -818,10 +816,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, break; case L2CAP_LM: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt & L2CAP_LM_FIPS) { err = -EINVAL; @@ -902,7 +899,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, struct bt_security sec; struct bt_power pwr; struct l2cap_conn *conn; - int len, err = 0; + int err = 0; u32 opt; u16 mtu; u8 mode; @@ -928,11 +925,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, sec.level = BT_SECURITY_LOW; - len = min_t(unsigned int, sizeof(sec), optlen); - if (copy_from_sockptr(&sec, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen); + if (err) break; - } if (sec.level < BT_SECURITY_LOW || sec.level > BT_SECURITY_FIPS) { @@ -977,10 +972,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) { set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); @@ -992,10 +986,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_FLUSHABLE: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt > BT_FLUSHABLE_ON) { err = -EINVAL; @@ -1027,11 +1020,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; - len = min_t(unsigned int, sizeof(pwr), optlen); - if (copy_from_sockptr(&pwr, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen); + if (err) break; - } if (pwr.force_active) set_bit(FLAG_FORCE_ACTIVE, &chan->flags); @@ -1065,10 +1056,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_SNDMTU: - if (!bdaddr_type_is_le(chan->src_type)) { - err = -EINVAL; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } /* Setting is not supported as it's the remote side that * decides this. @@ -1088,10 +1078,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mtu, optval, sizeof(u16))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen); + if (err) break; - } if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && sk->sk_state == BT_CONNECTED) @@ -1119,10 +1108,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mode, optval, sizeof(u8))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen); + if (err) break; - } BT_DBG("mode %u", mode); -- 2.25.1

2 1

[PATCH OLK-5.10] arm64: mm: Replace global variable in pbha with static key
by Wupeng Ma 14 Jun '24

14 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5L01 -------------------------------- During the lmbench test, it was observed that bw_mem experienced a degradation of 8% or more. To solve this issue, replacing the global variables with a static key. Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/soc/hisilicon/pbha.c | 17 +++++++++-------- include/linux/pbha.h | 13 ++++++++----- 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/soc/hisilicon/pbha.c b/drivers/soc/hisilicon/pbha.c index 57daa5c338b5..9e385c93bab5 100644 --- a/drivers/soc/hisilicon/pbha.c +++ b/drivers/soc/hisilicon/pbha.c @@ -17,8 +17,9 @@ #define HBM_MODE_CACHE 1 -bool __ro_after_init pbha_bit0_enabled; -bool __ro_after_init pbha_bit0_kernel_enabled; +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_enabled); +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + static bool pbha_enabled_phase_1; void __init early_pbha_bit0_init(void) @@ -191,15 +192,15 @@ static int __init setup_pbha(char *str) return 0; if (strcmp(str, "enable") == 0) { - pbha_bit0_enabled = true; - pbha_bit0_kernel_enabled = true; + static_branch_enable(&pbha_bit0_enabled); + static_branch_enable(&pbha_bit0_kernel_enabled); } else if (strcmp(str, "user") == 0) { - pbha_bit0_enabled = true; + static_branch_enable(&pbha_bit0_enabled); } - if (pbha_bit0_enabled) - pr_info("pbha bit_0 enabled, kernel: %d\n", - pbha_bit0_kernel_enabled); + if (static_branch_likely(&pbha_bit0_enabled)) + pr_info("pbha bit_0 enabled, kernel: %ld\n", + static_branch_likely(&pbha_bit0_kernel_enabled)); return 0; } diff --git a/include/linux/pbha.h b/include/linux/pbha.h index 45a4b07778bf..a8ac441628bd 100644 --- a/include/linux/pbha.h +++ b/include/linux/pbha.h @@ -20,20 +20,22 @@ #define HBM_MODE_CACHE 1 #ifdef CONFIG_ARM64_PBHA -extern bool __ro_after_init pbha_bit0_enabled; -extern bool __ro_after_init pbha_bit0_kernel_enabled; +DECLARE_STATIC_KEY_FALSE(pbha_bit0_enabled); +DECLARE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + extern struct mm_walk_ops pbha_bit0_walk_ops; extern void __init early_pbha_bit0_init(void); extern int pbha_bit0_update_vma(struct mm_struct *mm, int val); static inline bool system_support_pbha_bit0(void) { - return pbha_bit0_enabled; + return static_branch_unlikely(&pbha_bit0_enabled); } static inline pgprot_t pgprot_pbha_bit0(pgprot_t prot) { - if (!system_support_pbha_bit0() || !pbha_bit0_kernel_enabled) + if (!system_support_pbha_bit0() || + !static_branch_unlikely(&pbha_bit0_kernel_enabled)) return prot; return pgprot_pbha(prot, PBHA_VAL_BIT0); @@ -45,7 +47,8 @@ static inline pte_t maybe_mk_pbha_bit0(pte_t pte, struct vm_area_struct *vma) return pte; /* global init task will update pbha bit0 iff kernel can do this */ - if (unlikely(is_global_init(current)) && pbha_bit0_kernel_enabled && + if (unlikely(is_global_init(current)) && + static_branch_unlikely(&pbha_bit0_kernel_enabled) && !(vma->vm_flags & VM_PBHA_BIT0)) vma->vm_flags |= VM_PBHA_BIT0; -- 2.25.1

2 1

[PATCH OLK-5.10 v4 00/26] xfs: atomic writes for xfs
by Long Li 14 Jun '24

14 Jun '24

THis patch set support xfs atomic writes feature. Alan Adamson (1): nvme: Atomic write support Darrick J. Wong (3): fs: xfs: Introduce FORCEALIGN inode flag fs: xfs: Enable file data forcealign feature fs: xfs: Make file data allocations observe the 'forcealign' flag John Garry (11): block: Add core atomic write support fs: xfs: Do not free EOF blocks for forcealign fs: iomap: Sub-extent zeroing fs: xfs: iomap: Sub-extent zeroing fs: Add FS_XFLAG_ATOMICWRITES flag fs: iomap: Atomic write support fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign fs: xfs: Validate atomic writes fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE xfs: Update xfs_is_falloc_aligned() mask for forcealign xfs: Only free full extents for forcealign Long Li (6): block: get atomic write max sectors xfs: support atomic write ioctl xfs: atomic write file dio convert to mark IOCB_ATOMIC xfs: fix set xflags fail when inode has extent hit xfs: make bunmapi observe forcealigin block: fix kabi in struct queue_limits Prasad Singamsetty (1): fs: Initial atomic write support Zhang Yi (4): math64: add rem_u64() to just return the remainder iomap: pass blocksize to iomap_truncate_page() xfs: refactor the truncating order xfs: correct the truncate blocksize of realtime inode Documentation/ABI/testing/sysfs-block | 52 ++++++++++++ block/blk-core.c | 39 ++++++++- block/blk-merge.c | 95 ++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-settings.c | 57 +++++++++++++ block/blk-sysfs.c | 34 ++++++++ block/blk.h | 1 + drivers/md/dm-table.c | 5 +- drivers/md/dm.c | 4 +- drivers/nvme/host/core.c | 56 ++++++++++++ fs/aio.c | 8 +- fs/iomap/buffered-io.c | 8 +- fs/iomap/direct-io.c | 32 +++++-- fs/read_write.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 24 +++++- fs/xfs/libxfs/xfs_format.h | 15 +++- fs/xfs/libxfs/xfs_inode_buf.c | 40 +++++++++ fs/xfs/libxfs/xfs_inode_buf.h | 3 + fs/xfs/libxfs/xfs_sb.c | 4 + fs/xfs/xfs_bmap_util.c | 10 ++- fs/xfs/xfs_file.c | 40 ++++++++- fs/xfs/xfs_inode.c | 43 ++++++++++ fs/xfs/xfs_inode.h | 12 +++ fs/xfs/xfs_ioctl.c | 96 ++++++++++++++++++++- fs/xfs/xfs_iomap.c | 19 ++++- fs/xfs/xfs_iops.c | 118 +++++++++++++------------- fs/xfs/xfs_mount.h | 5 ++ fs/xfs/xfs_super.c | 9 ++ include/linux/blk_types.h | 7 ++ include/linux/blkdev.h | 77 ++++++++++++++++- include/linux/fs.h | 30 ++++++- include/linux/iomap.h | 5 +- include/linux/math64.h | 24 ++++++ include/uapi/linux/fs.h | 9 +- io_uring/io_uring.c | 2 +- 35 files changed, 884 insertions(+), 102 deletions(-) -- 2.31.1

2 27

[PATCH openEuler-1.0-LTS] dhugetlb: use rcu lock to protect hpool
by Liu Shixin 14 Jun '24

14 Jun '24

hulk inclusion category: bugfix bugzilla: 46904, https://gitee.com/openeuler/kernel/issues/IA5JXN -------------------------------- In freeing process, set memcg->hpool or dpool_global_hpool to NULL and then freeing it. To avoid UAF problem of hpool, we have to make sure the users that already hold pointer to hpool don't use the pointer after freeing hpool. The freeing of hpool should block until make sure all such users don't use hpool. Since anyone who want to use hpool have to increase its refcount at first. Use rcu_read_lock() and synchronize_rcu() to guarantee all such users failed to get hpool before freeing hpool. Fixes: 0bc0d0d57eda ("dhugetlb: backport dynamic hugetlb feature") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/hugetlb.c | 1 + mm/memcontrol.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 4be708677ce6..07b961d0a5ff 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3360,6 +3360,7 @@ void dhugetlb_pool_put(struct dhugetlb_pool *hpool) if (atomic_dec_and_test(&hpool->refcnt)) { css_put(&hpool->attach_memcg->css); + synchronize_rcu(); kfree(hpool); } } diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7dc68b1792ef..4ecb6f09b68b 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4701,14 +4701,19 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, struct dhugetlb_pool *get_dhugetlb_pool_from_memcg(struct mem_cgroup *memcg) { struct mem_cgroup_extension *memcg_ext; + struct dhugetlb_pool *hpool; if (!memcg) return NULL; + rcu_read_lock(); memcg_ext = container_of(memcg, struct mem_cgroup_extension, memcg); - if (dhugetlb_pool_get(memcg_ext->hpool)) - return memcg_ext->hpool; - return NULL; + hpool = memcg_ext->hpool; + if (!dhugetlb_pool_get(hpool)) + hpool = NULL; + rcu_read_unlock(); + + return hpool; } static void set_dhugetlb_pool_to_memcg(struct mem_cgroup *memcg, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
by Zheng Zucheng 14 Jun '24

14 Jun '24

From: Jason Gunthorpe <jgg(a)nvidia.com> mainline inclusion from mainline-v5.15-rc4 commit 305d568b72f17f674155a2a8275f865f207b3808 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4OB CVE: CVE-2021-47391 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- The FSM can run in a circle allowing rdma_resolve_ip() to be called twice on the same id_priv. While this cannot happen without going through the work, it violates the invariant that the same address resolution background request cannot be active twice. CPU 1 CPU 2 rdma_resolve_addr(): RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) #1 process_one_req(): for #1 addr_handler(): RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND mutex_unlock(&id_priv->handler_mutex); [.. handler still running ..] rdma_resolve_addr(): RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) !! two requests are now on the req_list rdma_destroy_id(): destroy_id_handler_unlock(): _destroy_id(): cma_cancel_operation(): rdma_addr_cancel() // process_one_req() self removes it spin_lock_bh(&lock); cancel_delayed_work(&req->work); if (!list_empty(&req->list)) == true ! rdma_addr_cancel() returns after process_on_req #1 is done kfree(id_priv) process_one_req(): for #2 addr_handler(): mutex_lock(&id_priv->handler_mutex); !! Use after free on id_priv rdma_addr_cancel() expects there to be one req on the list and only cancels the first one. The self-removal behavior of the work only happens after the handler has returned. This yields a situations where the req_list can have two reqs for the same "handle" but rdma_addr_cancel() only cancels the first one. The second req remains active beyond rdma_destroy_id() and will use-after-free id_priv once it inevitably triggers. Fix this by remembering if the id_priv has called rdma_resolve_ip() and always cancel before calling it again. This ensures the req_list never gets more than one item in it and doesn't cost anything in the normal flow that never uses this strange error path. Link: https://lore.kernel.org/r/0-v1-3bc675b8006d+22-syz_cancel_uaf_jgg@nvidia.com Cc: stable(a)vger.kernel.org Fixes: e51060f08a61 ("IB: IP address based RDMA connection manager") Reported-by: syzbot+dc3dfba010d7671e05f5(a)syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> (cherry picked from commit 305d568b72f17f674155a2a8275f865f207b3808) Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/core/cma.c drivers/infiniband/core/cma_priv.h [Some contexts different. No functional impact.] Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/infiniband/core/cma.c | 23 +++++++++++++++++++++++ drivers/infiniband/core/cma_priv.h | 1 + 2 files changed, 24 insertions(+) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..90cb1255ca64 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -1643,6 +1643,14 @@ static void cma_cancel_operation(struct rdma_id_private *id_priv, { switch (state) { case RDMA_CM_ADDR_QUERY: + /* + * We can avoid doing the rdma_addr_cancel() based on state, + * only RDMA_CM_ADDR_QUERY has a work that could still execute. + * Notice that the addr_handler work could still be exiting + * outside this state, however due to the interaction with the + * handler_mutex the work is guaranteed not to touch id_priv + * during exit. + */ rdma_addr_cancel(&id_priv->id.route.addr.dev_addr); break; case RDMA_CM_ROUTE_QUERY: @@ -3459,6 +3467,21 @@ int rdma_resolve_addr(struct rdma_cm_id *id, struct sockaddr *src_addr, if (dst_addr->sa_family == AF_IB) { ret = cma_resolve_ib_addr(id_priv); } else { + /* + * The FSM can return back to RDMA_CM_ADDR_BOUND after + * rdma_resolve_ip() is called, eg through the error + * path in addr_handler(). If this happens the existing + * request must be canceled before issuing a new one. + * Since canceling a request is a bit slow and this + * oddball path is rare, keep track once a request has + * been issued. The track turns out to be a permanent + * state since this is the only cancel as it is + * immediately before rdma_resolve_ip(). + */ + if (id_priv->used_resolve_ip) + rdma_addr_cancel(&id->route.addr.dev_addr); + else + id_priv->used_resolve_ip = 1; ret = rdma_resolve_ip(cma_src_addr(id_priv), dst_addr, &id->route.addr.dev_addr, timeout_ms, addr_handler, id_priv); diff --git a/drivers/infiniband/core/cma_priv.h b/drivers/infiniband/core/cma_priv.h index 194cfe78c447..e2e0bc89d847 100644 --- a/drivers/infiniband/core/cma_priv.h +++ b/drivers/infiniband/core/cma_priv.h @@ -87,6 +87,7 @@ struct rdma_id_private { bool tos_set; u8 reuseaddr; u8 afonly; + u8 used_resolve_ip; enum ib_gid_type gid_type; /* -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix UAF problem of hpool
by Liu Shixin 14 Jun '24

14 Jun '24

Add rcu lock protection to avoid get refcount of hpool after it has been freed. Liu Shixin (2): mm/dynamic_hugetlb: simplify the refcount code mm/dynamic_hugetlb: use rcu lock to protect hpool mm/dynamic_hugetlb.c | 128 +++++++++++++++++++++++++++---------------- 1 file changed, 82 insertions(+), 46 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] Bluetooth: L2CAP: Fix not validating setsockopt user input
by Kaixiong Yu 14 Jun '24

14 Jun '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.8.7 commit 8ee0c132a61df9723813c40e742dc5321824daa9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRQE CVE: CVE-2024-35965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f3951242ace5efc7131932e2e01e6ac6baed846 ] Check user input length before copying data. Fixes: 33575df7be67 ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c") Fixes: 3ee7b7cd8390 ("Bluetooth: Add BT_MODE socket option") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_sock.c [The conflict occurs because the commit 54db3630deff566224de6cfb0767d2d398e68ed5 ("Bluetooth: Remove BT_HS"), which is from stable inclusion-v6.8.2, is not merged] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 54 +++++++++++++++----------------------- 1 file changed, 21 insertions(+), 33 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 63bfbb5918fe..f739223d3af8 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -744,7 +744,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, struct sock *sk = sock->sk; struct l2cap_chan *chan = l2cap_pi(sk)->chan; struct l2cap_options opts; - int len, err = 0; + int err = 0; u32 opt; BT_DBG("sk %p", sk); @@ -771,11 +771,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, opts.max_tx = chan->max_tx; opts.txwin_size = chan->tx_win; - len = min_t(unsigned int, sizeof(opts), optlen); - if (copy_from_sockptr(&opts, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen); + if (err) break; - } if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { err = -EINVAL; @@ -818,10 +816,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, break; case L2CAP_LM: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt & L2CAP_LM_FIPS) { err = -EINVAL; @@ -902,7 +899,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, struct bt_security sec; struct bt_power pwr; struct l2cap_conn *conn; - int len, err = 0; + int err = 0; u32 opt; u16 mtu; u8 mode; @@ -928,11 +925,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, sec.level = BT_SECURITY_LOW; - len = min_t(unsigned int, sizeof(sec), optlen); - if (copy_from_sockptr(&sec, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen); + if (err) break; - } if (sec.level < BT_SECURITY_LOW || sec.level > BT_SECURITY_FIPS) { @@ -977,10 +972,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) { set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); @@ -992,10 +986,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_FLUSHABLE: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt > BT_FLUSHABLE_ON) { err = -EINVAL; @@ -1027,11 +1020,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; - len = min_t(unsigned int, sizeof(pwr), optlen); - if (copy_from_sockptr(&pwr, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen); + if (err) break; - } if (pwr.force_active) set_bit(FLAG_FORCE_ACTIVE, &chan->flags); @@ -1040,10 +1031,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_CHANNEL_POLICY: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; - break; - } + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) + break; if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) { err = -EINVAL; @@ -1088,10 +1078,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mtu, optval, sizeof(u16))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen); + if (err) break; - } if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && sk->sk_state == BT_CONNECTED) @@ -1119,10 +1108,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mode, optval, sizeof(u8))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen); + if (err) break; - } BT_DBG("mode %u", mode); -- 2.25.1

2 1

[PATCH OLK-5.10 v2 0/2] Fix UAF problem of hpool
by Liu Shixin 14 Jun '24

14 Jun '24

Add rcu lock protection to avoid get refcount of hpool after it has been freed. Liu Shixin (2): mm/dynamic_hugetlb: simplify the refcount code mm/dynamic_hugetlb: use rcu lock to protect hpool mm/dynamic_hugetlb.c | 128 +++++++++++++++++++++++++++---------------- 1 file changed, 82 insertions(+), 46 deletions(-) -- 2.25.1

1 2

[PATCH OLK-5.10 0/2] Fix UAF problem of hpool
by Liu Shixin 14 Jun '24

14 Jun '24

Add rcu lock protection to avoid get refcount of hpool after it has been freed. Liu Shixin (2): mm/dynamic_hugetlb: simplify the refcount code mm/dynamic_hugetlb: use rcu lock to protect hpool mm/dynamic_hugetlb.c | 128 +++++++++++++++++++++++++++---------------- 1 file changed, 82 insertions(+), 46 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: RFCOMM: Fix not validating setsockopt user input
by Jinjiang Tu 14 Jun '24

14 Jun '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v6.9-rc4 commit a97de7bff13b1cc825c1b1344eaed8d6c2d3e695 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRFS CVE: CVE-2024-35966 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064 Fixes: 9f2c8a03fbb3 ("Bluetooth: Replace RFCOMM link mode with security level") Fixes: bb23c0ab8246 ("Bluetooth: Add support for deferring RFCOMM connection setup") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/bluetooth/rfcomm/sock.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index 4cf1fa9900ca..82f404d3eba2 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -631,7 +631,7 @@ static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, switch (optname) { case RFCOMM_LM: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { + if (bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen)) { err = -EFAULT; break; } @@ -666,7 +666,6 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, struct sock *sk = sock->sk; struct bt_security sec; int err = 0; - size_t len; u32 opt; BT_DBG("sk %p", sk); @@ -688,11 +687,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, sec.level = BT_SECURITY_LOW; - len = min_t(unsigned int, sizeof(sec), optlen); - if (copy_from_sockptr(&sec, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen); + if (err) break; - } if (sec.level > BT_SECURITY_HIGH) { err = -EINVAL; @@ -708,10 +705,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); -- 2.25.1

2 1

[PATCH OLK-5.10] Bluetooth: RFCOMM: Fix not validating setsockopt user input
by Jinjiang Tu 14 Jun '24

14 Jun '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v6.9-rc4 commit a97de7bff13b1cc825c1b1344eaed8d6c2d3e695 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRFS CVE: CVE-2024-35966 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064 Fixes: 9f2c8a03fbb3 ("Bluetooth: Replace RFCOMM link mode with security level") Fixes: bb23c0ab8246 ("Bluetooth: Add support for deferring RFCOMM connection setup") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/bluetooth/rfcomm/sock.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index 4cf1fa9900ca..82f404d3eba2 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -631,7 +631,7 @@ static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, switch (optname) { case RFCOMM_LM: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { + if (bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen)) { err = -EFAULT; break; } @@ -666,7 +666,6 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, struct sock *sk = sock->sk; struct bt_security sec; int err = 0; - size_t len; u32 opt; BT_DBG("sk %p", sk); @@ -688,11 +687,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, sec.level = BT_SECURITY_LOW; - len = min_t(unsigned int, sizeof(sec), optlen); - if (copy_from_sockptr(&sec, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen); + if (err) break; - } if (sec.level > BT_SECURITY_HIGH) { err = -EINVAL; @@ -708,10 +705,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); -- 2.25.1

2 1

[PATCH OLK-5.10] config: enable CONFIG_BLK_CGROUP_IOCOST by default
by Li Nan 14 Jun '24

14 Jun '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA582B CVE: NA -------------------------------- It will also enable CONFIG_BLK_RQ_ALLOC_TIME. Signed-off-by: Li Nan <linan122(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 3 ++- arch/x86/configs/openeuler_defconfig | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ffb058ec0b0a..4450315d742e 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -945,6 +945,7 @@ CONFIG_MODULE_SIG_HASH="sha256" # CONFIG_TRIM_UNUSED_KSYMS is not set CONFIG_MODULES_TREE_LOOKUP=y CONFIG_BLOCK=y +CONFIG_BLK_RQ_ALLOC_TIME=y CONFIG_BLK_SCSI_REQUEST=y CONFIG_BLK_CGROUP_RWSTAT=y CONFIG_BLK_DEV_BSG=y @@ -957,7 +958,7 @@ CONFIG_BLK_DEV_THROTTLING=y # CONFIG_BLK_CMDLINE_PARSER is not set CONFIG_BLK_WBT=y # CONFIG_BLK_CGROUP_IOLATENCY is not set -# CONFIG_BLK_CGROUP_IOCOST is not set +CONFIG_BLK_CGROUP_IOCOST=y CONFIG_BLK_WBT_MQ=y CONFIG_BLK_DEBUG_FS=y CONFIG_BLK_DEBUG_FS_ZONED=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index dbf869f75111..6d56ba68ff1f 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -923,6 +923,7 @@ CONFIG_MODULE_SIG_HASH="sha256" # CONFIG_TRIM_UNUSED_KSYMS is not set CONFIG_MODULES_TREE_LOOKUP=y CONFIG_BLOCK=y +CONFIG_BLK_RQ_ALLOC_TIME=y CONFIG_BLK_SCSI_REQUEST=y CONFIG_BLK_CGROUP_RWSTAT=y CONFIG_BLK_DEV_BSG=y @@ -935,7 +936,7 @@ CONFIG_BLK_DEV_THROTTLING=y # CONFIG_BLK_CMDLINE_PARSER is not set CONFIG_BLK_WBT=y # CONFIG_BLK_CGROUP_IOLATENCY is not set -# CONFIG_BLK_CGROUP_IOCOST is not set +CONFIG_BLK_CGROUP_IOCOST=y CONFIG_BLK_WBT_MQ=y CONFIG_BLK_DEBUG_FS=y CONFIG_BLK_DEBUG_FS_ZONED=y -- 2.39.2

