- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
by Guo Mengqi 15 May '24

15 May '24

From: Alexey Khoroshilov <khoroshilov(a)ispras.ru> stable inclusion from stable-v5.10.210 commit 4a98bc739d0753a5810ce5630943cd7614c7717e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2EF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a path in rt5645_jack_detect_work(), where rt5645->jd_mutex is left locked forever. That may lead to deadlock when rt5645_jack_detect_work() is called for the second time. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: cdba4301adda ("ASoC: rt5650: add mutex to avoid the jack detection failure") Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Link: https://lore.kernel.org/r/1707645514-21196-1-git-send-email-khoroshilov@isp… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- sound/soc/codecs/rt5645.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index 99d91bfb8812..44fb57def4ad 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -3271,6 +3271,7 @@ static void rt5645_jack_detect_work(struct work_struct *work) report, SND_JACK_HEADPHONE); snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); + mutex_unlock(&rt5645->jd_mutex); return; case 4: val = snd_soc_component_read(rt5645->component, RT5645_A_JD_CTRL1) & 0x0020; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
by Guo Mengqi 15 May '24

15 May '24

From: Zach O'Keefe <zokeefe(a)google.com> stable inclusion from stable-v5.10.210 commit 81e7d2530d458548b90a5c5e76b77ad5e5d1c0df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2EC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78 upstream. (struct dirty_throttle_control *)->thresh is an unsigned long, but is passed as the u32 divisor argument to div_u64(). On architectures where unsigned long is 64 bytes, the argument will be implicitly truncated. Use div64_u64() instead of div_u64() so that the value used in the "is this a safe division" check is the same as the divisor. Also, remove redundant cast of the numerator to u64, as that should happen implicitly. This would be difficult to exploit in memcg domain, given the ratio-based arithmetic domain_drity_limits() uses, but is much easier in global writeback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. vm.dirty_bytes=(1<<32)*PAGE_SIZE so that dtc->thresh == (1<<32) Link: https://lkml.kernel.org/r/20240118181954.1415197-1-zokeefe@google.com Fixes: f6789593d5ce ("mm/page-writeback.c: fix divide by zero in bdi_dirty_limits()") Signed-off-by: Zach O'Keefe <zokeefe(a)google.com> Cc: Maxim Patlasov <MPatlasov(a)parallels.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index b72da123f242..e969667e8d62 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1519,7 +1519,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
by Guo Mengqi 15 May '24

15 May '24

From: Zach O'Keefe <zokeefe(a)google.com> stable inclusion from stable-v5.10.210 commit 81e7d2530d458548b90a5c5e76b77ad5e5d1c0df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2EC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78 upstream. (struct dirty_throttle_control *)->thresh is an unsigned long, but is passed as the u32 divisor argument to div_u64(). On architectures where unsigned long is 64 bytes, the argument will be implicitly truncated. Use div64_u64() instead of div_u64() so that the value used in the "is this a safe division" check is the same as the divisor. Also, remove redundant cast of the numerator to u64, as that should happen implicitly. This would be difficult to exploit in memcg domain, given the ratio-based arithmetic domain_drity_limits() uses, but is much easier in global writeback domain with a BDI_CAP_STRICTLIMIT-backing device, using e.g. vm.dirty_bytes=(1<<32)*PAGE_SIZE so that dtc->thresh == (1<<32) Link: https://lkml.kernel.org/r/20240118181954.1415197-1-zokeefe@google.com Fixes: f6789593d5ce ("mm/page-writeback.c: fix divide by zero in bdi_dirty_limits()") Signed-off-by: Zach O'Keefe <zokeefe(a)google.com> Cc: Maxim Patlasov <MPatlasov(a)parallels.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index b72da123f242..e969667e8d62 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1519,7 +1519,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
by Guo Mengqi 15 May '24

15 May '24

From: Alexey Khoroshilov <khoroshilov(a)ispras.ru> stable inclusion from stable-v5.10.210 commit 4a98bc739d0753a5810ce5630943cd7614c7717e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2EF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a path in rt5645_jack_detect_work(), where rt5645->jd_mutex is left locked forever. That may lead to deadlock when rt5645_jack_detect_work() is called for the second time. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: cdba4301adda ("ASoC: rt5650: add mutex to avoid the jack detection failure") Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Link: https://lore.kernel.org/r/1707645514-21196-1-git-send-email-khoroshilov@isp… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- sound/soc/codecs/rt5645.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index d1533e95a74f..f21605db4176 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -3269,6 +3269,7 @@ static void rt5645_jack_detect_work(struct work_struct *work) report, SND_JACK_HEADPHONE); snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); + mutex_unlock(&rt5645->jd_mutex); return; case 4: val = snd_soc_component_read(rt5645->component, RT5645_A_JD_CTRL1) & 0x0020; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
by Guo Mengqi 15 May '24

15 May '24

From: Alexey Khoroshilov <khoroshilov(a)ispras.ru> stable inclusion from stable-v5.10.210 commit 4a98bc739d0753a5810ce5630943cd7614c7717e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2EF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a path in rt5645_jack_detect_work(), where rt5645->jd_mutex is left locked forever. That may lead to deadlock when rt5645_jack_detect_work() is called for the second time. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: cdba4301adda ("ASoC: rt5650: add mutex to avoid the jack detection failure") Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Link: https://lore.kernel.org/r/1707645514-21196-1-git-send-email-khoroshilov@isp… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- sound/soc/codecs/rt5645.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index d1533e95a74f..f21605db4176 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -3269,6 +3269,7 @@ static void rt5645_jack_detect_work(struct work_struct *work) report, SND_JACK_HEADPHONE); snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); + mutex_unlock(&rt5645->jd_mutex); return; case 4: val = snd_soc_component_read(rt5645->component, RT5645_A_JD_CTRL1) & 0x0020; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
by Guo Mengqi 15 May '24

15 May '24

From: Alexey Khoroshilov <khoroshilov(a)ispras.ru> stable inclusion from stable-v5.10.210 commit 4a98bc739d0753a5810ce5630943cd7614c7717e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2EF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a path in rt5645_jack_detect_work(), where rt5645->jd_mutex is left locked forever. That may lead to deadlock when rt5645_jack_detect_work() is called for the second time. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: cdba4301adda ("ASoC: rt5650: add mutex to avoid the jack detection failure") Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Link: https://lore.kernel.org/r/1707645514-21196-1-git-send-email-khoroshilov@isp… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- sound/soc/codecs/rt5645.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index d1533e95a74f..f21605db4176 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -3269,6 +3269,7 @@ static void rt5645_jack_detect_work(struct work_struct *work) report, SND_JACK_HEADPHONE); snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); + mutex_unlock(&rt5645->jd_mutex); return; case 4: val = snd_soc_component_read(rt5645->component, RT5645_A_JD_CTRL1) & 0x0020; -- 2.17.1

2 1

[PATCH OLK-5.10 0/4] CVE-2024-26686
by Guo Mengqi 15 May '24

15 May '24

CVE-2024-26686 Eric W. Biederman (1): exit: Use the correct exit_code in /proc/<pid>/stat Oleg Nesterov (3): fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() fs/proc: do_task_stat: use __for_each_thread() fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats fs/proc/array.c | 69 +++++++++++++++++++++++++++++-------------------- 1 file changed, 41 insertions(+), 28 deletions(-) -- 2.17.1

2 5

[PATCH openEuler-22.03-LTS-SP2 0/4] CVE-2024-26686
by Guo Mengqi 15 May '24

15 May '24

CVE-2024-26686 Eric W. Biederman (1): exit: Use the correct exit_code in /proc/<pid>/stat Oleg Nesterov (3): fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() fs/proc: do_task_stat: use __for_each_thread() fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats fs/proc/array.c | 69 +++++++++++++++++++++++++++++-------------------- 1 file changed, 41 insertions(+), 28 deletions(-) -- 2.17.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/4] CVE-2024-26686
by Guo Mengqi 15 May '24

15 May '24

CVE-2024-26686 Eric W. Biederman (1): exit: Use the correct exit_code in /proc/<pid>/stat Oleg Nesterov (3): fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() fs/proc: do_task_stat: use __for_each_thread() fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats fs/proc/array.c | 69 +++++++++++++++++++++++++++++-------------------- 1 file changed, 41 insertions(+), 28 deletions(-) -- 2.17.1

2 5

[PATCH openEuler-22.03-LTS 0/4] CVE-2024-26686
by Guo Mengqi 15 May '24

15 May '24

CVE-2024-26686 Eric W. Biederman (1): exit: Use the correct exit_code in /proc/<pid>/stat Oleg Nesterov (3): fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() fs/proc: do_task_stat: use __for_each_thread() fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats fs/proc/array.c | 69 +++++++++++++++++++++++++++++-------------------- 1 file changed, 41 insertions(+), 28 deletions(-) -- 2.17.1

2 5

[PATCH openEuler-22.03-LTS-SP1] btrfs: don't drop extent_map for free space inode on write error
by Guo Mengqi 15 May '24

15 May '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v6.1.79 commit 02f2b95b00bf57d20320ee168b30fb7f3db8e555 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2F7 CVE: CVE-2024-26726 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5571e41ec6e56e35f34ae9f5b3a335ef510e0ade upstream. While running the CI for an unrelated change I hit the following panic with generic/648 on btrfs_holes_spacecache. assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1385! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G W 6.8.0-rc2+ #1 RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0 Call Trace: <TASK> extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76 This happens because we fail to write out the free space cache in one instance, come back around and attempt to write it again. However on the second pass through we go to call btrfs_get_extent() on the inode to get the extent mapping. Because this is a new block group, and with the free space inode we always search the commit root to avoid deadlocking with the tree, we find nothing and return a EXTENT_MAP_HOLE for the requested range. This happens because the first time we try to write the space cache out we hit an error, and on an error we drop the extent mapping. This is normal for normal files, but the free space cache inode is special. We always expect the extent map to be correct. Thus the second time through we end up with a bogus extent map. Since we're deprecating this feature, the most straightforward way to fix this is to simply skip dropping the extent map range for this failed range. I shortened the test by using error injection to stress the area to make it easier to reproduce. With this patch in place we no longer panic with my error injection test. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 515e3e997372..b9b5ea4b7762 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -2775,8 +2775,22 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent) unwritten_start += logical_len; clear_extent_uptodate(io_tree, unwritten_start, end, NULL); - /* Drop the cache for the part of the extent we didn't write. */ - btrfs_drop_extent_cache(BTRFS_I(inode), unwritten_start, end, 0); + /* + * Drop extent maps for the part of the extent we didn't write. + * + * We have an exception here for the free_space_inode, this is + * because when we do btrfs_get_extent() on the free space inode + * we will search the commit root. If this is a new block group + * we won't find anything, and we will trip over the assert in + * writepage where we do ASSERT(em->block_start != + * EXTENT_MAP_HOLE). + * + * Theoretically we could also skip this for any NOCOW extent as + * we don't mess with the extent map tree in the NOCOW case, but + * for now simply skip this if we are the free space inode. + */ + if (!btrfs_is_free_space_inode(BTRFS_I(inode))) + btrfs_drop_extent_cache(BTRFS_I(inode), unwritten_start, end, 0); /* * If the ordered extent had an IOERR or something else went -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] btrfs: don't drop extent_map for free space inode on write error
by Guo Mengqi 15 May '24

15 May '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v6.1.79 commit 02f2b95b00bf57d20320ee168b30fb7f3db8e555 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2F7 CVE: CVE-2024-26726 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5571e41ec6e56e35f34ae9f5b3a335ef510e0ade upstream. While running the CI for an unrelated change I hit the following panic with generic/648 on btrfs_holes_spacecache. assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1385! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G W 6.8.0-rc2+ #1 RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0 Call Trace: <TASK> extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76 This happens because we fail to write out the free space cache in one instance, come back around and attempt to write it again. However on the second pass through we go to call btrfs_get_extent() on the inode to get the extent mapping. Because this is a new block group, and with the free space inode we always search the commit root to avoid deadlocking with the tree, we find nothing and return a EXTENT_MAP_HOLE for the requested range. This happens because the first time we try to write the space cache out we hit an error, and on an error we drop the extent mapping. This is normal for normal files, but the free space cache inode is special. We always expect the extent map to be correct. Thus the second time through we end up with a bogus extent map. Since we're deprecating this feature, the most straightforward way to fix this is to simply skip dropping the extent map range for this failed range. I shortened the test by using error injection to stress the area to make it easier to reproduce. With this patch in place we no longer panic with my error injection test. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index b12fc82e34ba..03670d4cd6ed 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -2775,8 +2775,22 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent) unwritten_start += logical_len; clear_extent_uptodate(io_tree, unwritten_start, end, NULL); - /* Drop the cache for the part of the extent we didn't write. */ - btrfs_drop_extent_cache(BTRFS_I(inode), unwritten_start, end, 0); + /* + * Drop extent maps for the part of the extent we didn't write. + * + * We have an exception here for the free_space_inode, this is + * because when we do btrfs_get_extent() on the free space inode + * we will search the commit root. If this is a new block group + * we won't find anything, and we will trip over the assert in + * writepage where we do ASSERT(em->block_start != + * EXTENT_MAP_HOLE). + * + * Theoretically we could also skip this for any NOCOW extent as + * we don't mess with the extent map tree in the NOCOW case, but + * for now simply skip this if we are the free space inode. + */ + if (!btrfs_is_free_space_inode(BTRFS_I(inode))) + btrfs_drop_extent_cache(BTRFS_I(inode), unwritten_start, end, 0); /* * If the ordered extent had an IOERR or something else went -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] btrfs: don't drop extent_map for free space inode on write error
by Guo Mengqi 15 May '24

15 May '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v6.1.79 commit 02f2b95b00bf57d20320ee168b30fb7f3db8e555 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2F7 CVE: CVE-2024-26726 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5571e41ec6e56e35f34ae9f5b3a335ef510e0ade upstream. While running the CI for an unrelated change I hit the following panic with generic/648 on btrfs_holes_spacecache. assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1385! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G W 6.8.0-rc2+ #1 RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0 Call Trace: <TASK> extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76 This happens because we fail to write out the free space cache in one instance, come back around and attempt to write it again. However on the second pass through we go to call btrfs_get_extent() on the inode to get the extent mapping. Because this is a new block group, and with the free space inode we always search the commit root to avoid deadlocking with the tree, we find nothing and return a EXTENT_MAP_HOLE for the requested range. This happens because the first time we try to write the space cache out we hit an error, and on an error we drop the extent mapping. This is normal for normal files, but the free space cache inode is special. We always expect the extent map to be correct. Thus the second time through we end up with a bogus extent map. Since we're deprecating this feature, the most straightforward way to fix this is to simply skip dropping the extent map range for this failed range. I shortened the test by using error injection to stress the area to make it easier to reproduce. With this patch in place we no longer panic with my error injection test. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 515e3e997372..b9b5ea4b7762 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -2775,8 +2775,22 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent) unwritten_start += logical_len; clear_extent_uptodate(io_tree, unwritten_start, end, NULL); - /* Drop the cache for the part of the extent we didn't write. */ - btrfs_drop_extent_cache(BTRFS_I(inode), unwritten_start, end, 0); + /* + * Drop extent maps for the part of the extent we didn't write. + * + * We have an exception here for the free_space_inode, this is + * because when we do btrfs_get_extent() on the free space inode + * we will search the commit root. If this is a new block group + * we won't find anything, and we will trip over the assert in + * writepage where we do ASSERT(em->block_start != + * EXTENT_MAP_HOLE). + * + * Theoretically we could also skip this for any NOCOW extent as + * we don't mess with the extent map tree in the NOCOW case, but + * for now simply skip this if we are the free space inode. + */ + if (!btrfs_is_free_space_inode(BTRFS_I(inode))) + btrfs_drop_extent_cache(BTRFS_I(inode), unwritten_start, end, 0); /* * If the ordered extent had an IOERR or something else went -- 2.17.1

2 1

[PATCH OLK-5.10] iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
by Guo Mengqi 15 May '24

15 May '24

From: "zhili.liu" <zhili.liu(a)ucas.com.cn> stable inclusion from stable-v5.10.210 commit 36a49290d7e6d554020057a409747a092b1d3b56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 792595bab4925aa06532a14dd256db523eb4fa5e upstream. Recently, we encounter kernel crash in function rm3100_common_probe caused by out of bound access of array rm3100_samp_rates (because of underlying hardware failures). Add boundary check to prevent out of bound access. Fixes: 121354b2eceb ("iio: magnetometer: Add driver support for PNI RM3100") Suggested-by: Zhouyi Zhou <zhouzhouyi(a)gmail.com> Signed-off-by: zhili.liu <zhili.liu(a)ucas.com.cn> Link: https://lore.kernel.org/r/1704157631-3814-1-git-send-email-zhouzhouyi@gmail… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/magnetometer/rm3100-core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/iio/magnetometer/rm3100-core.c b/drivers/iio/magnetometer/rm3100-core.c index 720234a91db1..e7690d38621a 100644 --- a/drivers/iio/magnetometer/rm3100-core.c +++ b/drivers/iio/magnetometer/rm3100-core.c @@ -538,6 +538,7 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq) struct rm3100_data *data; unsigned int tmp; int ret; + int samp_rate_index; indio_dev = devm_iio_device_alloc(dev, sizeof(*data)); if (!indio_dev) @@ -596,9 +597,14 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq) ret = regmap_read(regmap, RM3100_REG_TMRC, &tmp); if (ret < 0) return ret; + + samp_rate_index = tmp - RM3100_TMRC_OFFSET; + if (samp_rate_index < 0 || samp_rate_index >= RM3100_SAMP_NUM) { + dev_err(dev, "The value read from RM3100_REG_TMRC is invalid!\n"); + return -EINVAL; + } /* Initializing max wait time, which is double conversion time. */ - data->conversion_time = rm3100_samp_rates[tmp - RM3100_TMRC_OFFSET][2] - * 2; + data->conversion_time = rm3100_samp_rates[samp_rate_index][2] * 2; /* Cycle count values may not be what we want. */ if ((tmp - RM3100_TMRC_OFFSET) == 0) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
by Guo Mengqi 15 May '24

15 May '24

From: "zhili.liu" <zhili.liu(a)ucas.com.cn> stable inclusion from stable-v5.10.210 commit 36a49290d7e6d554020057a409747a092b1d3b56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 792595bab4925aa06532a14dd256db523eb4fa5e upstream. Recently, we encounter kernel crash in function rm3100_common_probe caused by out of bound access of array rm3100_samp_rates (because of underlying hardware failures). Add boundary check to prevent out of bound access. Fixes: 121354b2eceb ("iio: magnetometer: Add driver support for PNI RM3100") Suggested-by: Zhouyi Zhou <zhouzhouyi(a)gmail.com> Signed-off-by: zhili.liu <zhili.liu(a)ucas.com.cn> Link: https://lore.kernel.org/r/1704157631-3814-1-git-send-email-zhouzhouyi@gmail… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/magnetometer/rm3100-core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/iio/magnetometer/rm3100-core.c b/drivers/iio/magnetometer/rm3100-core.c index 720234a91db1..e7690d38621a 100644 --- a/drivers/iio/magnetometer/rm3100-core.c +++ b/drivers/iio/magnetometer/rm3100-core.c @@ -538,6 +538,7 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq) struct rm3100_data *data; unsigned int tmp; int ret; + int samp_rate_index; indio_dev = devm_iio_device_alloc(dev, sizeof(*data)); if (!indio_dev) @@ -596,9 +597,14 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq) ret = regmap_read(regmap, RM3100_REG_TMRC, &tmp); if (ret < 0) return ret; + + samp_rate_index = tmp - RM3100_TMRC_OFFSET; + if (samp_rate_index < 0 || samp_rate_index >= RM3100_SAMP_NUM) { + dev_err(dev, "The value read from RM3100_REG_TMRC is invalid!\n"); + return -EINVAL; + } /* Initializing max wait time, which is double conversion time. */ - data->conversion_time = rm3100_samp_rates[tmp - RM3100_TMRC_OFFSET][2] - * 2; + data->conversion_time = rm3100_samp_rates[samp_rate_index][2] * 2; /* Cycle count values may not be what we want. */ if ((tmp - RM3100_TMRC_OFFSET) == 0) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
by Guo Mengqi 15 May '24

15 May '24

From: "zhili.liu" <zhili.liu(a)ucas.com.cn> stable inclusion from stable-v5.10.210 commit 36a49290d7e6d554020057a409747a092b1d3b56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 792595bab4925aa06532a14dd256db523eb4fa5e upstream. Recently, we encounter kernel crash in function rm3100_common_probe caused by out of bound access of array rm3100_samp_rates (because of underlying hardware failures). Add boundary check to prevent out of bound access. Fixes: 121354b2eceb ("iio: magnetometer: Add driver support for PNI RM3100") Suggested-by: Zhouyi Zhou <zhouzhouyi(a)gmail.com> Signed-off-by: zhili.liu <zhili.liu(a)ucas.com.cn> Link: https://lore.kernel.org/r/1704157631-3814-1-git-send-email-zhouzhouyi@gmail… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/magnetometer/rm3100-core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/iio/magnetometer/rm3100-core.c b/drivers/iio/magnetometer/rm3100-core.c index 720234a91db1..e7690d38621a 100644 --- a/drivers/iio/magnetometer/rm3100-core.c +++ b/drivers/iio/magnetometer/rm3100-core.c @@ -538,6 +538,7 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq) struct rm3100_data *data; unsigned int tmp; int ret; + int samp_rate_index; indio_dev = devm_iio_device_alloc(dev, sizeof(*data)); if (!indio_dev) @@ -596,9 +597,14 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq) ret = regmap_read(regmap, RM3100_REG_TMRC, &tmp); if (ret < 0) return ret; + + samp_rate_index = tmp - RM3100_TMRC_OFFSET; + if (samp_rate_index < 0 || samp_rate_index >= RM3100_SAMP_NUM) { + dev_err(dev, "The value read from RM3100_REG_TMRC is invalid!\n"); + return -EINVAL; + } /* Initializing max wait time, which is double conversion time. */ - data->conversion_time = rm3100_samp_rates[tmp - RM3100_TMRC_OFFSET][2] - * 2; + data->conversion_time = rm3100_samp_rates[samp_rate_index][2] * 2; /* Cycle count values may not be what we want. */ if ((tmp - RM3100_TMRC_OFFSET) == 0) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
by Guo Mengqi 15 May '24