2 1

[PATCH] block: support to dispatch bio asynchronously
by Li Nan 14 Jun '24

14 Jun '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5AEP CVE: NA -------------------------------- In certain environments, specific CPUs handle a large number of tasks and become bottlenecks, affecting overall system performance. This commit introduces a new feature that enables asynchronous I/O dispatch to designated CPUs, thereby relieving the pressure on the busy CPUs. Signed-off-by: Li Nan <linan122(a)huawei.com> --- block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 8 + block/blk-core.c | 240 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 59 ++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 328 insertions(+), 1 deletion(-) diff --git a/block/blk.h b/block/blk.h index 4bbcc971d4f7..5e7c00356ddc 100644 --- a/block/blk.h +++ b/block/blk.h @@ -450,4 +450,11 @@ int bio_add_hw_page(struct request_queue *q, struct bio *bio, struct page *page, unsigned int len, unsigned int offset, unsigned int max_sectors, bool *same_page); +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC +void blk_free_queue_dispatch_async(struct request_queue *q); +#else +static inline void blk_free_queue_dispatch_async(struct request_queue *q) +{ +} +#endif #endif /* BLK_INTERNAL_H */ diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index 1853ec569b72..5445d89ae1cf 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -301,6 +301,7 @@ enum { * of this bio. */ BIO_CGROUP_ACCT, /* has been accounted to a cgroup */ BIO_TRACKED, /* set if bio goes through the rq_qos path */ + BIO_ASYNC, /* has been dispatched asynchronously */ BIO_FLAG_LAST }; diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 50b4fd0a0687..3a071d12623e 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -603,6 +603,12 @@ struct request_queue { KABI_REPLACE(unsigned long dtag_wait_time, struct blk_mq_tags *shared_sbitmap_tags) + +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + /* used when QUEUE_FLAG_DISPATCH_ASYNC is set */ + struct cpumask *dispatch_async_cpus; + int __percpu *last_dispatch_cpu; +#endif KABI_RESERVE(1) KABI_RESERVE(2) KABI_RESERVE(3) @@ -643,6 +649,8 @@ struct request_queue { #define QUEUE_FLAG_NOWAIT 29 /* device supports NOWAIT */ /*at least one blk-mq hctx can't get driver tag */ #define QUEUE_FLAG_HCTX_WAIT 30 +/* support to dispatch bio asynchronously */ +#define QUEUE_FLAG_DISPATCH_ASYNC 31 #define QUEUE_FLAG_MQ_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \ (1 << QUEUE_FLAG_SAME_COMP) | \ diff --git a/block/blk-core.c b/block/blk-core.c index f91f8e8be482..a1ebbf96d19a 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -87,6 +87,234 @@ struct kmem_cache *blk_requestq_cachep; */ static struct workqueue_struct *kblockd_workqueue; +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + +#define BIO_DISPATCH_MAX_LOOP 16 + +struct async_bio { + struct bio_list list; + spinlock_t lock; +} ____cacheline_aligned_in_smp; + +struct bio_dispatch_async_ctl { + /* + * Vector size is nr_cpu_ids, list stores bio dispatched from other cpu, + * such bio will be dispatched asynchronously to the cpu this structure + * is serviced. + */ + struct async_bio *bios; + /* kthread to handle bio dispatched from other cpu. */ + struct task_struct *thread; + wait_queue_head_t wait; +}; + +static struct bio_dispatch_async_ctl __percpu *bio_dispatch_async_ctl; + +static int blk_alloc_queue_dispatch_async(struct request_queue *q) +{ + int cpu; + + /* use the same function and parameters as alloc_cpumask_var() */ + q->dispatch_async_cpus = kmalloc_node(cpumask_size(), + GFP_KERNEL, q->node); + if (!q->dispatch_async_cpus) + return -ENOMEM; + + q->last_dispatch_cpu = alloc_percpu(int); + if (!q->last_dispatch_cpu) { + kfree(q->dispatch_async_cpus); + q->dispatch_async_cpus = NULL; + return -ENOMEM; + } + + cpumask_setall(q->dispatch_async_cpus); + for_each_possible_cpu(cpu) + *per_cpu_ptr(q->last_dispatch_cpu, cpu) = cpu; + + return 0; +} + +void blk_free_queue_dispatch_async(struct request_queue *q) +{ + kfree(q->dispatch_async_cpus); + q->dispatch_async_cpus = NULL; + free_percpu(q->last_dispatch_cpu); + q->last_dispatch_cpu = NULL; +} + +static int get_dispatch_cpu(struct request_queue *q) +{ + int cpu = cpumask_next(this_cpu_read(*q->last_dispatch_cpu), + q->dispatch_async_cpus); + + if (cpu >= nr_cpu_ids) + cpu = cpumask_first(q->dispatch_async_cpus); + + return cpu; +} + +static bool __submit_bio_noacct_async(struct bio *bio) +{ + struct request_queue *q = bio->bi_disk->queue; + int current_cpu = smp_processor_id(); + int dispatch_cpu = get_dispatch_cpu(q); + struct bio_dispatch_async_ctl *ctl; + + if (dispatch_cpu >= nr_cpu_ids) + return false; + + this_cpu_write(*q->last_dispatch_cpu, dispatch_cpu); + + ctl = per_cpu_ptr(bio_dispatch_async_ctl, dispatch_cpu); + spin_lock_irq(&ctl->bios[current_cpu].lock); + bio_list_add(&ctl->bios[current_cpu].list, bio); + spin_unlock_irq(&ctl->bios[current_cpu].lock); + + if (wq_has_sleeper(&ctl->wait)) + wake_up(&ctl->wait); + + return true; +} + +static bool submit_bio_noacct_async(struct bio *bio) +{ + struct request_queue *q; + + if (bio_flagged(bio, BIO_ASYNC)) + return false; + + bio_set_flag(bio, BIO_ASYNC); + /* + * Don't dispatch bio asynchronously in following cases: + * + * - QUEUE_FLAG_DISPATCH_ASYNC is not set; + * - current cpu is the target cpu; + * - bio is flagged no wait; + * - io polling is enabled; + */ + q = bio->bi_disk->queue; + if (!test_bit(QUEUE_FLAG_DISPATCH_ASYNC, &q->queue_flags) || + test_bit(QUEUE_FLAG_POLL, &q->queue_flags) || + cpumask_test_cpu(smp_processor_id(), q->dispatch_async_cpus) || + bio->bi_opf & REQ_NOWAIT) + return false; + + return __submit_bio_noacct_async(bio); +} + +static bool collect_bio(struct bio_dispatch_async_ctl *ctl, + struct bio_list *list) +{ + bool has_bio = false; + int cpu; + + for_each_possible_cpu(cpu) { + struct async_bio *abio = &ctl->bios[cpu]; + + if (bio_list_empty(&abio->list)) + continue; + + has_bio = true; + + spin_lock_irq(&abio->lock); + bio_list_merge(list, &abio->list); + bio_list_init(&abio->list); + spin_unlock_irq(&abio->lock); + } + + return has_bio; +} + +static int bio_dispatch_work(void *data) +{ + int loop_count = 0; + struct bio_list bio_list_on_stack; + struct blk_plug plug; + struct bio_dispatch_async_ctl *ctl; + + bio_list_init(&bio_list_on_stack); + ctl = this_cpu_ptr(bio_dispatch_async_ctl); + + for (;; loop_count++) { + struct bio *bio; + bool has_bio = collect_bio(ctl, &bio_list_on_stack); + + if (!has_bio) { + DEFINE_WAIT(wait); + + for (;;) { + prepare_to_wait(&ctl->wait, &wait, + TASK_INTERRUPTIBLE); + has_bio = collect_bio(ctl, &bio_list_on_stack); + if (has_bio) + break; + schedule(); + loop_count = 0; + } + finish_wait(&ctl->wait, &wait); + } + + blk_start_plug(&plug); + while ((bio = bio_list_pop(&bio_list_on_stack))) + submit_bio_noacct(bio); + blk_finish_plug(&plug); + + /* prevent soft lockup. */ + if (loop_count >= BIO_DISPATCH_MAX_LOOP) { + loop_count = 0; + cond_resched(); + } + } + + return 0; +} + +static void init_blk_queue_async_dispatch(void) +{ + int cpu; + + bio_dispatch_async_ctl = alloc_percpu(struct bio_dispatch_async_ctl); + if (!bio_dispatch_async_ctl) + panic("Failed to alloc bio_dispatch_async_ctl\n"); + + for_each_possible_cpu(cpu) { + int i; + struct bio_dispatch_async_ctl *ctl = + per_cpu_ptr(bio_dispatch_async_ctl, cpu); + + init_waitqueue_head(&ctl->wait); + ctl->bios = kmalloc_array(nr_cpu_ids, sizeof(struct async_bio), + GFP_KERNEL | __GFP_NOFAIL); + for (i = 0; i < nr_cpu_ids; ++i) { + bio_list_init(&ctl->bios[i].list); + spin_lock_init(&ctl->bios[i].lock); + } + + ctl->thread = + kthread_create_on_cpu(bio_dispatch_work, NULL, cpu, + "bio_dispatch_work_%u"); + if (IS_ERR_OR_NULL(ctl->thread)) + panic("Failed to create bio dispatch thread\n"); + + wake_up_process(ctl->thread); + } +} +#else +static int blk_alloc_queue_dispatch_async(struct request_queue *q) +{ + return 0; +} + +static bool submit_bio_noacct_async(struct bio *bio) +{ + return false; +} + +static void init_blk_queue_async_dispatch(void) +{ +} +#endif + /** * blk_queue_flag_set - atomically set a queue flag * @flag: flag to be set @@ -539,9 +767,12 @@ struct request_queue *blk_alloc_queue(int node_id) q->last_merge = NULL; + if (blk_alloc_queue_dispatch_async(q)) + goto fail_q; + q->id = ida_simple_get(&blk_queue_ida, 0, 0, GFP_KERNEL); if (q->id < 0) - goto fail_q; + goto fail_dispatch_async; ret = bioset_init(&q->bio_split, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); if (ret) @@ -606,6 +837,8 @@ struct request_queue *blk_alloc_queue(int node_id) bioset_exit(&q->bio_split); fail_id: ida_simple_remove(&blk_queue_ida, q->id); +fail_dispatch_async: + blk_free_queue_dispatch_async(q); fail_q: kmem_cache_free(blk_requestq_cachep, q); return NULL; @@ -1055,6 +1288,9 @@ static blk_qc_t __submit_bio_noacct_mq(struct bio *bio) */ blk_qc_t submit_bio_noacct(struct bio *bio) { + if (submit_bio_noacct_async(bio)) + return BLK_QC_T_NONE; + if (!submit_bio_checks(bio)) return BLK_QC_T_NONE; @@ -1905,5 +2141,7 @@ int __init blk_dev_init(void) blk_debugfs_root = debugfs_create_dir("block", NULL); + init_blk_queue_async_dispatch(); + return 0; } diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c index a879f94782e4..b5b17c6ee650 100644 --- a/block/blk-mq-debugfs.c +++ b/block/blk-mq-debugfs.c @@ -131,6 +131,7 @@ static const char *const blk_queue_flag_name[] = { QUEUE_FLAG_NAME(RQ_ALLOC_TIME), QUEUE_FLAG_NAME(HCTX_ACTIVE), QUEUE_FLAG_NAME(NOWAIT), + QUEUE_FLAG_NAME(DISPATCH_ASYNC), }; #undef QUEUE_FLAG_NAME diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index c95be9626a09..53598eb6affd 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -288,6 +288,9 @@ QUEUE_SYSFS_BIT_FNS(nonrot, NONROT, 1); QUEUE_SYSFS_BIT_FNS(random, ADD_RANDOM, 0); QUEUE_SYSFS_BIT_FNS(iostats, IO_STAT, 0); QUEUE_SYSFS_BIT_FNS(stable_writes, STABLE_WRITES, 0); +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC +QUEUE_SYSFS_BIT_FNS(dispatch_async, DISPATCH_ASYNC, 0); +#endif #undef QUEUE_SYSFS_BIT_FNS static ssize_t queue_zoned_show(struct request_queue *q, char *page) @@ -619,6 +622,57 @@ QUEUE_RW_ENTRY(queue_iostats, "iostats"); QUEUE_RW_ENTRY(queue_random, "add_random"); QUEUE_RW_ENTRY(queue_stable_writes, "stable_writes"); +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + +static ssize_t queue_dispatch_async_cpus_show(struct request_queue *q, + char *page) +{ + return sprintf(page, "%*pb\n", nr_cpu_ids, + cpumask_bits(q->dispatch_async_cpus)); +} + +static ssize_t queue_dispatch_async_cpus_store(struct request_queue *q, + const char *page, size_t count) +{ + cpumask_var_t cpumask; + ssize_t ret; + + if (!alloc_cpumask_var(&cpumask, GFP_KERNEL)) + return -ENOMEM; + + ret = bitmap_parse(page, count, cpumask_bits(cpumask), + nr_cpumask_bits); + if (ret < 0) + goto out; + + if (cpumask_empty(cpumask) || + !cpumask_subset(cpumask, cpu_online_mask)) { + ret = -EINVAL; + goto out; + } + + blk_mq_freeze_queue(q); + blk_mq_quiesce_queue(q); + + cpumask_copy(q->dispatch_async_cpus, cpumask); + + blk_mq_unquiesce_queue(q); + blk_mq_unfreeze_queue(q); + ret = count; +out: + free_cpumask_var(cpumask); + return ret; +} + +static struct queue_sysfs_entry queue_dispatch_async_cpus_entry = { + .attr = {.name = "dispatch_async_cpus", .mode = 0644 }, + .show = queue_dispatch_async_cpus_show, + .store = queue_dispatch_async_cpus_store, +}; + +QUEUE_RW_ENTRY(queue_dispatch_async, "dispatch_async"); +#endif + static struct attribute *queue_attrs[] = { &queue_requests_entry.attr, &queue_ra_entry.attr, @@ -659,6 +713,10 @@ static struct attribute *queue_attrs[] = { &queue_wb_lat_entry.attr, &queue_poll_delay_entry.attr, &queue_io_timeout_entry.attr, +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + &queue_dispatch_async_cpus_entry.attr, + &queue_dispatch_async_entry.attr, +#endif #ifdef CONFIG_BLK_DEV_THROTTLING_LOW &blk_throtl_sample_time_entry.attr, #endif @@ -795,6 +853,7 @@ static void blk_release_queue(struct kobject *kobj) blk_stat_remove_callback(q, q->poll_cb); blk_stat_free_callback(q->poll_cb); + blk_free_queue_dispatch_async(q); blk_free_queue_stats(q->stats); blk_exit_queue(q); diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index d2ba9ee9eb81..996a6196cc5a 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -964,6 +964,7 @@ CONFIG_BLK_DEBUG_FS_ZONED=y # CONFIG_BLK_SED_OPAL is not set # CONFIG_BLK_INLINE_ENCRYPTION is not set CONFIG_BLK_DEV_DUMPINFO=y +CONFIG_BLK_BIO_DISPATCH_ASYNC=y # # Partition Types diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index dbf869f75111..6b014668cf4d 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -942,6 +942,7 @@ CONFIG_BLK_DEBUG_FS_ZONED=y # CONFIG_BLK_SED_OPAL is not set # CONFIG_BLK_INLINE_ENCRYPTION is not set CONFIG_BLK_DEV_DUMPINFO=y +CONFIG_BLK_BIO_DISPATCH_ASYNC=y # # Partition Types diff --git a/block/Kconfig b/block/Kconfig index e5c965f1ea25..24c6bb87727d 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -209,6 +209,17 @@ config BLK_DEV_DUMPINFO Dump info when open an write opened block device exclusively or open an exclusive opened device for write +config BLK_BIO_DISPATCH_ASYNC + bool "Dispatch bios asynchronously on specific cpus" + default n + help + In certain environments, specific CPUs handle a large number of + tasks and become bottlenecks, affecting overall system + performance. This commit introduces a new feature that enables + asynchronous I/O dispatch to designated CPUs, thereby relieving + the pressure on the busy CPUs. + If unsure, say N. + menu "Partition Types" source "block/partitions/Kconfig" -- 2.39.2

1 0

[openeuler:openEuler-1.0-LTS 14221/22914] fs/ext4/.tmp_mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0xb0f: unreachable instruction
by kernel test robot 14 Jun '24

14 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: efdd263f4cc3df5dcccb45402615eb6d2d8f55c5 commit: 41298197ead9e85ee2ec1d52122f03fd1863cff2 [14221/22914] ext4: convert BUG_ON's to WARN_ON's in mballoc.c config: x86_64-buildonly-randconfig-006-20240614 (https://download.01.org/0day-ci/archive/20240614/202406141455.MPvgmjIK-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240614/202406141455.MPvgmjIK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406141455.MPvgmjIK-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/ext4/mballoc.c:12: In file included from fs/ext4/ext4_jbd2.h:16: In file included from include/linux/jbd2.h:26: In file included from include/linux/buffer_head.h:14: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. fs/ext4/mballoc.c:4734: warning: Function parameter or member 'bh' not described in 'ext4_free_blocks' >> fs/ext4/.tmp_mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0xb0f: unreachable instruction fs/ext4/.tmp_mballoc.o: warning: objtool: missing symbol for section .init.text objdump-func vmlinux.o ext4_mb_complex_scan_group: -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] block: support to dispatch bio asynchronously
by Li Nan 14 Jun '24

14 Jun '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5AEP CVE: NA -------------------------------- In certain environments, specific CPUs handle a large number of tasks and become bottlenecks, affecting overall system performance. This commit introduces a new feature that enables asynchronous I/O dispatch to designated CPUs, thereby relieving the pressure on the busy CPUs. Signed-off-by: Li Nan <linan122(a)huawei.com> --- block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 8 + block/blk-core.c | 240 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 59 ++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 328 insertions(+), 1 deletion(-) diff --git a/block/blk.h b/block/blk.h index 4bbcc971d4f7..5e7c00356ddc 100644 --- a/block/blk.h +++ b/block/blk.h @@ -450,4 +450,11 @@ int bio_add_hw_page(struct request_queue *q, struct bio *bio, struct page *page, unsigned int len, unsigned int offset, unsigned int max_sectors, bool *same_page); +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC +void blk_free_queue_dispatch_async(struct request_queue *q); +#else +static inline void blk_free_queue_dispatch_async(struct request_queue *q) +{ +} +#endif #endif /* BLK_INTERNAL_H */ diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index 1853ec569b72..5445d89ae1cf 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -301,6 +301,7 @@ enum { * of this bio. */ BIO_CGROUP_ACCT, /* has been accounted to a cgroup */ BIO_TRACKED, /* set if bio goes through the rq_qos path */ + BIO_ASYNC, /* has been dispatched asynchronously */ BIO_FLAG_LAST }; diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 50b4fd0a0687..3a071d12623e 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -603,6 +603,12 @@ struct request_queue { KABI_REPLACE(unsigned long dtag_wait_time, struct blk_mq_tags *shared_sbitmap_tags) + +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + /* used when QUEUE_FLAG_DISPATCH_ASYNC is set */ + struct cpumask *dispatch_async_cpus; + int __percpu *last_dispatch_cpu; +#endif KABI_RESERVE(1) KABI_RESERVE(2) KABI_RESERVE(3) @@ -643,6 +649,8 @@ struct request_queue { #define QUEUE_FLAG_NOWAIT 29 /* device supports NOWAIT */ /*at least one blk-mq hctx can't get driver tag */ #define QUEUE_FLAG_HCTX_WAIT 30 +/* support to dispatch bio asynchronously */ +#define QUEUE_FLAG_DISPATCH_ASYNC 31 #define QUEUE_FLAG_MQ_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \ (1 << QUEUE_FLAG_SAME_COMP) | \ diff --git a/block/blk-core.c b/block/blk-core.c index f91f8e8be482..a1ebbf96d19a 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -87,6 +87,234 @@ struct kmem_cache *blk_requestq_cachep; */ static struct workqueue_struct *kblockd_workqueue; +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + +#define BIO_DISPATCH_MAX_LOOP 16 + +struct async_bio { + struct bio_list list; + spinlock_t lock; +} ____cacheline_aligned_in_smp; + +struct bio_dispatch_async_ctl { + /* + * Vector size is nr_cpu_ids, list stores bio dispatched from other cpu, + * such bio will be dispatched asynchronously to the cpu this structure + * is serviced. + */ + struct async_bio *bios; + /* kthread to handle bio dispatched from other cpu. */ + struct task_struct *thread; + wait_queue_head_t wait; +}; + +static struct bio_dispatch_async_ctl __percpu *bio_dispatch_async_ctl; + +static int blk_alloc_queue_dispatch_async(struct request_queue *q) +{ + int cpu; + + /* use the same function and parameters as alloc_cpumask_var() */ + q->dispatch_async_cpus = kmalloc_node(cpumask_size(), + GFP_KERNEL, q->node); + if (!q->dispatch_async_cpus) + return -ENOMEM; + + q->last_dispatch_cpu = alloc_percpu(int); + if (!q->last_dispatch_cpu) { + kfree(q->dispatch_async_cpus); + q->dispatch_async_cpus = NULL; + return -ENOMEM; + } + + cpumask_setall(q->dispatch_async_cpus); + for_each_possible_cpu(cpu) + *per_cpu_ptr(q->last_dispatch_cpu, cpu) = cpu; + + return 0; +} + +void blk_free_queue_dispatch_async(struct request_queue *q) +{ + kfree(q->dispatch_async_cpus); + q->dispatch_async_cpus = NULL; + free_percpu(q->last_dispatch_cpu); + q->last_dispatch_cpu = NULL; +} + +static int get_dispatch_cpu(struct request_queue *q) +{ + int cpu = cpumask_next(this_cpu_read(*q->last_dispatch_cpu), + q->dispatch_async_cpus); + + if (cpu >= nr_cpu_ids) + cpu = cpumask_first(q->dispatch_async_cpus); + + return cpu; +} + +static bool __submit_bio_noacct_async(struct bio *bio) +{ + struct request_queue *q = bio->bi_disk->queue; + int current_cpu = smp_processor_id(); + int dispatch_cpu = get_dispatch_cpu(q); + struct bio_dispatch_async_ctl *ctl; + + if (dispatch_cpu >= nr_cpu_ids) + return false; + + this_cpu_write(*q->last_dispatch_cpu, dispatch_cpu); + + ctl = per_cpu_ptr(bio_dispatch_async_ctl, dispatch_cpu); + spin_lock_irq(&ctl->bios[current_cpu].lock); + bio_list_add(&ctl->bios[current_cpu].list, bio); + spin_unlock_irq(&ctl->bios[current_cpu].lock); + + if (wq_has_sleeper(&ctl->wait)) + wake_up(&ctl->wait); + + return true; +} + +static bool submit_bio_noacct_async(struct bio *bio) +{ + struct request_queue *q; + + if (bio_flagged(bio, BIO_ASYNC)) + return false; + + bio_set_flag(bio, BIO_ASYNC); + /* + * Don't dispatch bio asynchronously in following cases: + * + * - QUEUE_FLAG_DISPATCH_ASYNC is not set; + * - current cpu is the target cpu; + * - bio is flagged no wait; + * - io polling is enabled; + */ + q = bio->bi_disk->queue; + if (!test_bit(QUEUE_FLAG_DISPATCH_ASYNC, &q->queue_flags) || + test_bit(QUEUE_FLAG_POLL, &q->queue_flags) || + cpumask_test_cpu(smp_processor_id(), q->dispatch_async_cpus) || + bio->bi_opf & REQ_NOWAIT) + return false; + + return __submit_bio_noacct_async(bio); +} + +static bool collect_bio(struct bio_dispatch_async_ctl *ctl, + struct bio_list *list) +{ + bool has_bio = false; + int cpu; + + for_each_possible_cpu(cpu) { + struct async_bio *abio = &ctl->bios[cpu]; + + if (bio_list_empty(&abio->list)) + continue; + + has_bio = true; + + spin_lock_irq(&abio->lock); + bio_list_merge(list, &abio->list); + bio_list_init(&abio->list); + spin_unlock_irq(&abio->lock); + } + + return has_bio; +} + +static int bio_dispatch_work(void *data) +{ + int loop_count = 0; + struct bio_list bio_list_on_stack; + struct blk_plug plug; + struct bio_dispatch_async_ctl *ctl; + + bio_list_init(&bio_list_on_stack); + ctl = this_cpu_ptr(bio_dispatch_async_ctl); + + for (;; loop_count++) { + struct bio *bio; + bool has_bio = collect_bio(ctl, &bio_list_on_stack); + + if (!has_bio) { + DEFINE_WAIT(wait); + + for (;;) { + prepare_to_wait(&ctl->wait, &wait, + TASK_INTERRUPTIBLE); + has_bio = collect_bio(ctl, &bio_list_on_stack); + if (has_bio) + break; + schedule(); + loop_count = 0; + } + finish_wait(&ctl->wait, &wait); + } + + blk_start_plug(&plug); + while ((bio = bio_list_pop(&bio_list_on_stack))) + submit_bio_noacct(bio); + blk_finish_plug(&plug); + + /* prevent soft lockup. */ + if (loop_count >= BIO_DISPATCH_MAX_LOOP) { + loop_count = 0; + cond_resched(); + } + } + + return 0; +} + +static void init_blk_queue_async_dispatch(void) +{ + int cpu; + + bio_dispatch_async_ctl = alloc_percpu(struct bio_dispatch_async_ctl); + if (!bio_dispatch_async_ctl) + panic("Failed to alloc bio_dispatch_async_ctl\n"); + + for_each_possible_cpu(cpu) { + int i; + struct bio_dispatch_async_ctl *ctl = + per_cpu_ptr(bio_dispatch_async_ctl, cpu); + + init_waitqueue_head(&ctl->wait); + ctl->bios = kmalloc_array(nr_cpu_ids, sizeof(struct async_bio), + GFP_KERNEL | __GFP_NOFAIL); + for (i = 0; i < nr_cpu_ids; ++i) { + bio_list_init(&ctl->bios[i].list); + spin_lock_init(&ctl->bios[i].lock); + } + + ctl->thread = + kthread_create_on_cpu(bio_dispatch_work, NULL, cpu, + "bio_dispatch_work_%u"); + if (IS_ERR_OR_NULL(ctl->thread)) + panic("Failed to create bio dispatch thread\n"); + + wake_up_process(ctl->thread); + } +} +#else +static int blk_alloc_queue_dispatch_async(struct request_queue *q) +{ + return 0; +} + +static bool submit_bio_noacct_async(struct bio *bio) +{ + return false; +} + +static void init_blk_queue_async_dispatch(void) +{ +} +#endif + /** * blk_queue_flag_set - atomically set a queue flag * @flag: flag to be set @@ -539,9 +767,12 @@ struct request_queue *blk_alloc_queue(int node_id) q->last_merge = NULL; + if (blk_alloc_queue_dispatch_async(q)) + goto fail_q; + q->id = ida_simple_get(&blk_queue_ida, 0, 0, GFP_KERNEL); if (q->id < 0) - goto fail_q; + goto fail_dispatch_async; ret = bioset_init(&q->bio_split, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); if (ret) @@ -606,6 +837,8 @@ struct request_queue *blk_alloc_queue(int node_id) bioset_exit(&q->bio_split); fail_id: ida_simple_remove(&blk_queue_ida, q->id); +fail_dispatch_async: + blk_free_queue_dispatch_async(q); fail_q: kmem_cache_free(blk_requestq_cachep, q); return NULL; @@ -1055,6 +1288,9 @@ static blk_qc_t __submit_bio_noacct_mq(struct bio *bio) */ blk_qc_t submit_bio_noacct(struct bio *bio) { + if (submit_bio_noacct_async(bio)) + return BLK_QC_T_NONE; + if (!submit_bio_checks(bio)) return BLK_QC_T_NONE; @@ -1905,5 +2141,7 @@ int __init blk_dev_init(void) blk_debugfs_root = debugfs_create_dir("block", NULL); + init_blk_queue_async_dispatch(); + return 0; } diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c index a879f94782e4..b5b17c6ee650 100644 --- a/block/blk-mq-debugfs.c +++ b/block/blk-mq-debugfs.c @@ -131,6 +131,7 @@ static const char *const blk_queue_flag_name[] = { QUEUE_FLAG_NAME(RQ_ALLOC_TIME), QUEUE_FLAG_NAME(HCTX_ACTIVE), QUEUE_FLAG_NAME(NOWAIT), + QUEUE_FLAG_NAME(DISPATCH_ASYNC), }; #undef QUEUE_FLAG_NAME diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index c95be9626a09..53598eb6affd 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -288,6 +288,9 @@ QUEUE_SYSFS_BIT_FNS(nonrot, NONROT, 1); QUEUE_SYSFS_BIT_FNS(random, ADD_RANDOM, 0); QUEUE_SYSFS_BIT_FNS(iostats, IO_STAT, 0); QUEUE_SYSFS_BIT_FNS(stable_writes, STABLE_WRITES, 0); +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC +QUEUE_SYSFS_BIT_FNS(dispatch_async, DISPATCH_ASYNC, 0); +#endif #undef QUEUE_SYSFS_BIT_FNS static ssize_t queue_zoned_show(struct request_queue *q, char *page) @@ -619,6 +622,57 @@ QUEUE_RW_ENTRY(queue_iostats, "iostats"); QUEUE_RW_ENTRY(queue_random, "add_random"); QUEUE_RW_ENTRY(queue_stable_writes, "stable_writes"); +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + +static ssize_t queue_dispatch_async_cpus_show(struct request_queue *q, + char *page) +{ + return sprintf(page, "%*pb\n", nr_cpu_ids, + cpumask_bits(q->dispatch_async_cpus)); +} + +static ssize_t queue_dispatch_async_cpus_store(struct request_queue *q, + const char *page, size_t count) +{ + cpumask_var_t cpumask; + ssize_t ret; + + if (!alloc_cpumask_var(&cpumask, GFP_KERNEL)) + return -ENOMEM; + + ret = bitmap_parse(page, count, cpumask_bits(cpumask), + nr_cpumask_bits); + if (ret < 0) + goto out; + + if (cpumask_empty(cpumask) || + !cpumask_subset(cpumask, cpu_online_mask)) { + ret = -EINVAL; + goto out; + } + + blk_mq_freeze_queue(q); + blk_mq_quiesce_queue(q); + + cpumask_copy(q->dispatch_async_cpus, cpumask); + + blk_mq_unquiesce_queue(q); + blk_mq_unfreeze_queue(q); + ret = count; +out: + free_cpumask_var(cpumask); + return ret; +} + +static struct queue_sysfs_entry queue_dispatch_async_cpus_entry = { + .attr = {.name = "dispatch_async_cpus", .mode = 0644 }, + .show = queue_dispatch_async_cpus_show, + .store = queue_dispatch_async_cpus_store, +}; + +QUEUE_RW_ENTRY(queue_dispatch_async, "dispatch_async"); +#endif + static struct attribute *queue_attrs[] = { &queue_requests_entry.attr, &queue_ra_entry.attr, @@ -659,6 +713,10 @@ static struct attribute *queue_attrs[] = { &queue_wb_lat_entry.attr, &queue_poll_delay_entry.attr, &queue_io_timeout_entry.attr, +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + &queue_dispatch_async_cpus_entry.attr, + &queue_dispatch_async_entry.attr, +#endif #ifdef CONFIG_BLK_DEV_THROTTLING_LOW &blk_throtl_sample_time_entry.attr, #endif @@ -795,6 +853,7 @@ static void blk_release_queue(struct kobject *kobj) blk_stat_remove_callback(q, q->poll_cb); blk_stat_free_callback(q->poll_cb); + blk_free_queue_dispatch_async(q); blk_free_queue_stats(q->stats); blk_exit_queue(q); diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index d2ba9ee9eb81..996a6196cc5a 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -964,6 +964,7 @@ CONFIG_BLK_DEBUG_FS_ZONED=y # CONFIG_BLK_SED_OPAL is not set # CONFIG_BLK_INLINE_ENCRYPTION is not set CONFIG_BLK_DEV_DUMPINFO=y +CONFIG_BLK_BIO_DISPATCH_ASYNC=y # # Partition Types diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index dbf869f75111..6b014668cf4d 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -942,6 +942,7 @@ CONFIG_BLK_DEBUG_FS_ZONED=y # CONFIG_BLK_SED_OPAL is not set # CONFIG_BLK_INLINE_ENCRYPTION is not set CONFIG_BLK_DEV_DUMPINFO=y +CONFIG_BLK_BIO_DISPATCH_ASYNC=y # # Partition Types diff --git a/block/Kconfig b/block/Kconfig index e5c965f1ea25..24c6bb87727d 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -209,6 +209,17 @@ config BLK_DEV_DUMPINFO Dump info when open an write opened block device exclusively or open an exclusive opened device for write +config BLK_BIO_DISPATCH_ASYNC + bool "Dispatch bios asynchronously on specific cpus" + default n + help + In certain environments, specific CPUs handle a large number of + tasks and become bottlenecks, affecting overall system + performance. This commit introduces a new feature that enables + asynchronous I/O dispatch to designated CPUs, thereby relieving + the pressure on the busy CPUs. + If unsure, say N. + menu "Partition Types" source "block/partitions/Kconfig" -- 2.39.2

1 0

[PATCH openEuler-22.03-LTS-SP1] afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server
by Zizhi Wo 14 Jun '24