15 May '24

From: "zhili.liu" <zhili.liu(a)ucas.com.cn> stable inclusion from stable-v5.10.210 commit 36a49290d7e6d554020057a409747a092b1d3b56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 792595bab4925aa06532a14dd256db523eb4fa5e upstream. Recently, we encounter kernel crash in function rm3100_common_probe caused by out of bound access of array rm3100_samp_rates (because of underlying hardware failures). Add boundary check to prevent out of bound access. Fixes: 121354b2eceb ("iio: magnetometer: Add driver support for PNI RM3100") Suggested-by: Zhouyi Zhou <zhouzhouyi(a)gmail.com> Signed-off-by: zhili.liu <zhili.liu(a)ucas.com.cn> Link: https://lore.kernel.org/r/1704157631-3814-1-git-send-email-zhouzhouyi@gmail… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/magnetometer/rm3100-core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/iio/magnetometer/rm3100-core.c b/drivers/iio/magnetometer/rm3100-core.c index 720234a91db1..e7690d38621a 100644 --- a/drivers/iio/magnetometer/rm3100-core.c +++ b/drivers/iio/magnetometer/rm3100-core.c @@ -538,6 +538,7 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq) struct rm3100_data *data; unsigned int tmp; int ret; + int samp_rate_index; indio_dev = devm_iio_device_alloc(dev, sizeof(*data)); if (!indio_dev) @@ -596,9 +597,14 @@ int rm3100_common_probe(struct device *dev, struct regmap *regmap, int irq) ret = regmap_read(regmap, RM3100_REG_TMRC, &tmp); if (ret < 0) return ret; + + samp_rate_index = tmp - RM3100_TMRC_OFFSET; + if (samp_rate_index < 0 || samp_rate_index >= RM3100_SAMP_NUM) { + dev_err(dev, "The value read from RM3100_REG_TMRC is invalid!\n"); + return -EINVAL; + } /* Initializing max wait time, which is double conversion time. */ - data->conversion_time = rm3100_samp_rates[tmp - RM3100_TMRC_OFFSET][2] - * 2; + data->conversion_time = rm3100_samp_rates[samp_rate_index][2] * 2; /* Cycle count values may not be what we want. */ if ((tmp - RM3100_TMRC_OFFSET) == 0) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] nilfs2: fix potential bug in end_buffer_async_write
by Guo Mengqi 15 May '24

15 May '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.210 commit f3e4963566f58726d3265a727116a42b591f6596 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FP Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5bc09b397cbf1221f8a8aacb1152650c9195b02b upstream. According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async_write flag and cause a BUG_ON failure when using nilfs2. Nilfs2 itself does not use end_buffer_async_write(). But, the async_write flag is now used as a marker by commit 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") as a means of resolving double list insertion of dirty blocks in nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the resulting crash. This modification is safe as long as it is used for file data and b-tree node blocks where the page caches are independent. However, it was irrelevant and redundant to also introduce async_write for segment summary and super root blocks that share buffers with the backing device. This led to the possibility that the BUG_ON check in end_buffer_async_write would fail as described above, if independent writebacks of the backing device occurred in parallel. The use of async_write for segment summary buffers has already been removed in a previous change. Fix this issue by removing the manipulation of the async_write flag for the remaining super root block buffer. Link: https://lkml.kernel.org/r/20240203161645.4992-1-konishi.ryusuke@gmail.com Fixes: 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+5c04210f7c7f897c1e7f(a)syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/00000000000019a97c05fd42f8c8@google.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- fs/nilfs2/segment.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 4a910c8a5691..f264e3a4f0aa 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1702,7 +1702,6 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) list_for_each_entry(bh, &segbuf->sb_payload_buffers, b_assoc_buffers) { - set_buffer_async_write(bh); if (bh == segbuf->sb_super_root) { if (bh->b_page != bd_page) { lock_page(bd_page); @@ -1713,6 +1712,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } break; } + set_buffer_async_write(bh); if (bh->b_page != fs_page) { nilfs_begin_page_io(fs_page); fs_page = bh->b_page; @@ -1798,7 +1798,6 @@ static void nilfs_abort_logs(struct list_head *logs, int err) list_for_each_entry(bh, &segbuf->sb_payload_buffers, b_assoc_buffers) { - clear_buffer_async_write(bh); if (bh == segbuf->sb_super_root) { clear_buffer_uptodate(bh); if (bh->b_page != bd_page) { @@ -1807,6 +1806,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err) } break; } + clear_buffer_async_write(bh); if (bh->b_page != fs_page) { nilfs_end_page_io(fs_page, err); fs_page = bh->b_page; @@ -1894,8 +1894,9 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci) BIT(BH_Delay) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Redirected)); - set_mask_bits(&bh->b_state, clear_bits, set_bits); if (bh == segbuf->sb_super_root) { + set_buffer_uptodate(bh); + clear_buffer_dirty(bh); if (bh->b_page != bd_page) { end_page_writeback(bd_page); bd_page = bh->b_page; @@ -1903,6 +1904,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci) update_sr = true; break; } + set_mask_bits(&bh->b_state, clear_bits, set_bits); if (bh->b_page != fs_page) { nilfs_end_page_io(fs_page, 0); fs_page = bh->b_page; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] nilfs2: fix data corruption in dsync block recovery for small block sizes
by Guo Mengqi 15 May '24

15 May '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.210 commit 364a66be2abdcd4fd426ffa44d9b8f40aafb3caa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FH Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 67b8bcbaed4777871bb0dcc888fb02a614a98ab1 upstream. The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache. In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process. Fix these issues by correcting this byte offset calculation on the page. Link: https://lkml.kernel.org/r/20240124121936.10575-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- fs/nilfs2/recovery.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c index 2217f904a7cf..188b8cc52e2b 100644 --- a/fs/nilfs2/recovery.c +++ b/fs/nilfs2/recovery.c @@ -472,9 +472,10 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs, static int nilfs_recovery_copy_block(struct the_nilfs *nilfs, struct nilfs_recovery_block *rb, - struct page *page) + loff_t pos, struct page *page) { struct buffer_head *bh_org; + size_t from = pos & ~PAGE_MASK; void *kaddr; bh_org = __bread(nilfs->ns_bdev, rb->blocknr, nilfs->ns_blocksize); @@ -482,7 +483,7 @@ static int nilfs_recovery_copy_block(struct the_nilfs *nilfs, return -EIO; kaddr = kmap_atomic(page); - memcpy(kaddr + bh_offset(bh_org), bh_org->b_data, bh_org->b_size); + memcpy(kaddr + from, bh_org->b_data, bh_org->b_size); kunmap_atomic(kaddr); brelse(bh_org); return 0; @@ -521,7 +522,7 @@ static int nilfs_recover_dsync_blocks(struct the_nilfs *nilfs, goto failed_inode; } - err = nilfs_recovery_copy_block(nilfs, rb, page); + err = nilfs_recovery_copy_block(nilfs, rb, pos, page); if (unlikely(err)) goto failed_page; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] nilfs2: fix data corruption in dsync block recovery for small block sizes
by Guo Mengqi 15 May '24

15 May '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.210 commit 364a66be2abdcd4fd426ffa44d9b8f40aafb3caa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FH Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 67b8bcbaed4777871bb0dcc888fb02a614a98ab1 upstream. The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache. In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process. Fix these issues by correcting this byte offset calculation on the page. Link: https://lkml.kernel.org/r/20240124121936.10575-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- fs/nilfs2/recovery.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c index 2217f904a7cf..188b8cc52e2b 100644 --- a/fs/nilfs2/recovery.c +++ b/fs/nilfs2/recovery.c @@ -472,9 +472,10 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs, static int nilfs_recovery_copy_block(struct the_nilfs *nilfs, struct nilfs_recovery_block *rb, - struct page *page) + loff_t pos, struct page *page) { struct buffer_head *bh_org; + size_t from = pos & ~PAGE_MASK; void *kaddr; bh_org = __bread(nilfs->ns_bdev, rb->blocknr, nilfs->ns_blocksize); @@ -482,7 +483,7 @@ static int nilfs_recovery_copy_block(struct the_nilfs *nilfs, return -EIO; kaddr = kmap_atomic(page); - memcpy(kaddr + bh_offset(bh_org), bh_org->b_data, bh_org->b_size); + memcpy(kaddr + from, bh_org->b_data, bh_org->b_size); kunmap_atomic(kaddr); brelse(bh_org); return 0; @@ -521,7 +522,7 @@ static int nilfs_recover_dsync_blocks(struct the_nilfs *nilfs, goto failed_inode; } - err = nilfs_recovery_copy_block(nilfs, rb, page); + err = nilfs_recovery_copy_block(nilfs, rb, pos, page); if (unlikely(err)) goto failed_page; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix data corruption in dsync block recovery for small block sizes
by Guo Mengqi 15 May '24

15 May '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.210 commit 364a66be2abdcd4fd426ffa44d9b8f40aafb3caa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FH Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 67b8bcbaed4777871bb0dcc888fb02a614a98ab1 upstream. The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache. In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process. Fix these issues by correcting this byte offset calculation on the page. Link: https://lkml.kernel.org/r/20240124121936.10575-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- fs/nilfs2/recovery.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c index 2217f904a7cf..188b8cc52e2b 100644 --- a/fs/nilfs2/recovery.c +++ b/fs/nilfs2/recovery.c @@ -472,9 +472,10 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs, static int nilfs_recovery_copy_block(struct the_nilfs *nilfs, struct nilfs_recovery_block *rb, - struct page *page) + loff_t pos, struct page *page) { struct buffer_head *bh_org; + size_t from = pos & ~PAGE_MASK; void *kaddr; bh_org = __bread(nilfs->ns_bdev, rb->blocknr, nilfs->ns_blocksize); @@ -482,7 +483,7 @@ static int nilfs_recovery_copy_block(struct the_nilfs *nilfs, return -EIO; kaddr = kmap_atomic(page); - memcpy(kaddr + bh_offset(bh_org), bh_org->b_data, bh_org->b_size); + memcpy(kaddr + from, bh_org->b_data, bh_org->b_size); kunmap_atomic(kaddr); brelse(bh_org); return 0; @@ -521,7 +522,7 @@ static int nilfs_recover_dsync_blocks(struct the_nilfs *nilfs, goto failed_inode; } - err = nilfs_recovery_copy_block(nilfs, rb, page); + err = nilfs_recovery_copy_block(nilfs, rb, pos, page); if (unlikely(err)) goto failed_page; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
by Guo Mengqi 15 May '24

15 May '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v5.10.210 commit 0d8011a878fdf96123bc0d6a12e2fe7ced5fddfb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 37e8c97e539015637cb920d3e6f1e404f707a06e upstream. Syzkaller reported [1] hitting a warning after failing to allocate resources for skb in hsr_init_skb(). Since a WARN_ONCE() call will not help much in this case, it might be prudent to switch to netdev_warn_once(). At the very least it will suppress syzkaller reports such as [1]. Just in case, use netdev_warn_once() in send_prp_supervision_frame() for similar reasons. [1] HSR: Could not send supervision frame WARNING: CPU: 1 PID: 85 at net/hsr/hsr_device.c:294 send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294 RIP: 0010:send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294 ... Call Trace: <IRQ> hsr_announce+0x114/0x370 net/hsr/hsr_device.c:382 call_timer_fn+0x193/0x590 kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x764/0xb20 kernel/time/timer.c:2022 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035 __do_softirq+0x21a/0x8de kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649 ... This issue is also found in older kernels (at least up to 5.10). Cc: stable(a)vger.kernel.org Reported-by: syzbot+3ae0a3f42c84074b7c8e(a)syzkaller.appspotmail.com Fixes: 121c33b07b31 ("net: hsr: introduce common code for skb initialization") Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/hsr/hsr_device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c index 84e6ef4f3525..c5a4c5fb7293 100644 --- a/net/hsr/hsr_device.c +++ b/net/hsr/hsr_device.c @@ -291,7 +291,7 @@ static void send_hsr_supervision_frame(struct hsr_port *master, skb = hsr_init_skb(master); if (!skb) { - WARN_ONCE(1, "HSR: Could not send supervision frame\n"); + netdev_warn_once(master->dev, "HSR: Could not send supervision frame\n"); return; } @@ -338,7 +338,7 @@ static void send_prp_supervision_frame(struct hsr_port *master, skb = hsr_init_skb(master); if (!skb) { - WARN_ONCE(1, "PRP: Could not send supervision frame\n"); + netdev_warn_once(master->dev, "PRP: Could not send supervision frame\n"); return; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] powerpc/kasan: Fix addr error caused by page alignment
by Guo Mengqi 15 May '24

15 May '24

From: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> mainline inclusion from mainline-v6.8-rc5 commit 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In kasan_init_region, when k_start is not page aligned, at the begin of for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then `va = block + k_cur - k_start` is less than block, the addr va is invalid, because the memory address space from va to block is not alloced by memblock_alloc, which will not be reserved by memblock_reserve later, it will be used by other places. As a result, memory overwriting occurs. for example: int __init __weak kasan_init_region(void *start, size_t size) { [...] /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ block = memblock_alloc(k_end - k_start, PAGE_SIZE); [...] for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) { /* at the begin of for loop * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400) * va(dcd96c00) is less than block(dcd97000), va is invalid */ void *va = block + k_cur - k_start; [...] } [...] } Therefore, page alignment is performed on k_start before memblock_alloc() to ensure the validity of the VA address. Fixes: 663c0c9496a6 ("powerpc/kasan: Fix shadow area set up for modules.") Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/1705974359-43790-1-git-send-email-xiaojiangfeng@huawei.c… Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> --- arch/powerpc/mm/kasan/kasan_init_32.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c index f3e4d069e0ba..643fc525897d 100644 --- a/arch/powerpc/mm/kasan/kasan_init_32.c +++ b/arch/powerpc/mm/kasan/kasan_init_32.c @@ -64,6 +64,7 @@ int __init __weak kasan_init_region(void *start, size_t size) if (ret) return ret; + k_start = k_start & PAGE_MASK; block = memblock_alloc(k_end - k_start, PAGE_SIZE); if (!block) return -ENOMEM; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] powerpc/kasan: Fix addr error caused by page alignment
by Guo Mengqi 15 May '24

15 May '24

From: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> mainline inclusion from mainline-v6.8-rc5 commit 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In kasan_init_region, when k_start is not page aligned, at the begin of for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then `va = block + k_cur - k_start` is less than block, the addr va is invalid, because the memory address space from va to block is not alloced by memblock_alloc, which will not be reserved by memblock_reserve later, it will be used by other places. As a result, memory overwriting occurs. for example: int __init __weak kasan_init_region(void *start, size_t size) { [...] /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ block = memblock_alloc(k_end - k_start, PAGE_SIZE); [...] for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) { /* at the begin of for loop * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400) * va(dcd96c00) is less than block(dcd97000), va is invalid */ void *va = block + k_cur - k_start; [...] } [...] } Therefore, page alignment is performed on k_start before memblock_alloc() to ensure the validity of the VA address. Fixes: 663c0c9496a6 ("powerpc/kasan: Fix shadow area set up for modules.") Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/1705974359-43790-1-git-send-email-xiaojiangfeng@huawei.c… Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> --- arch/powerpc/mm/kasan/kasan_init_32.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c index f3e4d069e0ba..643fc525897d 100644 --- a/arch/powerpc/mm/kasan/kasan_init_32.c +++ b/arch/powerpc/mm/kasan/kasan_init_32.c @@ -64,6 +64,7 @@ int __init __weak kasan_init_region(void *start, size_t size) if (ret) return ret; + k_start = k_start & PAGE_MASK; block = memblock_alloc(k_end - k_start, PAGE_SIZE); if (!block) return -ENOMEM; -- 2.17.1

2 1

[PATCH OLK-5.10] powerpc/kasan: Fix addr error caused by page alignment
by Guo Mengqi 15 May '24

15 May '24

From: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> mainline inclusion from mainline-v6.8-rc5 commit 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In kasan_init_region, when k_start is not page aligned, at the begin of for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then `va = block + k_cur - k_start` is less than block, the addr va is invalid, because the memory address space from va to block is not alloced by memblock_alloc, which will not be reserved by memblock_reserve later, it will be used by other places. As a result, memory overwriting occurs. for example: int __init __weak kasan_init_region(void *start, size_t size) { [...] /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ block = memblock_alloc(k_end - k_start, PAGE_SIZE); [...] for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) { /* at the begin of for loop * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400) * va(dcd96c00) is less than block(dcd97000), va is invalid */ void *va = block + k_cur - k_start; [...] } [...] } Therefore, page alignment is performed on k_start before memblock_alloc() to ensure the validity of the VA address. Fixes: 663c0c9496a6 ("powerpc/kasan: Fix shadow area set up for modules.") Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/1705974359-43790-1-git-send-email-xiaojiangfeng@huawei.c… Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> --- arch/powerpc/mm/kasan/kasan_init_32.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c index f3e4d069e0ba..643fc525897d 100644 --- a/arch/powerpc/mm/kasan/kasan_init_32.c +++ b/arch/powerpc/mm/kasan/kasan_init_32.c @@ -64,6 +64,7 @@ int __init __weak kasan_init_region(void *start, size_t size) if (ret) return ret; + k_start = k_start & PAGE_MASK; block = memblock_alloc(k_end - k_start, PAGE_SIZE); if (!block) return -ENOMEM; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] powerpc/kasan: Fix addr error caused by page alignment
by Guo Mengqi 15 May '24

15 May '24

From: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> mainline inclusion from mainline-v6.8-rc5 commit 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2FQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In kasan_init_region, when k_start is not page aligned, at the begin of for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then `va = block + k_cur - k_start` is less than block, the addr va is invalid, because the memory address space from va to block is not alloced by memblock_alloc, which will not be reserved by memblock_reserve later, it will be used by other places. As a result, memory overwriting occurs. for example: int __init __weak kasan_init_region(void *start, size_t size) { [...] /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */ block = memblock_alloc(k_end - k_start, PAGE_SIZE); [...] for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) { /* at the begin of for loop * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400) * va(dcd96c00) is less than block(dcd97000), va is invalid */ void *va = block + k_cur - k_start; [...] } [...] } Therefore, page alignment is performed on k_start before memblock_alloc() to ensure the validity of the VA address. Fixes: 663c0c9496a6 ("powerpc/kasan: Fix shadow area set up for modules.") Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/1705974359-43790-1-git-send-email-xiaojiangfeng@huawei.c… Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> --- arch/powerpc/mm/kasan/kasan_init_32.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c index f3e4d069e0ba..643fc525897d 100644 --- a/arch/powerpc/mm/kasan/kasan_init_32.c +++ b/arch/powerpc/mm/kasan/kasan_init_32.c @@ -64,6 +64,7 @@ int __init __weak kasan_init_region(void *start, size_t size) if (ret) return ret; + k_start = k_start & PAGE_MASK; block = memblock_alloc(k_end - k_start, PAGE_SIZE); if (!block) return -ENOMEM; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] KVM: s390: vsie: fix race during shadow creation
by Guo Mengqi 15 May '24

15 May '24

From: Christian Borntraeger <borntraeger(a)linux.ibm.com> stable inclusion from stable-v6.1.82 commit 5df3b81a567eb565029563f26f374ae3803a1dfc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GQ CVE: CVE-2023-52639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fe752331d4b361d43cfd0b89534b4b2176057c32 ] Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation: static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) { [...] gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); gmap->private = vcpu->kvm; Let children inherit the private field of the parent. Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization") Cc: <stable(a)vger.kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Reviewed-by: Janosch Frank <frankja(a)linux.ibm.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger(a)linux.ibm.com> Link: https://lore.kernel.org/r/20231220125317.4258-1-borntraeger@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflicts: arch/s390/kvm/vsie.c Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- arch/s390/kvm/vsie.c | 1 - arch/s390/mm/gmap.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c index 3fbf7081c000..ebfc4386d140 100644 --- a/arch/s390/kvm/vsie.c +++ b/arch/s390/kvm/vsie.c @@ -1197,7 +1197,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); - gmap->private = vcpu->kvm; WRITE_ONCE(vsie_page->gmap, gmap); return 0; } diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 03e561608eed..ac74cb6206a1 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -1663,6 +1663,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce, return ERR_PTR(-ENOMEM); new->mm = parent->mm; new->parent = gmap_get(parent); + new->private = parent->private; new->orig_asce = asce; new->edat_level = edat_level; new->initialized = false; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] KVM: s390: vsie: fix race during shadow creation
by Guo Mengqi 15 May '24

15 May '24

From: Christian Borntraeger <borntraeger(a)linux.ibm.com> stable inclusion from stable-v6.1.82 commit 5df3b81a567eb565029563f26f374ae3803a1dfc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GQ CVE: CVE-2023-52639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fe752331d4b361d43cfd0b89534b4b2176057c32 ] Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation: static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) { [...] gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); gmap->private = vcpu->kvm; Let children inherit the private field of the parent. Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization") Cc: <stable(a)vger.kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Reviewed-by: Janosch Frank <frankja(a)linux.ibm.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger(a)linux.ibm.com> Link: https://lore.kernel.org/r/20231220125317.4258-1-borntraeger@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflicts: arch/s390/kvm/vsie.c Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- arch/s390/kvm/vsie.c | 1 - arch/s390/mm/gmap.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c index ff58decfef5e..359659d6684d 100644 --- a/arch/s390/kvm/vsie.c +++ b/arch/s390/kvm/vsie.c @@ -1199,7 +1199,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); - gmap->private = vcpu->kvm; WRITE_ONCE(vsie_page->gmap, gmap); return 0; } diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 0ba3af22bfe5..9168dfe7a767 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -1663,6 +1663,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce, return ERR_PTR(-ENOMEM); new->mm = parent->mm; new->parent = gmap_get(parent); + new->private = parent->private; new->orig_asce = asce; new->edat_level = edat_level; new->initialized = false; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] KVM: s390: vsie: fix race during shadow creation
by Guo Mengqi 15 May '24