14 Jun '24

From: David Howells <dhowells(a)redhat.com> stable inclusion from stable-v5.14.9 commit e66fc460d6dcf85cf12288e133a081205aebcd97 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4M4 CVE: CVE-2021-47366 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit b537a3c21775075395af475dcc6ef212fcf29db8 ] AFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and Linux's afs client switches between them when talking to a non-YFS server if the read size, the file position or the sum of the two have the upper 32 bits set of the 64-bit value. This is a problem, however, since the file position and length fields of FS.FetchData are *signed* 32-bit values. Fix this by capturing the capability bits obtained from the fileserver when it's sent an FS.GetCapabilities RPC, rather than just discarding them, and then picking out the VICED_CAPABILITY_64BITFILES flag. This can then be used to decide whether to use FS.FetchData or FS.FetchData64 - and also FS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to switch on the parameter values. This capabilities flag could also be used to limit the maximum size of the file, but all servers must be checked for that. Note that the issue does not exist with FS.StoreData - that uses *unsigned* 32-bit values. It's also not a problem with Auristor servers as its YFS.FetchData64 op uses unsigned 64-bit values. This can be tested by cloning a git repo through an OpenAFS client to an OpenAFS server and then doing "git status" on it from a Linux afs client[1]. Provided the clone has a pack file that's in the 2G-4G range, the git status will show errors like: error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index This can be observed in the server's FileLog with something like the following appearing: Sun Aug 29 19:31:39 2021 SRXAFS_FetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001 Sun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001 Sun Aug 29 19:31:39 2021 FetchData_RXStyle: Pos 18446744071815340032, Len 3154 Sun Aug 29 19:31:39 2021 FetchData_RXStyle: file size 2400758866 ... Sun Aug 29 19:31:40 2021 SRXAFS_FetchData returns 5 Note the file position of 18446744071815340032. This is the requested file position sign-extended. Fixes: b9b1f8d5930a ("AFS: write support fixes") Reported-by: Markus Suvanto <markus.suvanto(a)gmail.com> Signed-off-by: David Howells <dhowells(a)redhat.com> Reviewed-by: Marc Dionne <marc.dionne(a)auristor.com> Tested-by: Markus Suvanto <markus.suvanto(a)gmail.com> cc: linux-afs(a)lists.infradead.org cc: openafs-devel(a)openafs.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=214217#c9 [1] Link: https://lore.kernel.org/r/951332.1631308745@warthog.procyon.org.uk/ Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/afs/fs_probe.c fs/afs/fsclient.c [Simple context conflict adaptation.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/afs/fs_probe.c | 8 +++++++- fs/afs/fsclient.c | 30 ++++++++++++++++++++---------- fs/afs/internal.h | 1 + fs/afs/protocol_afs.h | 15 +++++++++++++++ fs/afs/protocol_yfs.h | 6 ++++++ 5 files changed, 49 insertions(+), 11 deletions(-) create mode 100644 fs/afs/protocol_afs.h diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c index e7e98ad63a91..c0031a3ab42f 100644 --- a/fs/afs/fs_probe.c +++ b/fs/afs/fs_probe.c @@ -9,6 +9,7 @@ #include <linux/slab.h> #include "afs_fs.h" #include "internal.h" +#include "protocol_afs.h" #include "protocol_yfs.h" static unsigned int afs_fs_probe_fast_poll_interval = 30 * HZ; @@ -102,7 +103,7 @@ void afs_fileserver_probe_result(struct afs_call *call) struct afs_addr_list *alist = call->alist; struct afs_server *server = call->server; unsigned int index = call->addr_ix; - unsigned int rtt_us = 0; + unsigned int rtt_us = 0, cap0; int ret = call->error; _enter("%pU,%u", &server->uuid, index); @@ -159,6 +160,11 @@ void afs_fileserver_probe_result(struct afs_call *call) clear_bit(AFS_SERVER_FL_IS_YFS, &server->flags); alist->addrs[index].srx_service = call->service_id; } + cap0 = ntohl(call->tmp); + if (cap0 & AFS3_VICED_CAPABILITY_64BITFILES) + set_bit(AFS_SERVER_FL_HAS_FS64, &server->flags); + else + clear_bit(AFS_SERVER_FL_HAS_FS64, &server->flags); } if (rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us) && diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c index 0048a32cb040..bf1fd9d187dc 100644 --- a/fs/afs/fsclient.c +++ b/fs/afs/fsclient.c @@ -483,9 +483,7 @@ void afs_fs_fetch_data(struct afs_operation *op) struct afs_read *req = op->fetch.req; __be32 *bp; - if (upper_32_bits(req->pos) || - upper_32_bits(req->len) || - upper_32_bits(req->pos + req->len)) + if (test_bit(AFS_SERVER_FL_HAS_FS64, &op->server->flags)) return afs_fs_fetch_data64(op); _enter(""); @@ -1149,8 +1147,7 @@ void afs_fs_store_data(struct afs_operation *op) (unsigned long long) size, (unsigned long long) pos, (unsigned long long) i_size); - if (upper_32_bits(pos) || upper_32_bits(i_size) || upper_32_bits(size) || - upper_32_bits(pos + size)) + if (test_bit(AFS_SERVER_FL_HAS_FS64, &op->server->flags)) return afs_fs_store_data64(op, pos, size, i_size); call = afs_alloc_flat_call(op->net, &afs_RXFSStoreData, @@ -1264,7 +1261,7 @@ static void afs_fs_setattr_size(struct afs_operation *op) key_serial(op->key), vp->fid.vid, vp->fid.vnode); ASSERT(attr->ia_valid & ATTR_SIZE); - if (upper_32_bits(attr->ia_size)) + if (test_bit(AFS_SERVER_FL_HAS_FS64, &op->server->flags)) return afs_fs_setattr_size64(op); call = afs_alloc_flat_call(op->net, &afs_RXFSStoreData_as_Status, @@ -1691,20 +1688,33 @@ static int afs_deliver_fs_get_capabilities(struct afs_call *call) return ret; count = ntohl(call->tmp); - call->count = count; call->count2 = count; - afs_extract_discard(call, count * sizeof(__be32)); + if (count == 0) { + call->unmarshall = 4; + call->tmp = 0; + break; + } + + /* Extract the first word of the capabilities to call->tmp */ + afs_extract_to_tmp(call); call->unmarshall++; fallthrough; - /* Extract capabilities words */ case 2: ret = afs_extract_data(call, false); if (ret < 0) return ret; - /* TODO: Examine capabilities */ + afs_extract_discard(call, (count - 1) * sizeof(__be32)); + call->unmarshall++; + fallthrough; + + /* Extract remaining capabilities words */ + case 3: + ret = afs_extract_data(call, false); + if (ret < 0) + return ret; call->unmarshall++; break; diff --git a/fs/afs/internal.h b/fs/afs/internal.h index 637cbe549397..8ce13fe4dd78 100644 --- a/fs/afs/internal.h +++ b/fs/afs/internal.h @@ -510,6 +510,7 @@ struct afs_server { #define AFS_SERVER_FL_IS_YFS 16 /* Server is YFS not AFS */ #define AFS_SERVER_FL_NO_IBULK 17 /* Fileserver doesn't support FS.InlineBulkStatus */ #define AFS_SERVER_FL_NO_RM2 18 /* Fileserver doesn't support YFS.RemoveFile2 */ +#define AFS_SERVER_FL_HAS_FS64 19 /* Fileserver supports FS.{Fetch,Store}Data64 */ atomic_t ref; /* Object refcount */ atomic_t active; /* Active user count */ u32 addr_version; /* Address list version */ diff --git a/fs/afs/protocol_afs.h b/fs/afs/protocol_afs.h new file mode 100644 index 000000000000..0c39358c8b70 --- /dev/null +++ b/fs/afs/protocol_afs.h @@ -0,0 +1,15 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* AFS protocol bits + * + * Copyright (C) 2021 Red Hat, Inc. All Rights Reserved. + * Written by David Howells (dhowells(a)redhat.com) + */ + + +#define AFSCAPABILITIESMAX 196 /* Maximum number of words in a capability set */ + +/* AFS3 Fileserver capabilities word 0 */ +#define AFS3_VICED_CAPABILITY_ERRORTRANS 0x0001 /* Uses UAE errors */ +#define AFS3_VICED_CAPABILITY_64BITFILES 0x0002 /* FetchData64 & StoreData64 supported */ +#define AFS3_VICED_CAPABILITY_WRITELOCKACL 0x0004 /* Can lock a file even without lock perm */ +#define AFS3_VICED_CAPABILITY_SANEACLS 0x0008 /* ACLs reviewed for sanity - don't use */ diff --git a/fs/afs/protocol_yfs.h b/fs/afs/protocol_yfs.h index b5bd03b1d3c7..e4cd89c44c46 100644 --- a/fs/afs/protocol_yfs.h +++ b/fs/afs/protocol_yfs.h @@ -168,3 +168,9 @@ enum yfs_lock_type { yfs_LockMandatoryWrite = 0x101, yfs_LockMandatoryExtend = 0x102, }; + +/* RXYFS Viced Capability Flags */ +#define YFS_VICED_CAPABILITY_ERRORTRANS 0x0001 /* Deprecated v0.195 */ +#define YFS_VICED_CAPABILITY_64BITFILES 0x0002 /* Deprecated v0.195 */ +#define YFS_VICED_CAPABILITY_WRITELOCKACL 0x0004 /* Can lock a file even without lock perm */ +#define YFS_VICED_CAPABILITY_SANEACLS 0x0008 /* Deprecated v0.195 */ -- 2.39.2

2 1

[PATCH OLK-5.10 v3 0/2] block: support to dispatch bio asynchronously
by Li Nan 14 Jun '24

14 Jun '24

v3: code optimization. Li Nan (2): block: support to dispatch bio asynchronously block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 9 + block/blk-core.c | 240 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 59 ++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 329 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS v3 0/2] block: support to dispatch bio asynchronously
by Li Nan 14 Jun '24

14 Jun '24

v3: code optimization. Li Nan (2): block: support to dispatch bio asynchronously block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 9 + block/blk-core.c | 240 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 59 ++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 329 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH OLK-5.10 v2 0/2] block: support to dispatch bio asynchronously
by Li Nan 14 Jun '24

14 Jun '24

v2: bugfix and code optimization. Li Nan (2): block: support to dispatch bio asynchronously block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 9 + block/blk-core.c | 238 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 60 +++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 328 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] iio: mma8452: Fix trigger reference couting
by Zhang Changzhong 14 Jun '24

14 Jun '24

From: Lars-Peter Clausen <lars(a)metafoo.de> stable inclusion from stable-v4.19.221 commit f5deab10ced368c807866283f8b79144c4823be8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S271 CVE: CVE-2021-47500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cd0082235783f814241a1c9483fb89e405f4f892 upstream. The mma8452 driver directly assigns a trigger to the struct iio_dev. The IIO core when done using this trigger will call `iio_trigger_put()` to drop the reference count by 1. Without the matching `iio_trigger_get()` in the driver the reference count can reach 0 too early, the trigger gets freed while still in use and a use-after-free occurs. Fix this by getting a reference to the trigger before assigning it to the IIO device. Fixes: ae6d9ce05691 ("iio: mma8452: Add support for interrupt driven triggers.") Signed-off-by: Lars-Peter Clausen <lars(a)metafoo.de> Link: https://lore.kernel.org/r/20211024092700.6844-1-lars@metafoo.de Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/iio/accel/mma8452.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c index 421a0a8..db815ba 100644 --- a/drivers/iio/accel/mma8452.c +++ b/drivers/iio/accel/mma8452.c @@ -1465,7 +1465,7 @@ static int mma8452_trigger_setup(struct iio_dev *indio_dev) if (ret) return ret; - indio_dev->trig = trig; + indio_dev->trig = iio_trigger_get(trig); return 0; } -- 2.9.5

2 1

[PATCH OLK-5.10 v3 00/26] xfs: atomic writes for xfs
by Long Li 13 Jun '24

13 Jun '24

THis patch set support xfs atomic writes feature. Alan Adamson (1): nvme: Atomic write support Darrick J. Wong (3): fs: xfs: Introduce FORCEALIGN inode flag fs: xfs: Enable file data forcealign feature fs: xfs: Make file data allocations observe the 'forcealign' flag John Garry (11): block: Add core atomic write support fs: xfs: Do not free EOF blocks for forcealign fs: iomap: Sub-extent zeroing fs: xfs: iomap: Sub-extent zeroing fs: Add FS_XFLAG_ATOMICWRITES flag fs: iomap: Atomic write support fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign fs: xfs: Validate atomic writes fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE xfs: Update xfs_is_falloc_aligned() mask for forcealign xfs: Only free full extents for forcealign Long Li (6): block: get atomic write max sectors xfs: support atomic write ioctl xfs: atomic write file dio convert to mark IOCB_ATOMIC xfs: fix set xflags fail when inode has extent hit xfs: make bunmapi observe forcealigin block: fix kabi in struct queue_limits Prasad Singamsetty (1): fs: Initial atomic write support Zhang Yi (4): math64: add rem_u64() to just return the remainder iomap: pass blocksize to iomap_truncate_page() xfs: refactor the truncating order xfs: correct the truncate blocksize of realtime inode Documentation/ABI/testing/sysfs-block | 52 ++++++++++++ block/blk-core.c | 39 ++++++++- block/blk-merge.c | 95 ++++++++++++++++++++- block/blk-settings.c | 55 ++++++++++++ block/blk-sysfs.c | 34 ++++++++ block/blk.h | 1 + drivers/md/dm-table.c | 1 + drivers/nvme/host/core.c | 56 ++++++++++++ fs/aio.c | 8 +- fs/iomap/buffered-io.c | 8 +- fs/iomap/direct-io.c | 33 +++++-- fs/read_write.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 22 ++++- fs/xfs/libxfs/xfs_format.h | 15 +++- fs/xfs/libxfs/xfs_inode_buf.c | 40 +++++++++ fs/xfs/libxfs/xfs_inode_buf.h | 3 + fs/xfs/libxfs/xfs_sb.c | 4 + fs/xfs/xfs_bmap_util.c | 10 ++- fs/xfs/xfs_file.c | 41 ++++++++- fs/xfs/xfs_inode.c | 43 ++++++++++ fs/xfs/xfs_inode.h | 12 +++ fs/xfs/xfs_ioctl.c | 96 ++++++++++++++++++++- fs/xfs/xfs_iomap.c | 19 ++++- fs/xfs/xfs_iops.c | 118 +++++++++++++------------- fs/xfs/xfs_mount.h | 5 ++ fs/xfs/xfs_super.c | 9 ++ include/linux/blk_types.h | 7 ++ include/linux/blkdev.h | 76 ++++++++++++++++- include/linux/fs.h | 30 ++++++- include/linux/iomap.h | 5 +- include/linux/math64.h | 24 ++++++ include/uapi/linux/fs.h | 9 +- io_uring/io_uring.c | 2 +- 33 files changed, 877 insertions(+), 97 deletions(-) -- 2.31.1

2 27

[PATCH openEuler-1.0-LTS] watchdog: Fix possible use-after-free by calling del_timer_sync()
by Jialin Zhang 13 Jun '24

13 Jun '24

From: Zou Wei <zou_wei(a)huawei.com> stable inclusion from stable-v4.19.198 commit ecd620e0fb1ff7f78fdb593379b2e6938c99707a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RL1P CVE: CVE-2021-47321 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d0212f095ab56672f6f36aabc605bda205e1e0bf ] This driver's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Zou Wei <zou_wei(a)huawei.com> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Acked-by: Vladimir Zapolskiy <vz(a)mleia.com> Link: https://lore.kernel.org/r/1620802676-19701-1-git-send-email-zou_wei@huawei.… Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim(a)linux-watchdog.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/watchdog/lpc18xx_wdt.c | 2 +- drivers/watchdog/w83877f_wdt.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c index 331cadb459ac..48580b6406c2 100644 --- a/drivers/watchdog/lpc18xx_wdt.c +++ b/drivers/watchdog/lpc18xx_wdt.c @@ -301,7 +301,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev) struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev); dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n"); - del_timer(&lpc18xx_wdt->timer); + del_timer_sync(&lpc18xx_wdt->timer); watchdog_unregister_device(&lpc18xx_wdt->wdt_dev); clk_disable_unprepare(lpc18xx_wdt->wdt_clk); diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c index 05658ecc0aa4..ec4641fc2d21 100644 --- a/drivers/watchdog/w83877f_wdt.c +++ b/drivers/watchdog/w83877f_wdt.c @@ -170,7 +170,7 @@ static void wdt_startup(void) static void wdt_turnoff(void) { /* Stop the timer */ - del_timer(&timer); + del_timer_sync(&timer); wdt_change(WDT_DISABLE); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2021-47261
by Yongqiang Liu 13 Jun '24

13 Jun '24

Alaa Hleihel (1): IB/mlx5: Fix initializing CQ fragments buffer drivers/infiniband/hw/mlx5/cq.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] drm/panel: fix a possible null pointer dereference
by Jialin Zhang 13 Jun '24

13 Jun '24

From: Ma Ke <make_ruc2021(a)163.com> stable inclusion from stable-v5.10.202 commit c7dc0aca5962fb37dbea9769dd26ec37813faae1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFEM CVE: CVE-2023-52821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 924e5814d1f84e6fa5cb19c6eceb69f066225229 ] In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke <make_ruc2021(a)163.com> Reviewed-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://lore.kernel.org/r/20231007033105.3997998-1-make_ruc2021@163.com Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20231007033105.3997998-1-make… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/gpu/drm/panel/panel-arm-versatile.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/panel/panel-arm-versatile.c b/drivers/gpu/drm/panel/panel-arm-versatile.c index abb0788843c6..503ecea72c5e 100644 --- a/drivers/gpu/drm/panel/panel-arm-versatile.c +++ b/drivers/gpu/drm/panel/panel-arm-versatile.c @@ -267,6 +267,8 @@ static int versatile_panel_get_modes(struct drm_panel *panel, connector->display_info.bus_flags = vpanel->panel_type->bus_flags; mode = drm_mode_duplicate(connector->dev, &vpanel->panel_type->mode); + if (!mode) + return -ENOMEM; drm_mode_set_name(mode); mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] soc: fsl: qbman: Use raw spinlock for cgr_lock
by Jialin Zhang 13 Jun '24

13 Jun '24

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v5.10.215 commit 32edca2f03a6cc42c650ddc3ad83d086e3f365d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CD CVE: CVE-2024-35819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fbec4e7fed89b579f2483041fabf9650fb0dd6bc ] smp_call_function always runs its callback in hard IRQ context, even on PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock for cgr_lock to ensure we aren't waiting on a sleeping task. Although this bug has existed for a while, it was not apparent until commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change") which invokes smp_call_function_single via qman_update_cgr_safe every time a link goes up or down. Fixes: 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()") CC: stable(a)vger.kernel.org Reported-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Closes: https://lore.kernel.org/all/20230323153935.nofnjucqjqnz34ej@skbuf/ Reported-by: Steffen Trumtrar <s.trumtrar(a)pengutronix.de> Closes: https://lore.kernel.org/linux-arm-kernel/87wmsyvclu.fsf@pengutronix.de/ Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Camelia Groza <camelia.groza(a)nxp.com> Tested-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/soc/fsl/qbman/qman.c [The conflict occurs because commit c542f3a70521("soc: fsl: qbman: Add helper for sanity checking cgr ops") and commit 39ed969a7a54("soc: fsl: qbman: Add CGR update function") is not merged. The function qman_update_cgr() does not exist on this branch.] Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/soc/fsl/qbman/qman.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c index d8267e6c31a5..f6e270565dde 100644 --- a/drivers/soc/fsl/qbman/qman.c +++ b/drivers/soc/fsl/qbman/qman.c @@ -991,7 +991,7 @@ struct qman_portal { /* linked-list of CSCN handlers. */ struct list_head cgr_cbs; /* list lock */ - spinlock_t cgr_lock; + raw_spinlock_t cgr_lock; struct work_struct congestion_work; struct work_struct mr_work; char irqname[MAX_IRQNAME]; @@ -1281,7 +1281,7 @@ static int qman_create_portal(struct qman_portal *portal, /* if the given mask is NULL, assume all CGRs can be seen */ qman_cgrs_fill(&portal->cgrs[0]); INIT_LIST_HEAD(&portal->cgr_cbs); - spin_lock_init(&portal->cgr_lock); + raw_spin_lock_init(&portal->cgr_lock); INIT_WORK(&portal->congestion_work, qm_congestion_task); INIT_WORK(&portal->mr_work, qm_mr_process_task); portal->bits = 0; @@ -1456,11 +1456,14 @@ static void qm_congestion_task(struct work_struct *work) union qm_mc_result *mcr; struct qman_cgr *cgr; - spin_lock_irq(&p->cgr_lock); + /* + * FIXME: QM_MCR_TIMEOUT is 10ms, which is too long for a raw spinlock! + */ + raw_spin_lock_irq(&p->cgr_lock); qm_mc_start(&p->p); qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION); if (!qm_mc_result_timeout(&p->p, &mcr)) { - spin_unlock_irq(&p->cgr_lock); + raw_spin_unlock_irq(&p->cgr_lock); dev_crit(p->config->dev, "QUERYCONGESTION timeout\n"); qman_p_irqsource_add(p, QM_PIRQ_CSCI); return; @@ -1476,7 +1479,7 @@ static void qm_congestion_task(struct work_struct *work) list_for_each_entry(cgr, &p->cgr_cbs, node) if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid)) cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid)); - spin_unlock_irq(&p->cgr_lock); + raw_spin_unlock_irq(&p->cgr_lock); qman_p_irqsource_add(p, QM_PIRQ_CSCI); } @@ -2440,7 +2443,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, preempt_enable(); cgr->chan = p->config->channel; - spin_lock_irq(&p->cgr_lock); + raw_spin_lock_irq(&p->cgr_lock); if (opts) { struct qm_mcc_initcgr local_opts = *opts; @@ -2477,7 +2480,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, qman_cgrs_get(&p->cgrs[1], cgr->cgrid)) cgr->cb(p, cgr, 1); out: - spin_unlock_irq(&p->cgr_lock); + raw_spin_unlock_irq(&p->cgr_lock); put_affine_portal(); return ret; } @@ -2502,7 +2505,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) goto put_portal; } memset(&local_opts, 0, sizeof(struct qm_mcc_initcgr)); - spin_lock_irqsave(&p->cgr_lock, irqflags); + raw_spin_lock_irqsave(&p->cgr_lock, irqflags); list_del(&cgr->node); /* * If there are no other CGR objects for this CGRID in the list, @@ -2527,7 +2530,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) /* add back to the list */ list_add(&cgr->node, &p->cgr_cbs); release_lock: - spin_unlock_irqrestore(&p->cgr_lock, irqflags); + raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags); put_portal: put_affine_portal(); return ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] soc: fsl: qbman: Use raw spinlock for cgr_lock
by Jialin Zhang 13 Jun '24

13 Jun '24

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v4.19.312 commit 2b3fede8225133671ce837c0d284804aa3bc7a02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CD CVE: CVE-2024-35819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fbec4e7fed89b579f2483041fabf9650fb0dd6bc ] smp_call_function always runs its callback in hard IRQ context, even on PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock for cgr_lock to ensure we aren't waiting on a sleeping task. Although this bug has existed for a while, it was not apparent until commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change") which invokes smp_call_function_single via qman_update_cgr_safe every time a link goes up or down. Fixes: 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()") CC: stable(a)vger.kernel.org Reported-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Closes: https://lore.kernel.org/all/20230323153935.nofnjucqjqnz34ej@skbuf/ Reported-by: Steffen Trumtrar <s.trumtrar(a)pengutronix.de> Closes: https://lore.kernel.org/linux-arm-kernel/87wmsyvclu.fsf@pengutronix.de/ Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Camelia Groza <camelia.groza(a)nxp.com> Tested-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/soc/fsl/qbman/qman.c [The conflict occurs because commit 99fe1b21b5e5("soc: fsl: qbman: Add helper for sanity checking cgr ops") and commit e2bd2df406ed("soc: fsl: qbman: Add CGR update function") is not merged. The function qman_update_cgr() does not exist on this branch.] Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/soc/fsl/qbman/qman.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c index f760f76e7fad..09ec2baaec16 100644 --- a/drivers/soc/fsl/qbman/qman.c +++ b/drivers/soc/fsl/qbman/qman.c @@ -976,7 +976,7 @@ struct qman_portal { /* linked-list of CSCN handlers. */ struct list_head cgr_cbs; /* list lock */ - spinlock_t cgr_lock; + raw_spinlock_t cgr_lock; struct work_struct congestion_work; struct work_struct mr_work; char irqname[MAX_IRQNAME]; @@ -1194,7 +1194,7 @@ static int qman_create_portal(struct qman_portal *portal, /* if the given mask is NULL, assume all CGRs can be seen */ qman_cgrs_fill(&portal->cgrs[0]); INIT_LIST_HEAD(&portal->cgr_cbs); - spin_lock_init(&portal->cgr_lock); + raw_spin_lock_init(&portal->cgr_lock); INIT_WORK(&portal->congestion_work, qm_congestion_task); INIT_WORK(&portal->mr_work, qm_mr_process_task); portal->bits = 0; @@ -1369,11 +1369,14 @@ static void qm_congestion_task(struct work_struct *work) union qm_mc_result *mcr; struct qman_cgr *cgr; - spin_lock_irq(&p->cgr_lock); + /* + * FIXME: QM_MCR_TIMEOUT is 10ms, which is too long for a raw spinlock! + */ + raw_spin_lock_irq(&p->cgr_lock); qm_mc_start(&p->p); qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION); if (!qm_mc_result_timeout(&p->p, &mcr)) { - spin_unlock_irq(&p->cgr_lock); + raw_spin_unlock_irq(&p->cgr_lock); dev_crit(p->config->dev, "QUERYCONGESTION timeout\n"); qman_p_irqsource_add(p, QM_PIRQ_CSCI); return; @@ -1389,7 +1392,7 @@ static void qm_congestion_task(struct work_struct *work) list_for_each_entry(cgr, &p->cgr_cbs, node) if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid)) cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid)); - spin_unlock_irq(&p->cgr_lock); + raw_spin_unlock_irq(&p->cgr_lock); qman_p_irqsource_add(p, QM_PIRQ_CSCI); } @@ -2346,7 +2349,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, preempt_enable(); cgr->chan = p->config->channel; - spin_lock_irq(&p->cgr_lock); + raw_spin_lock_irq(&p->cgr_lock); if (opts) { struct qm_mcc_initcgr local_opts = *opts; @@ -2383,7 +2386,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, qman_cgrs_get(&p->cgrs[1], cgr->cgrid)) cgr->cb(p, cgr, 1); out: - spin_unlock_irq(&p->cgr_lock); + raw_spin_unlock_irq(&p->cgr_lock); put_affine_portal(); return ret; } @@ -2408,7 +2411,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) goto put_portal; } memset(&local_opts, 0, sizeof(struct qm_mcc_initcgr)); - spin_lock_irqsave(&p->cgr_lock, irqflags); + raw_spin_lock_irqsave(&p->cgr_lock, irqflags); list_del(&cgr->node); /* * If there are no other CGR objects for this CGRID in the list, @@ -2433,7 +2436,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) /* add back to the list */ list_add(&cgr->node, &p->cgr_cbs); release_lock: - spin_unlock_irqrestore(&p->cgr_lock, irqflags); + raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags); put_portal: put_affine_portal(); return ret; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-35796
by Yongqiang Liu 13 Jun '24

13 Jun '24

Claus Hansen Ries (1): net: ll_temac: platform_get_resource replaced by wrong function drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/2] block: support to dispatch bio asynchronously
by Li Nan 13 Jun '24

13 Jun '24

Li Nan (2): block: support to dispatch bio asynchronously block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 9 + block/blk-core.c | 239 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 58 ++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 327 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/1] CVE-2024-35796
by Yongqiang Liu 13 Jun '24

13 Jun '24

Claus Hansen Ries (1): net: ll_temac: platform_get_resource replaced by wrong function drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 v2 00/28] xfs: atomic writes for xfs
by Long Li 13 Jun '24

13 Jun '24

THis patch set support xfs atomic writes feature. Alan Adamson (1): nvme: Atomic write support Christoph Hellwig (1): scsi: cxlflash: Query write_zeroes limit for zeroing Darrick J. Wong (3): fs: xfs: Introduce FORCEALIGN inode flag fs: xfs: Enable file data forcealign feature fs: xfs: Make file data allocations observe the 'forcealign' flag John Garry (13): block: Pass blk_queue_get_max_sectors() a request pointer block: Add core atomic write support block: Add fops atomic write support fs: xfs: Do not free EOF blocks for forcealign fs: iomap: Sub-extent zeroing fs: xfs: iomap: Sub-extent zeroing fs: Add FS_XFLAG_ATOMICWRITES flag fs: iomap: Atomic write support fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign fs: xfs: Validate atomic writes fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE xfs: Update xfs_is_falloc_aligned() mask for forcealign xfs: Only free full extents for forcealign Long Li (5): xfs: support atomic write ioctl xfs: atomic write file dio convert to mark IOCB_ATOMIC xfs: fix set xflags fail when inode has extent hit xfs: make bunmapi observe forcealigin block: fix kabi in struct queue_limits Prasad Singamsetty (1): fs: Initial atomic write support Zhang Yi (4): math64: add rem_u64() to just return the remainder iomap: pass blocksize to iomap_truncate_page() xfs: refactor the truncating order xfs: correct the truncate blocksize of realtime inode Documentation/ABI/testing/sysfs-block | 52 ++++++++++++ block/blk-core.c | 39 ++++++++- block/blk-merge.c | 95 ++++++++++++++++++++- block/blk-settings.c | 111 ++++++++++++++++++++++++ block/blk-sysfs.c | 34 ++++++++ block/blk.h | 1 + drivers/block/rnbd/rnbd-srv-dev.h | 3 +- drivers/md/dm-table.c | 1 + drivers/nvme/host/core.c | 56 ++++++++++++ drivers/scsi/cxlflash/vlun.c | 4 +- fs/aio.c | 8 +- fs/block_dev.c | 30 ++++++- fs/iomap/buffered-io.c | 8 +- fs/iomap/direct-io.c | 33 +++++-- fs/read_write.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 22 ++++- fs/xfs/libxfs/xfs_format.h | 15 +++- fs/xfs/libxfs/xfs_inode_buf.c | 40 +++++++++ fs/xfs/libxfs/xfs_inode_buf.h | 3 + fs/xfs/libxfs/xfs_sb.c | 4 + fs/xfs/xfs_bmap_util.c | 10 ++- fs/xfs/xfs_file.c | 41 ++++++++- fs/xfs/xfs_inode.c | 43 ++++++++++ fs/xfs/xfs_inode.h | 12 +++ fs/xfs/xfs_ioctl.c | 96 ++++++++++++++++++++- fs/xfs/xfs_iomap.c | 19 ++++- fs/xfs/xfs_iops.c | 118 +++++++++++++------------- fs/xfs/xfs_mount.h | 5 ++ fs/xfs/xfs_super.c | 9 ++ include/linux/blk_types.h | 7 ++ include/linux/blkdev.h | 81 +++++++++++++++++- include/linux/fs.h | 33 ++++++- include/linux/iomap.h | 5 +- include/linux/math64.h | 24 ++++++ include/uapi/linux/fs.h | 9 +- io_uring/io_uring.c | 2 +- 36 files changed, 971 insertions(+), 104 deletions(-) -- 2.31.1

3 30

[PATCH openEuler-22.03-LTS-SP1] IB/hfi1: Restore allocated resources on failed copyout
by Zeng Heng 13 Jun '24

13 Jun '24

From: Dean Luick <dean.luick(a)cornelisnetworks.com> stable inclusion from stable-v5.10.168 commit 79b595d9591426156a9e0635a5b5115508a36fef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LR CVE: CVE-2023-52747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@a… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index d84b1098762c..7828fb593120 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1359,12 +1359,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info, tidcnt); if (copy_to_user((void __user *)addr, &tinfo.tidcnt, sizeof(tinfo.tidcnt))) - return -EFAULT; + ret = -EFAULT; addr = arg + offsetof(struct hfi1_tid_info, length); - if (copy_to_user((void __user *)addr, &tinfo.length, + if (!ret && copy_to_user((void __user *)addr, &tinfo.length, sizeof(tinfo.length))) ret = -EFAULT; + + if (ret) + hfi1_user_exp_rcv_invalid(fd, &tinfo); } return ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: rds: fix memory leak in rds_recvmsg
by Zheng Zucheng 13 Jun '24

13 Jun '24

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v5.10.46 commit 5946fbf48355f5a8caeff72580c7658da5966b86 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4HY CVE: CVE-2021-47249 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49bfcbfd989a8f1f23e705759a6bb099de2cff9f ] Syzbot reported memory leak in rds. The problem was in unputted refcount in case of error. int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, int msg_flags) { ... if (!rds_next_incoming(rs, &inc)) { ... } After this "if" inc refcount incremented and if (rds_cmsg_recv(inc, msg, rs)) { ret = -EFAULT; goto out; } ... out: return ret; } in case of rds_cmsg_recv() fail the refcount won't be decremented. And it's easy to see from ftrace log, that rds_inc_addref() don't have rds_inc_put() pair in rds_recvmsg() after rds_cmsg_recv() 1) | rds_recvmsg() { 1) 3.721 us | rds_inc_addref(); 1) 3.853 us | rds_message_inc_copy_to_user(); 1) + 10.395 us | rds_cmsg_recv(); 1) + 34.260 us | } Fixes: bdbe6fbc6a2f ("RDS: recv.c") Reported-and-tested-by: syzbot+5134cdf021c4ed5aaa5f(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Reviewed-by: Håkon Bugge <haakon.bugge(a)oracle.com> Acked-by: Santosh Shilimkar <santosh.shilimkar(a)oracle.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- net/rds/recv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rds/recv.c b/net/rds/recv.c index 3ca278988b52..ccf0bf283002 100644 --- a/net/rds/recv.c +++ b/net/rds/recv.c @@ -705,7 +705,7 @@ int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, if (rds_cmsg_recv(inc, msg, rs)) { ret = -EFAULT; - goto out; + break; } rds_recvmsg_zcookie(rs, msg); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: seq: Fix race of snd_seq_timer_open()
by Zheng Zucheng 13 Jun '24