15 May '24

From: Christian Borntraeger <borntraeger(a)linux.ibm.com> stable inclusion from stable-v6.1.82 commit 5df3b81a567eb565029563f26f374ae3803a1dfc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GQ CVE: CVE-2023-52639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fe752331d4b361d43cfd0b89534b4b2176057c32 ] Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation: static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) { [...] gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); gmap->private = vcpu->kvm; Let children inherit the private field of the parent. Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization") Cc: <stable(a)vger.kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Reviewed-by: Janosch Frank <frankja(a)linux.ibm.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger(a)linux.ibm.com> Link: https://lore.kernel.org/r/20231220125317.4258-1-borntraeger@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflicts: arch/s390/kvm/vsie.c Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- arch/s390/kvm/vsie.c | 1 - arch/s390/mm/gmap.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c index 3fbf7081c000..ebfc4386d140 100644 --- a/arch/s390/kvm/vsie.c +++ b/arch/s390/kvm/vsie.c @@ -1197,7 +1197,6 @@ static int acquire_gmap_shadow(struct kvm_vcpu *vcpu, gmap = gmap_shadow(vcpu->arch.gmap, asce, edat); if (IS_ERR(gmap)) return PTR_ERR(gmap); - gmap->private = vcpu->kvm; WRITE_ONCE(vsie_page->gmap, gmap); return 0; } diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c index 03e561608eed..ac74cb6206a1 100644 --- a/arch/s390/mm/gmap.c +++ b/arch/s390/mm/gmap.c @@ -1663,6 +1663,7 @@ struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce, return ERR_PTR(-ENOMEM); new->mm = parent->mm; new->parent = gmap_get(parent); + new->private = parent->private; new->orig_asce = asce; new->edat_level = edat_level; new->initialized = false; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] RDMA/mlx5: Fix fortify source warning while accessing Eth segment
by Guo Mengqi 15 May '24

15 May '24

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v5.10.214 commit d27c48dc309da72c3b46351a1205d89687272baa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK6L CVE: CVE-2024-26907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4d5e86a56615cc387d21c629f9af8fb0e958d350 ] ------------[ cut here ]------------ memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2) WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy [last unloaded: mlx_compat(OE)] CPU: 0 PID: 293779 Comm: ssh Tainted: G OE 6.2.0-32-generic #32~22.04.1-Ubuntu Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da <0f> 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7 RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8 R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80 FS: 00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0x72/0x90 ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] ? __warn+0x8d/0x160 ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] ? report_bug+0x1bb/0x1d0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x19/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib] ipoib_send+0x2ec/0x770 [ib_ipoib] ipoib_start_xmit+0x5a0/0x770 [ib_ipoib] dev_hard_start_xmit+0x8e/0x1e0 ? validate_xmit_skb_list+0x4d/0x80 sch_direct_xmit+0x116/0x3a0 __dev_xmit_skb+0x1fd/0x580 __dev_queue_xmit+0x284/0x6b0 ? _raw_spin_unlock_irq+0xe/0x50 ? __flush_work.isra.0+0x20d/0x370 ? push_pseudo_header+0x17/0x40 [ib_ipoib] neigh_connected_output+0xcd/0x110 ip_finish_output2+0x179/0x480 ? __smp_call_single_queue+0x61/0xa0 __ip_finish_output+0xc3/0x190 ip_finish_output+0x2e/0xf0 ip_output+0x78/0x110 ? __pfx_ip_finish_output+0x10/0x10 ip_local_out+0x64/0x70 __ip_queue_xmit+0x18a/0x460 ip_queue_xmit+0x15/0x30 __tcp_transmit_skb+0x914/0x9c0 tcp_write_xmit+0x334/0x8d0 tcp_push_one+0x3c/0x60 tcp_sendmsg_locked+0x2e1/0xac0 tcp_sendmsg+0x2d/0x50 inet_sendmsg+0x43/0x90 sock_sendmsg+0x68/0x80 sock_write_iter+0x93/0x100 vfs_write+0x326/0x3c0 ksys_write+0xbd/0xf0 ? do_syscall_64+0x69/0x90 __x64_sys_write+0x19/0x30 do_syscall_64+0x59/0x90 ? do_user_addr_fault+0x1d0/0x640 ? exit_to_user_mode_prepare+0x3b/0xd0 ? irqentry_exit_to_user_mode+0x9/0x20 ? irqentry_exit+0x43/0x50 ? exc_page_fault+0x92/0x1b0 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fc03ad14a37 Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffdf8697fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000008024 RCX: 00007fc03ad14a37 RDX: 0000000000008024 RSI: 0000556f46bd8270 RDI: 0000000000000003 RBP: 0000556f46bb1800 R08: 0000000000007fe3 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 0000556f46bc66b0 R14: 000000000000000a R15: 0000556f46bb2f50 </TASK> ---[ end trace 0000000000000000 ]--- Link: https://lore.kernel.org/r/8228ad34bd1a25047586270f7b1fb4ddcd046282.17064339… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/infiniband/hw/mlx5/wr.c | 2 +- include/linux/mlx5/qp.h | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/wr.c b/drivers/infiniband/hw/mlx5/wr.c index d6038fb6c50c..19fd440a6ce3 100644 --- a/drivers/infiniband/hw/mlx5/wr.c +++ b/drivers/infiniband/hw/mlx5/wr.c @@ -128,7 +128,7 @@ static void set_eth_seg(const struct ib_send_wr *wr, struct mlx5_ib_qp *qp, */ copysz = min_t(u64, *cur_edge - (void *)eseg->inline_hdr.start, left); - memcpy(eseg->inline_hdr.start, pdata, copysz); + memcpy(eseg->inline_hdr.data, pdata, copysz); stride = ALIGN(sizeof(struct mlx5_wqe_eth_seg) - sizeof(eseg->inline_hdr.start) + copysz, 16); *size += stride / 16; diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h index d75ef8aa8fac..28d44061d670 100644 --- a/include/linux/mlx5/qp.h +++ b/include/linux/mlx5/qp.h @@ -261,7 +261,10 @@ struct mlx5_wqe_eth_seg { union { struct { __be16 sz; - u8 start[2]; + union { + u8 start[2]; + DECLARE_FLEX_ARRAY(u8, data); + }; } inline_hdr; struct { __be16 type; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] RDMA/mlx5: Fix fortify source warning while accessing Eth segment
by Guo Mengqi 15 May '24

15 May '24

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v5.10.214 commit d27c48dc309da72c3b46351a1205d89687272baa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK6L CVE: CVE-2024-26907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4d5e86a56615cc387d21c629f9af8fb0e958d350 ] ------------[ cut here ]------------ memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2) WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy [last unloaded: mlx_compat(OE)] CPU: 0 PID: 293779 Comm: ssh Tainted: G OE 6.2.0-32-generic #32~22.04.1-Ubuntu Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da <0f> 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7 RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8 R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80 FS: 00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0x72/0x90 ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] ? __warn+0x8d/0x160 ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] ? report_bug+0x1bb/0x1d0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x19/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib] ipoib_send+0x2ec/0x770 [ib_ipoib] ipoib_start_xmit+0x5a0/0x770 [ib_ipoib] dev_hard_start_xmit+0x8e/0x1e0 ? validate_xmit_skb_list+0x4d/0x80 sch_direct_xmit+0x116/0x3a0 __dev_xmit_skb+0x1fd/0x580 __dev_queue_xmit+0x284/0x6b0 ? _raw_spin_unlock_irq+0xe/0x50 ? __flush_work.isra.0+0x20d/0x370 ? push_pseudo_header+0x17/0x40 [ib_ipoib] neigh_connected_output+0xcd/0x110 ip_finish_output2+0x179/0x480 ? __smp_call_single_queue+0x61/0xa0 __ip_finish_output+0xc3/0x190 ip_finish_output+0x2e/0xf0 ip_output+0x78/0x110 ? __pfx_ip_finish_output+0x10/0x10 ip_local_out+0x64/0x70 __ip_queue_xmit+0x18a/0x460 ip_queue_xmit+0x15/0x30 __tcp_transmit_skb+0x914/0x9c0 tcp_write_xmit+0x334/0x8d0 tcp_push_one+0x3c/0x60 tcp_sendmsg_locked+0x2e1/0xac0 tcp_sendmsg+0x2d/0x50 inet_sendmsg+0x43/0x90 sock_sendmsg+0x68/0x80 sock_write_iter+0x93/0x100 vfs_write+0x326/0x3c0 ksys_write+0xbd/0xf0 ? do_syscall_64+0x69/0x90 __x64_sys_write+0x19/0x30 do_syscall_64+0x59/0x90 ? do_user_addr_fault+0x1d0/0x640 ? exit_to_user_mode_prepare+0x3b/0xd0 ? irqentry_exit_to_user_mode+0x9/0x20 ? irqentry_exit+0x43/0x50 ? exc_page_fault+0x92/0x1b0 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fc03ad14a37 Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffdf8697fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000008024 RCX: 00007fc03ad14a37 RDX: 0000000000008024 RSI: 0000556f46bd8270 RDI: 0000000000000003 RBP: 0000556f46bb1800 R08: 0000000000007fe3 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 0000556f46bc66b0 R14: 000000000000000a R15: 0000556f46bb2f50 </TASK> ---[ end trace 0000000000000000 ]--- Link: https://lore.kernel.org/r/8228ad34bd1a25047586270f7b1fb4ddcd046282.17064339… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/infiniband/hw/mlx5/wr.c | 2 +- include/linux/mlx5/qp.h | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/wr.c b/drivers/infiniband/hw/mlx5/wr.c index d6038fb6c50c..19fd440a6ce3 100644 --- a/drivers/infiniband/hw/mlx5/wr.c +++ b/drivers/infiniband/hw/mlx5/wr.c @@ -128,7 +128,7 @@ static void set_eth_seg(const struct ib_send_wr *wr, struct mlx5_ib_qp *qp, */ copysz = min_t(u64, *cur_edge - (void *)eseg->inline_hdr.start, left); - memcpy(eseg->inline_hdr.start, pdata, copysz); + memcpy(eseg->inline_hdr.data, pdata, copysz); stride = ALIGN(sizeof(struct mlx5_wqe_eth_seg) - sizeof(eseg->inline_hdr.start) + copysz, 16); *size += stride / 16; diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h index d75ef8aa8fac..28d44061d670 100644 --- a/include/linux/mlx5/qp.h +++ b/include/linux/mlx5/qp.h @@ -261,7 +261,10 @@ struct mlx5_wqe_eth_seg { union { struct { __be16 sz; - u8 start[2]; + union { + u8 start[2]; + DECLARE_FLEX_ARRAY(u8, data); + }; } inline_hdr; struct { __be16 type; -- 2.17.1

2 1

[PATCH OLK-5.10] wireguard: receive: annotate data-race around receiving_counter.counter
by Guo Mengqi 15 May '24

15 May '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v5.10.214 commit f87884e0dffd61b47e58bc6e1e2f6843c212b0cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK8D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bba045dc4d996d03dce6fe45726e78a1a1f6d4c3 ] Syzkaller with KCSAN identified a data-race issue when accessing keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE() annotations to mark the data race as intentional. BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0: counter_validate drivers/net/wireguard/receive.c:321 [inline] wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461 __napi_poll+0x60/0x3b0 net/core/dev.c:6536 napi_poll net/core/dev.c:6605 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6738 __do_softirq+0xc4/0x279 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499 process_one_work kernel/workqueue.c:2633 [inline] ... read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1: decrypt_packet drivers/net/wireguard/receive.c:252 [inline] wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706 worker_thread+0x525/0x730 kernel/workqueue.c:2787 ... Fixes: a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter") Reported-by: syzbot+d1de830e4ecdaac83d89(a)syzkaller.appspotmail.com Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireguard/receive.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c index d38b24339a1f..ed274e9bdf3c 100644 --- a/drivers/net/wireguard/receive.c +++ b/drivers/net/wireguard/receive.c @@ -258,7 +258,7 @@ static bool decrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair) if (unlikely(!READ_ONCE(keypair->receiving.is_valid) || wg_birthdate_has_expired(keypair->receiving.birthdate, REJECT_AFTER_TIME) || - keypair->receiving_counter.counter >= REJECT_AFTER_MESSAGES)) { + READ_ONCE(keypair->receiving_counter.counter) >= REJECT_AFTER_MESSAGES)) { WRITE_ONCE(keypair->receiving.is_valid, false); return false; } @@ -325,7 +325,7 @@ static bool counter_validate(struct noise_replay_counter *counter, u64 their_cou for (i = 1; i <= top; ++i) counter->backtrack[(i + index_current) & ((COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1)] = 0; - counter->counter = their_counter; + WRITE_ONCE(counter->counter, their_counter); } index &= (COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1; @@ -470,7 +470,7 @@ int wg_packet_rx_poll(struct napi_struct *napi, int budget) net_dbg_ratelimited("%s: Packet has invalid nonce %llu (max %llu)\n", peer->device->dev->name, PACKET_CB(skb)->nonce, - keypair->receiving_counter.counter); + READ_ONCE(keypair->receiving_counter.counter)); goto next; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wireguard: receive: annotate data-race around receiving_counter.counter
by Guo Mengqi 15 May '24

15 May '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v5.10.214 commit f87884e0dffd61b47e58bc6e1e2f6843c212b0cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK8D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bba045dc4d996d03dce6fe45726e78a1a1f6d4c3 ] Syzkaller with KCSAN identified a data-race issue when accessing keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE() annotations to mark the data race as intentional. BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0: counter_validate drivers/net/wireguard/receive.c:321 [inline] wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461 __napi_poll+0x60/0x3b0 net/core/dev.c:6536 napi_poll net/core/dev.c:6605 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6738 __do_softirq+0xc4/0x279 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499 process_one_work kernel/workqueue.c:2633 [inline] ... read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1: decrypt_packet drivers/net/wireguard/receive.c:252 [inline] wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706 worker_thread+0x525/0x730 kernel/workqueue.c:2787 ... Fixes: a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter") Reported-by: syzbot+d1de830e4ecdaac83d89(a)syzkaller.appspotmail.com Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireguard/receive.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c index 7b8df406c773..ce4fc5b5eef5 100644 --- a/drivers/net/wireguard/receive.c +++ b/drivers/net/wireguard/receive.c @@ -258,7 +258,7 @@ static bool decrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair) if (unlikely(!READ_ONCE(keypair->receiving.is_valid) || wg_birthdate_has_expired(keypair->receiving.birthdate, REJECT_AFTER_TIME) || - keypair->receiving_counter.counter >= REJECT_AFTER_MESSAGES)) { + READ_ONCE(keypair->receiving_counter.counter) >= REJECT_AFTER_MESSAGES)) { WRITE_ONCE(keypair->receiving.is_valid, false); return false; } @@ -325,7 +325,7 @@ static bool counter_validate(struct noise_replay_counter *counter, u64 their_cou for (i = 1; i <= top; ++i) counter->backtrack[(i + index_current) & ((COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1)] = 0; - counter->counter = their_counter; + WRITE_ONCE(counter->counter, their_counter); } index &= (COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1; @@ -470,7 +470,7 @@ int wg_packet_rx_poll(struct napi_struct *napi, int budget) net_dbg_ratelimited("%s: Packet has invalid nonce %llu (max %llu)\n", peer->device->dev->name, PACKET_CB(skb)->nonce, - keypair->receiving_counter.counter); + READ_ONCE(keypair->receiving_counter.counter)); goto next; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] wireguard: receive: annotate data-race around receiving_counter.counter
by Guo Mengqi 15 May '24

15 May '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v5.10.214 commit f87884e0dffd61b47e58bc6e1e2f6843c212b0cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK8D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bba045dc4d996d03dce6fe45726e78a1a1f6d4c3 ] Syzkaller with KCSAN identified a data-race issue when accessing keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE() annotations to mark the data race as intentional. BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0: counter_validate drivers/net/wireguard/receive.c:321 [inline] wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461 __napi_poll+0x60/0x3b0 net/core/dev.c:6536 napi_poll net/core/dev.c:6605 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6738 __do_softirq+0xc4/0x279 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499 process_one_work kernel/workqueue.c:2633 [inline] ... read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1: decrypt_packet drivers/net/wireguard/receive.c:252 [inline] wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706 worker_thread+0x525/0x730 kernel/workqueue.c:2787 ... Fixes: a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter") Reported-by: syzbot+d1de830e4ecdaac83d89(a)syzkaller.appspotmail.com Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireguard/receive.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c index 7b8df406c773..ce4fc5b5eef5 100644 --- a/drivers/net/wireguard/receive.c +++ b/drivers/net/wireguard/receive.c @@ -258,7 +258,7 @@ static bool decrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair) if (unlikely(!READ_ONCE(keypair->receiving.is_valid) || wg_birthdate_has_expired(keypair->receiving.birthdate, REJECT_AFTER_TIME) || - keypair->receiving_counter.counter >= REJECT_AFTER_MESSAGES)) { + READ_ONCE(keypair->receiving_counter.counter) >= REJECT_AFTER_MESSAGES)) { WRITE_ONCE(keypair->receiving.is_valid, false); return false; } @@ -325,7 +325,7 @@ static bool counter_validate(struct noise_replay_counter *counter, u64 their_cou for (i = 1; i <= top; ++i) counter->backtrack[(i + index_current) & ((COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1)] = 0; - counter->counter = their_counter; + WRITE_ONCE(counter->counter, their_counter); } index &= (COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1; @@ -470,7 +470,7 @@ int wg_packet_rx_poll(struct napi_struct *napi, int budget) net_dbg_ratelimited("%s: Packet has invalid nonce %llu (max %llu)\n", peer->device->dev->name, PACKET_CB(skb)->nonce, - keypair->receiving_counter.counter); + READ_ONCE(keypair->receiving_counter.counter)); goto next; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] RDMA/mlx5: Fix fortify source warning while accessing Eth segment
by Guo Mengqi 15 May '24

15 May '24

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v5.10.214 commit d27c48dc309da72c3b46351a1205d89687272baa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK6L CVE: CVE-2024-26907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4d5e86a56615cc387d21c629f9af8fb0e958d350 ] ------------[ cut here ]------------ memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2) WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy [last unloaded: mlx_compat(OE)] CPU: 0 PID: 293779 Comm: ssh Tainted: G OE 6.2.0-32-generic #32~22.04.1-Ubuntu Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da <0f> 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7 RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8 R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80 FS: 00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0x72/0x90 ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] ? __warn+0x8d/0x160 ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] ? report_bug+0x1bb/0x1d0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x19/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib] ipoib_send+0x2ec/0x770 [ib_ipoib] ipoib_start_xmit+0x5a0/0x770 [ib_ipoib] dev_hard_start_xmit+0x8e/0x1e0 ? validate_xmit_skb_list+0x4d/0x80 sch_direct_xmit+0x116/0x3a0 __dev_xmit_skb+0x1fd/0x580 __dev_queue_xmit+0x284/0x6b0 ? _raw_spin_unlock_irq+0xe/0x50 ? __flush_work.isra.0+0x20d/0x370 ? push_pseudo_header+0x17/0x40 [ib_ipoib] neigh_connected_output+0xcd/0x110 ip_finish_output2+0x179/0x480 ? __smp_call_single_queue+0x61/0xa0 __ip_finish_output+0xc3/0x190 ip_finish_output+0x2e/0xf0 ip_output+0x78/0x110 ? __pfx_ip_finish_output+0x10/0x10 ip_local_out+0x64/0x70 __ip_queue_xmit+0x18a/0x460 ip_queue_xmit+0x15/0x30 __tcp_transmit_skb+0x914/0x9c0 tcp_write_xmit+0x334/0x8d0 tcp_push_one+0x3c/0x60 tcp_sendmsg_locked+0x2e1/0xac0 tcp_sendmsg+0x2d/0x50 inet_sendmsg+0x43/0x90 sock_sendmsg+0x68/0x80 sock_write_iter+0x93/0x100 vfs_write+0x326/0x3c0 ksys_write+0xbd/0xf0 ? do_syscall_64+0x69/0x90 __x64_sys_write+0x19/0x30 do_syscall_64+0x59/0x90 ? do_user_addr_fault+0x1d0/0x640 ? exit_to_user_mode_prepare+0x3b/0xd0 ? irqentry_exit_to_user_mode+0x9/0x20 ? irqentry_exit+0x43/0x50 ? exc_page_fault+0x92/0x1b0 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fc03ad14a37 Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffdf8697fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000008024 RCX: 00007fc03ad14a37 RDX: 0000000000008024 RSI: 0000556f46bd8270 RDI: 0000000000000003 RBP: 0000556f46bb1800 R08: 0000000000007fe3 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 0000556f46bc66b0 R14: 000000000000000a R15: 0000556f46bb2f50 </TASK> ---[ end trace 0000000000000000 ]--- Link: https://lore.kernel.org/r/8228ad34bd1a25047586270f7b1fb4ddcd046282.17064339… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/infiniband/hw/mlx5/wr.c | 2 +- include/linux/mlx5/qp.h | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/wr.c b/drivers/infiniband/hw/mlx5/wr.c index d6038fb6c50c..19fd440a6ce3 100644 --- a/drivers/infiniband/hw/mlx5/wr.c +++ b/drivers/infiniband/hw/mlx5/wr.c @@ -128,7 +128,7 @@ static void set_eth_seg(const struct ib_send_wr *wr, struct mlx5_ib_qp *qp, */ copysz = min_t(u64, *cur_edge - (void *)eseg->inline_hdr.start, left); - memcpy(eseg->inline_hdr.start, pdata, copysz); + memcpy(eseg->inline_hdr.data, pdata, copysz); stride = ALIGN(sizeof(struct mlx5_wqe_eth_seg) - sizeof(eseg->inline_hdr.start) + copysz, 16); *size += stride / 16; diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h index d75ef8aa8fac..28d44061d670 100644 --- a/include/linux/mlx5/qp.h +++ b/include/linux/mlx5/qp.h @@ -261,7 +261,10 @@ struct mlx5_wqe_eth_seg { union { struct { __be16 sz; - u8 start[2]; + union { + u8 start[2]; + DECLARE_FLEX_ARRAY(u8, data); + }; } inline_hdr; struct { __be16 type; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] wireguard: receive: annotate data-race around receiving_counter.counter
by Guo Mengqi 15 May '24