13 Jun '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.44 commit bd7d88b0874f82f7b29d1a53e574cedaf23166ba category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4II CVE: CVE-2021-47281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 83e197a8414c0ba545e7e3916ce05f836f349273 upstream. The timer instance per queue is exclusive, and snd_seq_timer_open() should have managed the concurrent accesses. It looks as if it's checking the already existing timer instance at the beginning, but it's not right, because there is no protection, hence any later concurrent call of snd_seq_timer_open() may override the timer instance easily. This may result in UAF, as the leftover timer instance can keep running while the queue itself gets closed, as spotted by syzkaller recently. For avoiding the race, add a proper check at the assignment of tmr->timeri again, and return -EBUSY if it's been already registered. Reported-by: syzbot+ddc1260a83ed1cbf6fb5(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/000000000000dce34f05c42f110c@google.com Link: https://lore.kernel.org/r/20210610152059.24633-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Conflicts: sound/core/seq/seq_timer.c [Some contexts different. No functional impact.] Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- sound/core/seq/seq_timer.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c index f587d0e27476..168256b58313 100644 --- a/sound/core/seq/seq_timer.c +++ b/sound/core/seq/seq_timer.c @@ -308,8 +308,15 @@ int snd_seq_timer_open(struct snd_seq_queue *q) t->callback_data = q; t->flags |= SNDRV_TIMER_IFLG_AUTO; spin_lock_irq(&tmr->lock); - tmr->timeri = t; + if (tmr->timeri) + err = -EBUSY; + else + tmr->timeri = t; spin_unlock_irq(&tmr->lock); + if (err < 0) { + snd_timer_close(t); + return err; + } return 0; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] IB/hfi1: Restore allocated resources on failed copyout
by Zeng Heng 13 Jun '24

13 Jun '24

From: Dean Luick <dean.luick(a)cornelisnetworks.com> stable inclusion from stable-v5.10.168 commit 79b595d9591426156a9e0635a5b5115508a36fef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O7 CVE: CVE-2023-52747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@a… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index d84b1098762c..7828fb593120 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1359,12 +1359,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info, tidcnt); if (copy_to_user((void __user *)addr, &tinfo.tidcnt, sizeof(tinfo.tidcnt))) - return -EFAULT; + ret = -EFAULT; addr = arg + offsetof(struct hfi1_tid_info, length); - if (copy_to_user((void __user *)addr, &tinfo.length, + if (!ret && copy_to_user((void __user *)addr, &tinfo.length, sizeof(tinfo.length))) ret = -EFAULT; + + if (ret) + hfi1_user_exp_rcv_invalid(fd, &tinfo); } return ret; -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2024-36011
by Liao Chen 13 Jun '24

13 Jun '24

Bluetooth: HCI: Fix potential null-ptr-deref Sungwoo Kim (1): Bluetooth: HCI: Fix potential null-ptr-deref net/bluetooth/hci_event.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10] IB/hfi1: Restore allocated resources on failed copyout
by Zeng Heng 13 Jun '24

13 Jun '24

From: Dean Luick <dean.luick(a)cornelisnetworks.com> stable inclusion from stable-v5.10.168 commit 79b595d9591426156a9e0635a5b5115508a36fef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O7 CVE: CVE-2023-52747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@a… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index d84b1098762c..7828fb593120 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1359,12 +1359,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info, tidcnt); if (copy_to_user((void __user *)addr, &tinfo.tidcnt, sizeof(tinfo.tidcnt))) - return -EFAULT; + ret = -EFAULT; addr = arg + offsetof(struct hfi1_tid_info, length); - if (copy_to_user((void __user *)addr, &tinfo.length, + if (!ret && copy_to_user((void __user *)addr, &tinfo.length, sizeof(tinfo.length))) ret = -EFAULT; + + if (ret) + hfi1_user_exp_rcv_invalid(fd, &tinfo); } return ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: rds: fix memory leak in rds_recvmsg
by Zheng Zucheng 13 Jun '24

13 Jun '24

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v5.10.46 commit 5946fbf48355f5a8caeff72580c7658da5966b86 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4HY CVE: CVE-2021-47249 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49bfcbfd989a8f1f23e705759a6bb099de2cff9f ] Syzbot reported memory leak in rds. The problem was in unputted refcount in case of error. int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, int msg_flags) { ... if (!rds_next_incoming(rs, &inc)) { ... } After this "if" inc refcount incremented and if (rds_cmsg_recv(inc, msg, rs)) { ret = -EFAULT; goto out; } ... out: return ret; } in case of rds_cmsg_recv() fail the refcount won't be decremented. And it's easy to see from ftrace log, that rds_inc_addref() don't have rds_inc_put() pair in rds_recvmsg() after rds_cmsg_recv() 1) | rds_recvmsg() { 1) 3.721 us | rds_inc_addref(); 1) 3.853 us | rds_message_inc_copy_to_user(); 1) + 10.395 us | rds_cmsg_recv(); 1) + 34.260 us | } Fixes: bdbe6fbc6a2f ("RDS: recv.c") Reported-and-tested-by: syzbot+5134cdf021c4ed5aaa5f(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Reviewed-by: Håkon Bugge <haakon.bugge(a)oracle.com> Acked-by: Santosh Shilimkar <santosh.shilimkar(a)oracle.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- net/rds/recv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rds/recv.c b/net/rds/recv.c index 3ca278988b52..ccf0bf283002 100644 --- a/net/rds/recv.c +++ b/net/rds/recv.c @@ -705,7 +705,7 @@ int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, if (rds_cmsg_recv(inc, msg, rs)) { ret = -EFAULT; - goto out; + break; } rds_recvmsg_zcookie(rs, msg); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: rds: fix memory leak in rds_recvmsg
by Zheng Zucheng 13 Jun '24

13 Jun '24

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-5.10.46 commit 5946fbf48355f5a8caeff72580c7658da5966b86 bugzilla: 168323 CVE: CVE-2021-47249 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49bfcbfd989a8f1f23e705759a6bb099de2cff9f ] Syzbot reported memory leak in rds. The problem was in unputted refcount in case of error. int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, int msg_flags) { ... if (!rds_next_incoming(rs, &inc)) { ... } After this "if" inc refcount incremented and if (rds_cmsg_recv(inc, msg, rs)) { ret = -EFAULT; goto out; } ... out: return ret; } in case of rds_cmsg_recv() fail the refcount won't be decremented. And it's easy to see from ftrace log, that rds_inc_addref() don't have rds_inc_put() pair in rds_recvmsg() after rds_cmsg_recv() 1) | rds_recvmsg() { 1) 3.721 us | rds_inc_addref(); 1) 3.853 us | rds_message_inc_copy_to_user(); 1) + 10.395 us | rds_cmsg_recv(); 1) + 34.260 us | } Fixes: bdbe6fbc6a2f ("RDS: recv.c") Reported-and-tested-by: syzbot+5134cdf021c4ed5aaa5f(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Reviewed-by: Håkon Bugge <haakon.bugge(a)oracle.com> Acked-by: Santosh Shilimkar <santosh.shilimkar(a)oracle.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- net/rds/recv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rds/recv.c b/net/rds/recv.c index 3ca278988b52..ccf0bf283002 100644 --- a/net/rds/recv.c +++ b/net/rds/recv.c @@ -705,7 +705,7 @@ int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, if (rds_cmsg_recv(inc, msg, rs)) { ret = -EFAULT; - goto out; + break; } rds_recvmsg_zcookie(rs, msg); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: seq: Fix race of snd_seq_timer_open()
by Zheng Zucheng 13 Jun '24

13 Jun '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.44 commit bd7d88b0874f82f7b29d1a53e574cedaf23166ba category: bugfix bugzilla: 109295 CVE: CVE-2021-47281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 83e197a8414c0ba545e7e3916ce05f836f349273 upstream. The timer instance per queue is exclusive, and snd_seq_timer_open() should have managed the concurrent accesses. It looks as if it's checking the already existing timer instance at the beginning, but it's not right, because there is no protection, hence any later concurrent call of snd_seq_timer_open() may override the timer instance easily. This may result in UAF, as the leftover timer instance can keep running while the queue itself gets closed, as spotted by syzkaller recently. For avoiding the race, add a proper check at the assignment of tmr->timeri again, and return -EBUSY if it's been already registered. Reported-by: syzbot+ddc1260a83ed1cbf6fb5(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/000000000000dce34f05c42f110c@google.com Link: https://lore.kernel.org/r/20210610152059.24633-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- sound/core/seq/seq_timer.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c index f587d0e27476..4c9384f1189d 100644 --- a/sound/core/seq/seq_timer.c +++ b/sound/core/seq/seq_timer.c @@ -308,8 +308,16 @@ int snd_seq_timer_open(struct snd_seq_queue *q) t->callback_data = q; t->flags |= SNDRV_TIMER_IFLG_AUTO; spin_lock_irq(&tmr->lock); - tmr->timeri = t; + if (tmr->timeri) + err = -EBUSY; + else + tmr->timeri = t; spin_unlock_irq(&tmr->lock); + if (err < 0) { + snd_timer_close(t); + snd_timer_instance_free(t); + return err; + } return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2021-47509
by Jialin Zhang 13 Jun '24

13 Jun '24

Takashi Iwai (2): ALSA: pcm: oss: Fix potential out-of-bounds shift ALSA: pcm: oss: Limit the period size to 16MB sound/core/oss/pcm_oss.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] IB/hfi1: Restore allocated resources on failed copyout
by Zeng Heng 13 Jun '24

13 Jun '24

From: Dean Luick <dean.luick(a)cornelisnetworks.com> stable inclusion from stable-v4.19.273 commit 00d9e212b8a39e6ffcf31b9d2e503d2bf6009d45 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LR CVE: CVE-2023-52747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@a… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index 34ffca618427..499bfae098c2 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1345,12 +1345,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info, tidcnt); if (copy_to_user((void __user *)addr, &tinfo.tidcnt, sizeof(tinfo.tidcnt))) - return -EFAULT; + ret = -EFAULT; addr = arg + offsetof(struct hfi1_tid_info, length); - if (copy_to_user((void __user *)addr, &tinfo.length, + if (!ret && copy_to_user((void __user *)addr, &tinfo.length, sizeof(tinfo.length))) ret = -EFAULT; + + if (ret) + hfi1_user_exp_rcv_invalid(fd, &tinfo); } return ret; -- 2.25.1

2 1

[PATCH OLK-5.10] keys: Fix overwrite of key expiration on instantiation
by Xiang Yang 13 Jun '24

13 Jun '24

From: Silvio Gissi <sifonsec(a)amazon.com> stable inclusion from stable-v5.10.217 commit ad2011ea787928b2accb5134f1e423b11fe80a8a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TM8D CVE: CVE-2024-36031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9da27fb65a14c18efd4473e2e82b76b53ba60252 upstream. The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that key_set_expiry is only called when the pre-parser sets a specific expiry. Fixes: 39299bdd2546 ("keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry") Signed-off-by: Silvio Gissi <sifonsec(a)amazon.com> cc: David Howells <dhowells(a)redhat.com> cc: Hazem Mohamed Abuelfotoh <abuehaze(a)amazon.com> cc: linux-afs(a)lists.infradead.org cc: linux-cifs(a)vger.kernel.org cc: keyrings(a)vger.kernel.org cc: netdev(a)vger.kernel.org cc: stable(a)vger.kernel.org Reviewed-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- security/keys/key.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/keys/key.c b/security/keys/key.c index 67ad0826e385..e5111ce17e25 100644 --- a/security/keys/key.c +++ b/security/keys/key.c @@ -464,7 +464,8 @@ static int __key_instantiate_and_link(struct key *key, if (authkey) key_invalidate(authkey); - key_set_expiry(key, prep->expiry); + if (prep->expiry != TIME64_MAX) + key_set_expiry(key, prep->expiry); } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] IB/hfi1: Restore allocated resources on failed copyout
by Zeng Heng 13 Jun '24

13 Jun '24

From: Dean Luick <dean.luick(a)cornelisnetworks.com> stable inclusion from stable-v4.19.273 commit 00d9e212b8a39e6ffcf31b9d2e503d2bf6009d45 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LR CVE: CVE-2023-52747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@a… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index 34ffca618427..499bfae098c2 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1345,12 +1345,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info, tidcnt); if (copy_to_user((void __user *)addr, &tinfo.tidcnt, sizeof(tinfo.tidcnt))) - return -EFAULT; + ret = -EFAULT; addr = arg + offsetof(struct hfi1_tid_info, length); - if (copy_to_user((void __user *)addr, &tinfo.length, + if (!ret && copy_to_user((void __user *)addr, &tinfo.length, sizeof(tinfo.length))) ret = -EFAULT; + + if (ret) + hfi1_user_exp_rcv_invalid(fd, &tinfo); } return ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] IB/hfi1: Restore allocated resources on failed copyout
by Zeng Heng 13 Jun '24

13 Jun '24

From: Dean Luick <dean.luick(a)cornelisnetworks.com> stable inclusion from stable-v5.10.168 commit 79b595d9591426156a9e0635a5b5115508a36fef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LR CVE: CVE-2023-52747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@a… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index 34ffca618427..499bfae098c2 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1345,12 +1345,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info, tidcnt); if (copy_to_user((void __user *)addr, &tinfo.tidcnt, sizeof(tinfo.tidcnt))) - return -EFAULT; + ret = -EFAULT; addr = arg + offsetof(struct hfi1_tid_info, length); - if (copy_to_user((void __user *)addr, &tinfo.length, + if (!ret && copy_to_user((void __user *)addr, &tinfo.length, sizeof(tinfo.length))) ret = -EFAULT; + + if (ret) + hfi1_user_exp_rcv_invalid(fd, &tinfo); } return ret; -- 2.25.1

2 1

[PATCH OLK-5.10] block: support to dispatch bio asynchronously
by Li Nan 13 Jun '24

13 Jun '24

From: Yu Kuai <yukuai3(a)huawei.com> In certain environments, specific CPUs handle a large number of tasks and become bottlenecks, affecting overall system performance. This commit introduces a new feature that enables asynchronous I/O dispatch to designated CPUs, thereby relieving the pressure on the busy CPUs. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Li Nan <linan122(a)huawei.com> --- block/blk.h | 7 ++ include/linux/blk_types.h | 1 + include/linux/blkdev.h | 8 ++ block/blk-core.c | 229 +++++++++++++++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 58 ++++++++++ block/Kconfig | 12 ++ 7 files changed, 315 insertions(+), 1 deletion(-) diff --git a/block/blk.h b/block/blk.h index 4bbcc971d4f7..5e7c00356ddc 100644 --- a/block/blk.h +++ b/block/blk.h @@ -450,4 +450,11 @@ int bio_add_hw_page(struct request_queue *q, struct bio *bio, struct page *page, unsigned int len, unsigned int offset, unsigned int max_sectors, bool *same_page); +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC +void blk_free_queue_dispatch_async(struct request_queue *q); +#else +static inline void blk_free_queue_dispatch_async(struct request_queue *q) +{ +} +#endif #endif /* BLK_INTERNAL_H */ diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index 1853ec569b72..865e1198e837 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -301,6 +301,7 @@ enum { * of this bio. */ BIO_CGROUP_ACCT, /* has been accounted to a cgroup */ BIO_TRACKED, /* set if bio goes through the rq_qos path */ + BIO_ASYNC, BIO_FLAG_LAST }; diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 50b4fd0a0687..453bae093b65 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -601,6 +601,12 @@ struct request_queue { #define BLK_MAX_WRITE_HINTS 5 u64 write_hints[BLK_MAX_WRITE_HINTS]; + +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + /* used when QUEUE_FLAG_DISPATCH_ASYNC is set */ + struct cpumask dispatch_async_cpus; + int __percpu *last_dispatch_cpu; +#endif KABI_REPLACE(unsigned long dtag_wait_time, struct blk_mq_tags *shared_sbitmap_tags) KABI_RESERVE(1) @@ -643,6 +649,8 @@ struct request_queue { #define QUEUE_FLAG_NOWAIT 29 /* device supports NOWAIT */ /*at least one blk-mq hctx can't get driver tag */ #define QUEUE_FLAG_HCTX_WAIT 30 +/* support to dispatch bio asynchronously */ +#define QUEUE_FLAG_DISPATCH_ASYNC 31 #define QUEUE_FLAG_MQ_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \ (1 << QUEUE_FLAG_SAME_COMP) | \ diff --git a/block/blk-core.c b/block/blk-core.c index f91f8e8be482..03375d28d664 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -87,6 +87,223 @@ struct kmem_cache *blk_requestq_cachep; */ static struct workqueue_struct *kblockd_workqueue; +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + +#define BIO_DISPATCH_MAX_LOOP 16 + +struct async_bio { + struct bio_list list; + spinlock_t lock; +} ____cacheline_aligned_in_smp; + +struct bio_dispatch_async_ctl { + /* + * Vector size is nr_cpu_ids, list stores bio dispatched from other cpu, + * such bio will be dispatched asynchronously to the cpu this structure + * is serviced. + */ + struct async_bio *bios; + /* kthread to handle bio dispatched from other cpu. */ + struct task_struct *thread; + wait_queue_head_t wait; +}; + +static struct bio_dispatch_async_ctl __percpu *bio_dispatch_async_ctl; + +static int blk_alloc_queue_dispatch_async(struct request_queue *q) +{ + int cpu; + + q->last_dispatch_cpu = alloc_percpu(int); + if (!q->last_dispatch_cpu) + return -ENOMEM; + + cpumask_setall(&q->dispatch_async_cpus); + for_each_possible_cpu(cpu) + *per_cpu_ptr(q->last_dispatch_cpu, cpu) = cpu; + + return 0; +} + +void blk_free_queue_dispatch_async(struct request_queue *q) +{ + free_percpu(q->last_dispatch_cpu); + q->last_dispatch_cpu = NULL; +} + +static int get_dispatch_cpu(struct request_queue *q, int cpu) +{ + int *last_dispatch_cpu = + per_cpu_ptr(q->last_dispatch_cpu, cpu); + + cpu = cpumask_next(*last_dispatch_cpu, &q->dispatch_async_cpus); + if (cpu >= nr_cpu_ids) + cpu = cpumask_first(&q->dispatch_async_cpus); + + *last_dispatch_cpu = cpu; + + return cpu; +} + +static bool __submit_bio_noacct_async(struct bio *bio) +{ + int cpu = smp_processor_id(); + int dispatch_cpu = get_dispatch_cpu(bio->bi_disk->queue, cpu); + struct bio_dispatch_async_ctl *ctl; + + if (dispatch_cpu >= nr_cpu_ids || dispatch_cpu == cpu) + return false; + + ctl = per_cpu_ptr(bio_dispatch_async_ctl, dispatch_cpu); + spin_lock_irq(&ctl->bios[cpu].lock); + bio_list_add(&ctl->bios[cpu].list, bio); + spin_unlock_irq(&ctl->bios[cpu].lock); + + if (wq_has_sleeper(&ctl->wait)) + wake_up(&ctl->wait); + + return true; +} + +static bool submit_bio_noacct_async(struct bio *bio) +{ + struct request_queue *q; + + if (bio_flagged(bio, BIO_ASYNC)) + return false; + + bio_set_flag(bio, BIO_ASYNC); + /* + * Don't dispatch bio asynchronously in following cases: + * + * - QUEUE_FLAG_DISPATCH_ASYNC is not set; + * - current cpu is the target cpu; + * - bio is flagged no wait; + * - io polling is enabled; + */ + q = bio->bi_disk->queue; + if (!test_bit(QUEUE_FLAG_DISPATCH_ASYNC, &q->queue_flags) || + test_bit(QUEUE_FLAG_POLL, &q->queue_flags) || + cpumask_test_cpu(smp_processor_id(), &q->dispatch_async_cpus) || + bio->bi_opf & REQ_NOWAIT) + return false; + + return __submit_bio_noacct_async(bio); +} + +static bool collect_bio(struct bio_dispatch_async_ctl *ctl, + struct bio_list *list) +{ + bool has_bio = false; + int cpu; + + for_each_possible_cpu(cpu) { + struct async_bio *abio = &ctl->bios[cpu]; + + if (bio_list_empty(&abio->list)) + continue; + + has_bio = true; + + spin_lock_irq(&abio->lock); + bio_list_merge(list, &abio->list); + bio_list_init(&abio->list); + spin_unlock_irq(&abio->lock); + } + + return has_bio; +} + +static int bio_dispatch_work(void *data) +{ + int loop_count = 0; + struct bio_list bio_list_on_stack; + struct blk_plug plug; + struct bio_dispatch_async_ctl *ctl; + + bio_list_init(&bio_list_on_stack); + ctl = this_cpu_ptr(bio_dispatch_async_ctl); + + for (;; loop_count++) { + struct bio *bio; + bool has_bio = collect_bio(ctl, &bio_list_on_stack); + + if (!has_bio) { + DEFINE_WAIT(wait); + + for (;;) { + prepare_to_wait(&ctl->wait, &wait, + TASK_INTERRUPTIBLE); + has_bio = collect_bio(ctl, &bio_list_on_stack); + if (has_bio) + break; + schedule(); + loop_count = 0; + } + finish_wait(&ctl->wait, &wait); + } + + blk_start_plug(&plug); + while ((bio = bio_list_pop(&bio_list_on_stack))) + submit_bio_noacct(bio); + blk_finish_plug(&plug); + + /* prevent soft lockup. */ + if (loop_count >= BIO_DISPATCH_MAX_LOOP) { + loop_count = 0; + cond_resched(); + } + } + + return 0; +} + +static void init_blk_queue_async_dispatch(void) +{ + int cpu; + + bio_dispatch_async_ctl = alloc_percpu(struct bio_dispatch_async_ctl); + if (!bio_dispatch_async_ctl) + panic("Failed to alloc bio_dispatch_async_ctl\n"); + + for_each_possible_cpu(cpu) { + int i; + struct bio_dispatch_async_ctl *ctl = + per_cpu_ptr(bio_dispatch_async_ctl, cpu); + + init_waitqueue_head(&ctl->wait); + ctl->bios = kmalloc_array(nr_cpu_ids, sizeof(struct async_bio), + GFP_KERNEL | __GFP_NOFAIL); + for (i = 0; i < nr_cpu_ids; ++i) { + bio_list_init(&ctl->bios[i].list); + spin_lock_init(&ctl->bios[i].lock); + } + + ctl->thread = + kthread_create_on_cpu(bio_dispatch_work, NULL, cpu, + "bio_dispatch_work_%u"); + if (IS_ERR_OR_NULL(ctl->thread)) + panic("Failed to create bio dispatch thread\n"); + + wake_up_process(ctl->thread); + } +} +#else +static int blk_alloc_queue_dispatch_async(struct request_queue *q) +{ + return 0; +} + +static bool submit_bio_noacct_async(struct bio *bio) +{ + return false; +} + +static void init_blk_queue_async_dispatch(void) +{ +} +#endif + /** * blk_queue_flag_set - atomically set a queue flag * @flag: flag to be set @@ -539,9 +756,12 @@ struct request_queue *blk_alloc_queue(int node_id) q->last_merge = NULL; + if (blk_alloc_queue_dispatch_async(q)) + goto fail_q; + q->id = ida_simple_get(&blk_queue_ida, 0, 0, GFP_KERNEL); if (q->id < 0) - goto fail_q; + goto fail_dispatch_async; ret = bioset_init(&q->bio_split, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); if (ret) @@ -606,6 +826,8 @@ struct request_queue *blk_alloc_queue(int node_id) bioset_exit(&q->bio_split); fail_id: ida_simple_remove(&blk_queue_ida, q->id); +fail_dispatch_async: + blk_free_queue_dispatch_async(q); fail_q: kmem_cache_free(blk_requestq_cachep, q); return NULL; @@ -1055,6 +1277,9 @@ static blk_qc_t __submit_bio_noacct_mq(struct bio *bio) */ blk_qc_t submit_bio_noacct(struct bio *bio) { + if (submit_bio_noacct_async(bio)) + return BLK_QC_T_NONE; + if (!submit_bio_checks(bio)) return BLK_QC_T_NONE; @@ -1905,5 +2130,7 @@ int __init blk_dev_init(void) blk_debugfs_root = debugfs_create_dir("block", NULL); + init_blk_queue_async_dispatch(); + return 0; } diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c index a879f94782e4..b5b17c6ee650 100644 --- a/block/blk-mq-debugfs.c +++ b/block/blk-mq-debugfs.c @@ -131,6 +131,7 @@ static const char *const blk_queue_flag_name[] = { QUEUE_FLAG_NAME(RQ_ALLOC_TIME), QUEUE_FLAG_NAME(HCTX_ACTIVE), QUEUE_FLAG_NAME(NOWAIT), + QUEUE_FLAG_NAME(DISPATCH_ASYNC), }; #undef QUEUE_FLAG_NAME diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index c95be9626a09..e363222858b4 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -288,6 +288,9 @@ QUEUE_SYSFS_BIT_FNS(nonrot, NONROT, 1); QUEUE_SYSFS_BIT_FNS(random, ADD_RANDOM, 0); QUEUE_SYSFS_BIT_FNS(iostats, IO_STAT, 0); QUEUE_SYSFS_BIT_FNS(stable_writes, STABLE_WRITES, 0); +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC +QUEUE_SYSFS_BIT_FNS(dispatch_async, DISPATCH_ASYNC, 0); +#endif #undef QUEUE_SYSFS_BIT_FNS static ssize_t queue_zoned_show(struct request_queue *q, char *page) @@ -619,6 +622,56 @@ QUEUE_RW_ENTRY(queue_iostats, "iostats"); QUEUE_RW_ENTRY(queue_random, "add_random"); QUEUE_RW_ENTRY(queue_stable_writes, "stable_writes"); +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + +static ssize_t queue_dispatch_async_cpus_show(struct request_queue *q, + char *page) +{ + + return sprintf(page, "%*pb\n", nr_cpu_ids, + cpumask_bits(&q->dispatch_async_cpus)); +} + +static ssize_t queue_dispatch_async_cpus_store(struct request_queue *q, + const char *page, size_t count) +{ + cpumask_var_t cpumask; + ssize_t ret; + + if (!alloc_cpumask_var(&cpumask, GFP_KERNEL)) + return -ENOMEM; + + ret = bitmap_parse(page, count, cpumask_bits(cpumask), + nr_cpumask_bits); + if (ret < 0) + goto out; + + if (cpumask_empty(cpumask) || + !cpumask_subset(cpumask, cpu_online_mask)) + return -EINVAL; + + blk_mq_freeze_queue(q); + blk_mq_quiesce_queue(q); + + cpumask_copy(&q->dispatch_async_cpus, cpumask); + + blk_mq_unquiesce_queue(q); + blk_mq_unfreeze_queue(q); + ret = count; +out: + free_cpumask_var(cpumask); + return ret; +} + +static struct queue_sysfs_entry queue_dispatch_async_cpus_entry = { + .attr = {.name = "dispatch_async_cpus", .mode = 0644 }, + .show = queue_dispatch_async_cpus_show, + .store = queue_dispatch_async_cpus_store, +}; + +QUEUE_RW_ENTRY(queue_dispatch_async, "dispatch_async"); +#endif + static struct attribute *queue_attrs[] = { &queue_requests_entry.attr, &queue_ra_entry.attr, @@ -659,6 +712,10 @@ static struct attribute *queue_attrs[] = { &queue_wb_lat_entry.attr, &queue_poll_delay_entry.attr, &queue_io_timeout_entry.attr, +#ifdef CONFIG_BLK_BIO_DISPATCH_ASYNC + &queue_dispatch_async_cpus_entry.attr, + &queue_dispatch_async_entry.attr, +#endif #ifdef CONFIG_BLK_DEV_THROTTLING_LOW &blk_throtl_sample_time_entry.attr, #endif @@ -795,6 +852,7 @@ static void blk_release_queue(struct kobject *kobj) blk_stat_remove_callback(q, q->poll_cb); blk_stat_free_callback(q->poll_cb); + blk_free_queue_dispatch_async(q); blk_free_queue_stats(q->stats); blk_exit_queue(q); diff --git a/block/Kconfig b/block/Kconfig index e5c965f1ea25..bda77b006352 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -209,6 +209,18 @@ config BLK_DEV_DUMPINFO Dump info when open an write opened block device exclusively or open an exclusive opened device for write +config BLK_BIO_DISPATCH_ASYNC + bool "Dispatch bios asynchronously on specific cpus" + default n + help + If there are multiple nodes, memory access across nodes is rather bad + compare to local node. And if some drivers are using internal spin + locks, io performance will be bad if bios are issued concurrently from + different nodes. This feature will dispatch bio asynchronously to the + specific CPUs to avoid across nodes memory access in driver, noted this + feature will require special care in the driver to work. If unsure, + say N here. + menu "Partition Types" source "block/partitions/Kconfig" -- 2.39.2

2 1

virtcca patch
by Lishengjie 12 Jun '24

12 Jun '24

1 0

[PATCH openEuler-22.03-LTS-SP1] bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
by Liu Jian 12 Jun '24

12 Jun '24

From: Jason Xing <kernelxing(a)tencent.com> mainline inclusion from mainline-v6.9-rc7 commit 6648e613226e18897231ab5e42ffc29e63fa3365 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U1UZ CVE: CVE-2024-36938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0: sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 value changed: 0xffffffff83d7feb0 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer similarly due to no protection of saved_data_ready. Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses "write_lock_bh(&sk->sk_callback_lock);". To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Reported-by: syzbot+aa8c8ec2538929f18f2d(a)syzkaller.appspotmail.com Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: John Fastabend <john.fastabend(a)gmail.com> Closes: https://syzkaller.appspot.com/bug?extid=aa8c8ec2538929f18f2d Link: https://lore.kernel.org/all/20240329134037.92124-1-kerneljasonxing@gmail.com Link: https://lore.kernel.org/bpf/20240404021001.94815-1-kerneljasonxing@gmail.com Conflicts: include/linux/skmsg.h net/core/skmsg.c [This is because we didnot backport 5a685cd94b21 and 6df7f764cd3c.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/linux/skmsg.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h index a83885c5bb86..9bd49d9539e9 100644 --- a/include/linux/skmsg.h +++ b/include/linux/skmsg.h @@ -476,10 +476,12 @@ static inline void sk_psock_put(struct sock *sk, struct sk_psock *psock) static inline void sk_psock_data_ready(struct sock *sk, struct sk_psock *psock) { + read_lock_bh(&sk->sk_callback_lock); if (psock->parser.enabled) psock->parser.saved_data_ready(sk); else sk->sk_data_ready(sk); + read_unlock_bh(&sk->sk_callback_lock); } static inline void psock_set_prog(struct bpf_prog **pprog, -- 2.34.1

2 1

[PATCH OLK-5.10] bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
by Liu Jian 12 Jun '24

12 Jun '24

From: Jason Xing <kernelxing(a)tencent.com> mainline inclusion from mainline-v6.9-rc7 commit 6648e613226e18897231ab5e42ffc29e63fa3365 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U1UZ CVE: CVE-2024-36938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0: sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 value changed: 0xffffffff83d7feb0 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer similarly due to no protection of saved_data_ready. Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses "write_lock_bh(&sk->sk_callback_lock);". To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Reported-by: syzbot+aa8c8ec2538929f18f2d(a)syzkaller.appspotmail.com Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: John Fastabend <john.fastabend(a)gmail.com> Closes: https://syzkaller.appspot.com/bug?extid=aa8c8ec2538929f18f2d Link: https://lore.kernel.org/all/20240329134037.92124-1-kerneljasonxing@gmail.com Link: https://lore.kernel.org/bpf/20240404021001.94815-1-kerneljasonxing@gmail.com Conflicts: include/linux/skmsg.h net/core/skmsg.c [This is because we didnot backport 5a685cd94b21 and 6df7f764cd3c.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/linux/skmsg.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h index 9c14c5fbb8c0..f9d8e8b1a4e8 100644 --- a/include/linux/skmsg.h +++ b/include/linux/skmsg.h @@ -477,10 +477,12 @@ static inline void sk_psock_put(struct sock *sk, struct sk_psock *psock) static inline void sk_psock_data_ready(struct sock *sk, struct sk_psock *psock) { + read_lock_bh(&sk->sk_callback_lock); if (psock->parser.enabled) psock->parser.saved_data_ready(sk); else sk->sk_data_ready(sk); + read_unlock_bh(&sk->sk_callback_lock); } static inline void psock_set_prog(struct bpf_prog **pprog, -- 2.34.1

2 1

[PATCH OLK-6.6] tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
by Cui GaoSheng 12 Jun '24

12 Jun '24

From: Daniel Starke <daniel.starke(a)siemens.com> mainline inclusion from mainline-v6.10-rc1 commit 47388e807f85948eefc403a8a5fdc5b406a65d5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TAHR CVE: CVE-2024-36016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size. Reported-by: j51569436(a)gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218708 Tested-by: j51569436(a)gmail.com Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Starke <daniel.starke(a)siemens.com> Link: https://lore.kernel.org/r/20240424054842.7741-1-daniel.starke@siemens.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/tty/n_gsm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 0ee7531c9201..f8858865c5bb 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2912,7 +2912,10 @@ static void gsm0_receive(struct gsm_mux *gsm, unsigned char c) break; case GSM_DATA: /* Data */ gsm->buf[gsm->count++] = c; - if (gsm->count == gsm->len) { + if (gsm->count >= MAX_MRU) { + gsm->bad_size++; + gsm->state = GSM_SEARCH; + } else if (gsm->count >= gsm->len) { /* Calculate final FCS for UI frames over all data */ if ((gsm->control & ~PF) != UIH) { gsm->fcs = gsm_fcs_add_block(gsm->fcs, gsm->buf, @@ -3025,7 +3028,7 @@ static void gsm1_receive(struct gsm_mux *gsm, unsigned char c) gsm->state = GSM_DATA; break; case GSM_DATA: /* Data */ - if (gsm->count > gsm->mru) { /* Allow one for the FCS */ + if (gsm->count > gsm->mru || gsm->count > MAX_MRU) { /* Allow one for the FCS */ gsm->state = GSM_OVERRUN; gsm->bad_size++; } else -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
by Cui GaoSheng 12 Jun '24

12 Jun '24

From: Daniel Starke <daniel.starke(a)siemens.com> mainline inclusion from mainline-v6.10-rc1 commit 47388e807f85948eefc403a8a5fdc5b406a65d5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TAHR CVE: CVE-2024-36016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size. Reported-by: j51569436(a)gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218708 Tested-by: j51569436(a)gmail.com Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Starke <daniel.starke(a)siemens.com> Link: https://lore.kernel.org/r/20240424054842.7741-1-daniel.starke@siemens.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/n_gsm.c [7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") has not been merged, context conflict] Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/tty/n_gsm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 6cd87e71fecc..594be57f44ec 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2015,8 +2015,12 @@ static void gsm0_receive(struct gsm_mux *gsm, unsigned char c) break; case GSM_DATA: /* Data */ gsm->buf[gsm->count++] = c; - if (gsm->count == gsm->len) + if (gsm->count >= MAX_MRU) { + gsm->bad_size++; + gsm->state = GSM_SEARCH; + } else if (gsm->count >= gsm->len) { gsm->state = GSM_FCS; + } break; case GSM_FCS: /* FCS follows the packet */ gsm->received_fcs = c; @@ -2109,7 +2113,7 @@ static void gsm1_receive(struct gsm_mux *gsm, unsigned char c) gsm->state = GSM_DATA; break; case GSM_DATA: /* Data */ - if (gsm->count > gsm->mru) { /* Allow one for the FCS */ + if (gsm->count > gsm->mru || gsm->count > MAX_MRU) { /* Allow one for the FCS */ gsm->state = GSM_OVERRUN; gsm->bad_size++; } else -- 2.34.1

2 1

[PATCH OLK-5.10] tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
by Cui GaoSheng 12 Jun '24

12 Jun '24

From: Daniel Starke <daniel.starke(a)siemens.com> mainline inclusion from mainline-v6.10-rc1 commit 47388e807f85948eefc403a8a5fdc5b406a65d5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TAHR CVE: CVE-2024-36016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size. Reported-by: j51569436(a)gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218708 Tested-by: j51569436(a)gmail.com Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Starke <daniel.starke(a)siemens.com> Link: https://lore.kernel.org/r/20240424054842.7741-1-daniel.starke@siemens.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/n_gsm.c [7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") has not been merged, context conflict] Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/tty/n_gsm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index c20f69a4c5e9..0a367fa23c27 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2082,8 +2082,12 @@ static void gsm0_receive(struct gsm_mux *gsm, unsigned char c) break; case GSM_DATA: /* Data */ gsm->buf[gsm->count++] = c; - if (gsm->count == gsm->len) + if (gsm->count >= MAX_MRU) { + gsm->bad_size++; + gsm->state = GSM_SEARCH; + } else if (gsm->count >= gsm->len) { gsm->state = GSM_FCS; + } break; case GSM_FCS: /* FCS follows the packet */ gsm->received_fcs = c; @@ -2176,7 +2180,7 @@ static void gsm1_receive(struct gsm_mux *gsm, unsigned char c) gsm->state = GSM_DATA; break; case GSM_DATA: /* Data */ - if (gsm->count > gsm->mru) { /* Allow one for the FCS */ + if (gsm->count > gsm->mru || gsm->count > MAX_MRU) { /* Allow one for the FCS */ gsm->state = GSM_OVERRUN; gsm->bad_size++; } else -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
by Cui GaoSheng 12 Jun '24

12 Jun '24

From: Daniel Starke <daniel.starke(a)siemens.com> mainline inclusion from mainline-v6.10-rc1 commit 47388e807f85948eefc403a8a5fdc5b406a65d5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TAHR CVE: CVE-2024-36016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size. Reported-by: j51569436(a)gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218708 Tested-by: j51569436(a)gmail.com Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Starke <daniel.starke(a)siemens.com> Link: https://lore.kernel.org/r/20240424054842.7741-1-daniel.starke@siemens.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/n_gsm.c [7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") has not been merged, context conflict] Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/tty/n_gsm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 05d9064b4ee7..52a2e613b59a 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1914,8 +1914,12 @@ static void gsm0_receive(struct gsm_mux *gsm, unsigned char c) break; case GSM_DATA: /* Data */ gsm->buf[gsm->count++] = c; - if (gsm->count == gsm->len) + if (gsm->count >= MAX_MRU) { + gsm->bad_size++; + gsm->state = GSM_SEARCH; + } else if (gsm->count >= gsm->len) { gsm->state = GSM_FCS; + } break; case GSM_FCS: /* FCS follows the packet */ gsm->received_fcs = c; @@ -1994,7 +1998,7 @@ static void gsm1_receive(struct gsm_mux *gsm, unsigned char c) gsm->state = GSM_DATA; break; case GSM_DATA: /* Data */ - if (gsm->count > gsm->mru) { /* Allow one for the FCS */ + if (gsm->count > gsm->mru || gsm->count > MAX_MRU) { /* Allow one for the FCS */ gsm->state = GSM_OVERRUN; gsm->bad_size++; } else -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] IB/hfi1: Restore allocated resources on failed copyout
by Zeng Heng 12 Jun '24

12 Jun '24

From: Dean Luick <dean.luick(a)cornelisnetworks.com> stable inclusion from stable-v5.10.168 commit 79b595d9591426156a9e0635a5b5115508a36fef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LR CVE: CVE-2023-52747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@a… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index 34ffca618427..499bfae098c2 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1345,12 +1345,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info, tidcnt); if (copy_to_user((void __user *)addr, &tinfo.tidcnt, sizeof(tinfo.tidcnt))) - return -EFAULT; + ret = -EFAULT; addr = arg + offsetof(struct hfi1_tid_info, length); - if (copy_to_user((void __user *)addr, &tinfo.length, + if (!ret && copy_to_user((void __user *)addr, &tinfo.length, sizeof(tinfo.length))) ret = -EFAULT; + + if (ret) + hfi1_user_exp_rcv_invalid(fd, &tinfo); } return ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] IB/hfi1: Restore allocated resources on failed copyout
by Zeng Heng 12 Jun '24

12 Jun '24

From: Dean Luick <dean.luick(a)cornelisnetworks.com> stable inclusion from stable-v5.10.168 commit 79b595d9591426156a9e0635a5b5115508a36fef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O7 CVE: CVE-2023-52747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@a… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index 34ffca618427..499bfae098c2 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1345,12 +1345,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info, tidcnt); if (copy_to_user((void __user *)addr, &tinfo.tidcnt, sizeof(tinfo.tidcnt))) - return -EFAULT; + ret = -EFAULT; addr = arg + offsetof(struct hfi1_tid_info, length); - if (copy_to_user((void __user *)addr, &tinfo.length, + if (!ret && copy_to_user((void __user *)addr, &tinfo.length, sizeof(tinfo.length))) ret = -EFAULT; + + if (ret) + hfi1_user_exp_rcv_invalid(fd, &tinfo); } return ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
by Zeng Heng 12 Jun '24

12 Jun '24

José Expósito (1): IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() Mike Marciniszyn (1): IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields drivers/infiniband/hw/qib/qib_user_sdma.c | 32 ++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
by Zhang Changzhong 12 Jun '24

12 Jun '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> stable inclusion from stable-v4.19.311 commit 96481624fb5a6319079fb5059e46dbce43a90186 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q98R CVE: CVE-2024-35828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5f0e4aede01cb01fa633171f0533affd25328c3a ] In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer(). Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240126075336.2825608-1-alexious@zju.edu.cn Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/wireless/marvell/libertas/cmd.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/marvell/libertas/cmd.c b/drivers/net/wireless/marvell/libertas/cmd.c index c1f4229..d1984f0 100644 --- a/drivers/net/wireless/marvell/libertas/cmd.c +++ b/drivers/net/wireless/marvell/libertas/cmd.c @@ -1132,7 +1132,7 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv) if (!cmdarray[i].cmdbuf) { lbs_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n"); ret = -1; - goto done; + goto free_cmd_array; } } @@ -1140,8 +1140,17 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv) init_waitqueue_head(&cmdarray[i].cmdwait_q); lbs_cleanup_and_insert_cmd(priv, &cmdarray[i]); } - ret = 0; + return 0; +free_cmd_array: + for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) { + if (cmdarray[i].cmdbuf) { + kfree(cmdarray[i].cmdbuf); + cmdarray[i].cmdbuf = NULL; + } + } + kfree(priv->cmd_array); + priv->cmd_array = NULL; done: return ret; } -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
by Zhang Changzhong 12 Jun '24

12 Jun '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> stable inclusion from stable-v5.10.214 commit f0dd27314c7afe34794c2aa19dd6f2d30eb23bc7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q98R CVE: CVE-2024-35828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5f0e4aede01cb01fa633171f0533affd25328c3a ] In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer(). Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240126075336.2825608-1-alexious@zju.edu.cn Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/wireless/marvell/libertas/cmd.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/marvell/libertas/cmd.c b/drivers/net/wireless/marvell/libertas/cmd.c index a4d9dd7..db9a852 100644 --- a/drivers/net/wireless/marvell/libertas/cmd.c +++ b/drivers/net/wireless/marvell/libertas/cmd.c @@ -1133,7 +1133,7 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv) if (!cmdarray[i].cmdbuf) { lbs_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n"); ret = -1; - goto done; + goto free_cmd_array; } } @@ -1141,8 +1141,17 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv) init_waitqueue_head(&cmdarray[i].cmdwait_q); lbs_cleanup_and_insert_cmd(priv, &cmdarray[i]); } - ret = 0; + return 0; +free_cmd_array: + for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) { + if (cmdarray[i].cmdbuf) { + kfree(cmdarray[i].cmdbuf); + cmdarray[i].cmdbuf = NULL; + } + } + kfree(priv->cmd_array); + priv->cmd_array = NULL; done: return ret; } -- 2.9.5

2 1

[PATCH OLK-5.10] wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
by Zhang Changzhong 12 Jun '24

12 Jun '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> stable inclusion from stable-v5.10.214 commit f0dd27314c7afe34794c2aa19dd6f2d30eb23bc7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q98R CVE: CVE-2024-35828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5f0e4aede01cb01fa633171f0533affd25328c3a ] In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer(). Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240126075336.2825608-1-alexious@zju.edu.cn Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/wireless/marvell/libertas/cmd.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/marvell/libertas/cmd.c b/drivers/net/wireless/marvell/libertas/cmd.c index a4d9dd7..db9a852 100644 --- a/drivers/net/wireless/marvell/libertas/cmd.c +++ b/drivers/net/wireless/marvell/libertas/cmd.c @@ -1133,7 +1133,7 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv) if (!cmdarray[i].cmdbuf) { lbs_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n"); ret = -1; - goto done; + goto free_cmd_array; } } @@ -1141,8 +1141,17 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv) init_waitqueue_head(&cmdarray[i].cmdwait_q); lbs_cleanup_and_insert_cmd(priv, &cmdarray[i]); } - ret = 0; + return 0; +free_cmd_array: + for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) { + if (cmdarray[i].cmdbuf) { + kfree(cmdarray[i].cmdbuf); + cmdarray[i].cmdbuf = NULL; + } + } + kfree(priv->cmd_array); + priv->cmd_array = NULL; done: return ret; } -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
by Zeng Heng 12 Jun '24

12 Jun '24

From: Mike Marciniszyn <mike.marciniszyn(a)cornelisnetworks.com> mainline inclusion from mainline-v5.15 commit d39bf40e55e666b5905fdbd46a0dced030ce87be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RD02 CVE: CVE-2021-47485 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Overflowing either addrlimit or bytes_togo can allow userspace to trigger a buffer overflow of kernel memory. Check for overflows in all the places doing math on user controlled buffers. Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters") Link: https://lore.kernel.org/r/20211012175519.7298.77738.stgit@awfm-01.cornelisn… Reported-by: Ilja Van Sprundel <ivansprundel(a)ioactive.com> Reviewed-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/qib/qib_user_sdma.c | 32 ++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c index 926f3c8eba69..5df039ff43c2 100644 --- a/drivers/infiniband/hw/qib/qib_user_sdma.c +++ b/drivers/infiniband/hw/qib/qib_user_sdma.c @@ -606,7 +606,7 @@ static int qib_user_sdma_coalesce(const struct qib_devdata *dd, /* * How many pages in this iovec element? */ -static int qib_user_sdma_num_pages(const struct iovec *iov) +static size_t qib_user_sdma_num_pages(const struct iovec *iov) { const unsigned long addr = (unsigned long) iov->iov_base; const unsigned long len = iov->iov_len; @@ -662,7 +662,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev, static int qib_user_sdma_pin_pages(const struct qib_devdata *dd, struct qib_user_sdma_queue *pq, struct qib_user_sdma_pkt *pkt, - unsigned long addr, int tlen, int npages) + unsigned long addr, int tlen, size_t npages) { struct page *pages[8]; int i, j; @@ -726,7 +726,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd, unsigned long idx; for (idx = 0; idx < niov; idx++) { - const int npages = qib_user_sdma_num_pages(iov + idx); + const size_t npages = qib_user_sdma_num_pages(iov + idx); const unsigned long addr = (unsigned long) iov[idx].iov_base; ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr, @@ -828,8 +828,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, unsigned pktnw; unsigned pktnwc; int nfrags = 0; - int npages = 0; - int bytes_togo = 0; + size_t npages = 0; + size_t bytes_togo = 0; int tiddma = 0; int cfur; @@ -889,7 +889,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, npages += qib_user_sdma_num_pages(&iov[idx]); - bytes_togo += slen; + if (check_add_overflow(bytes_togo, slen, &bytes_togo) || + bytes_togo > type_max(typeof(pkt->bytes_togo))) { + ret = -EINVAL; + goto free_pbc; + } pktnwc += slen >> 2; idx++; nfrags++; @@ -908,7 +912,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, } if (frag_size) { - int pktsize, tidsmsize, n; + size_t tidsmsize, n, pktsize, sz, addrlimit; n = npages*((2*PAGE_SIZE/frag_size)+1); pktsize = sizeof(*pkt) + sizeof(pkt->addr[0])*n; @@ -926,14 +930,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, else tidsmsize = 0; - pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL); + if (check_add_overflow(pktsize, tidsmsize, &sz)) { + ret = -EINVAL; + goto free_pbc; + } + pkt = kmalloc(sz, GFP_KERNEL); if (!pkt) { ret = -ENOMEM; goto free_pbc; } pkt->largepkt = 1; pkt->frag_size = frag_size; - pkt->addrlimit = n + ARRAY_SIZE(pkt->addr); + if (check_add_overflow(n, ARRAY_SIZE(pkt->addr), + &addrlimit) || + addrlimit > type_max(typeof(pkt->addrlimit))) { + ret = -EINVAL; + goto free_pbc; + } + pkt->addrlimit = addrlimit; if (tiddma) { char *tidsm = (char *)pkt + pktsize; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] misc/libmasm/module: Fix two use after free in ibmasm_init_one
by Zhang Changzhong 12 Jun '24

12 Jun '24

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v4.19.198 commit 481a76d4749ee3a27f902ba213fdcbb4bb39720e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RLTD CVE: CVE-2021-47334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7272b591c4cb9327c43443f67b8fbae7657dd9ae ] In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are allocated by input_allocate_device(), and assigned to sp->remote.mouse_dev and sp->remote.keybd_dev respectively. In the err_free_devices error branch of ibmasm_init_one, mouse_dev and keybd_dev are freed by input_free_device(), and return error. Then the execution runs into error_send_message error branch of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. My patch add a "error_init_remote" label to handle the error of ibmasm_init_remote_input_dev(), to avoid the uaf bugs. Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Link: https://lore.kernel.org/r/20210426170620.10546-1-lyl2019@mail.ustc.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/misc/ibmasm/module.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c index e914b8c..9f83441 100644 --- a/drivers/misc/ibmasm/module.c +++ b/drivers/misc/ibmasm/module.c @@ -125,7 +125,7 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id) result = ibmasm_init_remote_input_dev(sp); if (result) { dev_err(sp->dev, "Failed to initialize remote queue\n"); - goto error_send_message; + goto error_init_remote; } result = ibmasm_send_driver_vpd(sp); @@ -145,8 +145,9 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id) return 0; error_send_message: - disable_sp_interrupts(sp->base_address); ibmasm_free_remote_input_dev(sp); +error_init_remote: + disable_sp_interrupts(sp->base_address); free_irq(sp->irq, (void *)sp); error_request_irq: iounmap(sp->base_address); -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] IB/hfi1: Restore allocated resources on failed copyout
by Zeng Heng 12 Jun '24

12 Jun '24

From: Dean Luick <dean.luick(a)cornelisnetworks.com> stable inclusion from stable-v5.10.168 commit 79b595d9591426156a9e0635a5b5115508a36fef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O7 CVE: CVE-2023-52747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ] Fix a resource leak if an error occurs. Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") Signed-off-by: Dean Luick <dean.luick(a)cornelisnetworks.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@a… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index d84b1098762c..7828fb593120 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1359,12 +1359,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info, tidcnt); if (copy_to_user((void __user *)addr, &tinfo.tidcnt, sizeof(tinfo.tidcnt))) - return -EFAULT; + ret = -EFAULT; addr = arg + offsetof(struct hfi1_tid_info, length); - if (copy_to_user((void __user *)addr, &tinfo.length, + if (!ret && copy_to_user((void __user *)addr, &tinfo.length, sizeof(tinfo.length))) ret = -EFAULT; + + if (ret) + hfi1_user_exp_rcv_invalid(fd, &tinfo); } return ret; -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-36953
by Liu Shixin 12 Jun '24

12 Jun '24

Marc Zyngier (1): KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id Oliver Upton (1): KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() arch/arm64/kvm/vgic/vgic-kvm-device.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] drm/vc4: don't check if plane->state->fb == state->fb
by Liu Shixin 12 Jun '24

12 Jun '24

From: Maíra Canal <mcanal(a)igalia.com> mainline inclusion from mainline-v6.9-rc1 commit 5ee0d47dcf33efd8950b347dcf4d20bab12a3fa9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGM8 CVE: CVE-2024-35932 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently, when using non-blocking commits, we can see the following kernel warning: [ 110.908514] ------------[ cut here ]------------ [ 110.908529] refcount_t: underflow; use-after-free. [ 110.908620] WARNING: CPU: 0 PID: 1866 at lib/refcount.c:87 refcount_dec_not_one+0xb8/0xc0 [ 110.908664] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp vc4 brcmfmac hci_uart btbcm brcmutil bluetooth snd_soc_hdmi_codec cfg80211 cec drm_display_helper drm_dma_helper drm_kms_helper snd_soc_core snd_compress snd_pcm_dmaengine fb_sys_fops sysimgblt syscopyarea sysfillrect raspberrypi_hwmon ecdh_generic ecc rfkill libaes i2c_bcm2835 binfmt_misc joydev snd_bcm2835(C) bcm2835_codec(C) bcm2835_isp(C) v4l2_mem2mem videobuf2_dma_contig snd_pcm bcm2835_v4l2(C) raspberrypi_gpiomem bcm2835_mmal_vchiq(C) videobuf2_v4l2 snd_timer videobuf2_vmalloc videobuf2_memops videobuf2_common snd videodev vc_sm_cma(C) mc hid_logitech_dj uio_pdrv_genirq uio i2c_dev drm fuse dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [ 110.909086] CPU: 0 PID: 1866 Comm: kodi.bin Tainted: G C 6.1.66-v8+ #32 [ 110.909104] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 110.909114] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 110.909132] pc : refcount_dec_not_one+0xb8/0xc0 [ 110.909152] lr : refcount_dec_not_one+0xb4/0xc0 [ 110.909170] sp : ffffffc00913b9c0 [ 110.909177] x29: ffffffc00913b9c0 x28: 000000556969bbb0 x27: 000000556990df60 [ 110.909205] x26: 0000000000000002 x25: 0000000000000004 x24: ffffff8004448480 [ 110.909230] x23: ffffff800570b500 x22: ffffff802e03a7bc x21: ffffffecfca68c78 [ 110.909257] x20: ffffff8002b42000 x19: ffffff802e03a600 x18: 0000000000000000 [ 110.909283] x17: 0000000000000011 x16: ffffffffffffffff x15: 0000000000000004 [ 110.909308] x14: 0000000000000fff x13: ffffffed577e47e0 x12: 0000000000000003 [ 110.909333] x11: 0000000000000000 x10: 0000000000000027 x9 : c912d0d083728c00 [ 110.909359] x8 : c912d0d083728c00 x7 : 65646e75203a745f x6 : 746e756f63666572 [ 110.909384] x5 : ffffffed579f62ee x4 : ffffffed579eb01e x3 : 0000000000000000 [ 110.909409] x2 : 0000000000000000 x1 : ffffffc00913b750 x0 : 0000000000000001 [ 110.909434] Call trace: [ 110.909441] refcount_dec_not_one+0xb8/0xc0 [ 110.909461] vc4_bo_dec_usecnt+0x4c/0x1b0 [vc4] [ 110.909903] vc4_cleanup_fb+0x44/0x50 [vc4] [ 110.910315] drm_atomic_helper_cleanup_planes+0x88/0xa4 [drm_kms_helper] [ 110.910669] vc4_atomic_commit_tail+0x390/0x9dc [vc4] [ 110.911079] commit_tail+0xb0/0x164 [drm_kms_helper] [ 110.911397] drm_atomic_helper_commit+0x1d0/0x1f0 [drm_kms_helper] [ 110.911716] drm_atomic_commit+0xb0/0xdc [drm] [ 110.912569] drm_mode_atomic_ioctl+0x348/0x4b8 [drm] [ 110.913330] drm_ioctl_kernel+0xec/0x15c [drm] [ 110.914091] drm_ioctl+0x24c/0x3b0 [drm] [ 110.914850] __arm64_sys_ioctl+0x9c/0xd4 [ 110.914873] invoke_syscall+0x4c/0x114 [ 110.914897] el0_svc_common+0xd0/0x118 [ 110.914917] do_el0_svc+0x38/0xd0 [ 110.914936] el0_svc+0x30/0x8c [ 110.914958] el0t_64_sync_handler+0x84/0xf0 [ 110.914979] el0t_64_sync+0x18c/0x190 [ 110.914996] ---[ end trace 0000000000000000 ]--- This happens because, although `prepare_fb` and `cleanup_fb` are perfectly balanced, we cannot guarantee consistency in the check plane->state->fb == state->fb. This means that sometimes we can increase the refcount in `prepare_fb` and don't decrease it in `cleanup_fb`. The opposite can also be true. In fact, the struct drm_plane .state shouldn't be accessed directly but instead, the `drm_atomic_get_new_plane_state()` helper function should be used. So, we could stick to this check, but using `drm_atomic_get_new_plane_state()`. But actually, this check is not really needed. We can increase and decrease the refcount symmetrically without problems. This is going to make the code more simple and consistent. Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Acked-by: Maxime Ripard <mripard(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240105175908.242000-1-mcana… Conflicts: drivers/gpu/drm/vc4/vc4_plane.c [ Context conflicts. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/gpu/drm/vc4/vc4_plane.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c index 2e03c16c60bb..3915c78c57b9 100644 --- a/drivers/gpu/drm/vc4/vc4_plane.c +++ b/drivers/gpu/drm/vc4/vc4_plane.c @@ -1250,9 +1250,6 @@ static int vc4_prepare_fb(struct drm_plane *plane, drm_gem_fb_prepare_fb(plane, state); - if (plane->state->fb == state->fb) - return 0; - ret = vc4_bo_inc_usecnt(bo); if (ret) return ret; @@ -1265,7 +1262,7 @@ static void vc4_cleanup_fb(struct drm_plane *plane, { struct vc4_bo *bo; - if (plane->state->fb == state->fb || !state->fb) + if (!state->fb) return; bo = to_vc4_bo(&drm_fb_cma_get_gem_obj(state->fb, 0)->base); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: encx24j600: check error in devm_regmap_init_encx24j600
by Jinjiang Tu 12 Jun '24

12 Jun '24

From: Nanyong Sun <sunnanyong(a)huawei.com> stable inclusion from stable-v4.19.213 commit 5e5494e6fc8a29c927e0478bec4a078a40da8901 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RBIY CVE: CVE-2021-47440 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f03dca0c9e2297c84a018e306f8a9cd534ee4287 upstream. devm_regmap_init may return error which caused by like out of memory, this will results in null pointer dereference later when reading or writing register: general protection fault in encx24j600_spi_probe KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] CPU: 0 PID: 286 Comm: spi-encx24j600- Not tainted 5.15.0-rc2-00142-g9978db750e31-dirty #11 9c53a778c1306b1b02359f3c2bbedc0222cba652 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:regcache_cache_bypass drivers/base/regmap/regcache.c:540 Code: 54 41 89 f4 55 53 48 89 fb 48 83 ec 08 e8 26 94 a8 fe 48 8d bb a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 4a 03 00 00 4c 8d ab b0 00 00 00 48 8b ab a0 00 RSP: 0018:ffffc900010476b8 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 0000000000000000 RDX: 0000000000000012 RSI: ffff888002de0000 RDI: 0000000000000094 RBP: ffff888013c9a000 R08: 0000000000000000 R09: fffffbfff3f9cc6a R10: ffffc900010476e8 R11: fffffbfff3f9cc69 R12: 0000000000000001 R13: 000000000000000a R14: ffff888013c9af54 R15: ffff888013c9ad08 FS: 00007ffa984ab580(0000) GS:ffff88801fe00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a6384136c8 CR3: 000000003bbe6003 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: encx24j600_spi_probe drivers/net/ethernet/microchip/encx24j600.c:459 spi_probe drivers/spi/spi.c:397 really_probe drivers/base/dd.c:517 __driver_probe_device drivers/base/dd.c:751 driver_probe_device drivers/base/dd.c:782 __device_attach_driver drivers/base/dd.c:899 bus_for_each_drv drivers/base/bus.c:427 __device_attach drivers/base/dd.c:971 bus_probe_device drivers/base/bus.c:487 device_add drivers/base/core.c:3364 __spi_add_device drivers/spi/spi.c:599 spi_add_device drivers/spi/spi.c:641 spi_new_device drivers/spi/spi.c:717 new_device_store+0x18c/0x1f1 [spi_stub 4e02719357f1ff33f5a43d00630982840568e85e] dev_attr_store drivers/base/core.c:2074 sysfs_kf_write fs/sysfs/file.c:139 kernfs_fop_write_iter fs/kernfs/file.c:300 new_sync_write fs/read_write.c:508 (discriminator 4) vfs_write fs/read_write.c:594 ksys_write fs/read_write.c:648 do_syscall_64 arch/x86/entry/common.c:50 entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:113 Add error check in devm_regmap_init_encx24j600 to avoid this situation. Fixes: 04fbfce7a222 ("net: Microchip encx24j600 driver") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Nanyong Sun <sunnanyong(a)huawei.com> Link: https://lore.kernel.org/r/20211012125901.3623144-1-sunnanyong@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/net/ethernet/microchip/encx24j600-regmap.c | 10 ++++++++-- drivers/net/ethernet/microchip/encx24j600.c | 5 ++++- drivers/net/ethernet/microchip/encx24j600_hw.h | 4 ++-- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/microchip/encx24j600-regmap.c b/drivers/net/ethernet/microchip/encx24j600-regmap.c index 44bb04d4d21b..46181559d1f1 100644 --- a/drivers/net/ethernet/microchip/encx24j600-regmap.c +++ b/drivers/net/ethernet/microchip/encx24j600-regmap.c @@ -505,13 +505,19 @@ static struct regmap_bus phymap_encx24j600 = { .reg_read = regmap_encx24j600_phy_reg_read, }; -void devm_regmap_init_encx24j600(struct device *dev, - struct encx24j600_context *ctx) +int devm_regmap_init_encx24j600(struct device *dev, + struct encx24j600_context *ctx) { mutex_init(&ctx->mutex); regcfg.lock_arg = ctx; ctx->regmap = devm_regmap_init(dev, &regmap_encx24j600, ctx, &regcfg); + if (IS_ERR(ctx->regmap)) + return PTR_ERR(ctx->regmap); ctx->phymap = devm_regmap_init(dev, &phymap_encx24j600, ctx, &phycfg); + if (IS_ERR(ctx->phymap)) + return PTR_ERR(ctx->phymap); + + return 0; } EXPORT_SYMBOL_GPL(devm_regmap_init_encx24j600); diff --git a/drivers/net/ethernet/microchip/encx24j600.c b/drivers/net/ethernet/microchip/encx24j600.c index f831238d9793..965814a343b4 100644 --- a/drivers/net/ethernet/microchip/encx24j600.c +++ b/drivers/net/ethernet/microchip/encx24j600.c @@ -1032,10 +1032,13 @@ static int encx24j600_spi_probe(struct spi_device *spi) priv->speed = SPEED_100; priv->ctx.spi = spi; - devm_regmap_init_encx24j600(&spi->dev, &priv->ctx); ndev->irq = spi->irq; ndev->netdev_ops = &encx24j600_netdev_ops; + ret = devm_regmap_init_encx24j600(&spi->dev, &priv->ctx); + if (ret) + goto out_free; + mutex_init(&priv->lock); /* Reset device and check if it is connected */ diff --git a/drivers/net/ethernet/microchip/encx24j600_hw.h b/drivers/net/ethernet/microchip/encx24j600_hw.h index f604a260ede7..711147a159aa 100644 --- a/drivers/net/ethernet/microchip/encx24j600_hw.h +++ b/drivers/net/ethernet/microchip/encx24j600_hw.h @@ -15,8 +15,8 @@ struct encx24j600_context { int bank; }; -void devm_regmap_init_encx24j600(struct device *dev, - struct encx24j600_context *ctx); +int devm_regmap_init_encx24j600(struct device *dev, + struct encx24j600_context *ctx); /* Single-byte instructions */ #define BANK_SELECT(bank) (0xC0 | ((bank & (BANK_MASK >> BANK_SHIFT)) << 1)) -- 2.25.1