15 May '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> stable inclusion from stable-v5.10.214 commit f87884e0dffd61b47e58bc6e1e2f6843c212b0cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK8D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bba045dc4d996d03dce6fe45726e78a1a1f6d4c3 ] Syzkaller with KCSAN identified a data-race issue when accessing keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE() annotations to mark the data race as intentional. BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0: counter_validate drivers/net/wireguard/receive.c:321 [inline] wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461 __napi_poll+0x60/0x3b0 net/core/dev.c:6536 napi_poll net/core/dev.c:6605 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6738 __do_softirq+0xc4/0x279 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499 process_one_work kernel/workqueue.c:2633 [inline] ... read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1: decrypt_packet drivers/net/wireguard/receive.c:252 [inline] wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706 worker_thread+0x525/0x730 kernel/workqueue.c:2787 ... Fixes: a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter") Reported-by: syzbot+d1de830e4ecdaac83d89(a)syzkaller.appspotmail.com Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireguard/receive.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c index 7b8df406c773..ce4fc5b5eef5 100644 --- a/drivers/net/wireguard/receive.c +++ b/drivers/net/wireguard/receive.c @@ -258,7 +258,7 @@ static bool decrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair) if (unlikely(!READ_ONCE(keypair->receiving.is_valid) || wg_birthdate_has_expired(keypair->receiving.birthdate, REJECT_AFTER_TIME) || - keypair->receiving_counter.counter >= REJECT_AFTER_MESSAGES)) { + READ_ONCE(keypair->receiving_counter.counter) >= REJECT_AFTER_MESSAGES)) { WRITE_ONCE(keypair->receiving.is_valid, false); return false; } @@ -325,7 +325,7 @@ static bool counter_validate(struct noise_replay_counter *counter, u64 their_cou for (i = 1; i <= top; ++i) counter->backtrack[(i + index_current) & ((COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1)] = 0; - counter->counter = their_counter; + WRITE_ONCE(counter->counter, their_counter); } index &= (COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1; @@ -470,7 +470,7 @@ int wg_packet_rx_poll(struct napi_struct *napi, int budget) net_dbg_ratelimited("%s: Packet has invalid nonce %llu (max %llu)\n", peer->device->dev->name, PACKET_CB(skb)->nonce, - keypair->receiving_counter.counter); + READ_ONCE(keypair->receiving_counter.counter)); goto next; } -- 2.17.1

2 1

[PATCH OLK-5.10] iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
by Guo Mengqi 15 May '24

15 May '24

From: Ethan Zhao <haifeng.zhao(a)linux.intel.com> stable inclusion from stable-v5.10.214 commit f873b85ec762c5a6abe94a7ddb31df5d3ba07d85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJYJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4fc82cd907ac075648789cc3a00877778aa1838b ] For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the device by flapping device's link through setting the slot's link control register, as pciehp_ist() DLLSC interrupt sequence response, pciehp will unload the device driver and then power it off. thus cause an IOMMU device-TLB invalidation (Intel VT-d spec, or ATS Invalidation in PCIe spec r6.1) request for non-existence target device to be sent and deadly loop to retry that request after ITE fault triggered in interrupt context. That would cause following continuous hard lockup warning and system hang [ 4211.433662] pcieport 0000:17:01.0: pciehp: Slot(108): Link Down [ 4211.433664] pcieport 0000:17:01.0: pciehp: Slot(108): Card not present [ 4223.822591] NMI watchdog: Watchdog detected hard LOCKUP on cpu 144 [ 4223.822622] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822623] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822623] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822624] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 1 0 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822624] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822625] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005 [ 4223.822625] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822625] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822626] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822626] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004 [ 4223.822626] FS: 0000000000000000(0000) GS:ffffa237ae400000(0000) knlGS:0000000000000000 [ 4223.822627] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4223.822627] CR2: 00007ffe86515d80 CR3: 000002fd3000a001 CR4: 0000000000770ee0 [ 4223.822627] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4223.822628] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 4223.822628] PKRU: 55555554 [ 4223.822628] Call Trace: [ 4223.822628] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822628] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822629] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822629] intel_iommu_release_device+0x1f/0x30 [ 4223.822629] iommu_release_device+0x33/0x60 [ 4223.822629] iommu_bus_notifier+0x7f/0x90 [ 4223.822630] blocking_notifier_call_chain+0x60/0x90 [ 4223.822630] device_del+0x2e5/0x420 [ 4223.822630] pci_remove_bus_device+0x70/0x110 [ 4223.822630] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822631] pciehp_disable_slot+0x6b/0x100 [ 4223.822631] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822631] pciehp_ist+0x176/0x180 [ 4223.822631] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822632] irq_thread_fn+0x19/0x50 [ 4223.822632] irq_thread+0x104/0x190 [ 4223.822632] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822632] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822633] kthread+0x114/0x130 [ 4223.822633] ? __kthread_cancel_work+0x40/0x40 [ 4223.822633] ret_from_fork+0x1f/0x30 [ 4223.822633] Kernel panic - not syncing: Hard LOCKUP [ 4223.822634] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822634] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822634] Call Trace: [ 4223.822634] <NMI> [ 4223.822635] dump_stack+0x6d/0x88 [ 4223.822635] panic+0x101/0x2d0 [ 4223.822635] ? ret_from_fork+0x11/0x30 [ 4223.822635] nmi_panic.cold.14+0xc/0xc [ 4223.822636] watchdog_overflow_callback.cold.8+0x6d/0x81 [ 4223.822636] __perf_event_overflow+0x4f/0xf0 [ 4223.822636] handle_pmi_common+0x1ef/0x290 [ 4223.822636] ? __set_pte_vaddr+0x28/0x40 [ 4223.822637] ? flush_tlb_one_kernel+0xa/0x20 [ 4223.822637] ? __native_set_fixmap+0x24/0x30 [ 4223.822637] ? ghes_copy_tofrom_phys+0x70/0x100 [ 4223.822637] ? __ghes_peek_estatus.isra.16+0x49/0xa0 [ 4223.822637] intel_pmu_handle_irq+0xba/0x2b0 [ 4223.822638] perf_event_nmi_handler+0x24/0x40 [ 4223.822638] nmi_handle+0x4d/0xf0 [ 4223.822638] default_do_nmi+0x49/0x100 [ 4223.822638] exc_nmi+0x134/0x180 [ 4223.822639] end_repeat_nmi+0x16/0x67 [ 4223.822639] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822639] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 10 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822640] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822640] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005 [ 4223.822640] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822641] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822641] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822641] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004 [ 4223.822641] ? qi_submit_sync+0x2c0/0x490 [ 4223.822642] ? qi_submit_sync+0x2c0/0x490 [ 4223.822642] </NMI> [ 4223.822642] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822642] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822643] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822643] intel_iommu_release_device+0x1f/0x30 [ 4223.822643] iommu_release_device+0x33/0x60 [ 4223.822643] iommu_bus_notifier+0x7f/0x90 [ 4223.822644] blocking_notifier_call_chain+0x60/0x90 [ 4223.822644] device_del+0x2e5/0x420 [ 4223.822644] pci_remove_bus_device+0x70/0x110 [ 4223.822644] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822644] pciehp_disable_slot+0x6b/0x100 [ 4223.822645] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822645] pciehp_ist+0x176/0x180 [ 4223.822645] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822645] irq_thread_fn+0x19/0x50 [ 4223.822646] irq_thread+0x104/0x190 [ 4223.822646] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822646] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822646] kthread+0x114/0x130 [ 4223.822647] ? __kthread_cancel_work+0x40/0x40 [ 4223.822647] ret_from_fork+0x1f/0x30 [ 4223.822647] Kernel Offset: 0x6400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Such issue could be triggered by all kinds of regular surprise removal hotplug operation. like: 1. pull EP(endpoint device) out directly. 2. turn off EP's power. 3. bring the link down. etc. this patch aims to work for regular safe removal and surprise removal unplug. these hot unplug handling process could be optimized for fix the ATS Invalidation hang issue by calling pci_dev_is_disconnected() in function devtlb_invalidation_with_pasid() to check target device state to avoid sending meaningless ATS Invalidation request to iommu when device is gone. (see IMPLEMENTATION NOTE in PCIe spec r6.1 section 10.3.1) For safe removal, device wouldn't be removed until the whole software handling process is done, it wouldn't trigger the hard lock up issue caused by too long ATS Invalidation timeout wait. In safe removal path, device state isn't set to pci_channel_io_perm_failure in pciehp_unconfigure_device() by checking 'presence' parameter, calling pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return false there, wouldn't break the function. For surprise removal, device state is set to pci_channel_io_perm_failure in pciehp_unconfigure_device(), means device is already gone (disconnected) call pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return true to break the function not to send ATS Invalidation request to the disconnected device blindly, thus avoid to trigger further ITE fault, and ITE fault will block all invalidation request to be handled. furthermore retry the timeout request could trigger hard lockup. safe removal (present) & surprise removal (not present) pciehp_ist() pciehp_handle_presence_or_link_change() pciehp_disable_slot() remove_board() pciehp_unconfigure_device(presence) { if (!presence) pci_walk_bus(parent, pci_dev_set_disconnected, NULL); } this patch works for regular safe removal and surprise removal of ATS capable endpoint on PCIe switch downstream ports. Fixes: 6f7db75e1c46 ("iommu/vt-d: Add second level page table interface") Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Tested-by: Haorong Ye <yehaorong(a)bytedance.com> Signed-off-by: Ethan Zhao <haifeng.zhao(a)linux.intel.com> Link: https://lore.kernel.org/r/20240301080727.3529832-3-haifeng.zhao@linux.intel… Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iommu/intel/pasid.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c index 9b24e8224379..586b289cf468 100644 --- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c @@ -489,6 +489,9 @@ devtlb_invalidation_with_pasid(struct intel_iommu *iommu, if (!info || !info->ats_enabled) return; + if (pci_dev_is_disconnected(to_pci_dev(dev))) + return; + sid = info->bus << 8 | info->devfn; qdep = info->ats_qdep; pfsid = info->pfsid; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
by Guo Mengqi 15 May '24

15 May '24

From: Ethan Zhao <haifeng.zhao(a)linux.intel.com> stable inclusion from stable-v5.10.214 commit f873b85ec762c5a6abe94a7ddb31df5d3ba07d85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJYJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4fc82cd907ac075648789cc3a00877778aa1838b ] For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the device by flapping device's link through setting the slot's link control register, as pciehp_ist() DLLSC interrupt sequence response, pciehp will unload the device driver and then power it off. thus cause an IOMMU device-TLB invalidation (Intel VT-d spec, or ATS Invalidation in PCIe spec r6.1) request for non-existence target device to be sent and deadly loop to retry that request after ITE fault triggered in interrupt context. That would cause following continuous hard lockup warning and system hang [ 4211.433662] pcieport 0000:17:01.0: pciehp: Slot(108): Link Down [ 4211.433664] pcieport 0000:17:01.0: pciehp: Slot(108): Card not present [ 4223.822591] NMI watchdog: Watchdog detected hard LOCKUP on cpu 144 [ 4223.822622] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822623] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822623] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822624] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 1 0 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822624] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822625] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005 [ 4223.822625] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822625] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822626] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822626] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004 [ 4223.822626] FS: 0000000000000000(0000) GS:ffffa237ae400000(0000) knlGS:0000000000000000 [ 4223.822627] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4223.822627] CR2: 00007ffe86515d80 CR3: 000002fd3000a001 CR4: 0000000000770ee0 [ 4223.822627] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4223.822628] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 4223.822628] PKRU: 55555554 [ 4223.822628] Call Trace: [ 4223.822628] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822628] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822629] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822629] intel_iommu_release_device+0x1f/0x30 [ 4223.822629] iommu_release_device+0x33/0x60 [ 4223.822629] iommu_bus_notifier+0x7f/0x90 [ 4223.822630] blocking_notifier_call_chain+0x60/0x90 [ 4223.822630] device_del+0x2e5/0x420 [ 4223.822630] pci_remove_bus_device+0x70/0x110 [ 4223.822630] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822631] pciehp_disable_slot+0x6b/0x100 [ 4223.822631] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822631] pciehp_ist+0x176/0x180 [ 4223.822631] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822632] irq_thread_fn+0x19/0x50 [ 4223.822632] irq_thread+0x104/0x190 [ 4223.822632] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822632] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822633] kthread+0x114/0x130 [ 4223.822633] ? __kthread_cancel_work+0x40/0x40 [ 4223.822633] ret_from_fork+0x1f/0x30 [ 4223.822633] Kernel panic - not syncing: Hard LOCKUP [ 4223.822634] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822634] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822634] Call Trace: [ 4223.822634] <NMI> [ 4223.822635] dump_stack+0x6d/0x88 [ 4223.822635] panic+0x101/0x2d0 [ 4223.822635] ? ret_from_fork+0x11/0x30 [ 4223.822635] nmi_panic.cold.14+0xc/0xc [ 4223.822636] watchdog_overflow_callback.cold.8+0x6d/0x81 [ 4223.822636] __perf_event_overflow+0x4f/0xf0 [ 4223.822636] handle_pmi_common+0x1ef/0x290 [ 4223.822636] ? __set_pte_vaddr+0x28/0x40 [ 4223.822637] ? flush_tlb_one_kernel+0xa/0x20 [ 4223.822637] ? __native_set_fixmap+0x24/0x30 [ 4223.822637] ? ghes_copy_tofrom_phys+0x70/0x100 [ 4223.822637] ? __ghes_peek_estatus.isra.16+0x49/0xa0 [ 4223.822637] intel_pmu_handle_irq+0xba/0x2b0 [ 4223.822638] perf_event_nmi_handler+0x24/0x40 [ 4223.822638] nmi_handle+0x4d/0xf0 [ 4223.822638] default_do_nmi+0x49/0x100 [ 4223.822638] exc_nmi+0x134/0x180 [ 4223.822639] end_repeat_nmi+0x16/0x67 [ 4223.822639] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822639] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 10 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822640] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822640] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005 [ 4223.822640] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822641] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822641] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822641] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004 [ 4223.822641] ? qi_submit_sync+0x2c0/0x490 [ 4223.822642] ? qi_submit_sync+0x2c0/0x490 [ 4223.822642] </NMI> [ 4223.822642] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822642] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822643] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822643] intel_iommu_release_device+0x1f/0x30 [ 4223.822643] iommu_release_device+0x33/0x60 [ 4223.822643] iommu_bus_notifier+0x7f/0x90 [ 4223.822644] blocking_notifier_call_chain+0x60/0x90 [ 4223.822644] device_del+0x2e5/0x420 [ 4223.822644] pci_remove_bus_device+0x70/0x110 [ 4223.822644] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822644] pciehp_disable_slot+0x6b/0x100 [ 4223.822645] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822645] pciehp_ist+0x176/0x180 [ 4223.822645] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822645] irq_thread_fn+0x19/0x50 [ 4223.822646] irq_thread+0x104/0x190 [ 4223.822646] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822646] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822646] kthread+0x114/0x130 [ 4223.822647] ? __kthread_cancel_work+0x40/0x40 [ 4223.822647] ret_from_fork+0x1f/0x30 [ 4223.822647] Kernel Offset: 0x6400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Such issue could be triggered by all kinds of regular surprise removal hotplug operation. like: 1. pull EP(endpoint device) out directly. 2. turn off EP's power. 3. bring the link down. etc. this patch aims to work for regular safe removal and surprise removal unplug. these hot unplug handling process could be optimized for fix the ATS Invalidation hang issue by calling pci_dev_is_disconnected() in function devtlb_invalidation_with_pasid() to check target device state to avoid sending meaningless ATS Invalidation request to iommu when device is gone. (see IMPLEMENTATION NOTE in PCIe spec r6.1 section 10.3.1) For safe removal, device wouldn't be removed until the whole software handling process is done, it wouldn't trigger the hard lock up issue caused by too long ATS Invalidation timeout wait. In safe removal path, device state isn't set to pci_channel_io_perm_failure in pciehp_unconfigure_device() by checking 'presence' parameter, calling pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return false there, wouldn't break the function. For surprise removal, device state is set to pci_channel_io_perm_failure in pciehp_unconfigure_device(), means device is already gone (disconnected) call pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return true to break the function not to send ATS Invalidation request to the disconnected device blindly, thus avoid to trigger further ITE fault, and ITE fault will block all invalidation request to be handled. furthermore retry the timeout request could trigger hard lockup. safe removal (present) & surprise removal (not present) pciehp_ist() pciehp_handle_presence_or_link_change() pciehp_disable_slot() remove_board() pciehp_unconfigure_device(presence) { if (!presence) pci_walk_bus(parent, pci_dev_set_disconnected, NULL); } this patch works for regular safe removal and surprise removal of ATS capable endpoint on PCIe switch downstream ports. Fixes: 6f7db75e1c46 ("iommu/vt-d: Add second level page table interface") Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Tested-by: Haorong Ye <yehaorong(a)bytedance.com> Signed-off-by: Ethan Zhao <haifeng.zhao(a)linux.intel.com> Link: https://lore.kernel.org/r/20240301080727.3529832-3-haifeng.zhao@linux.intel… Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iommu/intel/pasid.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c index 80d6412e2c54..ba9fa219a35a 100644 --- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c @@ -489,6 +489,9 @@ devtlb_invalidation_with_pasid(struct intel_iommu *iommu, if (!info || !info->ats_enabled) return; + if (pci_dev_is_disconnected(to_pci_dev(dev))) + return; + sid = info->bus << 8 | info->devfn; qdep = info->ats_qdep; pfsid = info->pfsid; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
by Guo Mengqi 15 May '24

15 May '24

From: Ethan Zhao <haifeng.zhao(a)linux.intel.com> stable inclusion from stable-v5.10.214 commit f873b85ec762c5a6abe94a7ddb31df5d3ba07d85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJYJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4fc82cd907ac075648789cc3a00877778aa1838b ] For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the device by flapping device's link through setting the slot's link control register, as pciehp_ist() DLLSC interrupt sequence response, pciehp will unload the device driver and then power it off. thus cause an IOMMU device-TLB invalidation (Intel VT-d spec, or ATS Invalidation in PCIe spec r6.1) request for non-existence target device to be sent and deadly loop to retry that request after ITE fault triggered in interrupt context. That would cause following continuous hard lockup warning and system hang [ 4211.433662] pcieport 0000:17:01.0: pciehp: Slot(108): Link Down [ 4211.433664] pcieport 0000:17:01.0: pciehp: Slot(108): Card not present [ 4223.822591] NMI watchdog: Watchdog detected hard LOCKUP on cpu 144 [ 4223.822622] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822623] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822623] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822624] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 1 0 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822624] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822625] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005 [ 4223.822625] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822625] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822626] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822626] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004 [ 4223.822626] FS: 0000000000000000(0000) GS:ffffa237ae400000(0000) knlGS:0000000000000000 [ 4223.822627] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4223.822627] CR2: 00007ffe86515d80 CR3: 000002fd3000a001 CR4: 0000000000770ee0 [ 4223.822627] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4223.822628] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 4223.822628] PKRU: 55555554 [ 4223.822628] Call Trace: [ 4223.822628] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822628] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822629] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822629] intel_iommu_release_device+0x1f/0x30 [ 4223.822629] iommu_release_device+0x33/0x60 [ 4223.822629] iommu_bus_notifier+0x7f/0x90 [ 4223.822630] blocking_notifier_call_chain+0x60/0x90 [ 4223.822630] device_del+0x2e5/0x420 [ 4223.822630] pci_remove_bus_device+0x70/0x110 [ 4223.822630] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822631] pciehp_disable_slot+0x6b/0x100 [ 4223.822631] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822631] pciehp_ist+0x176/0x180 [ 4223.822631] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822632] irq_thread_fn+0x19/0x50 [ 4223.822632] irq_thread+0x104/0x190 [ 4223.822632] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822632] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822633] kthread+0x114/0x130 [ 4223.822633] ? __kthread_cancel_work+0x40/0x40 [ 4223.822633] ret_from_fork+0x1f/0x30 [ 4223.822633] Kernel panic - not syncing: Hard LOCKUP [ 4223.822634] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822634] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822634] Call Trace: [ 4223.822634] <NMI> [ 4223.822635] dump_stack+0x6d/0x88 [ 4223.822635] panic+0x101/0x2d0 [ 4223.822635] ? ret_from_fork+0x11/0x30 [ 4223.822635] nmi_panic.cold.14+0xc/0xc [ 4223.822636] watchdog_overflow_callback.cold.8+0x6d/0x81 [ 4223.822636] __perf_event_overflow+0x4f/0xf0 [ 4223.822636] handle_pmi_common+0x1ef/0x290 [ 4223.822636] ? __set_pte_vaddr+0x28/0x40 [ 4223.822637] ? flush_tlb_one_kernel+0xa/0x20 [ 4223.822637] ? __native_set_fixmap+0x24/0x30 [ 4223.822637] ? ghes_copy_tofrom_phys+0x70/0x100 [ 4223.822637] ? __ghes_peek_estatus.isra.16+0x49/0xa0 [ 4223.822637] intel_pmu_handle_irq+0xba/0x2b0 [ 4223.822638] perf_event_nmi_handler+0x24/0x40 [ 4223.822638] nmi_handle+0x4d/0xf0 [ 4223.822638] default_do_nmi+0x49/0x100 [ 4223.822638] exc_nmi+0x134/0x180 [ 4223.822639] end_repeat_nmi+0x16/0x67 [ 4223.822639] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822639] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 10 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822640] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822640] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005 [ 4223.822640] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822641] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822641] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822641] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004 [ 4223.822641] ? qi_submit_sync+0x2c0/0x490 [ 4223.822642] ? qi_submit_sync+0x2c0/0x490 [ 4223.822642] </NMI> [ 4223.822642] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822642] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822643] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822643] intel_iommu_release_device+0x1f/0x30 [ 4223.822643] iommu_release_device+0x33/0x60 [ 4223.822643] iommu_bus_notifier+0x7f/0x90 [ 4223.822644] blocking_notifier_call_chain+0x60/0x90 [ 4223.822644] device_del+0x2e5/0x420 [ 4223.822644] pci_remove_bus_device+0x70/0x110 [ 4223.822644] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822644] pciehp_disable_slot+0x6b/0x100 [ 4223.822645] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822645] pciehp_ist+0x176/0x180 [ 4223.822645] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822645] irq_thread_fn+0x19/0x50 [ 4223.822646] irq_thread+0x104/0x190 [ 4223.822646] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822646] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822646] kthread+0x114/0x130 [ 4223.822647] ? __kthread_cancel_work+0x40/0x40 [ 4223.822647] ret_from_fork+0x1f/0x30 [ 4223.822647] Kernel Offset: 0x6400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Such issue could be triggered by all kinds of regular surprise removal hotplug operation. like: 1. pull EP(endpoint device) out directly. 2. turn off EP's power. 3. bring the link down. etc. this patch aims to work for regular safe removal and surprise removal unplug. these hot unplug handling process could be optimized for fix the ATS Invalidation hang issue by calling pci_dev_is_disconnected() in function devtlb_invalidation_with_pasid() to check target device state to avoid sending meaningless ATS Invalidation request to iommu when device is gone. (see IMPLEMENTATION NOTE in PCIe spec r6.1 section 10.3.1) For safe removal, device wouldn't be removed until the whole software handling process is done, it wouldn't trigger the hard lock up issue caused by too long ATS Invalidation timeout wait. In safe removal path, device state isn't set to pci_channel_io_perm_failure in pciehp_unconfigure_device() by checking 'presence' parameter, calling pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return false there, wouldn't break the function. For surprise removal, device state is set to pci_channel_io_perm_failure in pciehp_unconfigure_device(), means device is already gone (disconnected) call pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return true to break the function not to send ATS Invalidation request to the disconnected device blindly, thus avoid to trigger further ITE fault, and ITE fault will block all invalidation request to be handled. furthermore retry the timeout request could trigger hard lockup. safe removal (present) & surprise removal (not present) pciehp_ist() pciehp_handle_presence_or_link_change() pciehp_disable_slot() remove_board() pciehp_unconfigure_device(presence) { if (!presence) pci_walk_bus(parent, pci_dev_set_disconnected, NULL); } this patch works for regular safe removal and surprise removal of ATS capable endpoint on PCIe switch downstream ports. Fixes: 6f7db75e1c46 ("iommu/vt-d: Add second level page table interface") Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Tested-by: Haorong Ye <yehaorong(a)bytedance.com> Signed-off-by: Ethan Zhao <haifeng.zhao(a)linux.intel.com> Link: https://lore.kernel.org/r/20240301080727.3529832-3-haifeng.zhao@linux.intel… Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iommu/intel/pasid.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c index fb911b6c418f..f85326a7a269 100644 --- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c @@ -477,6 +477,9 @@ devtlb_invalidation_with_pasid(struct intel_iommu *iommu, if (!info || !info->ats_enabled) return; + if (pci_dev_is_disconnected(to_pci_dev(dev))) + return; + sid = info->bus << 8 | info->devfn; qdep = info->ats_qdep; pfsid = info->pfsid; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
by Guo Mengqi 15 May '24

15 May '24

From: Ethan Zhao <haifeng.zhao(a)linux.intel.com> stable inclusion from stable-v5.10.214 commit f873b85ec762c5a6abe94a7ddb31df5d3ba07d85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJYJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4fc82cd907ac075648789cc3a00877778aa1838b ] For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the device by flapping device's link through setting the slot's link control register, as pciehp_ist() DLLSC interrupt sequence response, pciehp will unload the device driver and then power it off. thus cause an IOMMU device-TLB invalidation (Intel VT-d spec, or ATS Invalidation in PCIe spec r6.1) request for non-existence target device to be sent and deadly loop to retry that request after ITE fault triggered in interrupt context. That would cause following continuous hard lockup warning and system hang [ 4211.433662] pcieport 0000:17:01.0: pciehp: Slot(108): Link Down [ 4211.433664] pcieport 0000:17:01.0: pciehp: Slot(108): Card not present [ 4223.822591] NMI watchdog: Watchdog detected hard LOCKUP on cpu 144 [ 4223.822622] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822623] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822623] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822624] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 1 0 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822624] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822625] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005 [ 4223.822625] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822625] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822626] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822626] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004 [ 4223.822626] FS: 0000000000000000(0000) GS:ffffa237ae400000(0000) knlGS:0000000000000000 [ 4223.822627] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4223.822627] CR2: 00007ffe86515d80 CR3: 000002fd3000a001 CR4: 0000000000770ee0 [ 4223.822627] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4223.822628] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 4223.822628] PKRU: 55555554 [ 4223.822628] Call Trace: [ 4223.822628] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822628] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822629] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822629] intel_iommu_release_device+0x1f/0x30 [ 4223.822629] iommu_release_device+0x33/0x60 [ 4223.822629] iommu_bus_notifier+0x7f/0x90 [ 4223.822630] blocking_notifier_call_chain+0x60/0x90 [ 4223.822630] device_del+0x2e5/0x420 [ 4223.822630] pci_remove_bus_device+0x70/0x110 [ 4223.822630] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822631] pciehp_disable_slot+0x6b/0x100 [ 4223.822631] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822631] pciehp_ist+0x176/0x180 [ 4223.822631] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822632] irq_thread_fn+0x19/0x50 [ 4223.822632] irq_thread+0x104/0x190 [ 4223.822632] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822632] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822633] kthread+0x114/0x130 [ 4223.822633] ? __kthread_cancel_work+0x40/0x40 [ 4223.822633] ret_from_fork+0x1f/0x30 [ 4223.822633] Kernel panic - not syncing: Hard LOCKUP [ 4223.822634] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S OE kernel version xxxx [ 4223.822634] Hardware name: vendorname xxxx 666-106, BIOS 01.01.02.03.01 05/15/2023 [ 4223.822634] Call Trace: [ 4223.822634] <NMI> [ 4223.822635] dump_stack+0x6d/0x88 [ 4223.822635] panic+0x101/0x2d0 [ 4223.822635] ? ret_from_fork+0x11/0x30 [ 4223.822635] nmi_panic.cold.14+0xc/0xc [ 4223.822636] watchdog_overflow_callback.cold.8+0x6d/0x81 [ 4223.822636] __perf_event_overflow+0x4f/0xf0 [ 4223.822636] handle_pmi_common+0x1ef/0x290 [ 4223.822636] ? __set_pte_vaddr+0x28/0x40 [ 4223.822637] ? flush_tlb_one_kernel+0xa/0x20 [ 4223.822637] ? __native_set_fixmap+0x24/0x30 [ 4223.822637] ? ghes_copy_tofrom_phys+0x70/0x100 [ 4223.822637] ? __ghes_peek_estatus.isra.16+0x49/0xa0 [ 4223.822637] intel_pmu_handle_irq+0xba/0x2b0 [ 4223.822638] perf_event_nmi_handler+0x24/0x40 [ 4223.822638] nmi_handle+0x4d/0xf0 [ 4223.822638] default_do_nmi+0x49/0x100 [ 4223.822638] exc_nmi+0x134/0x180 [ 4223.822639] end_repeat_nmi+0x16/0x67 [ 4223.822639] RIP: 0010:qi_submit_sync+0x2c0/0x490 [ 4223.822639] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 10 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39 [ 4223.822640] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093 [ 4223.822640] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005 [ 4223.822640] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340 [ 4223.822641] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000 [ 4223.822641] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200 [ 4223.822641] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004 [ 4223.822641] ? qi_submit_sync+0x2c0/0x490 [ 4223.822642] ? qi_submit_sync+0x2c0/0x490 [ 4223.822642] </NMI> [ 4223.822642] qi_flush_dev_iotlb+0xb1/0xd0 [ 4223.822642] __dmar_remove_one_dev_info+0x224/0x250 [ 4223.822643] dmar_remove_one_dev_info+0x3e/0x50 [ 4223.822643] intel_iommu_release_device+0x1f/0x30 [ 4223.822643] iommu_release_device+0x33/0x60 [ 4223.822643] iommu_bus_notifier+0x7f/0x90 [ 4223.822644] blocking_notifier_call_chain+0x60/0x90 [ 4223.822644] device_del+0x2e5/0x420 [ 4223.822644] pci_remove_bus_device+0x70/0x110 [ 4223.822644] pciehp_unconfigure_device+0x7c/0x130 [ 4223.822644] pciehp_disable_slot+0x6b/0x100 [ 4223.822645] pciehp_handle_presence_or_link_change+0xd8/0x320 [ 4223.822645] pciehp_ist+0x176/0x180 [ 4223.822645] ? irq_finalize_oneshot.part.50+0x110/0x110 [ 4223.822645] irq_thread_fn+0x19/0x50 [ 4223.822646] irq_thread+0x104/0x190 [ 4223.822646] ? irq_forced_thread_fn+0x90/0x90 [ 4223.822646] ? irq_thread_check_affinity+0xe0/0xe0 [ 4223.822646] kthread+0x114/0x130 [ 4223.822647] ? __kthread_cancel_work+0x40/0x40 [ 4223.822647] ret_from_fork+0x1f/0x30 [ 4223.822647] Kernel Offset: 0x6400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Such issue could be triggered by all kinds of regular surprise removal hotplug operation. like: 1. pull EP(endpoint device) out directly. 2. turn off EP's power. 3. bring the link down. etc. this patch aims to work for regular safe removal and surprise removal unplug. these hot unplug handling process could be optimized for fix the ATS Invalidation hang issue by calling pci_dev_is_disconnected() in function devtlb_invalidation_with_pasid() to check target device state to avoid sending meaningless ATS Invalidation request to iommu when device is gone. (see IMPLEMENTATION NOTE in PCIe spec r6.1 section 10.3.1) For safe removal, device wouldn't be removed until the whole software handling process is done, it wouldn't trigger the hard lock up issue caused by too long ATS Invalidation timeout wait. In safe removal path, device state isn't set to pci_channel_io_perm_failure in pciehp_unconfigure_device() by checking 'presence' parameter, calling pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return false there, wouldn't break the function. For surprise removal, device state is set to pci_channel_io_perm_failure in pciehp_unconfigure_device(), means device is already gone (disconnected) call pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return true to break the function not to send ATS Invalidation request to the disconnected device blindly, thus avoid to trigger further ITE fault, and ITE fault will block all invalidation request to be handled. furthermore retry the timeout request could trigger hard lockup. safe removal (present) & surprise removal (not present) pciehp_ist() pciehp_handle_presence_or_link_change() pciehp_disable_slot() remove_board() pciehp_unconfigure_device(presence) { if (!presence) pci_walk_bus(parent, pci_dev_set_disconnected, NULL); } this patch works for regular safe removal and surprise removal of ATS capable endpoint on PCIe switch downstream ports. Fixes: 6f7db75e1c46 ("iommu/vt-d: Add second level page table interface") Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Tested-by: Haorong Ye <yehaorong(a)bytedance.com> Signed-off-by: Ethan Zhao <haifeng.zhao(a)linux.intel.com> Link: https://lore.kernel.org/r/20240301080727.3529832-3-haifeng.zhao@linux.intel… Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iommu/intel/pasid.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c index fb911b6c418f..f85326a7a269 100644 --- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c @@ -477,6 +477,9 @@ devtlb_invalidation_with_pasid(struct intel_iommu *iommu, if (!info || !info->ats_enabled) return; + if (pci_dev_is_disconnected(to_pci_dev(dev))) + return; + sid = info->bus << 8 | info->devfn; qdep = info->ats_qdep; pfsid = info->pfsid; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] llc: make llc_ui_sendmsg() more robust against bonding changes
by Guo Mengqi 14 May '24

14 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit 04f2a74b562f3a7498be0399309669f342793d8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JVI CVE: CVE-2024-26636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit dad555c816a50c6a6a8a86be1f9177673918c647 ] syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ethernet header [1] Like some others, llc_ui_sendmsg() releases the socket lock before calling sock_alloc_send_skb(). Then it acquires it again, but does not redo all the sanity checks that were performed. This fix: - Uses LL_RESERVED_SPACE() to reserve space. - Check all conditions again after socket lock is held again. - Do not account Ethernet header for mtu limitation. [1] skbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0 kernel BUG at net/core/skbuff.c:193 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:189 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 lr : skb_panic net/core/skbuff.c:189 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 sp : ffff800096f97000 x29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000 x26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2 x23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0 x20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce x17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001 x14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400 x8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089 Call trace: skb_panic net/core/skbuff.c:189 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 skb_push+0xf0/0x108 net/core/skbuff.c:2451 eth_header+0x44/0x1f8 net/ethernet/eth.c:83 dev_hard_header include/linux/netdevice.h:3188 [inline] llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33 llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85 llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline] llc_sap_next_state net/llc/llc_sap.c:182 [inline] llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209 llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270 llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_sendmsg+0x194/0x274 net/socket.c:767 splice_to_socket+0x7cc/0xd58 fs/splice.c:881 do_splice_from fs/splice.c:933 [inline] direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142 splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088 do_splice_direct+0x20c/0x348 fs/splice.c:1194 do_sendfile+0x4bc/0xc70 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1322 [inline] __se_sys_sendfile64 fs/read_write.c:1308 [inline] __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595 Code: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+2a7024e9502df538e8ef(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240118183625.4007013-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/llc/af_llc.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index bde7b5b822a8..eea29cb65502 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -927,14 +927,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, */ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) { + DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); struct sock *sk = sock->sk; struct llc_sock *llc = llc_sk(sk); - DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); int flags = msg->msg_flags; int noblock = flags & MSG_DONTWAIT; + int rc = -EINVAL, copied = 0, hdrlen, hh_len; struct sk_buff *skb = NULL; + struct net_device *dev; size_t size = 0; - int rc = -EINVAL, copied = 0, hdrlen; dprintk("%s: sending from %02X to %02X\n", __func__, llc->laddr.lsap, llc->daddr.lsap); @@ -954,22 +955,29 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) if (rc) goto out; } - hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr); + dev = llc->dev; + hh_len = LL_RESERVED_SPACE(dev); + hdrlen = llc_ui_header_len(sk, addr); size = hdrlen + len; - if (size > llc->dev->mtu) - size = llc->dev->mtu; + size = min_t(size_t, size, READ_ONCE(dev->mtu)); copied = size - hdrlen; rc = -EINVAL; if (copied < 0) goto out; release_sock(sk); - skb = sock_alloc_send_skb(sk, size, noblock, &rc); + skb = sock_alloc_send_skb(sk, hh_len + size, noblock, &rc); lock_sock(sk); if (!skb) goto out; - skb->dev = llc->dev; + if (sock_flag(sk, SOCK_ZAPPED) || + llc->dev != dev || + hdrlen != llc_ui_header_len(sk, addr) || + hh_len != LL_RESERVED_SPACE(dev) || + size > READ_ONCE(dev->mtu)) + goto out; + skb->dev = dev; skb->protocol = llc_proto_type(addr->sllc_arphrd); - skb_reserve(skb, hdrlen); + skb_reserve(skb, hh_len + hdrlen); rc = memcpy_from_msg(skb_put(skb, copied), msg, copied); if (rc) goto out; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] llc: Drop support for ETH_P_TR_802_2.
by Guo Mengqi 14 May '24

14 May '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v5.10.210 commit 9ccdef19cf9497c2803b005369668feb91cacdfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JSA CVE: CVE-2024-26635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit e3f9bed9bee261e3347131764e42aeedf1ffea61 ] syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Fixes: 211ed865108e ("net: delete all instances of special processing for token ring") Reported-by: syzbot+b5ad66046b913bc04c6f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ad66046b913bc04c6f Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240119015515.61898-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/llc_pdu.h | 6 ++---- net/llc/llc_core.c | 7 ------- 2 files changed, 2 insertions(+), 11 deletions(-) diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h index 49aa79c7b278..581cd37aa98b 100644 --- a/include/net/llc_pdu.h +++ b/include/net/llc_pdu.h @@ -262,8 +262,7 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, */ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); + memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); } /** @@ -275,8 +274,7 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) */ static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); + memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); } /** diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c index 64d4bef04e73..4900a27b5176 100644 --- a/net/llc/llc_core.c +++ b/net/llc/llc_core.c @@ -135,22 +135,15 @@ static struct packet_type llc_packet_type __read_mostly = { .func = llc_rcv, }; -static struct packet_type llc_tr_packet_type __read_mostly = { - .type = cpu_to_be16(ETH_P_TR_802_2), - .func = llc_rcv, -}; - static int __init llc_init(void) { dev_add_pack(&llc_packet_type); - dev_add_pack(&llc_tr_packet_type); return 0; } static void __exit llc_exit(void) { dev_remove_pack(&llc_packet_type); - dev_remove_pack(&llc_tr_packet_type); } module_init(llc_init); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] llc: Drop support for ETH_P_TR_802_2.
by Guo Mengqi 14 May '24

14 May '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v5.10.210 commit 9ccdef19cf9497c2803b005369668feb91cacdfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JSA CVE: CVE-2024-26635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit e3f9bed9bee261e3347131764e42aeedf1ffea61 ] syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Fixes: 211ed865108e ("net: delete all instances of special processing for token ring") Reported-by: syzbot+b5ad66046b913bc04c6f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ad66046b913bc04c6f Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240119015515.61898-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/llc_pdu.h | 6 ++---- net/llc/llc_core.c | 7 ------- 2 files changed, 2 insertions(+), 11 deletions(-) diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h index 49aa79c7b278..581cd37aa98b 100644 --- a/include/net/llc_pdu.h +++ b/include/net/llc_pdu.h @@ -262,8 +262,7 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, */ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); + memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); } /** @@ -275,8 +274,7 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) */ static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); + memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); } /** diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c index 64d4bef04e73..4900a27b5176 100644 --- a/net/llc/llc_core.c +++ b/net/llc/llc_core.c @@ -135,22 +135,15 @@ static struct packet_type llc_packet_type __read_mostly = { .func = llc_rcv, }; -static struct packet_type llc_tr_packet_type __read_mostly = { - .type = cpu_to_be16(ETH_P_TR_802_2), - .func = llc_rcv, -}; - static int __init llc_init(void) { dev_add_pack(&llc_packet_type); - dev_add_pack(&llc_tr_packet_type); return 0; } static void __exit llc_exit(void) { dev_remove_pack(&llc_packet_type); - dev_remove_pack(&llc_tr_packet_type); } module_init(llc_init); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] llc: make llc_ui_sendmsg() more robust against bonding changes
by Guo Mengqi 14 May '24

14 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit 04f2a74b562f3a7498be0399309669f342793d8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JVI CVE: CVE-2024-26636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit dad555c816a50c6a6a8a86be1f9177673918c647 ] syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ethernet header [1] Like some others, llc_ui_sendmsg() releases the socket lock before calling sock_alloc_send_skb(). Then it acquires it again, but does not redo all the sanity checks that were performed. This fix: - Uses LL_RESERVED_SPACE() to reserve space. - Check all conditions again after socket lock is held again. - Do not account Ethernet header for mtu limitation. [1] skbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0 kernel BUG at net/core/skbuff.c:193 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:189 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 lr : skb_panic net/core/skbuff.c:189 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 sp : ffff800096f97000 x29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000 x26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2 x23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0 x20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce x17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001 x14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400 x8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089 Call trace: skb_panic net/core/skbuff.c:189 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 skb_push+0xf0/0x108 net/core/skbuff.c:2451 eth_header+0x44/0x1f8 net/ethernet/eth.c:83 dev_hard_header include/linux/netdevice.h:3188 [inline] llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33 llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85 llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline] llc_sap_next_state net/llc/llc_sap.c:182 [inline] llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209 llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270 llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_sendmsg+0x194/0x274 net/socket.c:767 splice_to_socket+0x7cc/0xd58 fs/splice.c:881 do_splice_from fs/splice.c:933 [inline] direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142 splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088 do_splice_direct+0x20c/0x348 fs/splice.c:1194 do_sendfile+0x4bc/0xc70 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1322 [inline] __se_sys_sendfile64 fs/read_write.c:1308 [inline] __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595 Code: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+2a7024e9502df538e8ef(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240118183625.4007013-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/llc/af_llc.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index 90a32864401c..dae978badd26 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -929,14 +929,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, */ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) { + DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); struct sock *sk = sock->sk; struct llc_sock *llc = llc_sk(sk); - DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); int flags = msg->msg_flags; int noblock = flags & MSG_DONTWAIT; + int rc = -EINVAL, copied = 0, hdrlen, hh_len; struct sk_buff *skb = NULL; + struct net_device *dev; size_t size = 0; - int rc = -EINVAL, copied = 0, hdrlen; dprintk("%s: sending from %02X to %02X\n", __func__, llc->laddr.lsap, llc->daddr.lsap); @@ -956,22 +957,29 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) if (rc) goto out; } - hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr); + dev = llc->dev; + hh_len = LL_RESERVED_SPACE(dev); + hdrlen = llc_ui_header_len(sk, addr); size = hdrlen + len; - if (size > llc->dev->mtu) - size = llc->dev->mtu; + size = min_t(size_t, size, READ_ONCE(dev->mtu)); copied = size - hdrlen; rc = -EINVAL; if (copied < 0) goto out; release_sock(sk); - skb = sock_alloc_send_skb(sk, size, noblock, &rc); + skb = sock_alloc_send_skb(sk, hh_len + size, noblock, &rc); lock_sock(sk); if (!skb) goto out; - skb->dev = llc->dev; + if (sock_flag(sk, SOCK_ZAPPED) || + llc->dev != dev || + hdrlen != llc_ui_header_len(sk, addr) || + hh_len != LL_RESERVED_SPACE(dev) || + size > READ_ONCE(dev->mtu)) + goto out; + skb->dev = dev; skb->protocol = llc_proto_type(addr->sllc_arphrd); - skb_reserve(skb, hdrlen); + skb_reserve(skb, hh_len + hdrlen); rc = memcpy_from_msg(skb_put(skb, copied), msg, copied); if (rc) goto out; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] llc: make llc_ui_sendmsg() more robust against bonding changes
by Guo Mengqi 14 May '24