2 1

[PATCH OLK-5.10] tee: optee: Fix kernel panic caused by incorrect error handling
by dinglongwei 12 Jun '24

12 Jun '24

From: Sumit Garg <sumit.garg(a)linaro.org> stable inclusion from stable-v5.10.215 commit bc40ded92af55760d12bec8222d4108de725dbe4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8ZF CVE: CVE-2024-35785 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 95915ba4b987cf2b222b0f251280228a1ff977ac upstream. The error path while failing to register devices on the TEE bus has a bug leading to kernel panic as follows: [ 15.398930] Unable to handle kernel paging request at virtual address ffff07ed00626d7c [ 15.406913] Mem abort info: [ 15.409722] ESR = 0x0000000096000005 [ 15.413490] EC = 0x25: DABT (current EL), IL = 32 bits [ 15.418814] SET = 0, FnV = 0 [ 15.421878] EA = 0, S1PTW = 0 [ 15.425031] FSC = 0x05: level 1 translation fault [ 15.429922] Data abort info: [ 15.432813] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 15.438310] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 15.443372] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 15.448697] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000d9e3e000 [ 15.455413] [ffff07ed00626d7c] pgd=1800000bffdf9003, p4d=1800000bffdf9003, pud=0000000000000000 [ 15.464146] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Commit 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration") lead to the introduction of this bug. So fix it appropriately. Reported-by: Mikko Rapeli <mikko.rapeli(a)linaro.org> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218542 Fixes: 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration") Cc: stable(a)vger.kernel.org Signed-off-by: Sumit Garg <sumit.garg(a)linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/tee/optee/device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/tee/optee/device.c b/drivers/tee/optee/device.c index 3cb39f02fae0..26683697ca30 100644 --- a/drivers/tee/optee/device.c +++ b/drivers/tee/optee/device.c @@ -90,13 +90,14 @@ static int optee_register_device(const uuid_t *device_uuid, u32 func) if (rc) { pr_err("device registration failed, err: %d\n", rc); put_device(&optee_device->dev); + return rc; } if (func == PTA_CMD_GET_DEVICES_SUPP) device_create_file(&optee_device->dev, &dev_attr_need_supplicant); - return rc; + return 0; } static int __optee_enumerate_devices(u32 func) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] fix CVE-2024-35839
by Zhengchao Shao 12 Jun '24

12 Jun '24

fix CVE-2024-35839 Pavel Tikhomirov (3): netfilter: nfnetlink_log: use proper helper for fetching physinif netfilter: propagate net to nf_bridge_get_physindev netfilter: bridge: replace physindev with physinif in nf_bridge_info include/linux/netfilter_bridge.h | 6 ++-- include/linux/skbuff.h | 2 +- include/net/netfilter/nf_log.h | 2 +- net/bridge/br_netfilter_hooks.c | 41 +++++++++++++++++----- net/bridge/br_netfilter_ipv6.c | 14 +++++--- net/ipv4/netfilter/nf_log_arp.c | 2 +- net/ipv4/netfilter/nf_log_ipv4.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 9 +++-- net/ipv6/netfilter/nf_log_ipv6.c | 2 +- net/ipv6/netfilter/nf_reject_ipv6.c | 11 ++++-- net/netfilter/ipset/ip_set_hash_netiface.c | 8 ++--- net/netfilter/nf_log_common.c | 5 +-- net/netfilter/nf_queue.c | 2 +- net/netfilter/nfnetlink_log.c | 8 ++--- net/netfilter/xt_physdev.c | 2 +- 15 files changed, 78 insertions(+), 38 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] tipc: fix a possible memleak in tipc_buf_append
by Zhengchao Shao 12 Jun '24

12 Jun '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v5.10.217 commit adbce6d20da6254c86425a8d4359b221b5ccbccd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9US4T CVE: CVE-2024-36954 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97bf6f81b29a8efaf5d0983251a7450e5794370d ] __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path. Fixes: b7df21cf1b79 ("tipc: skb_linearize the head skb when reassembling msgs") Reported-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Tung Nguyen <tung.q.nguyen(a)dektech.com.au> Link: https://lore.kernel.org/r/90710748c29a1521efac4f75ea01b3b7e61414cf.17144858… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/tipc/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 91dcf648d32b..b2b102d6f581 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -148,9 +148,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - *buf = NULL; if (skb_has_frag_list(frag) && __skb_linearize(frag)) goto err; + *buf = NULL; frag = skb_unshare(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] media: tc358743: register v4l2 async device only after successful setup
by liwei 12 Jun '24

12 Jun '24

From: Alexander Stein <alexander.stein(a)ew.tq-group.com> mainline inclusion from mainline-v6.9-rc1 commit 87399f1ff92203d65f1febf5919429f4bb613a02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q93E CVE: CVE-2024-35830 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access. Signed-off-by: Alexander Stein <alexander.stein(a)ew.tq-group.com> Reviewed-by: Robert Foss <rfoss(a)kernel.org> Fixes: 4c5211a10039 ("[media] tc358743: register v4l2 asynchronous subdevice") Signed-off-by: Robert Foss <rfoss(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240110090111.458115-1-alexa… Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/media/i2c/tc358743.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c index e4c0a27b636a..1b88388b7d02 100644 --- a/drivers/media/i2c/tc358743.c +++ b/drivers/media/i2c/tc358743.c @@ -2104,9 +2104,6 @@ static int tc358743_probe(struct i2c_client *client, state->mbus_fmt_code = MEDIA_BUS_FMT_RGB888_1X24; sd->dev = &client->dev; - err = v4l2_async_register_subdev(sd); - if (err < 0) - goto err_hdl; mutex_init(&state->confctl_mutex); @@ -2164,6 +2161,10 @@ static int tc358743_probe(struct i2c_client *client, if (err) goto err_work_queues; + err = v4l2_async_register_subdev(sd); + if (err < 0) + goto err_work_queues; + v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name, client->addr << 1, client->adapter->name); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
by liwei 12 Jun '24

12 Jun '24

From: Saurav Kashyap <skashyap(a)marvell.com> mainline inclusion from mainline-v6.9-rc2 commit c214ed2a4dda35b308b0b28eed804d7ae66401f9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U91D CVE: CVE-2024-36919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload and upload calls are sequential, hence lock is not required. This will suppress following BUG_ON(): [ 449.843143] ------------[ cut here ]------------ [ 449.848302] kernel BUG at mm/vmalloc.c:2727! [ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1 Rebooting. [ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016 [ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc] [ 449.882910] RIP: 0010:vunmap+0x2e/0x30 [ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41 [ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206 [ 449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005 [ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000 [ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf [ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000 [ 449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0 [ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000 [ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0 [ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 449.993028] Call Trace: [ 449.995756] __iommu_dma_free+0x96/0x100 [ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc] [ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc] [ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc] [ 450.018136] fc_rport_work+0x103/0x5b0 [libfc] [ 450.023103] process_one_work+0x1e8/0x3c0 [ 450.027581] worker_thread+0x50/0x3b0 [ 450.031669] ? rescuer_thread+0x370/0x370 [ 450.036143] kthread+0x149/0x170 [ 450.039744] ? set_kthread_struct+0x40/0x40 [ 450.044411] ret_from_fork+0x22/0x30 [ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls [ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler [ 450.159753] ---[ end trace 712de2c57c64abc8 ]--- Reported-by: Guangwu Zhang <guazhang(a)redhat.com> Signed-off-by: Saurav Kashyap <skashyap(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240315071427.31842-1-skashyap@marvell.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/scsi/bnx2fc/bnx2fc_tgt.c b/drivers/scsi/bnx2fc/bnx2fc_tgt.c index e3d1c7c440c8..c7d6842b293d 100644 --- a/drivers/scsi/bnx2fc/bnx2fc_tgt.c +++ b/drivers/scsi/bnx2fc/bnx2fc_tgt.c @@ -834,7 +834,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, BNX2FC_TGT_DBG(tgt, "Freeing up session resources\n"); - spin_lock_bh(&tgt->cq_lock); ctx_base_ptr = tgt->ctx_base; tgt->ctx_base = NULL; @@ -890,7 +889,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, tgt->sq, tgt->sq_dma); tgt->sq = NULL; } - spin_unlock_bh(&tgt->cq_lock); if (ctx_base_ptr) iounmap(ctx_base_ptr); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
by liwei 12 Jun '24

12 Jun '24

From: "Gustavo A. R. Silva" <gustavoars(a)kernel.org> mainline inclusion from mainline-v5.14-rc3 commit 8d4abca95ecc82fc8c41912fa0085281f19cc29f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4JV CVE: CVE-2021-47288 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix an 11-year old bug in ngene_command_config_free_buf() while addressing the following warnings caught with -Warray-bounds: arch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] The problem is that the original code is trying to copy 6 bytes of data into a one-byte size member _config_ of the wrong structue FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header _hdr_. Also, the name of the function ngene_command_config_free_buf() suggests that the actual intention is to ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function ngene_command_config_buf(), above). Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy(). This also helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy(). Link: https://github.com/KSPP/linux/issues/109 Fixes: dae52d009fc9 ("V4L/DVB: ngene: Initial check-in") Cc: stable(a)vger.kernel.org Reported-by: kernel test robot <lkp(a)intel.com> Reviewed-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/linux-hardening/20210420001631.GA45456@embeddedor/ Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/media/pci/ngene/ngene-core.c | 2 +- drivers/media/pci/ngene/ngene.h | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/media/pci/ngene/ngene-core.c b/drivers/media/pci/ngene/ngene-core.c index 25f16833a475..aa60559bbbb4 100644 --- a/drivers/media/pci/ngene/ngene-core.c +++ b/drivers/media/pci/ngene/ngene-core.c @@ -398,7 +398,7 @@ static int ngene_command_config_free_buf(struct ngene *dev, u8 *config) com.cmd.hdr.Opcode = CMD_CONFIGURE_FREE_BUFFER; com.cmd.hdr.Length = 6; - memcpy(&com.cmd.ConfigureBuffers.config, config, 6); + memcpy(&com.cmd.ConfigureFreeBuffers.config, config, 6); com.in_len = 6; com.out_len = 0; diff --git a/drivers/media/pci/ngene/ngene.h b/drivers/media/pci/ngene/ngene.h index 01d9f1b58fcb..9728bce1ea1c 100644 --- a/drivers/media/pci/ngene/ngene.h +++ b/drivers/media/pci/ngene/ngene.h @@ -419,12 +419,14 @@ enum _BUFFER_CONFIGS { struct FW_CONFIGURE_FREE_BUFFERS { struct FW_HEADER hdr; - u8 UVI1_BufferLength; - u8 UVI2_BufferLength; - u8 TVO_BufferLength; - u8 AUD1_BufferLength; - u8 AUD2_BufferLength; - u8 TVA_BufferLength; + struct { + u8 UVI1_BufferLength; + u8 UVI2_BufferLength; + u8 TVO_BufferLength; + u8 AUD1_BufferLength; + u8 AUD2_BufferLength; + u8 TVA_BufferLength; + } __packed config; } __attribute__ ((__packed__)); struct FW_CONFIGURE_UART { -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] media: tc358743: register v4l2 async device only after successful setup
by liwei 12 Jun '24

12 Jun '24

From: Alexander Stein <alexander.stein(a)ew.tq-group.com> mainline inclusion from mainline-v6.9-rc1 commit 87399f1ff92203d65f1febf5919429f4bb613a02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q93E CVE: CVE-2024-35830 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access. Signed-off-by: Alexander Stein <alexander.stein(a)ew.tq-group.com> Reviewed-by: Robert Foss <rfoss(a)kernel.org> Fixes: 4c5211a10039 ("[media] tc358743: register v4l2 asynchronous subdevice") Signed-off-by: Robert Foss <rfoss(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240110090111.458115-1-alexa… Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/media/i2c/tc358743.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c index f21da11caf22..8bcb4b354c89 100644 --- a/drivers/media/i2c/tc358743.c +++ b/drivers/media/i2c/tc358743.c @@ -2108,9 +2108,6 @@ static int tc358743_probe(struct i2c_client *client) state->mbus_fmt_code = MEDIA_BUS_FMT_RGB888_1X24; sd->dev = &client->dev; - err = v4l2_async_register_subdev(sd); - if (err < 0) - goto err_hdl; mutex_init(&state->confctl_mutex); @@ -2168,6 +2165,10 @@ static int tc358743_probe(struct i2c_client *client) if (err) goto err_work_queues; + err = v4l2_async_register_subdev(sd); + if (err < 0) + goto err_work_queues; + v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name, client->addr << 1, client->adapter->name); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
by liwei 12 Jun '24

12 Jun '24

From: Saurav Kashyap <skashyap(a)marvell.com> mainline inclusion from mainline-v6.9-rc2 commit c214ed2a4dda35b308b0b28eed804d7ae66401f9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U91D CVE: CVE-2024-36919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload and upload calls are sequential, hence lock is not required. This will suppress following BUG_ON(): [ 449.843143] ------------[ cut here ]------------ [ 449.848302] kernel BUG at mm/vmalloc.c:2727! [ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1 Rebooting. [ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016 [ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc] [ 449.882910] RIP: 0010:vunmap+0x2e/0x30 [ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41 [ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206 [ 449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005 [ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000 [ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf [ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000 [ 449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0 [ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000 [ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0 [ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 449.993028] Call Trace: [ 449.995756] __iommu_dma_free+0x96/0x100 [ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc] [ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc] [ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc] [ 450.018136] fc_rport_work+0x103/0x5b0 [libfc] [ 450.023103] process_one_work+0x1e8/0x3c0 [ 450.027581] worker_thread+0x50/0x3b0 [ 450.031669] ? rescuer_thread+0x370/0x370 [ 450.036143] kthread+0x149/0x170 [ 450.039744] ? set_kthread_struct+0x40/0x40 [ 450.044411] ret_from_fork+0x22/0x30 [ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls [ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler [ 450.159753] ---[ end trace 712de2c57c64abc8 ]--- Reported-by: Guangwu Zhang <guazhang(a)redhat.com> Signed-off-by: Saurav Kashyap <skashyap(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240315071427.31842-1-skashyap@marvell.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/scsi/bnx2fc/bnx2fc_tgt.c b/drivers/scsi/bnx2fc/bnx2fc_tgt.c index a3e2a38aabf2..283df0a9da16 100644 --- a/drivers/scsi/bnx2fc/bnx2fc_tgt.c +++ b/drivers/scsi/bnx2fc/bnx2fc_tgt.c @@ -833,7 +833,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, BNX2FC_TGT_DBG(tgt, "Freeing up session resources\n"); - spin_lock_bh(&tgt->cq_lock); ctx_base_ptr = tgt->ctx_base; tgt->ctx_base = NULL; @@ -889,7 +888,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, tgt->sq, tgt->sq_dma); tgt->sq = NULL; } - spin_unlock_bh(&tgt->cq_lock); if (ctx_base_ptr) iounmap(ctx_base_ptr); -- 2.25.1

2 1

[PATCH OLK-5.10] media: tc358743: register v4l2 async device only after successful setup
by liwei 12 Jun '24

12 Jun '24

From: Alexander Stein <alexander.stein(a)ew.tq-group.com> mainline inclusion from mainline-v6.9-rc1 commit 87399f1ff92203d65f1febf5919429f4bb613a02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q93E CVE: CVE-2024-35830 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access. Signed-off-by: Alexander Stein <alexander.stein(a)ew.tq-group.com> Reviewed-by: Robert Foss <rfoss(a)kernel.org> Fixes: 4c5211a10039 ("[media] tc358743: register v4l2 asynchronous subdevice") Signed-off-by: Robert Foss <rfoss(a)kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240110090111.458115-1-alexa… Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/media/i2c/tc358743.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c index f21da11caf22..8bcb4b354c89 100644 --- a/drivers/media/i2c/tc358743.c +++ b/drivers/media/i2c/tc358743.c @@ -2108,9 +2108,6 @@ static int tc358743_probe(struct i2c_client *client) state->mbus_fmt_code = MEDIA_BUS_FMT_RGB888_1X24; sd->dev = &client->dev; - err = v4l2_async_register_subdev(sd); - if (err < 0) - goto err_hdl; mutex_init(&state->confctl_mutex); @@ -2168,6 +2165,10 @@ static int tc358743_probe(struct i2c_client *client) if (err) goto err_work_queues; + err = v4l2_async_register_subdev(sd); + if (err < 0) + goto err_work_queues; + v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name, client->addr << 1, client->adapter->name); -- 2.25.1

2 1

[PATCH OLK-5.10] scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
by liwei 12 Jun '24

12 Jun '24

From: Saurav Kashyap <skashyap(a)marvell.com> mainline inclusion from mainline-v6.9-rc2 commit c214ed2a4dda35b308b0b28eed804d7ae66401f9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U91D CVE: CVE-2024-36919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload and upload calls are sequential, hence lock is not required. This will suppress following BUG_ON(): [ 449.843143] ------------[ cut here ]------------ [ 449.848302] kernel BUG at mm/vmalloc.c:2727! [ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1 Rebooting. [ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016 [ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc] [ 449.882910] RIP: 0010:vunmap+0x2e/0x30 [ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41 [ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206 [ 449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005 [ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000 [ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf [ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000 [ 449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0 [ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000 [ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0 [ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 449.993028] Call Trace: [ 449.995756] __iommu_dma_free+0x96/0x100 [ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc] [ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc] [ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc] [ 450.018136] fc_rport_work+0x103/0x5b0 [libfc] [ 450.023103] process_one_work+0x1e8/0x3c0 [ 450.027581] worker_thread+0x50/0x3b0 [ 450.031669] ? rescuer_thread+0x370/0x370 [ 450.036143] kthread+0x149/0x170 [ 450.039744] ? set_kthread_struct+0x40/0x40 [ 450.044411] ret_from_fork+0x22/0x30 [ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls [ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler [ 450.159753] ---[ end trace 712de2c57c64abc8 ]--- Reported-by: Guangwu Zhang <guazhang(a)redhat.com> Signed-off-by: Saurav Kashyap <skashyap(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240315071427.31842-1-skashyap@marvell.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/scsi/bnx2fc/bnx2fc_tgt.c b/drivers/scsi/bnx2fc/bnx2fc_tgt.c index a3e2a38aabf2..283df0a9da16 100644 --- a/drivers/scsi/bnx2fc/bnx2fc_tgt.c +++ b/drivers/scsi/bnx2fc/bnx2fc_tgt.c @@ -833,7 +833,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, BNX2FC_TGT_DBG(tgt, "Freeing up session resources\n"); - spin_lock_bh(&tgt->cq_lock); ctx_base_ptr = tgt->ctx_base; tgt->ctx_base = NULL; @@ -889,7 +888,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, tgt->sq, tgt->sq_dma); tgt->sq = NULL; } - spin_unlock_bh(&tgt->cq_lock); if (ctx_base_ptr) iounmap(ctx_base_ptr); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] i2c: acpi: fix resource leak in reconfiguration device addition
by Zeng Heng 12 Jun '24

12 Jun '24

From: Jamie Iles <quic_jiles(a)quicinc.com> mainline inclusion from mainline-v5.15-rc5 commit 6558b646ce1c2a872fe1c2c7cb116f05a2c1950f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O7 CVE: CVE-2021-47425 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------- acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a reference on the adapter which is never released which will result in a reference count leak and render the adapter unremovable. Make sure to put the adapter after creating the client in the same manner that we do for OF. Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications") Signed-off-by: Jamie Iles <quic_jiles(a)quicinc.com> Acked-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> [wsa: fixed title] Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/i2c/i2c-core-acpi.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c index 559c3b1284d7..2db4c49bee77 100644 --- a/drivers/i2c/i2c-core-acpi.c +++ b/drivers/i2c/i2c-core-acpi.c @@ -377,6 +377,7 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, break; i2c_acpi_register_device(adapter, adev, &info); + put_device(&adapter->dev); break; case ACPI_RECONFIG_DEVICE_REMOVE: if (!acpi_device_enumerated(adev)) -- 2.25.1

2 1

[PATCH OLK-6.6] pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
by Zeng Heng 12 Jun '24

12 Jun '24

mainline inclusion from mainline-v6.9-rc7 commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U3W9 CVE: CVE-2024-36959 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------- If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly. Fixes: 91d5c5060ee2 ("pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map") Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <20240415105328.3651441-1-zengheng4(a)huawei.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/pinctrl/devicetree.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c index 6e0a40962f38..5ee746cb81f5 100644 --- a/drivers/pinctrl/devicetree.c +++ b/drivers/pinctrl/devicetree.c @@ -220,14 +220,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) for (state = 0; ; state++) { /* Retrieve the pinctrl-* property */ propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state); - if (!propname) - return -ENOMEM; + if (!propname) { + ret = -ENOMEM; + goto err; + } prop = of_find_property(np, propname, &size); kfree(propname); if (!prop) { if (state == 0) { - of_node_put(np); - return -ENODEV; + ret = -ENODEV; + goto err; } break; } -- 2.25.1

2 1

[PATCH OLK-5.10] pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
by Zeng Heng 12 Jun '24

12 Jun '24

mainline inclusion from mainline-v6.9-rc7 commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U3W9 CVE: CVE-2024-36959 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------- If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly. Fixes: 91d5c5060ee2 ("pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map") Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <20240415105328.3651441-1-zengheng4(a)huawei.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/pinctrl/devicetree.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c index eac55fee5281..0220228c5040 100644 --- a/drivers/pinctrl/devicetree.c +++ b/drivers/pinctrl/devicetree.c @@ -220,14 +220,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) for (state = 0; ; state++) { /* Retrieve the pinctrl-* property */ propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state); - if (!propname) - return -ENOMEM; + if (!propname) { + ret = -ENOMEM; + goto err; + } prop = of_find_property(np, propname, &size); kfree(propname); if (!prop) { if (state == 0) { - of_node_put(np); - return -ENODEV; + ret = -ENODEV; + goto err; } break; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
by Zeng Heng 12 Jun '24

12 Jun '24

mainline inclusion from mainline-v6.9-rc7 commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U3W9 CVE: CVE-2024-36959 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------- If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly. Fixes: 91d5c5060ee2 ("pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map") Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <20240415105328.3651441-1-zengheng4(a)huawei.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Conflicts: drivers/pinctrl/devicetree.c [Resolve conflicts due to several refactor patches not merged.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pinctrl/devicetree.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c index 177ee1136e34..01cc09e2bccb 100644 --- a/drivers/pinctrl/devicetree.c +++ b/drivers/pinctrl/devicetree.c @@ -235,12 +235,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) for (state = 0; ; state++) { /* Retrieve the pinctrl-* property */ propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state); + if (!propname) { + ret = -ENOMEM; + goto err; + } prop = of_find_property(np, propname, &size); kfree(propname); if (!prop) { if (state == 0) { - of_node_put(np); - return -ENODEV; + ret = -ENODEV; + goto err; } break; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
by Zeng Heng 12 Jun '24

12 Jun '24

mainline inclusion from mainline-v6.9-rc7 commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U3W9 CVE: CVE-2024-36959 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------- If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly. Fixes: 91d5c5060ee2 ("pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map") Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <20240415105328.3651441-1-zengheng4(a)huawei.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- drivers/pinctrl/devicetree.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c index 177ee1136e34..01cc09e2bccb 100644 --- a/drivers/pinctrl/devicetree.c +++ b/drivers/pinctrl/devicetree.c @@ -235,12 +235,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) for (state = 0; ; state++) { /* Retrieve the pinctrl-* property */ propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state); + if (!propname) { + ret = -ENOMEM; + goto err; + } prop = of_find_property(np, propname, &size); kfree(propname); if (!prop) { if (state == 0) { - of_node_put(np); - return -ENODEV; + ret = -ENODEV; + goto err; } break; } -- 2.25.1

2 1

[PATCH OLK-5.10 00/29] xfs: atomic writes for xfs
by Long Li 12 Jun '24

12 Jun '24

THis patch set support xfs atomic writes feature. Alan Adamson (1): nvme: Atomic write support Darrick J. Wong (3): fs: xfs: Introduce FORCEALIGN inode flag fs: xfs: Enable file data forcealign feature fs: xfs: Make file data allocations observe the 'forcealign' flag John Garry (14): block: Pass blk_queue_get_max_sectors() a request pointer block: Add core atomic write support block: Add fops atomic write support fs: xfs: Do not free EOF blocks for forcealign fs: iomap: Sub-extent zeroing fs: xfs: iomap: Sub-extent zeroing fs: Add FS_XFLAG_ATOMICWRITES flag fs: iomap: Atomic write support fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign fs: xfs: Support atomic write for statx fs: xfs: Validate atomic writes fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE xfs: Update xfs_is_falloc_aligned() mask for forcealign xfs: Only free full extents for forcealign Long Li (4): xfs: support atomic write ioctl xfs: atomic write file dio convert to mark IOCB_ATOMIC xfs: fix set xflags fail when inode has extent hit xfs: make bunmapi observe forcealigin Prasad Singamsetty (3): fs: Initial atomic write support fs: Add initial atomic write support info to statx block: Add atomic write support for statx Zhang Yi (4): math64: add rem_u64() to just return the remainder iomap: pass blocksize to iomap_truncate_page() xfs: refactor the truncating order xfs: correct the truncate blocksize of realtime inode Documentation/ABI/testing/sysfs-block | 52 +++++++++ block/blk-core.c | 23 +++- block/blk-merge.c | 95 +++++++++++++++- block/blk-settings.c | 94 +++++++++++++++ block/blk-sysfs.c | 33 ++++++ drivers/block/rnbd/rnbd-srv-dev.h | 3 +- drivers/nvme/host/core.c | 52 +++++++++ fs/aio.c | 8 +- fs/block_dev.c | 62 +++++++++- fs/iomap/buffered-io.c | 8 +- fs/iomap/direct-io.c | 33 ++++-- fs/read_write.c | 2 +- fs/stat.c | 46 ++++++++ fs/xfs/libxfs/xfs_bmap.c | 22 +++- fs/xfs/libxfs/xfs_format.h | 15 ++- fs/xfs/libxfs/xfs_inode_buf.c | 40 +++++++ fs/xfs/libxfs/xfs_inode_buf.h | 3 + fs/xfs/libxfs/xfs_sb.c | 4 + fs/xfs/xfs_bmap_util.c | 10 +- fs/xfs/xfs_file.c | 41 ++++++- fs/xfs/xfs_inode.c | 42 +++++++ fs/xfs/xfs_inode.h | 12 ++ fs/xfs/xfs_ioctl.c | 96 +++++++++++++++- fs/xfs/xfs_iomap.c | 19 +++- fs/xfs/xfs_iops.c | 158 ++++++++++++++++---------- fs/xfs/xfs_mount.h | 5 + fs/xfs/xfs_super.c | 9 ++ include/linux/blk_types.h | 7 ++ include/linux/blkdev.h | 82 ++++++++++++- include/linux/fs.h | 37 +++++- include/linux/iomap.h | 5 +- include/linux/math64.h | 24 ++++ include/linux/stat.h | 3 + include/uapi/linux/fs.h | 9 +- include/uapi/linux/stat.h | 10 +- io_uring/io_uring.c | 2 +- 36 files changed, 1064 insertions(+), 102 deletions(-) -- 2.31.1

2 30

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-36905
by Zhengchao Shao 12 Jun '24

12 Jun '24

fix CVE-2024-36905 Eric Dumazet (1): tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets Paolo Abeni (1): net: relax socket state check at accept time. net/ipv4/af_inet.c | 4 +++- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_input.c | 2 ++ net/ipv4/tcp_output.c | 4 +++- 4 files changed, 10 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
by Zhang Zekun 12 Jun '24

12 Jun '24

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v4.19.299 commit 1953e62366da5460dc712e045f94fb0d8918999d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFJQ CVE: CVE-2023-52875 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0d6e24b422a2166a9297a8286ff2e6ab9a5e8cd3 ] Add the check for the return value of mtk_alloc_clk_data() in order to avoid NULL pointer dereference. Fixes: e9862118272a ("clk: mediatek: Add MT2701 clock support") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Link: https://lore.kernel.org/r/20230901024658.23405-1-jiasheng@iscas.ac.cn Reviewed-by: Markus Schneider-Pargmann <msp(a)baylibre.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/clk/mediatek/clk-mt2701.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c index 4dda8988b2f0..00e52a94e34f 100644 --- a/drivers/clk/mediatek/clk-mt2701.c +++ b/drivers/clk/mediatek/clk-mt2701.c @@ -688,6 +688,8 @@ static int mtk_topckgen_init(struct platform_device *pdev) return PTR_ERR(base); clk_data = mtk_alloc_clk_data(CLK_TOP_NR); + if (!clk_data) + return -ENOMEM; mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks), clk_data); @@ -755,6 +757,8 @@ static void __init mtk_infrasys_init_early(struct device_node *node) if (!infra_clk_data) { infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR); + if (!infra_clk_data) + return; for (i = 0; i < CLK_INFRA_NR; i++) infra_clk_data->clks[i] = ERR_PTR(-EPROBE_DEFER); @@ -781,6 +785,8 @@ static int mtk_infrasys_init(struct platform_device *pdev) if (!infra_clk_data) { infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR); + if (!infra_clk_data) + return -ENOMEM; } else { for (i = 0; i < CLK_INFRA_NR; i++) { if (infra_clk_data->clks[i] == ERR_PTR(-EPROBE_DEFER)) @@ -909,6 +915,8 @@ static int mtk_pericfg_init(struct platform_device *pdev) return PTR_ERR(base); clk_data = mtk_alloc_clk_data(CLK_PERI_NR); + if (!clk_data) + return -ENOMEM; mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks), clk_data); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] i2c: core: Run atomic i2c xfer when !preemptible
by Kaixiong Yu 11 Jun '24