14 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit 04f2a74b562f3a7498be0399309669f342793d8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JVI CVE: CVE-2024-26636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit dad555c816a50c6a6a8a86be1f9177673918c647 ] syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ethernet header [1] Like some others, llc_ui_sendmsg() releases the socket lock before calling sock_alloc_send_skb(). Then it acquires it again, but does not redo all the sanity checks that were performed. This fix: - Uses LL_RESERVED_SPACE() to reserve space. - Check all conditions again after socket lock is held again. - Do not account Ethernet header for mtu limitation. [1] skbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0 kernel BUG at net/core/skbuff.c:193 ! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:189 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 lr : skb_panic net/core/skbuff.c:189 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 sp : ffff800096f97000 x29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000 x26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2 x23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0 x20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce x17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001 x14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400 x8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089 Call trace: skb_panic net/core/skbuff.c:189 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:203 skb_push+0xf0/0x108 net/core/skbuff.c:2451 eth_header+0x44/0x1f8 net/ethernet/eth.c:83 dev_hard_header include/linux/netdevice.h:3188 [inline] llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33 llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85 llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline] llc_sap_next_state net/llc/llc_sap.c:182 [inline] llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209 llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270 llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_sendmsg+0x194/0x274 net/socket.c:767 splice_to_socket+0x7cc/0xd58 fs/splice.c:881 do_splice_from fs/splice.c:933 [inline] direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142 splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088 do_splice_direct+0x20c/0x348 fs/splice.c:1194 do_sendfile+0x4bc/0xc70 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1322 [inline] __se_sys_sendfile64 fs/read_write.c:1308 [inline] __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595 Code: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+2a7024e9502df538e8ef(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240118183625.4007013-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/llc/af_llc.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index bde7b5b822a8..eea29cb65502 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -927,14 +927,15 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, */ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) { + DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); struct sock *sk = sock->sk; struct llc_sock *llc = llc_sk(sk); - DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); int flags = msg->msg_flags; int noblock = flags & MSG_DONTWAIT; + int rc = -EINVAL, copied = 0, hdrlen, hh_len; struct sk_buff *skb = NULL; + struct net_device *dev; size_t size = 0; - int rc = -EINVAL, copied = 0, hdrlen; dprintk("%s: sending from %02X to %02X\n", __func__, llc->laddr.lsap, llc->daddr.lsap); @@ -954,22 +955,29 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) if (rc) goto out; } - hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr); + dev = llc->dev; + hh_len = LL_RESERVED_SPACE(dev); + hdrlen = llc_ui_header_len(sk, addr); size = hdrlen + len; - if (size > llc->dev->mtu) - size = llc->dev->mtu; + size = min_t(size_t, size, READ_ONCE(dev->mtu)); copied = size - hdrlen; rc = -EINVAL; if (copied < 0) goto out; release_sock(sk); - skb = sock_alloc_send_skb(sk, size, noblock, &rc); + skb = sock_alloc_send_skb(sk, hh_len + size, noblock, &rc); lock_sock(sk); if (!skb) goto out; - skb->dev = llc->dev; + if (sock_flag(sk, SOCK_ZAPPED) || + llc->dev != dev || + hdrlen != llc_ui_header_len(sk, addr) || + hh_len != LL_RESERVED_SPACE(dev) || + size > READ_ONCE(dev->mtu)) + goto out; + skb->dev = dev; skb->protocol = llc_proto_type(addr->sllc_arphrd); - skb_reserve(skb, hdrlen); + skb_reserve(skb, hh_len + hdrlen); rc = memcpy_from_msg(skb_put(skb, copied), msg, copied); if (rc) goto out; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] llc: Drop support for ETH_P_TR_802_2.
by Guo Mengqi 14 May '24

14 May '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> stable inclusion from stable-v5.10.210 commit 9ccdef19cf9497c2803b005369668feb91cacdfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JSA CVE: CVE-2024-26635 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit e3f9bed9bee261e3347131764e42aeedf1ffea61 ] syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit 211ed865108e ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Fixes: 211ed865108e ("net: delete all instances of special processing for token ring") Reported-by: syzbot+b5ad66046b913bc04c6f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ad66046b913bc04c6f Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240119015515.61898-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/llc_pdu.h | 6 ++---- net/llc/llc_core.c | 7 ------- 2 files changed, 2 insertions(+), 11 deletions(-) diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h index 49aa79c7b278..581cd37aa98b 100644 --- a/include/net/llc_pdu.h +++ b/include/net/llc_pdu.h @@ -262,8 +262,7 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, */ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); + memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN); } /** @@ -275,8 +274,7 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa) */ static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da) { - if (skb->protocol == htons(ETH_P_802_2)) - memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); + memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN); } /** diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c index 64d4bef04e73..4900a27b5176 100644 --- a/net/llc/llc_core.c +++ b/net/llc/llc_core.c @@ -135,22 +135,15 @@ static struct packet_type llc_packet_type __read_mostly = { .func = llc_rcv, }; -static struct packet_type llc_tr_packet_type __read_mostly = { - .type = cpu_to_be16(ETH_P_TR_802_2), - .func = llc_rcv, -}; - static int __init llc_init(void) { dev_add_pack(&llc_packet_type); - dev_add_pack(&llc_tr_packet_type); return 0; } static void __exit llc_exit(void) { dev_remove_pack(&llc_packet_type); - dev_remove_pack(&llc_tr_packet_type); } module_init(llc_init); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] binder: fix race between mmput() and do_exit()
by Guo Mengqi 14 May '24

14 May '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.209 commit 7e7a0d86542b0ea903006d3f42f33c4f7ead6918 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JWJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/android/binder_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 3c93e6c05c4d..c534b332c8d3 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -271,7 +271,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, } if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return 0; @@ -304,7 +304,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, err_no_vma: if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return vma ? -ENOMEM : -ESRCH; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] binder: fix race between mmput() and do_exit()
by Guo Mengqi 14 May '24

14 May '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.209 commit 7e7a0d86542b0ea903006d3f42f33c4f7ead6918 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JWJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/android/binder_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 3c93e6c05c4d..c534b332c8d3 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -271,7 +271,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, } if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return 0; @@ -304,7 +304,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, err_no_vma: if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return vma ? -ENOMEM : -ESRCH; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] binder: fix race between mmput() and do_exit()
by Guo Mengqi 14 May '24

14 May '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.209 commit 7e7a0d86542b0ea903006d3f42f33c4f7ead6918 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JWJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/android/binder_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 3c93e6c05c4d..c534b332c8d3 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -271,7 +271,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, } if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return 0; @@ -304,7 +304,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, err_no_vma: if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return vma ? -ENOMEM : -ESRCH; } -- 2.17.1

2 1

[PATCH OLK-5.10] crypto: scomp - fix req->dst buffer overflow
by Guo Mengqi 14 May '24

14 May '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v5.10.209 commit 4518dc468cdd796757190515a9be7408adc8911e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K14 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 738f4f8f0f41..4d6366a44400 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) struct crypto_scomp *scomp = *tfm_ctx; void **ctx = acomp_request_ctx(req); struct scomp_scratch *scratch; + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) @@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scratch = raw_cpu_ptr(&scomp_scratch); spin_lock(&scratch->lock); @@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, 1); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] crypto: scomp - fix req->dst buffer overflow
by Guo Mengqi 14 May '24

14 May '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v5.10.209 commit 4518dc468cdd796757190515a9be7408adc8911e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K14 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 738f4f8f0f41..4d6366a44400 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) struct crypto_scomp *scomp = *tfm_ctx; void **ctx = acomp_request_ctx(req); struct scomp_scratch *scratch; + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) @@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scratch = raw_cpu_ptr(&scomp_scratch); spin_lock(&scratch->lock); @@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, 1); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] crypto: scomp - fix req->dst buffer overflow
by Guo Mengqi 14 May '24

14 May '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v5.10.209 commit 4518dc468cdd796757190515a9be7408adc8911e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K14 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 738f4f8f0f41..4d6366a44400 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) struct crypto_scomp *scomp = *tfm_ctx; void **ctx = acomp_request_ctx(req); struct scomp_scratch *scratch; + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) @@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scratch = raw_cpu_ptr(&scomp_scratch); spin_lock(&scratch->lock); @@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, 1); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] block/rnbd-srv: Check for unlikely string overflow
by Guo Mengqi 14 May '24

14 May '24

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.8-rc1 commit 9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K1F CVE: CVE-2023-52618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning: drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra': drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~ In function 'rnbd_srv_get_full_path', inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | dev_search_path, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~ To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present). Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202312100355.lHoJPgKy-lkp@intel.com/ Cc: Md. Haris Iqbal <haris.iqbal(a)ionos.com> Cc: Jack Wang <jinpu.wang(a)ionos.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: <linux-block(a)vger.kernel.org> Signed-off-by: Kees Cook <keescook(a)chromium.org> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Link: https://lore.kernel.org/r/20231212214738.work.169-kees@kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/block/rnbd/rnbd-srv.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c index e1bc8b4cd592..9c5d52335e17 100644 --- a/drivers/block/rnbd/rnbd-srv.c +++ b/drivers/block/rnbd/rnbd-srv.c @@ -591,6 +591,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, { char *full_path; char *a, *b; + int len; full_path = kmalloc(PATH_MAX, GFP_KERNEL); if (!full_path) @@ -602,19 +603,19 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, */ a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path)); if (a) { - int len = a - dev_search_path; + len = a - dev_search_path; len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len, dev_search_path, srv_sess->sessname, dev_name); - if (len >= PATH_MAX) { - pr_err("Too long path: %s, %s, %s\n", - dev_search_path, srv_sess->sessname, dev_name); - kfree(full_path); - return ERR_PTR(-EINVAL); - } } else { - snprintf(full_path, PATH_MAX, "%s/%s", - dev_search_path, dev_name); + len = snprintf(full_path, PATH_MAX, "%s/%s", + dev_search_path, dev_name); + } + if (len >= PATH_MAX) { + pr_err("Too long path: %s, %s, %s\n", + dev_search_path, srv_sess->sessname, dev_name); + kfree(full_path); + return ERR_PTR(-EINVAL); } /* eliminitate duplicated slashes */ -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] crypto: scomp - fix req->dst buffer overflow
by Guo Mengqi 14 May '24

14 May '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v5.10.209 commit 4518dc468cdd796757190515a9be7408adc8911e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K14 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 738f4f8f0f41..4d6366a44400 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) struct crypto_scomp *scomp = *tfm_ctx; void **ctx = acomp_request_ctx(req); struct scomp_scratch *scratch; + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) @@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scratch = raw_cpu_ptr(&scomp_scratch); spin_lock(&scratch->lock); @@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, 1); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] block/rnbd-srv: Check for unlikely string overflow
by Guo Mengqi 14 May '24

14 May '24

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.8-rc1 commit 9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K1F CVE: CVE-2023-52618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning: drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra': drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~ In function 'rnbd_srv_get_full_path', inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | dev_search_path, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~ To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present). Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202312100355.lHoJPgKy-lkp@intel.com/ Cc: Md. Haris Iqbal <haris.iqbal(a)ionos.com> Cc: Jack Wang <jinpu.wang(a)ionos.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: <linux-block(a)vger.kernel.org> Signed-off-by: Kees Cook <keescook(a)chromium.org> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Link: https://lore.kernel.org/r/20231212214738.work.169-kees@kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/block/rnbd/rnbd-srv.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c index e1bc8b4cd592..9c5d52335e17 100644 --- a/drivers/block/rnbd/rnbd-srv.c +++ b/drivers/block/rnbd/rnbd-srv.c @@ -591,6 +591,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, { char *full_path; char *a, *b; + int len; full_path = kmalloc(PATH_MAX, GFP_KERNEL); if (!full_path) @@ -602,19 +603,19 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, */ a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path)); if (a) { - int len = a - dev_search_path; + len = a - dev_search_path; len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len, dev_search_path, srv_sess->sessname, dev_name); - if (len >= PATH_MAX) { - pr_err("Too long path: %s, %s, %s\n", - dev_search_path, srv_sess->sessname, dev_name); - kfree(full_path); - return ERR_PTR(-EINVAL); - } } else { - snprintf(full_path, PATH_MAX, "%s/%s", - dev_search_path, dev_name); + len = snprintf(full_path, PATH_MAX, "%s/%s", + dev_search_path, dev_name); + } + if (len >= PATH_MAX) { + pr_err("Too long path: %s, %s, %s\n", + dev_search_path, srv_sess->sessname, dev_name); + kfree(full_path); + return ERR_PTR(-EINVAL); } /* eliminitate duplicated slashes */ -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] block/rnbd-srv: Check for unlikely string overflow
by Guo Mengqi 14 May '24

14 May '24

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.8-rc1 commit 9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K1F CVE: CVE-2023-52618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning: drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra': drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~ In function 'rnbd_srv_get_full_path', inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | dev_search_path, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~ To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present). Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202312100355.lHoJPgKy-lkp@intel.com/ Cc: Md. Haris Iqbal <haris.iqbal(a)ionos.com> Cc: Jack Wang <jinpu.wang(a)ionos.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: <linux-block(a)vger.kernel.org> Signed-off-by: Kees Cook <keescook(a)chromium.org> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Acked-by: Jack Wang <jinpu.wang(a)ionos.com> Link: https://lore.kernel.org/r/20231212214738.work.169-kees@kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/block/rnbd/rnbd-srv.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c index e1bc8b4cd592..9c5d52335e17 100644 --- a/drivers/block/rnbd/rnbd-srv.c +++ b/drivers/block/rnbd/rnbd-srv.c @@ -591,6 +591,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, { char *full_path; char *a, *b; + int len; full_path = kmalloc(PATH_MAX, GFP_KERNEL); if (!full_path) @@ -602,19 +603,19 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, */ a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path)); if (a) { - int len = a - dev_search_path; + len = a - dev_search_path; len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len, dev_search_path, srv_sess->sessname, dev_name); - if (len >= PATH_MAX) { - pr_err("Too long path: %s, %s, %s\n", - dev_search_path, srv_sess->sessname, dev_name); - kfree(full_path); - return ERR_PTR(-EINVAL); - } } else { - snprintf(full_path, PATH_MAX, "%s/%s", - dev_search_path, dev_name); + len = snprintf(full_path, PATH_MAX, "%s/%s", + dev_search_path, dev_name); + } + if (len >= PATH_MAX) { + pr_err("Too long path: %s, %s, %s\n", + dev_search_path, srv_sess->sessname, dev_name); + kfree(full_path); + return ERR_PTR(-EINVAL); } /* eliminitate duplicated slashes */ -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] Bluetooth: Fix atomicity violation in {min,max}_key_size_set
by Guo Mengqi 14 May '24

14 May '24

From: Gui-Dong Han <2045gemini(a)gmail.com> stable inclusion from stable-v5.10.209 commit 394c6c0b6d9bdd7d6ebca35ca9cfbabf44c0c257 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917MX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit da9065caa594d19b26e1a030fd0cc27bd365d685 upstream. In min_key_size_set(): if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) return -EINVAL; hci_dev_lock(hdev); hdev->le_min_key_size = val; hci_dev_unlock(hdev); In max_key_size_set(): if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) return -EINVAL; hci_dev_lock(hdev); hdev->le_max_key_size = val; hci_dev_unlock(hdev); The atomicity violation occurs due to concurrent execution of set_min and set_max funcs.Consider a scenario where setmin writes a new, valid 'min' value, and concurrently, setmax writes a value that is greater than the old 'min' but smaller than the new 'min'. In this case, setmax might check against the old 'min' value (before acquiring the lock) but write its value after the 'min' has been updated by setmin. This leads to a situation where the 'max' value ends up being smaller than the 'min' value, which is an inconsistency. This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 5.17. To resolve this issue, it is suggested to encompass the validity checks within the locked sections in both set_min and set_max funcs. The modification ensures that the validation of 'val' against the current min/max values is atomic, thus maintaining the integrity of the settings. With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the lack of associated hardware, we cannot test the patch in runtime testing, and just verify it according to the code logic. [1] https://sites.google.com/view/basscheck/ Fixes: 18f81241b74f ("Bluetooth: Move {min,max}_key_size debugfs ...") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/bluetooth/hci_debugfs.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c index 338833f12365..d4efc4aa55af 100644 --- a/net/bluetooth/hci_debugfs.c +++ b/net/bluetooth/hci_debugfs.c @@ -994,10 +994,12 @@ static int min_key_size_set(void *data, u64 val) { struct hci_dev *hdev = data; - if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) + hci_dev_lock(hdev); + if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) { + hci_dev_unlock(hdev); return -EINVAL; + } - hci_dev_lock(hdev); hdev->le_min_key_size = val; hci_dev_unlock(hdev); @@ -1022,10 +1024,12 @@ static int max_key_size_set(void *data, u64 val) { struct hci_dev *hdev = data; - if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) + hci_dev_lock(hdev); + if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) { + hci_dev_unlock(hdev); return -EINVAL; + } - hci_dev_lock(hdev); hdev->le_max_key_size = val; hci_dev_unlock(hdev); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] Bluetooth: Fix atomicity violation in {min,max}_key_size_set
by Guo Mengqi 14 May '24

14 May '24

From: Gui-Dong Han <2045gemini(a)gmail.com> stable inclusion from stable-v5.10.209 commit 394c6c0b6d9bdd7d6ebca35ca9cfbabf44c0c257 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917MX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit da9065caa594d19b26e1a030fd0cc27bd365d685 upstream. In min_key_size_set(): if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) return -EINVAL; hci_dev_lock(hdev); hdev->le_min_key_size = val; hci_dev_unlock(hdev); In max_key_size_set(): if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) return -EINVAL; hci_dev_lock(hdev); hdev->le_max_key_size = val; hci_dev_unlock(hdev); The atomicity violation occurs due to concurrent execution of set_min and set_max funcs.Consider a scenario where setmin writes a new, valid 'min' value, and concurrently, setmax writes a value that is greater than the old 'min' but smaller than the new 'min'. In this case, setmax might check against the old 'min' value (before acquiring the lock) but write its value after the 'min' has been updated by setmin. This leads to a situation where the 'max' value ends up being smaller than the 'min' value, which is an inconsistency. This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 5.17. To resolve this issue, it is suggested to encompass the validity checks within the locked sections in both set_min and set_max funcs. The modification ensures that the validation of 'val' against the current min/max values is atomic, thus maintaining the integrity of the settings. With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the lack of associated hardware, we cannot test the patch in runtime testing, and just verify it according to the code logic. [1] https://sites.google.com/view/basscheck/ Fixes: 18f81241b74f ("Bluetooth: Move {min,max}_key_size debugfs ...") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/bluetooth/hci_debugfs.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c index 338833f12365..d4efc4aa55af 100644 --- a/net/bluetooth/hci_debugfs.c +++ b/net/bluetooth/hci_debugfs.c @@ -994,10 +994,12 @@ static int min_key_size_set(void *data, u64 val) { struct hci_dev *hdev = data; - if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) + hci_dev_lock(hdev); + if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) { + hci_dev_unlock(hdev); return -EINVAL; + } - hci_dev_lock(hdev); hdev->le_min_key_size = val; hci_dev_unlock(hdev); @@ -1022,10 +1024,12 @@ static int max_key_size_set(void *data, u64 val) { struct hci_dev *hdev = data; - if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) + hci_dev_lock(hdev); + if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) { + hci_dev_unlock(hdev); return -EINVAL; + } - hci_dev_lock(hdev); hdev->le_max_key_size = val; hci_dev_unlock(hdev); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: Fix atomicity violation in {min,max}_key_size_set
by Guo Mengqi 14 May '24

14 May '24

From: Gui-Dong Han <2045gemini(a)gmail.com> stable inclusion from stable-v5.10.209 commit 394c6c0b6d9bdd7d6ebca35ca9cfbabf44c0c257 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917MX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit da9065caa594d19b26e1a030fd0cc27bd365d685 upstream. In min_key_size_set(): if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) return -EINVAL; hci_dev_lock(hdev); hdev->le_min_key_size = val; hci_dev_unlock(hdev); In max_key_size_set(): if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) return -EINVAL; hci_dev_lock(hdev); hdev->le_max_key_size = val; hci_dev_unlock(hdev); The atomicity violation occurs due to concurrent execution of set_min and set_max funcs.Consider a scenario where setmin writes a new, valid 'min' value, and concurrently, setmax writes a value that is greater than the old 'min' but smaller than the new 'min'. In this case, setmax might check against the old 'min' value (before acquiring the lock) but write its value after the 'min' has been updated by setmin. This leads to a situation where the 'max' value ends up being smaller than the 'min' value, which is an inconsistency. This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 5.17. To resolve this issue, it is suggested to encompass the validity checks within the locked sections in both set_min and set_max funcs. The modification ensures that the validation of 'val' against the current min/max values is atomic, thus maintaining the integrity of the settings. With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the lack of associated hardware, we cannot test the patch in runtime testing, and just verify it according to the code logic. [1] https://sites.google.com/view/basscheck/ Fixes: 18f81241b74f ("Bluetooth: Move {min,max}_key_size debugfs ...") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/bluetooth/hci_debugfs.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c index 338833f12365..d4efc4aa55af 100644 --- a/net/bluetooth/hci_debugfs.c +++ b/net/bluetooth/hci_debugfs.c @@ -994,10 +994,12 @@ static int min_key_size_set(void *data, u64 val) { struct hci_dev *hdev = data; - if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) + hci_dev_lock(hdev); + if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) { + hci_dev_unlock(hdev); return -EINVAL; + } - hci_dev_lock(hdev); hdev->le_min_key_size = val; hci_dev_unlock(hdev); @@ -1022,10 +1024,12 @@ static int max_key_size_set(void *data, u64 val) { struct hci_dev *hdev = data; - if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) + hci_dev_lock(hdev); + if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) { + hci_dev_unlock(hdev); return -EINVAL; + } - hci_dev_lock(hdev); hdev->le_max_key_size = val; hci_dev_unlock(hdev); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
by Guo Mengqi 14 May '24

14 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.209 commit da23bd709b46168f7dfc36055801011222b076cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K08 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d375b98e0248980681e5e56b712026174d617198 ] syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough bytes to skb->head. Currently we might access garbage. [1] BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 __pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 pskb_may_pull_reason include/linux/skbuff.h:2673 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 7345 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index a03a322e0cc1..edf4a842506f 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -427,7 +427,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw; unsigned int nhoff = raw - skb->data; unsigned int off = nhoff + sizeof(*ipv6h); - u8 next, nexthdr = ipv6h->nexthdr; + u8 nexthdr = ipv6h->nexthdr; while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) { struct ipv6_opt_hdr *hdr; @@ -438,25 +438,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) hdr = (struct ipv6_opt_hdr *)(skb->data + off); if (nexthdr == NEXTHDR_FRAGMENT) { - struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr; - if (frag_hdr->frag_off) - break; optlen = 8; } else if (nexthdr == NEXTHDR_AUTH) { optlen = ipv6_authlen(hdr); } else { optlen = ipv6_optlen(hdr); } - /* cache hdr->nexthdr, since pskb_may_pull() might - * invalidate hdr - */ - next = hdr->nexthdr; - if (nexthdr == NEXTHDR_DEST) { - u16 i = 2; - /* Remember : hdr is no longer valid at this point. */ - if (!pskb_may_pull(skb, off + optlen)) + if (!pskb_may_pull(skb, off + optlen)) + break; + + hdr = (struct ipv6_opt_hdr *)(skb->data + off); + if (nexthdr == NEXTHDR_FRAGMENT) { + struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr; + + if (frag_hdr->frag_off) break; + } + if (nexthdr == NEXTHDR_DEST) { + u16 i = 2; while (1) { struct ipv6_tlv_tnl_enc_lim *tel; @@ -477,7 +477,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) i++; } } - nexthdr = next; + nexthdr = hdr->nexthdr; off += optlen; } return 0; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
by Guo Mengqi 14 May '24

14 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.209 commit da23bd709b46168f7dfc36055801011222b076cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K08 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d375b98e0248980681e5e56b712026174d617198 ] syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough bytes to skb->head. Currently we might access garbage. [1] BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 __pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 pskb_may_pull_reason include/linux/skbuff.h:2673 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 7345 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 3a2741569b84..fab133d67e6c 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -427,7 +427,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw; unsigned int nhoff = raw - skb->data; unsigned int off = nhoff + sizeof(*ipv6h); - u8 next, nexthdr = ipv6h->nexthdr; + u8 nexthdr = ipv6h->nexthdr; while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) { struct ipv6_opt_hdr *hdr; @@ -438,25 +438,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) hdr = (struct ipv6_opt_hdr *)(skb->data + off); if (nexthdr == NEXTHDR_FRAGMENT) { - struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr; - if (frag_hdr->frag_off) - break; optlen = 8; } else if (nexthdr == NEXTHDR_AUTH) { optlen = ipv6_authlen(hdr); } else { optlen = ipv6_optlen(hdr); } - /* cache hdr->nexthdr, since pskb_may_pull() might - * invalidate hdr - */ - next = hdr->nexthdr; - if (nexthdr == NEXTHDR_DEST) { - u16 i = 2; - /* Remember : hdr is no longer valid at this point. */ - if (!pskb_may_pull(skb, off + optlen)) + if (!pskb_may_pull(skb, off + optlen)) + break; + + hdr = (struct ipv6_opt_hdr *)(skb->data + off); + if (nexthdr == NEXTHDR_FRAGMENT) { + struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr; + + if (frag_hdr->frag_off) break; + } + if (nexthdr == NEXTHDR_DEST) { + u16 i = 2; while (1) { struct ipv6_tlv_tnl_enc_lim *tel; @@ -477,7 +477,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) i++; } } - nexthdr = next; + nexthdr = hdr->nexthdr; off += optlen; } return 0; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] thermal: intel: hfi: Add syscore callbacks for system-wide PM
by Guo Mengqi 14 May '24

14 May '24

From: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> mainline inclusion from mainline-v6.8-rc1 commit 97566d09fd02d2ab329774bb89a2cdf2267e86d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4D CVE: CVE-2024-26646 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kernel allocates a memory buffer and provides its location to the hardware, which uses it to update the HFI table. This allocation occurs during boot and remains constant throughout runtime. When resuming from hibernation, the restore kernel allocates a second memory buffer and reprograms the HFI hardware with the new location as part of a normal boot. The location of the second memory buffer may differ from the one allocated by the image kernel. When the restore kernel transfers control to the image kernel, its HFI buffer becomes invalid, potentially leading to memory corruption if the hardware writes to it (the hardware continues to use the buffer from the restore kernel). It is also possible that the hardware "forgets" the address of the memory buffer when resuming from "deep" suspend. Memory corruption may also occur in such a scenario. To prevent the described memory corruption, disable HFI when preparing to suspend or hibernate. Enable it when resuming. Add syscore callbacks to handle the package of the boot CPU (packages of non-boot CPUs are handled via CPU offline). Syscore ops always run on the boot CPU. Additionally, HFI only needs to be disabled during "deep" suspend and hibernation. Syscore ops only run in these cases. Cc: 6.1+ <stable(a)vger.kernel.org> # 6.1+ Signed-off-by: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> [ rjw: Comment adjustment, subject and changelog edits ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/thermal/intel/intel_hfi.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c index 158a2b7c6b6f..d442d639a900 100644 --- a/drivers/thermal/intel/intel_hfi.c +++ b/drivers/thermal/intel/intel_hfi.c @@ -33,7 +33,9 @@ #include <linux/processor.h> #include <linux/slab.h> #include <linux/spinlock.h> +#include <linux/suspend.h> #include <linux/string.h> +#include <linux/syscore_ops.h> #include <linux/topology.h> #include <linux/workqueue.h> @@ -524,6 +526,30 @@ static __init int hfi_parse_features(void) return 0; } +static void hfi_do_enable(void) +{ + /* This code runs only on the boot CPU. */ + struct hfi_cpu_info *info = &per_cpu(hfi_cpu_info, 0); + struct hfi_instance *hfi_instance = info->hfi_instance; + + /* No locking needed. There is no concurrency with CPU online. */ + hfi_set_hw_table(hfi_instance); + hfi_enable(); +} + +static int hfi_do_disable(void) +{ + /* No locking needed. There is no concurrency with CPU offline. */ + hfi_disable(); + + return 0; +} + +static struct syscore_ops hfi_pm_ops = { + .resume = hfi_do_enable, + .suspend = hfi_do_disable, +}; + void __init intel_hfi_init(void) { struct hfi_instance *hfi_instance; @@ -555,6 +581,8 @@ void __init intel_hfi_init(void) if (!hfi_updates_wq) goto err_nomem; + register_syscore_ops(&hfi_pm_ops); + return; err_nomem: -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
by Guo Mengqi 14 May '24

14 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.209 commit da23bd709b46168f7dfc36055801011222b076cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99K08 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d375b98e0248980681e5e56b712026174d617198 ] syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough bytes to skb->head. Currently we might access garbage. [1] BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 __pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 pskb_may_pull_reason include/linux/skbuff.h:2673 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 7345 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 3a2741569b84..fab133d67e6c 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -427,7 +427,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw; unsigned int nhoff = raw - skb->data; unsigned int off = nhoff + sizeof(*ipv6h); - u8 next, nexthdr = ipv6h->nexthdr; + u8 nexthdr = ipv6h->nexthdr; while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) { struct ipv6_opt_hdr *hdr; @@ -438,25 +438,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) hdr = (struct ipv6_opt_hdr *)(skb->data + off); if (nexthdr == NEXTHDR_FRAGMENT) { - struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr; - if (frag_hdr->frag_off) - break; optlen = 8; } else if (nexthdr == NEXTHDR_AUTH) { optlen = ipv6_authlen(hdr); } else { optlen = ipv6_optlen(hdr); } - /* cache hdr->nexthdr, since pskb_may_pull() might - * invalidate hdr - */ - next = hdr->nexthdr; - if (nexthdr == NEXTHDR_DEST) { - u16 i = 2; - /* Remember : hdr is no longer valid at this point. */ - if (!pskb_may_pull(skb, off + optlen)) + if (!pskb_may_pull(skb, off + optlen)) + break; + + hdr = (struct ipv6_opt_hdr *)(skb->data + off); + if (nexthdr == NEXTHDR_FRAGMENT) { + struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr; + + if (frag_hdr->frag_off) break; + } + if (nexthdr == NEXTHDR_DEST) { + u16 i = 2; while (1) { struct ipv6_tlv_tnl_enc_lim *tel; @@ -477,7 +477,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) i++; } } - nexthdr = next; + nexthdr = hdr->nexthdr; off += optlen; } return 0; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] netfilter: nf_tables: disallow anonymous set with timeout flag
by Guo Mengqi 14 May '24

14 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8 commit 16603605b667b70da974bea8216c93e7db043bf1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK56 CVE: CVE-2024-26642 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. Cc: stable(a)vger.kernel.org Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") Reported-by: lonial con <kongln9170(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index c17c1990234f..023fbe6de305 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4358,6 +4358,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == (NFT_SET_EVAL | NFT_SET_OBJECT)) return -EOPNOTSUPP; + if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == + (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) + return -EOPNOTSUPP; } dtype = 0; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: nf_tables: disallow anonymous set with timeout flag
by Guo Mengqi 14 May '24

14 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8 commit 16603605b667b70da974bea8216c93e7db043bf1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK56 CVE: CVE-2024-26642 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. Cc: stable(a)vger.kernel.org Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") Reported-by: lonial con <kongln9170(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 231e710ec55e..6d64694168ec 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4358,6 +4358,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == (NFT_SET_EVAL | NFT_SET_OBJECT)) return -EOPNOTSUPP; + if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == + (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) + return -EOPNOTSUPP; } dtype = 0; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] netfilter: nf_tables: disallow anonymous set with timeout flag
by Guo Mengqi 14 May '24

14 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8 commit 16603605b667b70da974bea8216c93e7db043bf1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK56 CVE: CVE-2024-26642 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. Cc: stable(a)vger.kernel.org Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") Reported-by: lonial con <kongln9170(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 0f117e44bf05..78f2c5fc8efc 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4356,6 +4356,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == (NFT_SET_EVAL | NFT_SET_OBJECT)) return -EOPNOTSUPP; + if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == + (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) + return -EOPNOTSUPP; } dtype = 0; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] netfilter: nf_tables: disallow timeout for anonymous sets
by Guo Mengqi 14 May '24

14 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.4-rc2 commit e26d3009efda338f19016df4175f354a9bd0a4ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK6C CVE: CVE-2023-52620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Never used from userspace, disallow these parameters. Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nf_tables_api.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 566053c7dc2e..c17c1990234f 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4399,6 +4399,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if (!(flags & NFT_SET_TIMEOUT)) return -EINVAL; + if (flags & NFT_SET_ANONYMOUS) + return -EOPNOTSUPP; + err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout); if (err) return err; @@ -4407,6 +4410,10 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if (nla[NFTA_SET_GC_INTERVAL] != NULL) { if (!(flags & NFT_SET_TIMEOUT)) return -EINVAL; + + if (flags & NFT_SET_ANONYMOUS) + return -EOPNOTSUPP; + gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] netfilter: nf_tables: disallow timeout for anonymous sets
by Guo Mengqi 14 May '24

14 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.4-rc2 commit e26d3009efda338f19016df4175f354a9bd0a4ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK6C CVE: CVE-2023-52620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Never used from userspace, disallow these parameters. Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nf_tables_api.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index c547d7beb6d1..0f117e44bf05 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4397,6 +4397,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if (!(flags & NFT_SET_TIMEOUT)) return -EINVAL; + if (flags & NFT_SET_ANONYMOUS) + return -EOPNOTSUPP; + err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout); if (err) return err; @@ -4405,6 +4408,10 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if (nla[NFTA_SET_GC_INTERVAL] != NULL) { if (!(flags & NFT_SET_TIMEOUT)) return -EINVAL; + + if (flags & NFT_SET_ANONYMOUS) + return -EOPNOTSUPP; + gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: nf_tables: disallow timeout for anonymous sets
by Guo Mengqi 14 May '24

14 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.4-rc2 commit e26d3009efda338f19016df4175f354a9bd0a4ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK6C CVE: CVE-2023-52620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Never used from userspace, disallow these parameters. Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nf_tables_api.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 07355fd7b2a2..231e710ec55e 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4399,6 +4399,9 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if (!(flags & NFT_SET_TIMEOUT)) return -EINVAL; + if (flags & NFT_SET_ANONYMOUS) + return -EOPNOTSUPP; + err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout); if (err) return err; @@ -4407,6 +4410,10 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, if (nla[NFTA_SET_GC_INTERVAL] != NULL) { if (!(flags & NFT_SET_TIMEOUT)) return -EINVAL; + + if (flags & NFT_SET_ANONYMOUS) + return -EOPNOTSUPP; + gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
by Guo Mengqi 14 May '24

14 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8 commit 552705a3650bbf46a22b1adedc1b04181490fc36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK7L CVE: CVE-2024-26643 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout"). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too. Cc: stable(a)vger.kernel.org Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") Reported-by: Mingi Cho <mgcho.minic(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 0a7f7ed33406..07355fd7b2a2 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4674,6 +4674,7 @@ static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) { list_del_rcu(&set->list); + set->dead = 1; if (event) nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_KERNEL); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
by Guo Mengqi 14 May '24

14 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8 commit 552705a3650bbf46a22b1adedc1b04181490fc36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK7L CVE: CVE-2024-26643 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout"). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too. Cc: stable(a)vger.kernel.org Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") Reported-by: Mingi Cho <mgcho.minic(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 3667b4daf1bb..566053c7dc2e 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4674,6 +4674,7 @@ static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) { list_del_rcu(&set->list); + set->dead = 1; if (event) nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_KERNEL); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] tracing: Ensure visibility when inserting an element into tracing_map
by Guo Mengqi 14 May '24

14 May '24

From: Petr Pavlu <petr.pavlu(a)suse.com> mainline inclusion from mainline-v6.8-rc2 commit 2b44760609e9eaafc9d234a6883d042fc21132a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV24 CVE: CVE-2024-26645 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Running the following two commands in parallel on a multi-processor AArch64 machine can sporadically produce an unexpected warning about duplicate histogram entries: $ while true; do echo hist:key=id.syscall:val=hitcount > \ /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist sleep 0.001 done $ stress-ng --sysbadaddr $(nproc) The warning looks as follows: [ 2911.172474] ------------[ cut here ]------------ [ 2911.173111] Duplicates detected: 1 [ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408 [ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E) [ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1 [ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G E 6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01 [ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018 [ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408 [ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408 [ 2911.185310] sp : ffff8000a1513900 [ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001 [ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008 [ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180 [ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff [ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8 [ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731 [ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c [ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8 [ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000 [ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480 [ 2911.194259] Call trace: [ 2911.194626] tracing_map_sort_entries+0x3e0/0x408 [ 2911.195220] hist_show+0x124/0x800 [ 2911.195692] seq_read_iter+0x1d4/0x4e8 [ 2911.196193] seq_read+0xe8/0x138 [ 2911.196638] vfs_read+0xc8/0x300 [ 2911.197078] ksys_read+0x70/0x108 [ 2911.197534] __arm64_sys_read+0x24/0x38 [ 2911.198046] invoke_syscall+0x78/0x108 [ 2911.198553] el0_svc_common.constprop.0+0xd0/0xf8 [ 2911.199157] do_el0_svc+0x28/0x40 [ 2911.199613] el0_svc+0x40/0x178 [ 2911.200048] el0t_64_sync_handler+0x13c/0x158 [ 2911.200621] el0t_64_sync+0x1a8/0x1b0 [ 2911.201115] ---[ end trace 0000000000000000 ]--- The problem appears to be caused by CPU reordering of writes issued from __tracing_map_insert(). The check for the presence of an element with a given key in this function is: val = READ_ONCE(entry->val); if (val && keys_match(key, val->key, map->key_size)) ... The write of a new entry is: elt = get_free_elt(map); memcpy(elt->key, key, map->key_size); entry->val = elt; The "memcpy(elt->key, key, map->key_size);" and "entry->val = elt;" stores may become visible in the reversed order on another CPU. This second CPU might then incorrectly determine that a new key doesn't match an already present val->key and subsequently insert a new element, resulting in a duplicate. Fix the problem by adding a write barrier between "memcpy(elt->key, key, map->key_size);" and "entry->val = elt;", and for good measure, also use WRITE_ONCE(entry->val, elt) for publishing the element. The sequence pairs with the mentioned "READ_ONCE(entry->val);" and the "val->key" check which has an address dependency. The barrier is placed on a path executed when adding an element for a new key. Subsequent updates targeting the same key remain unaffected. From the user's perspective, the issue was introduced by commit c193707dde77 ("tracing: Remove code which merges duplicates"), which followed commit cbf4100efb8f ("tracing: Add support to detect and avoid duplicates"). The previous code operated differently; it inherently expected potential races which result in duplicates but merged them later when they occurred. Link: https://lore.kernel.org/linux-trace-kernel/20240122150928.27725-1-petr.pavl… Fixes: c193707dde77 ("tracing: Remove code which merges duplicates") Signed-off-by: Petr Pavlu <petr.pavlu(a)suse.com> Acked-by: Tom Zanussi <tom.zanussi(a)linux.intel.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/tracing_map.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index 51a9d1185033..d47641f9740b 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -574,7 +574,12 @@ __tracing_map_insert(struct tracing_map *map, void *key, bool lookup_only) } memcpy(elt->key, key, map->key_size); - entry->val = elt; + /* + * Ensure the initialization is visible and + * publish the elt. + */ + smp_wmb(); + WRITE_ONCE(entry->val, elt); atomic64_inc(&map->hits); return entry->val; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
by Guo Mengqi 14 May '24

14 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8 commit 552705a3650bbf46a22b1adedc1b04181490fc36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK7L CVE: CVE-2024-26643 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout"). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too. Cc: stable(a)vger.kernel.org Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") Reported-by: Mingi Cho <mgcho.minic(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 866a4ea8f4e7..c547d7beb6d1 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4672,6 +4672,7 @@ static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) { list_del_rcu(&set->list); + set->dead = 1; if (event) nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_KERNEL); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] tracing: Ensure visibility when inserting an element into tracing_map
by Guo Mengqi 14 May '24

14 May '24

From: Petr Pavlu <petr.pavlu(a)suse.com> mainline inclusion from mainline-v6.8-rc2 commit 2b44760609e9eaafc9d234a6883d042fc21132a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV24 CVE: CVE-2024-26645 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Running the following two commands in parallel on a multi-processor AArch64 machine can sporadically produce an unexpected warning about duplicate histogram entries: $ while true; do echo hist:key=id.syscall:val=hitcount > \ /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist sleep 0.001 done $ stress-ng --sysbadaddr $(nproc) The warning looks as follows: [ 2911.172474] ------------[ cut here ]------------ [ 2911.173111] Duplicates detected: 1 [ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408 [ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E) [ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1 [ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G E 6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01 [ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018 [ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408 [ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408 [ 2911.185310] sp : ffff8000a1513900 [ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001 [ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008 [ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180 [ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff [ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8 [ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731 [ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c [ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8 [ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000 [ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480 [ 2911.194259] Call trace: [ 2911.194626] tracing_map_sort_entries+0x3e0/0x408 [ 2911.195220] hist_show+0x124/0x800 [ 2911.195692] seq_read_iter+0x1d4/0x4e8 [ 2911.196193] seq_read+0xe8/0x138 [ 2911.196638] vfs_read+0xc8/0x300 [ 2911.197078] ksys_read+0x70/0x108 [ 2911.197534] __arm64_sys_read+0x24/0x38 [ 2911.198046] invoke_syscall+0x78/0x108 [ 2911.198553] el0_svc_common.constprop.0+0xd0/0xf8 [ 2911.199157] do_el0_svc+0x28/0x40 [ 2911.199613] el0_svc+0x40/0x178 [ 2911.200048] el0t_64_sync_handler+0x13c/0x158 [ 2911.200621] el0t_64_sync+0x1a8/0x1b0 [ 2911.201115] ---[ end trace 0000000000000000 ]--- The problem appears to be caused by CPU reordering of writes issued from __tracing_map_insert(). The check for the presence of an element with a given key in this function is: val = READ_ONCE(entry->val); if (val && keys_match(key, val->key, map->key_size)) ... The write of a new entry is: elt = get_free_elt(map); memcpy(elt->key, key, map->key_size); entry->val = elt; The "memcpy(elt->key, key, map->key_size);" and "entry->val = elt;" stores may become visible in the reversed order on another CPU. This second CPU might then incorrectly determine that a new key doesn't match an already present val->key and subsequently insert a new element, resulting in a duplicate. Fix the problem by adding a write barrier between "memcpy(elt->key, key, map->key_size);" and "entry->val = elt;", and for good measure, also use WRITE_ONCE(entry->val, elt) for publishing the element. The sequence pairs with the mentioned "READ_ONCE(entry->val);" and the "val->key" check which has an address dependency. The barrier is placed on a path executed when adding an element for a new key. Subsequent updates targeting the same key remain unaffected. From the user's perspective, the issue was introduced by commit c193707dde77 ("tracing: Remove code which merges duplicates"), which followed commit cbf4100efb8f ("tracing: Add support to detect and avoid duplicates"). The previous code operated differently; it inherently expected potential races which result in duplicates but merged them later when they occurred. Link: https://lore.kernel.org/linux-trace-kernel/20240122150928.27725-1-petr.pavl… Fixes: c193707dde77 ("tracing: Remove code which merges duplicates") Signed-off-by: Petr Pavlu <petr.pavlu(a)suse.com> Acked-by: Tom Zanussi <tom.zanussi(a)linux.intel.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/tracing_map.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index 51a9d1185033..d47641f9740b 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -574,7 +574,12 @@ __tracing_map_insert(struct tracing_map *map, void *key, bool lookup_only) } memcpy(elt->key, key, map->key_size); - entry->val = elt; + /* + * Ensure the initialization is visible and + * publish the elt. + */ + smp_wmb(); + WRITE_ONCE(entry->val, elt); atomic64_inc(&map->hits); return entry->val; -- 2.17.1

2 1

[PATCH OLK-5.10] thermal: intel: hfi: Add syscore callbacks for system-wide PM
by Guo Mengqi 14 May '24