11 Jun '24

From: Benjamin Bara <benjamin.bara(a)skidata.com> stable inclusion from stable-v5.10.202 commit 25284c46b657f48c0f3880a2e0706c70d81182c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFEQ CVE: CVE-2023-52791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit aa49c90894d06e18a1ee7c095edbd2f37c232d02 upstream. Since bae1d3a05a8b, i2c transfers are non-atomic if preemption is disabled. However, non-atomic i2c transfers require preemption (e.g. in wait_for_completion() while waiting for the DMA). panic() calls preempt_disable_notrace() before calling emergency_restart(). Therefore, if an i2c device is used for the restart, the xfer should be atomic. This avoids warnings like: [ 12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0 [ 12.676926] Voluntary context switch within RCU read-side critical section! ... [ 12.742376] schedule_timeout from wait_for_completion_timeout+0x90/0x114 [ 12.749179] wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70 ... [ 12.994527] atomic_notifier_call_chain from machine_restart+0x34/0x58 [ 13.001050] machine_restart from panic+0x2a8/0x32c Use !preemptible() instead, which is basically the same check as pre-v5.2. Fixes: bae1d3a05a8b ("i2c: core: remove use of in_atomic()") Cc: stable(a)vger.kernel.org # v5.2+ Suggested-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Acked-by: Wolfram Sang <wsa(a)kernel.org> Reviewed-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Tested-by: Nishanth Menon <nm(a)ti.com> Signed-off-by: Benjamin Bara <benjamin.bara(a)skidata.com> Link: https://lore.kernel.org/r/20230327-tegra-pmic-reboot-v7-2-18699d5dcd76@skid… Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/i2c/i2c-core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core.h b/drivers/i2c/i2c-core.h index 8ce261167a2d..ea17f13b44c8 100644 --- a/drivers/i2c/i2c-core.h +++ b/drivers/i2c/i2c-core.h @@ -29,7 +29,7 @@ int i2c_dev_irq_from_resources(const struct resource *resources, */ static inline bool i2c_in_atomic_xfer_mode(void) { - return system_state > SYSTEM_RUNNING && irqs_disabled(); + return system_state > SYSTEM_RUNNING && !preemptible(); } static inline int __i2c_lock_bus_helper(struct i2c_adapter *adap) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: lock the inode in shared mode before starting fiemap
by Baokun Li 11 Jun '24

11 Jun '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.2-rc8 commit 519b7e13b5ae8dd38da1e52275705343be6bb508 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LZ CVE: CVE-2023-52737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently fiemap does not take the inode's lock (VFS lock), it only locks a file range in the inode's io tree. This however can lead to a deadlock if we have a concurrent fsync on the file and fiemap code triggers a fault when accessing the user space buffer with fiemap_fill_next_extent(). The deadlock happens on the inode's i_mmap_lock semaphore, which is taken both by fsync and btrfs_page_mkwrite(). This deadlock was recently reported by syzbot and triggers a trace like the following: task:syz-executor361 state:D stack:20264 pid:5668 ppid:5119 flags:0x00004004 Call Trace: <TASK> context_switch kernel/sched/core.c:5293 [inline] __schedule+0x995/0xe20 kernel/sched/core.c:6606 schedule+0xcb/0x190 kernel/sched/core.c:6682 wait_on_state fs/btrfs/extent-io-tree.c:707 [inline] wait_extent_bit+0x577/0x6f0 fs/btrfs/extent-io-tree.c:751 lock_extent+0x1c2/0x280 fs/btrfs/extent-io-tree.c:1742 find_lock_delalloc_range+0x4e6/0x9c0 fs/btrfs/extent_io.c:488 writepage_delalloc+0x1ef/0x540 fs/btrfs/extent_io.c:1863 __extent_writepage+0x736/0x14e0 fs/btrfs/extent_io.c:2174 extent_write_cache_pages+0x983/0x1220 fs/btrfs/extent_io.c:3091 extent_writepages+0x219/0x540 fs/btrfs/extent_io.c:3211 do_writepages+0x3c3/0x680 mm/page-writeback.c:2581 filemap_fdatawrite_wbc+0x11e/0x170 mm/filemap.c:388 __filemap_fdatawrite_range mm/filemap.c:421 [inline] filemap_fdatawrite_range+0x175/0x200 mm/filemap.c:439 btrfs_fdatawrite_range fs/btrfs/file.c:3850 [inline] start_ordered_ops fs/btrfs/file.c:1737 [inline] btrfs_sync_file+0x4ff/0x1190 fs/btrfs/file.c:1839 generic_write_sync include/linux/fs.h:2885 [inline] btrfs_do_write_iter+0xcd3/0x1280 fs/btrfs/file.c:1684 call_write_iter include/linux/fs.h:2189 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7d4054e9b9 RSP: 002b:00007f7d404fa2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f7d405d87a0 RCX: 00007f7d4054e9b9 RDX: 0000000000000090 RSI: 0000000020000000 RDI: 0000000000000006 RBP: 00007f7d405a51d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 61635f65646f6e69 R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87a8 </TASK> INFO: task syz-executor361:5697 blocked for more than 145 seconds. Not tainted 6.2.0-rc3-syzkaller-00376-g7c6984405241 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor361 state:D stack:21216 pid:5697 ppid:5119 flags:0x00004004 Call Trace: <TASK> context_switch kernel/sched/core.c:5293 [inline] __schedule+0x995/0xe20 kernel/sched/core.c:6606 schedule+0xcb/0x190 kernel/sched/core.c:6682 rwsem_down_read_slowpath+0x5f9/0x930 kernel/locking/rwsem.c:1095 __down_read_common+0x54/0x2a0 kernel/locking/rwsem.c:1260 btrfs_page_mkwrite+0x417/0xc80 fs/btrfs/inode.c:8526 do_page_mkwrite+0x19e/0x5e0 mm/memory.c:2947 wp_page_shared+0x15e/0x380 mm/memory.c:3295 handle_pte_fault mm/memory.c:4949 [inline] __handle_mm_fault mm/memory.c:5073 [inline] handle_mm_fault+0x1b79/0x26b0 mm/memory.c:5219 do_user_addr_fault+0x69b/0xcb0 arch/x86/mm/fault.c:1428 handle_page_fault arch/x86/mm/fault.c:1519 [inline] exc_page_fault+0x7a/0x110 arch/x86/mm/fault.c:1575 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S:233 Code: 74 0a 89 (...) RSP: 0018:ffffc9000570f330 EFLAGS: 00050202 RAX: ffffffff843e6601 RBX: 00007fffffffefc8 RCX: 0000000000000007 RDX: 0000000000000000 RSI: ffffc9000570f3e0 RDI: 0000000020000120 RBP: ffffc9000570f490 R08: 0000000000000000 R09: fffff52000ae1e83 R10: fffff52000ae1e83 R11: 1ffff92000ae1e7c R12: 0000000000000038 R13: ffffc9000570f3e0 R14: 0000000020000120 R15: ffffc9000570f3e0 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline] _copy_to_user+0xe9/0x130 lib/usercopy.c:34 copy_to_user include/linux/uaccess.h:169 [inline] fiemap_fill_next_extent+0x22e/0x410 fs/ioctl.c:144 emit_fiemap_extent+0x22d/0x3c0 fs/btrfs/extent_io.c:3458 fiemap_process_hole+0xa00/0xad0 fs/btrfs/extent_io.c:3716 extent_fiemap+0xe27/0x2100 fs/btrfs/extent_io.c:3922 btrfs_fiemap+0x172/0x1e0 fs/btrfs/inode.c:8209 ioctl_fiemap fs/ioctl.c:219 [inline] do_vfs_ioctl+0x185b/0x2980 fs/ioctl.c:810 __do_sys_ioctl fs/ioctl.c:868 [inline] __se_sys_ioctl+0x83/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7d4054e9b9 RSP: 002b:00007f7d390d92f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f7d405d87b0 RCX: 00007f7d4054e9b9 RDX: 0000000020000100 RSI: 00000000c020660b RDI: 0000000000000005 RBP: 00007f7d405a51d0 R08: 00007f7d390d9700 R09: 0000000000000000 R10: 00007f7d390d9700 R11: 0000000000000246 R12: 61635f65646f6e69 R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87b8 </TASK> What happens is the following: 1) Task A is doing an fsync, enters btrfs_sync_file() and flushes delalloc before locking the inode and the i_mmap_lock semaphore, that is, before calling btrfs_inode_lock(); 2) After task A flushes delalloc and before it calls btrfs_inode_lock(), another task dirties a page; 3) Task B starts a fiemap without FIEMAP_FLAG_SYNC, so the page dirtied at step 2 remains dirty and unflushed. Then when it enters extent_fiemap() and it locks a file range that includes the range of the page dirtied in step 2; 4) Task A calls btrfs_inode_lock() and locks the inode (VFS lock) and the inode's i_mmap_lock semaphore in write mode. Then it tries to flush delalloc by calling start_ordered_ops(), which will block, at find_lock_delalloc_range(), when trying to lock the range of the page dirtied at step 2, since this range was locked by the fiemap task (at step 3); 5) Task B generates a page fault when accessing the user space fiemap buffer with a call to fiemap_fill_next_extent(). The fault handler needs to call btrfs_page_mkwrite() for some other page of our inode, and there we deadlock when trying to lock the inode's i_mmap_lock semaphore in read mode, since the fsync task locked it in write mode (step 4) and the fsync task can not progress because it's waiting to lock a file range that is currently locked by us (the fiemap task, step 3). Fix this by taking the inode's lock (VFS lock) in shared mode when entering fiemap. This effectively serializes fiemap with fsync (except the most expensive part of fsync, the log sync), preventing this deadlock. Reported-by: syzbot+cc35f55c41e34c30dcb5(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/00000000000032dc7305f2a66f46@google.com/ CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent_io.c [a14b78ad06ab ("btrfs: introduce btrfs_inode_lock()/unlock()") and 570eb97bace8 ("btrfs: unify the lock/unlock extent variants") are not merged] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent_io.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c index 5fc65a780f83..16172c3b125d 100644 --- a/fs/btrfs/extent_io.c +++ b/fs/btrfs/extent_io.c @@ -4757,6 +4757,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, last_for_get_extent = isize; } + inode_lock_shared(&inode->vfs_inode); lock_extent_bits(&inode->io_tree, start, start + len - 1, &cached_state); @@ -4872,6 +4873,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, out: unlock_extent_cached(&inode->io_tree, start, start + len - 1, &cached_state); + inode_unlock_shared(&inode->vfs_inode); out_free_ulist: btrfs_free_path(path); -- 2.31.1

2 1

[PATCH OLK-5.10] btrfs: lock the inode in shared mode before starting fiemap
by Baokun Li 11 Jun '24

11 Jun '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.2-rc8 commit 519b7e13b5ae8dd38da1e52275705343be6bb508 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LZ CVE: CVE-2023-52737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently fiemap does not take the inode's lock (VFS lock), it only locks a file range in the inode's io tree. This however can lead to a deadlock if we have a concurrent fsync on the file and fiemap code triggers a fault when accessing the user space buffer with fiemap_fill_next_extent(). The deadlock happens on the inode's i_mmap_lock semaphore, which is taken both by fsync and btrfs_page_mkwrite(). This deadlock was recently reported by syzbot and triggers a trace like the following: task:syz-executor361 state:D stack:20264 pid:5668 ppid:5119 flags:0x00004004 Call Trace: <TASK> context_switch kernel/sched/core.c:5293 [inline] __schedule+0x995/0xe20 kernel/sched/core.c:6606 schedule+0xcb/0x190 kernel/sched/core.c:6682 wait_on_state fs/btrfs/extent-io-tree.c:707 [inline] wait_extent_bit+0x577/0x6f0 fs/btrfs/extent-io-tree.c:751 lock_extent+0x1c2/0x280 fs/btrfs/extent-io-tree.c:1742 find_lock_delalloc_range+0x4e6/0x9c0 fs/btrfs/extent_io.c:488 writepage_delalloc+0x1ef/0x540 fs/btrfs/extent_io.c:1863 __extent_writepage+0x736/0x14e0 fs/btrfs/extent_io.c:2174 extent_write_cache_pages+0x983/0x1220 fs/btrfs/extent_io.c:3091 extent_writepages+0x219/0x540 fs/btrfs/extent_io.c:3211 do_writepages+0x3c3/0x680 mm/page-writeback.c:2581 filemap_fdatawrite_wbc+0x11e/0x170 mm/filemap.c:388 __filemap_fdatawrite_range mm/filemap.c:421 [inline] filemap_fdatawrite_range+0x175/0x200 mm/filemap.c:439 btrfs_fdatawrite_range fs/btrfs/file.c:3850 [inline] start_ordered_ops fs/btrfs/file.c:1737 [inline] btrfs_sync_file+0x4ff/0x1190 fs/btrfs/file.c:1839 generic_write_sync include/linux/fs.h:2885 [inline] btrfs_do_write_iter+0xcd3/0x1280 fs/btrfs/file.c:1684 call_write_iter include/linux/fs.h:2189 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7d4054e9b9 RSP: 002b:00007f7d404fa2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f7d405d87a0 RCX: 00007f7d4054e9b9 RDX: 0000000000000090 RSI: 0000000020000000 RDI: 0000000000000006 RBP: 00007f7d405a51d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 61635f65646f6e69 R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87a8 </TASK> INFO: task syz-executor361:5697 blocked for more than 145 seconds. Not tainted 6.2.0-rc3-syzkaller-00376-g7c6984405241 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor361 state:D stack:21216 pid:5697 ppid:5119 flags:0x00004004 Call Trace: <TASK> context_switch kernel/sched/core.c:5293 [inline] __schedule+0x995/0xe20 kernel/sched/core.c:6606 schedule+0xcb/0x190 kernel/sched/core.c:6682 rwsem_down_read_slowpath+0x5f9/0x930 kernel/locking/rwsem.c:1095 __down_read_common+0x54/0x2a0 kernel/locking/rwsem.c:1260 btrfs_page_mkwrite+0x417/0xc80 fs/btrfs/inode.c:8526 do_page_mkwrite+0x19e/0x5e0 mm/memory.c:2947 wp_page_shared+0x15e/0x380 mm/memory.c:3295 handle_pte_fault mm/memory.c:4949 [inline] __handle_mm_fault mm/memory.c:5073 [inline] handle_mm_fault+0x1b79/0x26b0 mm/memory.c:5219 do_user_addr_fault+0x69b/0xcb0 arch/x86/mm/fault.c:1428 handle_page_fault arch/x86/mm/fault.c:1519 [inline] exc_page_fault+0x7a/0x110 arch/x86/mm/fault.c:1575 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S:233 Code: 74 0a 89 (...) RSP: 0018:ffffc9000570f330 EFLAGS: 00050202 RAX: ffffffff843e6601 RBX: 00007fffffffefc8 RCX: 0000000000000007 RDX: 0000000000000000 RSI: ffffc9000570f3e0 RDI: 0000000020000120 RBP: ffffc9000570f490 R08: 0000000000000000 R09: fffff52000ae1e83 R10: fffff52000ae1e83 R11: 1ffff92000ae1e7c R12: 0000000000000038 R13: ffffc9000570f3e0 R14: 0000000020000120 R15: ffffc9000570f3e0 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline] _copy_to_user+0xe9/0x130 lib/usercopy.c:34 copy_to_user include/linux/uaccess.h:169 [inline] fiemap_fill_next_extent+0x22e/0x410 fs/ioctl.c:144 emit_fiemap_extent+0x22d/0x3c0 fs/btrfs/extent_io.c:3458 fiemap_process_hole+0xa00/0xad0 fs/btrfs/extent_io.c:3716 extent_fiemap+0xe27/0x2100 fs/btrfs/extent_io.c:3922 btrfs_fiemap+0x172/0x1e0 fs/btrfs/inode.c:8209 ioctl_fiemap fs/ioctl.c:219 [inline] do_vfs_ioctl+0x185b/0x2980 fs/ioctl.c:810 __do_sys_ioctl fs/ioctl.c:868 [inline] __se_sys_ioctl+0x83/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7d4054e9b9 RSP: 002b:00007f7d390d92f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f7d405d87b0 RCX: 00007f7d4054e9b9 RDX: 0000000020000100 RSI: 00000000c020660b RDI: 0000000000000005 RBP: 00007f7d405a51d0 R08: 00007f7d390d9700 R09: 0000000000000000 R10: 00007f7d390d9700 R11: 0000000000000246 R12: 61635f65646f6e69 R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87b8 </TASK> What happens is the following: 1) Task A is doing an fsync, enters btrfs_sync_file() and flushes delalloc before locking the inode and the i_mmap_lock semaphore, that is, before calling btrfs_inode_lock(); 2) After task A flushes delalloc and before it calls btrfs_inode_lock(), another task dirties a page; 3) Task B starts a fiemap without FIEMAP_FLAG_SYNC, so the page dirtied at step 2 remains dirty and unflushed. Then when it enters extent_fiemap() and it locks a file range that includes the range of the page dirtied in step 2; 4) Task A calls btrfs_inode_lock() and locks the inode (VFS lock) and the inode's i_mmap_lock semaphore in write mode. Then it tries to flush delalloc by calling start_ordered_ops(), which will block, at find_lock_delalloc_range(), when trying to lock the range of the page dirtied at step 2, since this range was locked by the fiemap task (at step 3); 5) Task B generates a page fault when accessing the user space fiemap buffer with a call to fiemap_fill_next_extent(). The fault handler needs to call btrfs_page_mkwrite() for some other page of our inode, and there we deadlock when trying to lock the inode's i_mmap_lock semaphore in read mode, since the fsync task locked it in write mode (step 4) and the fsync task can not progress because it's waiting to lock a file range that is currently locked by us (the fiemap task, step 3). Fix this by taking the inode's lock (VFS lock) in shared mode when entering fiemap. This effectively serializes fiemap with fsync (except the most expensive part of fsync, the log sync), preventing this deadlock. Reported-by: syzbot+cc35f55c41e34c30dcb5(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/00000000000032dc7305f2a66f46@google.com/ CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent_io.c [a14b78ad06ab ("btrfs: introduce btrfs_inode_lock()/unlock()") and 570eb97bace8 ("btrfs: unify the lock/unlock extent variants") are not merged] Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/btrfs/extent_io.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c index 685a375bb6af..7119b81cf76d 100644 --- a/fs/btrfs/extent_io.c +++ b/fs/btrfs/extent_io.c @@ -4758,6 +4758,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, last_for_get_extent = isize; } + inode_lock_shared(&inode->vfs_inode); lock_extent_bits(&inode->io_tree, start, start + len - 1, &cached_state); @@ -4873,6 +4874,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo, out: unlock_extent_cached(&inode->io_tree, start, start + len - 1, &cached_state); + inode_unlock_shared(&inode->vfs_inode); out_free_ulist: btrfs_free_path(path); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] bna: ensure the copied buf is NUL terminated
by Zhang Zekun 11 Jun '24

11 Jun '24

From: Bui Quang Minh <minhquangbui99(a)gmail.com> mainline inclusion from mainline-v6.9-rc7 commit 8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U1KE CVE: CVE-2024-36934 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ----------------------------------------------------------- Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user. Fixes: 7afc5dbde091 ("bna: Add debugfs interface.") Signed-off-by: Bui Quang Minh <minhquangbui99(a)gmail.com> Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-2-f1f1b53a10f4@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c index 933799be0471..d549fdb6bbe2 100644 --- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c +++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c @@ -320,7 +320,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf, void *kern_buf; /* Copy the user space buf */ - kern_buf = memdup_user(buf, nbytes); + kern_buf = memdup_user_nul(buf, nbytes); if (IS_ERR(kern_buf)) return PTR_ERR(kern_buf); @@ -380,7 +380,7 @@ bnad_debugfs_write_regwr(struct file *file, const char __user *buf, void *kern_buf; /* Copy the user space buf */ - kern_buf = memdup_user(buf, nbytes); + kern_buf = memdup_user_nul(buf, nbytes); if (IS_ERR(kern_buf)) return PTR_ERR(kern_buf); -- 2.17.1

2 1

[PATCH OLK-5.10] cvm_tsi: Fix security issue for Confidential cVM TSI
by Shengjie Li 11 Jun '24

11 Jun '24

virtcca inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA45I1 -------------------------------- Fix security issue for Confidential cVM TSI: 1. Init TSI driver when config cvm_guest. 2. Modify the token structure to reduce the number of exposed variables. 3. Add a lock for obtaining the remote attestation report. Fixes: 31071f4b2a0b ("cvm_tsi: add cvm tsi interface") Signed-off-by: Shengjie Li <lishengjie12(a)huawei.com> --- arch/arm64/include/asm/cvm_smc.h | 22 +++---- arch/arm64/include/uapi/asm/cvm_tsi.h | 11 ++-- arch/arm64/kernel/cvm_tsi.c | 93 +++++++++++++-------------- 3 files changed, 63 insertions(+), 63 deletions(-) diff --git a/arch/arm64/include/asm/cvm_smc.h b/arch/arm64/include/asm/cvm_smc.h index c4d56333e3..91688bc169 100644 --- a/arch/arm64/include/asm/cvm_smc.h +++ b/arch/arm64/include/asm/cvm_smc.h @@ -124,30 +124,30 @@ static inline unsigned long tsi_measurement_read(struct cvm_measurement *cvm_mea return res.a0; } -static inline unsigned long tsi_attestation_token_init(struct cvm_attestation_cmd *attest_cmd) +static inline unsigned long tsi_attestation_token_init(unsigned char *challenge) { struct arm_smccc_res res; - unsigned char *challenge; + unsigned char *buf; - challenge = kmalloc(CHALLENGE_SIZE, GFP_KERNEL); - if (!challenge) + buf = kmalloc(CHALLENGE_SIZE, GFP_KERNEL); + if (!buf) return -ENOMEM; - memcpy(challenge, attest_cmd->challenge, CHALLENGE_SIZE); + memcpy(buf, challenge, CHALLENGE_SIZE); - arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_INIT, virt_to_phys(challenge), &res); - kfree(challenge); + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_INIT, virt_to_phys(buf), &res); + kfree(buf); return res.a0; } -static inline unsigned long tsi_attestation_token_continue(struct cvm_attestation_cmd *attest_cmd) +static inline unsigned long tsi_attestation_token_continue(struct cvm_token_granule *token_granule) { struct arm_smccc_res res; - arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_CONTINUE, virt_to_phys(attest_cmd->granule_ipa), - attest_cmd->offset, attest_cmd->size, &res); + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_CONTINUE, virt_to_phys(token_granule->ipa), + token_granule->offset, token_granule->size, &res); - attest_cmd->num_wr_bytes = res.a1; + token_granule->num_wr_bytes = res.a1; return res.a0; } diff --git a/arch/arm64/include/uapi/asm/cvm_tsi.h b/arch/arm64/include/uapi/asm/cvm_tsi.h index 43e17a0da0..1ed4386db2 100644 --- a/arch/arm64/include/uapi/asm/cvm_tsi.h +++ b/arch/arm64/include/uapi/asm/cvm_tsi.h @@ -55,10 +55,13 @@ struct cvm_measurement_extend { struct cvm_attestation_cmd { unsigned char challenge[CHALLENGE_SIZE]; /* input: challenge value */ - unsigned long token_size; /* return: challenge value */ - void *granule_head; - void *granule_ipa; /* IPA of the Granule to which the token will be written */ - unsigned long granule_count; + unsigned long token_size; /* return: token size */ +}; + +struct cvm_token_granule { + void *head; + void *ipa; /* IPA of the Granule to which the token will be written */ + unsigned long count; unsigned long offset; /* Offset within Granule to start of buffer in bytes */ unsigned long size; /* Size of buffer in bytes */ unsigned long num_wr_bytes; /* Number of bytes written to buffer */ diff --git a/arch/arm64/kernel/cvm_tsi.c b/arch/arm64/kernel/cvm_tsi.c index b48e5b17f4..a020dc12a5 100644 --- a/arch/arm64/kernel/cvm_tsi.c +++ b/arch/arm64/kernel/cvm_tsi.c @@ -4,6 +4,7 @@ #include <linux/slab.h> #include <linux/miscdevice.h> #include <linux/preempt.h> +#include <asm/cvm_guest.h> #include <asm/cvm_smc.h> #include <asm/cvm_tsi.h> @@ -16,20 +17,19 @@ struct attestation_token { static struct attestation_token token; +static DEFINE_MUTEX(token_lock); + static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg); -static int tmm_tsi_release(struct inode *inode, struct file *file); static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, size_t size, loff_t *offset); static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg); -static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg, - struct attestation_token *attest_token); +static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg); static int tmm_get_device_cert(struct cca_device_cert __user *arg); static const struct file_operations tmm_tsi_fops = { .owner = THIS_MODULE, .read = tmm_token_read, - .release = tmm_tsi_release, .unlocked_ioctl = tmm_tsi_ioctl }; @@ -44,11 +44,8 @@ static int __init tmm_tsi_init(void) unsigned long ver; int ret; - ver = tsi_get_version(); - if (ver == SMCCC_RET_NOT_SUPPORTED) { - pr_err("tmm_tsi: SMC return not supported!\n"); + if (!is_cvm_world()) return -EIO; - } ret = misc_register(&ioctl_dev); if (ret) { @@ -56,6 +53,11 @@ static int __init tmm_tsi_init(void) return ret; } + /* Allocate a large memory */ + token.buf = kzalloc(GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE, GFP_KERNEL); + if (!token.buf) + return -ENOMEM; + pr_warn("tmm_tsi: module loaded (version %lu.%lu).\n", TSI_ABI_VERSION_GET_MAJOR(ver), TSI_ABI_VERSION_GET_MINOR(ver)); @@ -65,8 +67,10 @@ static int __init tmm_tsi_init(void) static void __exit tmm_tsi_exit(void) { - if (token.buf != NULL) + if (token.buf != NULL) { + memset(token.buf, 0, GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE); kfree(token.buf); + } misc_deregister(&ioctl_dev); pr_warn("tmm_tsi: module unloaded.\n"); } @@ -80,7 +84,7 @@ static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg ret = tmm_get_tsi_version((struct cvm_tsi_version *)arg); break; case TMM_GET_ATTESTATION_TOKEN: - ret = tmm_get_attestation_token((struct cvm_attestation_cmd *)arg, &token); + ret = tmm_get_attestation_token((struct cvm_attestation_cmd *)arg); break; case TMM_GET_DEVICE_CERT: ret = tmm_get_device_cert((struct cca_device_cert *)arg); @@ -99,28 +103,25 @@ static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, int ret; int to_copy; - if (*offset >= token.size) + mutex_lock(&token_lock); + if (*offset >= token.size) { + mutex_unlock(&token_lock); return 0; + } to_copy = min((int)size, (int)(token.size - *offset)); ret = copy_to_user(user_buffer, token.buf + *offset, to_copy); if (ret) { pr_err("tmm_tsi: copy token to user failed (%d)!\n", ret); + mutex_unlock(&token_lock); return -1; } *offset += to_copy; + mutex_unlock(&token_lock); return to_copy; } -static int tmm_tsi_release(struct inode *inode, struct file *file) -{ - if (token.buf != NULL) { - memset(token.buf, 0, GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE); - kfree(token.buf); - } - return 0; -} static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg) { @@ -141,65 +142,61 @@ static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg) return 0; } -static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg, - struct attestation_token *attest_token) +static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg) { unsigned long ret; - struct cvm_attestation_cmd cmd = {0}; + struct cvm_token_granule token_granule = {0}; + unsigned char challenge[CHALLENGE_SIZE]; - ret = copy_from_user(&(cmd.challenge), &(arg->challenge), sizeof(cmd.challenge)); + ret = copy_from_user(challenge, &(arg->challenge), CHALLENGE_SIZE); if (ret) { pr_err("tmm_tsi: copy data from user failed (%lu)!\n", ret); return -EFAULT; } - /* Allocate a large memory */ - attest_token->buf = kmalloc(GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE, GFP_KERNEL); - if (!attest_token->buf) - return -ENOMEM; - cmd.granule_head = attest_token->buf; - cmd.granule_ipa = cmd.granule_head; + mutex_lock(&token_lock); + token_granule.head = token.buf; + token_granule.ipa = token_granule.head; - /* preempt_disable(); */ - - ret = tsi_attestation_token_init(&cmd); + ret = tsi_attestation_token_init(challenge); if (ret) { pr_err("tmm_tsi: tsi call tsi_attestation_token_init failed (%lu)!\n", ret); + mutex_unlock(&token_lock); return -EIO; } do { /* Retrieve one Granule of data per loop iteration */ - cmd.granule_ipa = cmd.granule_head + - (unsigned long)(cmd.granule_count * GRANULE_SIZE); - cmd.offset = 0; + token_granule.ipa = token_granule.head + + (unsigned long)(token_granule.count * GRANULE_SIZE); + token_granule.offset = 0; do { /* Retrieve sub-Granule chunk of data per loop iteration */ - cmd.size = GRANULE_SIZE - cmd.offset; - ret = tsi_attestation_token_continue(&cmd); - cmd.offset += cmd.num_wr_bytes; - } while (ret == TSI_INCOMPLETE && cmd.offset < GRANULE_SIZE); + token_granule.size = GRANULE_SIZE - token_granule.offset; + ret = tsi_attestation_token_continue(&token_granule); + token_granule.offset += token_granule.num_wr_bytes; + } while (ret == TSI_INCOMPLETE && token_granule.offset < GRANULE_SIZE); - cmd.granule_count += 1; - if (cmd.granule_count >= MAX_TOKEN_GRANULE_PAGE && ret == TSI_INCOMPLETE) { + token_granule.count += 1; + if (token_granule.count >= MAX_TOKEN_GRANULE_PAGE && ret == TSI_INCOMPLETE) { pr_err("tmm_tsi: macro MAX_TOKEN_GRANULE_PAGE (%d) is too small!\n", MAX_TOKEN_GRANULE_PAGE); + mutex_unlock(&token_lock); return -ENOMEM; } } while (ret == TSI_INCOMPLETE); - /* preempt_enable(); */ - /* Send to user space the total size of the token */ - cmd.granule_count = cmd.granule_count - 1; - cmd.token_size = (unsigned long)(GRANULE_SIZE * cmd.granule_count) + cmd.offset; - attest_token->size = cmd.token_size; + token_granule.count = token_granule.count - 1; + token.size = (unsigned long)(GRANULE_SIZE * token_granule.count) + token_granule.offset; - ret = copy_to_user(&(arg->token_size), &(cmd.token_size), sizeof(cmd.token_size)); + ret = copy_to_user(&(arg->token_size), &(token.size), sizeof(token.size)); if (ret) { pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + mutex_unlock(&token_lock); return -EFAULT; } + mutex_unlock(&token_lock); return 0; } @@ -211,7 +208,7 @@ static int tmm_get_device_cert(struct cca_device_cert __user *arg) unsigned long device_cert_size; device_cert_size = MAX_DEV_CERT_SIZE; - device_cert = kmalloc(device_cert_size, GFP_KERNEL); + device_cert = kzalloc(device_cert_size, GFP_KERNEL); if (!device_cert) return -ENOMEM; ret = tsi_get_device_cert(device_cert, &device_cert_size); -- 2.37.2.windows.2

2 1

[PATCH OLK-6.6] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 11 Jun '24

11 Jun '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v6.6.31 commit 2af84c46b9b8f2d6c0f88d09ee5c849ae1734676 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index dbbf7db4ff2f..1dd556496f27 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -756,15 +756,6 @@ static int at24_probe(struct i2c_client *client) } pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return dev_err_probe(dev, PTR_ERR(at24->nvmem), - "failed to register nvmem\n"); - } - /* * Perform a one-byte test read to verify that the chip is functional, * unless powering on the device is to be avoided during probe (i.e. @@ -780,6 +771,15 @@ static int at24_probe(struct i2c_client *client) } } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return dev_err_probe(dev, PTR_ERR(at24->nvmem), + "failed to register nvmem\n"); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-36905
by Zhengchao Shao 11 Jun '24

11 Jun '24

fix CVE-2024-36905 Eric Dumazet (1): tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets Paolo Abeni (1): net: relax socket state check at accept time. net/ipv4/af_inet.c | 4 +++- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_input.c | 2 ++ net/ipv4/tcp_output.c | 4 +++- 4 files changed, 10 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-36905
by Zhengchao Shao 11 Jun '24

11 Jun '24

fix CVE-2024-36905 Eric Dumazet (1): tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets Paolo Abeni (1): net: relax socket state check at accept time. net/ipv4/af_inet.c | 4 +++- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_input.c | 2 ++ net/ipv4/tcp_output.c | 4 +++- 4 files changed, 10 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] fix CVE-2024-36905
by Zhengchao Shao 11 Jun '24

11 Jun '24

Fix CVE-2024-36905 Eric Dumazet (1): tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets Paolo Abeni (1): net: relax socket state check at accept time. net/ipv4/af_inet.c | 4 +++- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_input.c | 2 ++ net/ipv4/tcp_output.c | 4 +++- 4 files changed, 10 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2023-52810
by Li Nan 11 Jun '24

11 Jun '24

Juntong Deng (1): fs/jfs: Add check for negative db_l2nbperpage Siddh Raman Pant (1): jfs: jfs_dmap: Validate db_l2nbperpage while mounting fs/jfs/jfs_filsys.h | 2 ++ fs/jfs/jfs_dmap.c | 7 +++++++ 2 files changed, 9 insertions(+) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] net: qcom/emac: fix UAF in emac_remove
by Ze Zuo 11 Jun '24

11 Jun '24

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v5.10.53 commit b560521eca03d0a2db6093a5a632cbdd0a0cf833 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S29U CVE: CVE-2021-47311 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ad297cd2db8953e2202970e9504cab247b6c7cb4 upstream. adpt is netdev private data and it cannot be used after free_netdev() call. Using adpt after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function. Fixes: 54e19bc74f33 ("net: qcom/emac: do not use devm on internal phy pdev") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/net/ethernet/qualcomm/emac/emac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c index b10f2bcf8506..938602864c24 100644 --- a/drivers/net/ethernet/qualcomm/emac/emac.c +++ b/drivers/net/ethernet/qualcomm/emac/emac.c @@ -754,12 +754,13 @@ static int emac_remove(struct platform_device *pdev) put_device(&adpt->phydev->mdio.dev); mdiobus_unregister(adpt->mii_bus); - free_netdev(netdev); if (adpt->phy.digital) iounmap(adpt->phy.digital); iounmap(adpt->phy.base); + free_netdev(netdev); + return 0; } -- 2.25.1

2 1

[PATCH OLK-5.10] cvm_tsi: Fix security issue for Confidential cVM TSI
by Shengjie Li 11 Jun '24

11 Jun '24

virtcca inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA45I1 -------------------------------- Fix security issue for Confidential cVM TSI: 1. Init TSI driver when config cvm_guest. 2. Modify the token structure to reduce the number of exposed variables. 3. Add a lock for obtaining the remote attestation report. Fixes: 31071f4b2a0b ("cvm_tsi: add cvm tsi interface") Signed-off-by: Shengjie Li <lishengjie12(a)huawei.com> --- arch/arm64/include/asm/cvm_smc.h | 22 +++---- arch/arm64/include/uapi/asm/cvm_tsi.h | 11 ++-- arch/arm64/kernel/cvm_tsi.c | 93 +++++++++++++-------------- 3 files changed, 63 insertions(+), 63 deletions(-) diff --git a/arch/arm64/include/asm/cvm_smc.h b/arch/arm64/include/asm/cvm_smc.h index c4d56333e3..91688bc169 100644 --- a/arch/arm64/include/asm/cvm_smc.h +++ b/arch/arm64/include/asm/cvm_smc.h @@ -124,30 +124,30 @@ static inline unsigned long tsi_measurement_read(struct cvm_measurement *cvm_mea return res.a0; } -static inline unsigned long tsi_attestation_token_init(struct cvm_attestation_cmd *attest_cmd) +static inline unsigned long tsi_attestation_token_init(unsigned char *challenge) { struct arm_smccc_res res; - unsigned char *challenge; + unsigned char *buf; - challenge = kmalloc(CHALLENGE_SIZE, GFP_KERNEL); - if (!challenge) + buf = kmalloc(CHALLENGE_SIZE, GFP_KERNEL); + if (!buf) return -ENOMEM; - memcpy(challenge, attest_cmd->challenge, CHALLENGE_SIZE); + memcpy(buf, challenge, CHALLENGE_SIZE); - arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_INIT, virt_to_phys(challenge), &res); - kfree(challenge); + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_INIT, virt_to_phys(buf), &res); + kfree(buf); return res.a0; } -static inline unsigned long tsi_attestation_token_continue(struct cvm_attestation_cmd *attest_cmd) +static inline unsigned long tsi_attestation_token_continue(struct cvm_token_granule *token_granule) { struct arm_smccc_res res; - arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_CONTINUE, virt_to_phys(attest_cmd->granule_ipa), - attest_cmd->offset, attest_cmd->size, &res); + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_CONTINUE, virt_to_phys(token_granule->ipa), + token_granule->offset, token_granule->size, &res); - attest_cmd->num_wr_bytes = res.a1; + token_granule->num_wr_bytes = res.a1; return res.a0; } diff --git a/arch/arm64/include/uapi/asm/cvm_tsi.h b/arch/arm64/include/uapi/asm/cvm_tsi.h index 43e17a0da0..1ed4386db2 100644 --- a/arch/arm64/include/uapi/asm/cvm_tsi.h +++ b/arch/arm64/include/uapi/asm/cvm_tsi.h @@ -55,10 +55,13 @@ struct cvm_measurement_extend { struct cvm_attestation_cmd { unsigned char challenge[CHALLENGE_SIZE]; /* input: challenge value */ - unsigned long token_size; /* return: challenge value */ - void *granule_head; - void *granule_ipa; /* IPA of the Granule to which the token will be written */ - unsigned long granule_count; + unsigned long token_size; /* return: token size */ +}; + +struct cvm_token_granule { + void *head; + void *ipa; /* IPA of the Granule to which the token will be written */ + unsigned long count; unsigned long offset; /* Offset within Granule to start of buffer in bytes */ unsigned long size; /* Size of buffer in bytes */ unsigned long num_wr_bytes; /* Number of bytes written to buffer */ diff --git a/arch/arm64/kernel/cvm_tsi.c b/arch/arm64/kernel/cvm_tsi.c index b48e5b17f4..a46f2b4724 100644 --- a/arch/arm64/kernel/cvm_tsi.c +++ b/arch/arm64/kernel/cvm_tsi.c @@ -4,6 +4,7 @@ #include <linux/slab.h> #include <linux/miscdevice.h> #include <linux/preempt.h> +#include <asm/cvm_guest.h> #include <asm/cvm_smc.h> #include <asm/cvm_tsi.h> @@ -16,20 +17,19 @@ struct attestation_token { static struct attestation_token token; +static DEFINE_SPINLOCK(token_lock); + static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg); -static int tmm_tsi_release(struct inode *inode, struct file *file); static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, size_t size, loff_t *offset); static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg); -static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg, - struct attestation_token *attest_token); +static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg); static int tmm_get_device_cert(struct cca_device_cert __user *arg); static const struct file_operations tmm_tsi_fops = { .owner = THIS_MODULE, .read = tmm_token_read, - .release = tmm_tsi_release, .unlocked_ioctl = tmm_tsi_ioctl }; @@ -44,11 +44,8 @@ static int __init tmm_tsi_init(void) unsigned long ver; int ret; - ver = tsi_get_version(); - if (ver == SMCCC_RET_NOT_SUPPORTED) { - pr_err("tmm_tsi: SMC return not supported!\n"); + if (!is_cvm_world()) return -EIO; - } ret = misc_register(&ioctl_dev); if (ret) { @@ -56,6 +53,11 @@ static int __init tmm_tsi_init(void) return ret; } + /* Allocate a large memory */ + token.buf = kzalloc(GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE, GFP_KERNEL); + if (!token.buf) + return -ENOMEM; + pr_warn("tmm_tsi: module loaded (version %lu.%lu).\n", TSI_ABI_VERSION_GET_MAJOR(ver), TSI_ABI_VERSION_GET_MINOR(ver)); @@ -65,8 +67,10 @@ static int __init tmm_tsi_init(void) static void __exit tmm_tsi_exit(void) { - if (token.buf != NULL) + if (token.buf != NULL) { + memset(token.buf, 0, GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE); kfree(token.buf); + } misc_deregister(&ioctl_dev); pr_warn("tmm_tsi: module unloaded.\n"); } @@ -80,7 +84,7 @@ static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg ret = tmm_get_tsi_version((struct cvm_tsi_version *)arg); break; case TMM_GET_ATTESTATION_TOKEN: - ret = tmm_get_attestation_token((struct cvm_attestation_cmd *)arg, &token); + ret = tmm_get_attestation_token((struct cvm_attestation_cmd *)arg); break; case TMM_GET_DEVICE_CERT: ret = tmm_get_device_cert((struct cca_device_cert *)arg); @@ -99,28 +103,25 @@ static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, int ret; int to_copy; - if (*offset >= token.size) + spin_lock(&token_lock); + if (*offset >= token.size) { + spin_unlock(&token_lock); return 0; + } to_copy = min((int)size, (int)(token.size - *offset)); ret = copy_to_user(user_buffer, token.buf + *offset, to_copy); if (ret) { pr_err("tmm_tsi: copy token to user failed (%d)!\n", ret); + spin_unlock(&token_lock); return -1; } *offset += to_copy; + spin_unlock(&token_lock); return to_copy; } -static int tmm_tsi_release(struct inode *inode, struct file *file) -{ - if (token.buf != NULL) { - memset(token.buf, 0, GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE); - kfree(token.buf); - } - return 0; -} static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg) { @@ -141,65 +142,61 @@ static int tmm_get_tsi_version(struct cvm_tsi_version __user *arg) return 0; } -static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg, - struct attestation_token *attest_token) +static int tmm_get_attestation_token(struct cvm_attestation_cmd __user *arg) { unsigned long ret; - struct cvm_attestation_cmd cmd = {0}; + struct cvm_token_granule token_granule = {0}; + unsigned char challenge[CHALLENGE_SIZE]; - ret = copy_from_user(&(cmd.challenge), &(arg->challenge), sizeof(cmd.challenge)); + ret = copy_from_user(challenge, &(arg->challenge), CHALLENGE_SIZE); if (ret) { pr_err("tmm_tsi: copy data from user failed (%lu)!\n", ret); return -EFAULT; } - /* Allocate a large memory */ - attest_token->buf = kmalloc(GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE, GFP_KERNEL); - if (!attest_token->buf) - return -ENOMEM; - cmd.granule_head = attest_token->buf; - cmd.granule_ipa = cmd.granule_head; + spin_lock(&token_lock); + token_granule.head = token.buf; + token_granule.ipa = token_granule.head; - /* preempt_disable(); */ - - ret = tsi_attestation_token_init(&cmd); + ret = tsi_attestation_token_init(challenge); if (ret) { pr_err("tmm_tsi: tsi call tsi_attestation_token_init failed (%lu)!\n", ret); + spin_unlock(&token_lock); return -EIO; } do { /* Retrieve one Granule of data per loop iteration */ - cmd.granule_ipa = cmd.granule_head + - (unsigned long)(cmd.granule_count * GRANULE_SIZE); - cmd.offset = 0; + token_granule.ipa = token_granule.head + + (unsigned long)(token_granule.count * GRANULE_SIZE); + token_granule.offset = 0; do { /* Retrieve sub-Granule chunk of data per loop iteration */ - cmd.size = GRANULE_SIZE - cmd.offset; - ret = tsi_attestation_token_continue(&cmd); - cmd.offset += cmd.num_wr_bytes; - } while (ret == TSI_INCOMPLETE && cmd.offset < GRANULE_SIZE); + token_granule.size = GRANULE_SIZE - token_granule.offset; + ret = tsi_attestation_token_continue(&token_granule); + token_granule.offset += token_granule.num_wr_bytes; + } while (ret == TSI_INCOMPLETE && token_granule.offset < GRANULE_SIZE); - cmd.granule_count += 1; - if (cmd.granule_count >= MAX_TOKEN_GRANULE_PAGE && ret == TSI_INCOMPLETE) { + token_granule.count += 1; + if (token_granule.count >= MAX_TOKEN_GRANULE_PAGE && ret == TSI_INCOMPLETE) { pr_err("tmm_tsi: macro MAX_TOKEN_GRANULE_PAGE (%d) is too small!\n", MAX_TOKEN_GRANULE_PAGE); + spin_unlock(&token_lock); return -ENOMEM; } } while (ret == TSI_INCOMPLETE); - /* preempt_enable(); */ - /* Send to user space the total size of the token */ - cmd.granule_count = cmd.granule_count - 1; - cmd.token_size = (unsigned long)(GRANULE_SIZE * cmd.granule_count) + cmd.offset; - attest_token->size = cmd.token_size; + token_granule.count = token_granule.count - 1; + token.size = (unsigned long)(GRANULE_SIZE * token_granule.count) + token_granule.offset; - ret = copy_to_user(&(arg->token_size), &(cmd.token_size), sizeof(cmd.token_size)); + ret = copy_to_user(&(arg->token_size), &(token.size), sizeof(token.size)); if (ret) { pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + spin_unlock(&token_lock); return -EFAULT; } + spin_unlock(&token_lock); return 0; } @@ -211,7 +208,7 @@ static int tmm_get_device_cert(struct cca_device_cert __user *arg) unsigned long device_cert_size; device_cert_size = MAX_DEV_CERT_SIZE; - device_cert = kmalloc(device_cert_size, GFP_KERNEL); + device_cert = kzalloc(device_cert_size, GFP_KERNEL); if (!device_cert) return -ENOMEM; ret = tsi_get_device_cert(device_cert, &device_cert_size); -- 2.37.2.windows.2

2 1

[PATCH openEuler-22.03-LTS-SP1] tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
by Zhengchao Shao 11 Jun '24

11 Jun '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.217 commit 413c33b9f3bc36fdf719690a78824db9f88a9485 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U4IQ CVE: CVE-2024-36905 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94062790aedb505bdda209b10bea47b294d6394f ] TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash [1], syzbot managed to trigger a divide by zero in tcp_rcv_space_adjust() A socket makes the following state transitions, without ever calling tcp_init_transfer(), meaning tcp_init_buffer_space() is also not called. TCP_CLOSE connect() TCP_SYN_SENT TCP_SYN_RECV shutdown() -> tcp_shutdown(sk, SEND_SHUTDOWN) TCP_FIN_WAIT1 To fix this issue, change tcp_shutdown() to not perform a TCP_SYN_RECV -> TCP_FIN_WAIT1 transition, which makes no sense anyway. When tcp_rcv_state_process() later changes socket state from TCP_SYN_RECV to TCP_ESTABLISH, then look at sk->sk_shutdown to finally enter TCP_FIN_WAIT1 state, and send a FIN packet from a sane socket state. This means tcp_send_fin() can now be called from BH context, and must use GFP_ATOMIC allocations. [1] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 1 PID: 5084 Comm: syz-executor358 Not tainted 6.9.0-rc6-syzkaller-00022-g98369dccd2f8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:tcp_rcv_space_adjust+0x2df/0x890 net/ipv4/tcp_input.c:767 Code: e3 04 4c 01 eb 48 8b 44 24 38 0f b6 04 10 84 c0 49 89 d5 0f 85 a5 03 00 00 41 8b 8e c8 09 00 00 89 e8 29 c8 48 0f af c3 31 d2 <48> f7 f1 48 8d 1c 43 49 8d 96 76 08 00 00 48 89 d0 48 c1 e8 03 48 RSP: 0018:ffffc900031ef3f0 EFLAGS: 00010246 RAX: 0c677a10441f8f42 RBX: 000000004fb95e7e RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000027d4b11f R08: ffffffff89e535a4 R09: 1ffffffff25e6ab7 R10: dffffc0000000000 R11: ffffffff8135e920 R12: ffff88802a9f8d30 R13: dffffc0000000000 R14: ffff88802a9f8d00 R15: 1ffff1100553f2da FS: 00005555775c0380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1155bf2304 CR3: 000000002b9f2000 CR4: 0000000000350ef0 Call Trace: <TASK> tcp_recvmsg_locked+0x106d/0x25a0 net/ipv4/tcp.c:2513 tcp_recvmsg+0x25d/0x920 net/ipv4/tcp.c:2578 inet6_recvmsg+0x16a/0x730 net/ipv6/af_inet6.c:680 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1068 ____sys_recvmsg+0x1db/0x470 net/socket.c:2803 ___sys_recvmsg net/socket.c:2845 [inline] do_recvmmsg+0x474/0xae0 net/socket.c:2939 __sys_recvmmsg net/socket.c:3018 [inline] __do_sys_recvmmsg net/socket.c:3041 [inline] __se_sys_recvmmsg net/socket.c:3034 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7faeb6363db9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcc1997168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faeb6363db9 RDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000001c R10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Neal Cardwell <ncardwell(a)google.com> Link: https://lore.kernel.org/r/20240501125448.896529-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_input.c | 2 ++ net/ipv4/tcp_output.c | 4 +++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 8eef91d14263..c8f65909a921 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2508,7 +2508,7 @@ void tcp_shutdown(struct sock *sk, int how) /* If we've already sent a FIN, or it's a closed state, skip this. */ if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_SYN_SENT | - TCPF_SYN_RECV | TCPF_CLOSE_WAIT)) { + TCPF_CLOSE_WAIT)) { /* Clear out any half completed packets. FIN if needed. */ if (tcp_close_state(sk)) tcp_send_fin(sk); @@ -2620,7 +2620,7 @@ void tcp_close(struct sock *sk, long timeout) * machine. State transitions: * * TCP_ESTABLISHED -> TCP_FIN_WAIT1 - * TCP_SYN_RECV -> TCP_FIN_WAIT1 (forget it, it's impossible) + * TCP_SYN_RECV -> TCP_FIN_WAIT1 (it is difficult) * TCP_CLOSE_WAIT -> TCP_LAST_ACK * * are legal only when FIN has been sent (i.e. in window), diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index f95a18b73677..9542f42b5d0c 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -6514,6 +6514,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) tcp_initialize_rcv_mss(sk); tcp_fast_path_on(tp); + if (sk->sk_shutdown & SEND_SHUTDOWN) + tcp_shutdown(sk, SEND_SHUTDOWN); break; case TCP_FIN_WAIT1: { diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 0996c71811d5..f32351a8f031 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -3474,7 +3474,9 @@ void tcp_send_fin(struct sock *sk) return; } } else { - skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation); + skb = alloc_skb_fclone(MAX_TCP_HEADER, + sk_gfp_mask(sk, GFP_ATOMIC | + __GFP_NOWARN)); if (unlikely(!skb)) return; -- 2.34.1

2 1

[PATCH OLK-5.10] tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
by Zhengchao Shao 11 Jun '24

11 Jun '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.217 commit 413c33b9f3bc36fdf719690a78824db9f88a9485 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U4IQ CVE: CVE-2024-36905 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94062790aedb505bdda209b10bea47b294d6394f ] TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash [1], syzbot managed to trigger a divide by zero in tcp_rcv_space_adjust() A socket makes the following state transitions, without ever calling tcp_init_transfer(), meaning tcp_init_buffer_space() is also not called. TCP_CLOSE connect() TCP_SYN_SENT TCP_SYN_RECV shutdown() -> tcp_shutdown(sk, SEND_SHUTDOWN) TCP_FIN_WAIT1 To fix this issue, change tcp_shutdown() to not perform a TCP_SYN_RECV -> TCP_FIN_WAIT1 transition, which makes no sense anyway. When tcp_rcv_state_process() later changes socket state from TCP_SYN_RECV to TCP_ESTABLISH, then look at sk->sk_shutdown to finally enter TCP_FIN_WAIT1 state, and send a FIN packet from a sane socket state. This means tcp_send_fin() can now be called from BH context, and must use GFP_ATOMIC allocations. [1] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 1 PID: 5084 Comm: syz-executor358 Not tainted 6.9.0-rc6-syzkaller-00022-g98369dccd2f8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:tcp_rcv_space_adjust+0x2df/0x890 net/ipv4/tcp_input.c:767 Code: e3 04 4c 01 eb 48 8b 44 24 38 0f b6 04 10 84 c0 49 89 d5 0f 85 a5 03 00 00 41 8b 8e c8 09 00 00 89 e8 29 c8 48 0f af c3 31 d2 <48> f7 f1 48 8d 1c 43 49 8d 96 76 08 00 00 48 89 d0 48 c1 e8 03 48 RSP: 0018:ffffc900031ef3f0 EFLAGS: 00010246 RAX: 0c677a10441f8f42 RBX: 000000004fb95e7e RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000027d4b11f R08: ffffffff89e535a4 R09: 1ffffffff25e6ab7 R10: dffffc0000000000 R11: ffffffff8135e920 R12: ffff88802a9f8d30 R13: dffffc0000000000 R14: ffff88802a9f8d00 R15: 1ffff1100553f2da FS: 00005555775c0380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1155bf2304 CR3: 000000002b9f2000 CR4: 0000000000350ef0 Call Trace: <TASK> tcp_recvmsg_locked+0x106d/0x25a0 net/ipv4/tcp.c:2513 tcp_recvmsg+0x25d/0x920 net/ipv4/tcp.c:2578 inet6_recvmsg+0x16a/0x730 net/ipv6/af_inet6.c:680 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1068 ____sys_recvmsg+0x1db/0x470 net/socket.c:2803 ___sys_recvmsg net/socket.c:2845 [inline] do_recvmmsg+0x474/0xae0 net/socket.c:2939 __sys_recvmmsg net/socket.c:3018 [inline] __do_sys_recvmmsg net/socket.c:3041 [inline] __se_sys_recvmmsg net/socket.c:3034 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7faeb6363db9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcc1997168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faeb6363db9 RDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000001c R10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Neal Cardwell <ncardwell(a)google.com> Link: https://lore.kernel.org/r/20240501125448.896529-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_input.c | 2 ++ net/ipv4/tcp_output.c | 4 +++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index f1ab4fa04dce..758818ec3f8b 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2527,7 +2527,7 @@ void tcp_shutdown(struct sock *sk, int how) /* If we've already sent a FIN, or it's a closed state, skip this. */ if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_SYN_SENT | - TCPF_SYN_RECV | TCPF_CLOSE_WAIT)) { + TCPF_CLOSE_WAIT)) { /* Clear out any half completed packets. FIN if needed. */ if (tcp_close_state(sk)) tcp_send_fin(sk); @@ -2638,7 +2638,7 @@ void __tcp_close(struct sock *sk, long timeout) * machine. State transitions: * * TCP_ESTABLISHED -> TCP_FIN_WAIT1 - * TCP_SYN_RECV -> TCP_FIN_WAIT1 (forget it, it's impossible) + * TCP_SYN_RECV -> TCP_FIN_WAIT1 (it is difficult) * TCP_CLOSE_WAIT -> TCP_LAST_ACK * * are legal only when FIN has been sent (i.e. in window), diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 2645dd64c382..0c783f8c0b36 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -6541,6 +6541,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) tcp_initialize_rcv_mss(sk); tcp_fast_path_on(tp); + if (sk->sk_shutdown & SEND_SHUTDOWN) + tcp_shutdown(sk, SEND_SHUTDOWN); break; case TCP_FIN_WAIT1: { diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 762f2009d61d..a1302d5cb98f 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -3495,7 +3495,9 @@ void tcp_send_fin(struct sock *sk) return; } } else { - skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation); + skb = alloc_skb_fclone(MAX_TCP_HEADER, + sk_gfp_mask(sk, GFP_ATOMIC | + __GFP_NOWARN)); if (unlikely(!skb)) return; -- 2.34.1

2 1

[PATCH OLK-6.6] tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
by Zhengchao Shao 11 Jun '24

11 Jun '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.31 commit f47d0d32fa94e815fdd78b8b88684873e67939f4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U4IQ CVE: CVE-2024-36905 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94062790aedb505bdda209b10bea47b294d6394f ] TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash [1], syzbot managed to trigger a divide by zero in tcp_rcv_space_adjust() A socket makes the following state transitions, without ever calling tcp_init_transfer(), meaning tcp_init_buffer_space() is also not called. TCP_CLOSE connect() TCP_SYN_SENT TCP_SYN_RECV shutdown() -> tcp_shutdown(sk, SEND_SHUTDOWN) TCP_FIN_WAIT1 To fix this issue, change tcp_shutdown() to not perform a TCP_SYN_RECV -> TCP_FIN_WAIT1 transition, which makes no sense anyway. When tcp_rcv_state_process() later changes socket state from TCP_SYN_RECV to TCP_ESTABLISH, then look at sk->sk_shutdown to finally enter TCP_FIN_WAIT1 state, and send a FIN packet from a sane socket state. This means tcp_send_fin() can now be called from BH context, and must use GFP_ATOMIC allocations. [1] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 1 PID: 5084 Comm: syz-executor358 Not tainted 6.9.0-rc6-syzkaller-00022-g98369dccd2f8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:tcp_rcv_space_adjust+0x2df/0x890 net/ipv4/tcp_input.c:767 Code: e3 04 4c 01 eb 48 8b 44 24 38 0f b6 04 10 84 c0 49 89 d5 0f 85 a5 03 00 00 41 8b 8e c8 09 00 00 89 e8 29 c8 48 0f af c3 31 d2 <48> f7 f1 48 8d 1c 43 49 8d 96 76 08 00 00 48 89 d0 48 c1 e8 03 48 RSP: 0018:ffffc900031ef3f0 EFLAGS: 00010246 RAX: 0c677a10441f8f42 RBX: 000000004fb95e7e RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000027d4b11f R08: ffffffff89e535a4 R09: 1ffffffff25e6ab7 R10: dffffc0000000000 R11: ffffffff8135e920 R12: ffff88802a9f8d30 R13: dffffc0000000000 R14: ffff88802a9f8d00 R15: 1ffff1100553f2da FS: 00005555775c0380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1155bf2304 CR3: 000000002b9f2000 CR4: 0000000000350ef0 Call Trace: <TASK> tcp_recvmsg_locked+0x106d/0x25a0 net/ipv4/tcp.c:2513 tcp_recvmsg+0x25d/0x920 net/ipv4/tcp.c:2578 inet6_recvmsg+0x16a/0x730 net/ipv6/af_inet6.c:680 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1068 ____sys_recvmsg+0x1db/0x470 net/socket.c:2803 ___sys_recvmsg net/socket.c:2845 [inline] do_recvmmsg+0x474/0xae0 net/socket.c:2939 __sys_recvmmsg net/socket.c:3018 [inline] __do_sys_recvmmsg net/socket.c:3041 [inline] __se_sys_recvmmsg net/socket.c:3034 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7faeb6363db9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcc1997168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faeb6363db9 RDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000001c R10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Neal Cardwell <ncardwell(a)google.com> Link: https://lore.kernel.org/r/20240501125448.896529-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_input.c | 2 ++ net/ipv4/tcp_output.c | 4 +++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 2ff83f2897ba..0f1380c3fcf4 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2714,7 +2714,7 @@ void tcp_shutdown(struct sock *sk, int how) /* If we've already sent a FIN, or it's a closed state, skip this. */ if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_SYN_SENT | - TCPF_SYN_RECV | TCPF_CLOSE_WAIT)) { + TCPF_CLOSE_WAIT)) { /* Clear out any half completed packets. FIN if needed. */ if (tcp_close_state(sk)) tcp_send_fin(sk); @@ -2823,7 +2823,7 @@ void __tcp_close(struct sock *sk, long timeout) * machine. State transitions: * * TCP_ESTABLISHED -> TCP_FIN_WAIT1 - * TCP_SYN_RECV -> TCP_FIN_WAIT1 (forget it, it's impossible) + * TCP_SYN_RECV -> TCP_FIN_WAIT1 (it is difficult) * TCP_CLOSE_WAIT -> TCP_LAST_ACK * * are legal only when FIN has been sent (i.e. in window), diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 7529412827de..259e48b57494 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -6654,6 +6654,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) tcp_initialize_rcv_mss(sk); tcp_fast_path_on(tp); + if (sk->sk_shutdown & SEND_SHUTDOWN) + tcp_shutdown(sk, SEND_SHUTDOWN); break; case TCP_FIN_WAIT1: { diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index f6950a42de20..cc18b8b70be0 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -3585,7 +3585,9 @@ void tcp_send_fin(struct sock *sk) return; } } else { - skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation); + skb = alloc_skb_fclone(MAX_TCP_HEADER, + sk_gfp_mask(sk, GFP_ATOMIC | + __GFP_NOWARN)); if (unlikely(!skb)) return; -- 2.34.1

2 1