14 May '24

From: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> mainline inclusion from mainline-v6.8-rc1 commit 97566d09fd02d2ab329774bb89a2cdf2267e86d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4D CVE: CVE-2024-26646 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kernel allocates a memory buffer and provides its location to the hardware, which uses it to update the HFI table. This allocation occurs during boot and remains constant throughout runtime. When resuming from hibernation, the restore kernel allocates a second memory buffer and reprograms the HFI hardware with the new location as part of a normal boot. The location of the second memory buffer may differ from the one allocated by the image kernel. When the restore kernel transfers control to the image kernel, its HFI buffer becomes invalid, potentially leading to memory corruption if the hardware writes to it (the hardware continues to use the buffer from the restore kernel). It is also possible that the hardware "forgets" the address of the memory buffer when resuming from "deep" suspend. Memory corruption may also occur in such a scenario. To prevent the described memory corruption, disable HFI when preparing to suspend or hibernate. Enable it when resuming. Add syscore callbacks to handle the package of the boot CPU (packages of non-boot CPUs are handled via CPU offline). Syscore ops always run on the boot CPU. Additionally, HFI only needs to be disabled during "deep" suspend and hibernation. Syscore ops only run in these cases. Cc: 6.1+ <stable(a)vger.kernel.org> # 6.1+ Signed-off-by: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> [ rjw: Comment adjustment, subject and changelog edits ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/thermal/intel/intel_hfi.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c index 158a2b7c6b6f..d442d639a900 100644 --- a/drivers/thermal/intel/intel_hfi.c +++ b/drivers/thermal/intel/intel_hfi.c @@ -33,7 +33,9 @@ #include <linux/processor.h> #include <linux/slab.h> #include <linux/spinlock.h> +#include <linux/suspend.h> #include <linux/string.h> +#include <linux/syscore_ops.h> #include <linux/topology.h> #include <linux/workqueue.h> @@ -524,6 +526,30 @@ static __init int hfi_parse_features(void) return 0; } +static void hfi_do_enable(void) +{ + /* This code runs only on the boot CPU. */ + struct hfi_cpu_info *info = &per_cpu(hfi_cpu_info, 0); + struct hfi_instance *hfi_instance = info->hfi_instance; + + /* No locking needed. There is no concurrency with CPU online. */ + hfi_set_hw_table(hfi_instance); + hfi_enable(); +} + +static int hfi_do_disable(void) +{ + /* No locking needed. There is no concurrency with CPU offline. */ + hfi_disable(); + + return 0; +} + +static struct syscore_ops hfi_pm_ops = { + .resume = hfi_do_enable, + .suspend = hfi_do_disable, +}; + void __init intel_hfi_init(void) { struct hfi_instance *hfi_instance; @@ -555,6 +581,8 @@ void __init intel_hfi_init(void) if (!hfi_updates_wq) goto err_nomem; + register_syscore_ops(&hfi_pm_ops); + return; err_nomem: -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] iio: adc: ad7091r: Allow users to configure device events
by Guo Mengqi 14 May '24

14 May '24

From: Marcelo Schmitt <marcelo.schmitt(a)analog.com> stable inclusion from stable-v5.10.210 commit 1eba6f7ffa295a0eec098c107043074be7cc4ec5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4R Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 020e71c7ffc25dfe29ed9be6c2d39af7bd7f661f ] AD7091R-5 devices are supported by the ad7091r-5 driver together with the ad7091r-base driver. Those drivers declared iio events for notifying user space when ADC readings fall bellow the thresholds of low limit registers or above the values set in high limit registers. However, to configure iio events and their thresholds, a set of callback functions must be implemented and those were not present until now. The consequence of trying to configure ad7091r-5 events without the proper callback functions was a null pointer dereference in the kernel because the pointers to the callback functions were not set. Implement event configuration callbacks allowing users to read/write event thresholds and enable/disable event generation. Since the event spec structs are generic to AD7091R devices, also move those from the ad7091r-5 driver the base driver so they can be reused when support for ad7091r-2/-4/-8 be added. Fixes: ca69300173b6 ("iio: adc: Add support for AD7091R5 ADC") Suggested-by: David Lechner <dlechner(a)baylibre.com> Signed-off-by: Marcelo Schmitt <marcelo.schmitt(a)analog.com> Link: https://lore.kernel.org/r/59552d3548dabd56adc3107b7b4869afee2b0c3c.17030133… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/adc/ad7091r-base.c | 156 +++++++++++++++++++++++++++++++++ drivers/iio/adc/ad7091r-base.h | 6 ++ drivers/iio/adc/ad7091r5.c | 28 +----- 3 files changed, 166 insertions(+), 24 deletions(-) diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c index 63b4d6ea4566..827971d458a5 100644 --- a/drivers/iio/adc/ad7091r-base.c +++ b/drivers/iio/adc/ad7091r-base.c @@ -6,6 +6,7 @@ */ #include <linux/bitops.h> +#include <linux/bitfield.h> #include <linux/iio/events.h> #include <linux/iio/iio.h> #include <linux/interrupt.h> @@ -49,6 +50,27 @@ struct ad7091r_state { struct mutex lock; /*lock to prevent concurent reads */ }; +const struct iio_event_spec ad7091r_events[] = { + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_RISING, + .mask_separate = BIT(IIO_EV_INFO_VALUE) | + BIT(IIO_EV_INFO_ENABLE), + }, + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_FALLING, + .mask_separate = BIT(IIO_EV_INFO_VALUE) | + BIT(IIO_EV_INFO_ENABLE), + }, + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_EITHER, + .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), + }, +}; +EXPORT_SYMBOL_NS_GPL(ad7091r_events, IIO_AD7091R); + static int ad7091r_set_mode(struct ad7091r_state *st, enum ad7091r_mode mode) { int ret, conf; @@ -168,8 +190,142 @@ static int ad7091r_read_raw(struct iio_dev *iio_dev, return ret; } +static int ad7091r_read_event_config(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + int val, ret; + + switch (dir) { + case IIO_EV_DIR_RISING: + ret = regmap_read(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + &val); + if (ret) + return ret; + return val != AD7091R_HIGH_LIMIT; + case IIO_EV_DIR_FALLING: + ret = regmap_read(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + &val); + if (ret) + return ret; + return val != AD7091R_LOW_LIMIT; + default: + return -EINVAL; + } +} + +static int ad7091r_write_event_config(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, int state) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + + if (state) { + return regmap_set_bits(st->map, AD7091R_REG_CONF, + AD7091R_REG_CONF_ALERT_EN); + } else { + /* + * Set thresholds either to 0 or to 2^12 - 1 as appropriate to + * prevent alerts and thus disable event generation. + */ + switch (dir) { + case IIO_EV_DIR_RISING: + return regmap_write(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + AD7091R_HIGH_LIMIT); + case IIO_EV_DIR_FALLING: + return regmap_write(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + AD7091R_LOW_LIMIT); + default: + return -EINVAL; + } + } +} + +static int ad7091r_read_event_value(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, + enum iio_event_info info, int *val, int *val2) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + int ret; + + switch (info) { + case IIO_EV_INFO_VALUE: + switch (dir) { + case IIO_EV_DIR_RISING: + ret = regmap_read(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + case IIO_EV_DIR_FALLING: + ret = regmap_read(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + default: + return -EINVAL; + } + case IIO_EV_INFO_HYSTERESIS: + ret = regmap_read(st->map, + AD7091R_REG_CH_HYSTERESIS(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + default: + return -EINVAL; + } +} + +static int ad7091r_write_event_value(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, + enum iio_event_info info, int val, int val2) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + + switch (info) { + case IIO_EV_INFO_VALUE: + switch (dir) { + case IIO_EV_DIR_RISING: + return regmap_write(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + val); + case IIO_EV_DIR_FALLING: + return regmap_write(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + val); + default: + return -EINVAL; + } + case IIO_EV_INFO_HYSTERESIS: + return regmap_write(st->map, + AD7091R_REG_CH_HYSTERESIS(chan->channel), + val); + default: + return -EINVAL; + } +} + static const struct iio_info ad7091r_info = { .read_raw = ad7091r_read_raw, + .read_event_config = &ad7091r_read_event_config, + .write_event_config = &ad7091r_write_event_config, + .read_event_value = &ad7091r_read_event_value, + .write_event_value = &ad7091r_write_event_value, }; static irqreturn_t ad7091r_event_handler(int irq, void *private) diff --git a/drivers/iio/adc/ad7091r-base.h b/drivers/iio/adc/ad7091r-base.h index 509748aef9b1..7a78976a2f80 100644 --- a/drivers/iio/adc/ad7091r-base.h +++ b/drivers/iio/adc/ad7091r-base.h @@ -8,6 +8,10 @@ #ifndef __DRIVERS_IIO_ADC_AD7091R_BASE_H__ #define __DRIVERS_IIO_ADC_AD7091R_BASE_H__ +/* AD7091R_REG_CH_LIMIT */ +#define AD7091R_HIGH_LIMIT 0xFFF +#define AD7091R_LOW_LIMIT 0x0 + struct device; struct ad7091r_state; @@ -17,6 +21,8 @@ struct ad7091r_chip_info { unsigned int vref_mV; }; +extern const struct iio_event_spec ad7091r_events[3]; + extern const struct regmap_config ad7091r_regmap_config; int ad7091r_probe(struct device *dev, const char *name, diff --git a/drivers/iio/adc/ad7091r5.c b/drivers/iio/adc/ad7091r5.c index 9665679c3ea6..e60511460786 100644 --- a/drivers/iio/adc/ad7091r5.c +++ b/drivers/iio/adc/ad7091r5.c @@ -12,26 +12,6 @@ #include "ad7091r-base.h" -static const struct iio_event_spec ad7091r5_events[] = { - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_RISING, - .mask_separate = BIT(IIO_EV_INFO_VALUE) | - BIT(IIO_EV_INFO_ENABLE), - }, - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_FALLING, - .mask_separate = BIT(IIO_EV_INFO_VALUE) | - BIT(IIO_EV_INFO_ENABLE), - }, - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_EITHER, - .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), - }, -}; - #define AD7091R_CHANNEL(idx, bits, ev, num_ev) { \ .type = IIO_VOLTAGE, \ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \ @@ -44,10 +24,10 @@ static const struct iio_event_spec ad7091r5_events[] = { .scan_type.realbits = bits, \ } static const struct iio_chan_spec ad7091r5_channels_irq[] = { - AD7091R_CHANNEL(0, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(1, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(2, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(3, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), + AD7091R_CHANNEL(0, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(1, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(2, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(3, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), }; static const struct iio_chan_spec ad7091r5_channels_noirq[] = { -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] tracing: Ensure visibility when inserting an element into tracing_map
by Guo Mengqi 14 May '24

14 May '24

From: Petr Pavlu <petr.pavlu(a)suse.com> mainline inclusion from mainline-v6.8-rc2 commit 2b44760609e9eaafc9d234a6883d042fc21132a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV24 CVE: CVE-2024-26645 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Running the following two commands in parallel on a multi-processor AArch64 machine can sporadically produce an unexpected warning about duplicate histogram entries: $ while true; do echo hist:key=id.syscall:val=hitcount > \ /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist sleep 0.001 done $ stress-ng --sysbadaddr $(nproc) The warning looks as follows: [ 2911.172474] ------------[ cut here ]------------ [ 2911.173111] Duplicates detected: 1 [ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408 [ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E) [ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1 [ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G E 6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01 [ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018 [ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408 [ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408 [ 2911.185310] sp : ffff8000a1513900 [ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001 [ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008 [ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180 [ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff [ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8 [ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731 [ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c [ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8 [ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000 [ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480 [ 2911.194259] Call trace: [ 2911.194626] tracing_map_sort_entries+0x3e0/0x408 [ 2911.195220] hist_show+0x124/0x800 [ 2911.195692] seq_read_iter+0x1d4/0x4e8 [ 2911.196193] seq_read+0xe8/0x138 [ 2911.196638] vfs_read+0xc8/0x300 [ 2911.197078] ksys_read+0x70/0x108 [ 2911.197534] __arm64_sys_read+0x24/0x38 [ 2911.198046] invoke_syscall+0x78/0x108 [ 2911.198553] el0_svc_common.constprop.0+0xd0/0xf8 [ 2911.199157] do_el0_svc+0x28/0x40 [ 2911.199613] el0_svc+0x40/0x178 [ 2911.200048] el0t_64_sync_handler+0x13c/0x158 [ 2911.200621] el0t_64_sync+0x1a8/0x1b0 [ 2911.201115] ---[ end trace 0000000000000000 ]--- The problem appears to be caused by CPU reordering of writes issued from __tracing_map_insert(). The check for the presence of an element with a given key in this function is: val = READ_ONCE(entry->val); if (val && keys_match(key, val->key, map->key_size)) ... The write of a new entry is: elt = get_free_elt(map); memcpy(elt->key, key, map->key_size); entry->val = elt; The "memcpy(elt->key, key, map->key_size);" and "entry->val = elt;" stores may become visible in the reversed order on another CPU. This second CPU might then incorrectly determine that a new key doesn't match an already present val->key and subsequently insert a new element, resulting in a duplicate. Fix the problem by adding a write barrier between "memcpy(elt->key, key, map->key_size);" and "entry->val = elt;", and for good measure, also use WRITE_ONCE(entry->val, elt) for publishing the element. The sequence pairs with the mentioned "READ_ONCE(entry->val);" and the "val->key" check which has an address dependency. The barrier is placed on a path executed when adding an element for a new key. Subsequent updates targeting the same key remain unaffected. From the user's perspective, the issue was introduced by commit c193707dde77 ("tracing: Remove code which merges duplicates"), which followed commit cbf4100efb8f ("tracing: Add support to detect and avoid duplicates"). The previous code operated differently; it inherently expected potential races which result in duplicates but merged them later when they occurred. Link: https://lore.kernel.org/linux-trace-kernel/20240122150928.27725-1-petr.pavl… Fixes: c193707dde77 ("tracing: Remove code which merges duplicates") Signed-off-by: Petr Pavlu <petr.pavlu(a)suse.com> Acked-by: Tom Zanussi <tom.zanussi(a)linux.intel.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/tracing_map.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index 51a9d1185033..d47641f9740b 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -574,7 +574,12 @@ __tracing_map_insert(struct tracing_map *map, void *key, bool lookup_only) } memcpy(elt->key, key, map->key_size); - entry->val = elt; + /* + * Ensure the initialization is visible and + * publish the elt. + */ + smp_wmb(); + WRITE_ONCE(entry->val, elt); atomic64_inc(&map->hits); return entry->val; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] thermal: intel: hfi: Add syscore callbacks for system-wide PM
by Guo Mengqi 14 May '24

14 May '24

From: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> mainline inclusion from mainline-v6.8-rc1 commit 97566d09fd02d2ab329774bb89a2cdf2267e86d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4D CVE: CVE-2024-26646 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kernel allocates a memory buffer and provides its location to the hardware, which uses it to update the HFI table. This allocation occurs during boot and remains constant throughout runtime. When resuming from hibernation, the restore kernel allocates a second memory buffer and reprograms the HFI hardware with the new location as part of a normal boot. The location of the second memory buffer may differ from the one allocated by the image kernel. When the restore kernel transfers control to the image kernel, its HFI buffer becomes invalid, potentially leading to memory corruption if the hardware writes to it (the hardware continues to use the buffer from the restore kernel). It is also possible that the hardware "forgets" the address of the memory buffer when resuming from "deep" suspend. Memory corruption may also occur in such a scenario. To prevent the described memory corruption, disable HFI when preparing to suspend or hibernate. Enable it when resuming. Add syscore callbacks to handle the package of the boot CPU (packages of non-boot CPUs are handled via CPU offline). Syscore ops always run on the boot CPU. Additionally, HFI only needs to be disabled during "deep" suspend and hibernation. Syscore ops only run in these cases. Cc: 6.1+ <stable(a)vger.kernel.org> # 6.1+ Signed-off-by: Ricardo Neri <ricardo.neri-calderon(a)linux.intel.com> [ rjw: Comment adjustment, subject and changelog edits ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/thermal/intel/intel_hfi.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/thermal/intel/intel_hfi.c b/drivers/thermal/intel/intel_hfi.c index 158a2b7c6b6f..d442d639a900 100644 --- a/drivers/thermal/intel/intel_hfi.c +++ b/drivers/thermal/intel/intel_hfi.c @@ -33,7 +33,9 @@ #include <linux/processor.h> #include <linux/slab.h> #include <linux/spinlock.h> +#include <linux/suspend.h> #include <linux/string.h> +#include <linux/syscore_ops.h> #include <linux/topology.h> #include <linux/workqueue.h> @@ -524,6 +526,30 @@ static __init int hfi_parse_features(void) return 0; } +static void hfi_do_enable(void) +{ + /* This code runs only on the boot CPU. */ + struct hfi_cpu_info *info = &per_cpu(hfi_cpu_info, 0); + struct hfi_instance *hfi_instance = info->hfi_instance; + + /* No locking needed. There is no concurrency with CPU online. */ + hfi_set_hw_table(hfi_instance); + hfi_enable(); +} + +static int hfi_do_disable(void) +{ + /* No locking needed. There is no concurrency with CPU offline. */ + hfi_disable(); + + return 0; +} + +static struct syscore_ops hfi_pm_ops = { + .resume = hfi_do_enable, + .suspend = hfi_do_disable, +}; + void __init intel_hfi_init(void) { struct hfi_instance *hfi_instance; @@ -555,6 +581,8 @@ void __init intel_hfi_init(void) if (!hfi_updates_wq) goto err_nomem; + register_syscore_ops(&hfi_pm_ops); + return; err_nomem: -- 2.17.1

2 1

[PATCH OLK-5.10] iio: adc: ad7091r: Allow users to configure device events
by Guo Mengqi 14 May '24

14 May '24

From: Marcelo Schmitt <marcelo.schmitt(a)analog.com> stable inclusion from stable-v5.10.210 commit 1eba6f7ffa295a0eec098c107043074be7cc4ec5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4R Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 020e71c7ffc25dfe29ed9be6c2d39af7bd7f661f ] AD7091R-5 devices are supported by the ad7091r-5 driver together with the ad7091r-base driver. Those drivers declared iio events for notifying user space when ADC readings fall bellow the thresholds of low limit registers or above the values set in high limit registers. However, to configure iio events and their thresholds, a set of callback functions must be implemented and those were not present until now. The consequence of trying to configure ad7091r-5 events without the proper callback functions was a null pointer dereference in the kernel because the pointers to the callback functions were not set. Implement event configuration callbacks allowing users to read/write event thresholds and enable/disable event generation. Since the event spec structs are generic to AD7091R devices, also move those from the ad7091r-5 driver the base driver so they can be reused when support for ad7091r-2/-4/-8 be added. Fixes: ca69300173b6 ("iio: adc: Add support for AD7091R5 ADC") Suggested-by: David Lechner <dlechner(a)baylibre.com> Signed-off-by: Marcelo Schmitt <marcelo.schmitt(a)analog.com> Link: https://lore.kernel.org/r/59552d3548dabd56adc3107b7b4869afee2b0c3c.17030133… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/adc/ad7091r-base.c | 156 +++++++++++++++++++++++++++++++++ drivers/iio/adc/ad7091r-base.h | 6 ++ drivers/iio/adc/ad7091r5.c | 28 +----- 3 files changed, 166 insertions(+), 24 deletions(-) diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c index 63b4d6ea4566..827971d458a5 100644 --- a/drivers/iio/adc/ad7091r-base.c +++ b/drivers/iio/adc/ad7091r-base.c @@ -6,6 +6,7 @@ */ #include <linux/bitops.h> +#include <linux/bitfield.h> #include <linux/iio/events.h> #include <linux/iio/iio.h> #include <linux/interrupt.h> @@ -49,6 +50,27 @@ struct ad7091r_state { struct mutex lock; /*lock to prevent concurent reads */ }; +const struct iio_event_spec ad7091r_events[] = { + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_RISING, + .mask_separate = BIT(IIO_EV_INFO_VALUE) | + BIT(IIO_EV_INFO_ENABLE), + }, + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_FALLING, + .mask_separate = BIT(IIO_EV_INFO_VALUE) | + BIT(IIO_EV_INFO_ENABLE), + }, + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_EITHER, + .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), + }, +}; +EXPORT_SYMBOL_NS_GPL(ad7091r_events, IIO_AD7091R); + static int ad7091r_set_mode(struct ad7091r_state *st, enum ad7091r_mode mode) { int ret, conf; @@ -168,8 +190,142 @@ static int ad7091r_read_raw(struct iio_dev *iio_dev, return ret; } +static int ad7091r_read_event_config(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + int val, ret; + + switch (dir) { + case IIO_EV_DIR_RISING: + ret = regmap_read(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + &val); + if (ret) + return ret; + return val != AD7091R_HIGH_LIMIT; + case IIO_EV_DIR_FALLING: + ret = regmap_read(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + &val); + if (ret) + return ret; + return val != AD7091R_LOW_LIMIT; + default: + return -EINVAL; + } +} + +static int ad7091r_write_event_config(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, int state) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + + if (state) { + return regmap_set_bits(st->map, AD7091R_REG_CONF, + AD7091R_REG_CONF_ALERT_EN); + } else { + /* + * Set thresholds either to 0 or to 2^12 - 1 as appropriate to + * prevent alerts and thus disable event generation. + */ + switch (dir) { + case IIO_EV_DIR_RISING: + return regmap_write(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + AD7091R_HIGH_LIMIT); + case IIO_EV_DIR_FALLING: + return regmap_write(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + AD7091R_LOW_LIMIT); + default: + return -EINVAL; + } + } +} + +static int ad7091r_read_event_value(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, + enum iio_event_info info, int *val, int *val2) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + int ret; + + switch (info) { + case IIO_EV_INFO_VALUE: + switch (dir) { + case IIO_EV_DIR_RISING: + ret = regmap_read(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + case IIO_EV_DIR_FALLING: + ret = regmap_read(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + default: + return -EINVAL; + } + case IIO_EV_INFO_HYSTERESIS: + ret = regmap_read(st->map, + AD7091R_REG_CH_HYSTERESIS(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + default: + return -EINVAL; + } +} + +static int ad7091r_write_event_value(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, + enum iio_event_info info, int val, int val2) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + + switch (info) { + case IIO_EV_INFO_VALUE: + switch (dir) { + case IIO_EV_DIR_RISING: + return regmap_write(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + val); + case IIO_EV_DIR_FALLING: + return regmap_write(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + val); + default: + return -EINVAL; + } + case IIO_EV_INFO_HYSTERESIS: + return regmap_write(st->map, + AD7091R_REG_CH_HYSTERESIS(chan->channel), + val); + default: + return -EINVAL; + } +} + static const struct iio_info ad7091r_info = { .read_raw = ad7091r_read_raw, + .read_event_config = &ad7091r_read_event_config, + .write_event_config = &ad7091r_write_event_config, + .read_event_value = &ad7091r_read_event_value, + .write_event_value = &ad7091r_write_event_value, }; static irqreturn_t ad7091r_event_handler(int irq, void *private) diff --git a/drivers/iio/adc/ad7091r-base.h b/drivers/iio/adc/ad7091r-base.h index 509748aef9b1..7a78976a2f80 100644 --- a/drivers/iio/adc/ad7091r-base.h +++ b/drivers/iio/adc/ad7091r-base.h @@ -8,6 +8,10 @@ #ifndef __DRIVERS_IIO_ADC_AD7091R_BASE_H__ #define __DRIVERS_IIO_ADC_AD7091R_BASE_H__ +/* AD7091R_REG_CH_LIMIT */ +#define AD7091R_HIGH_LIMIT 0xFFF +#define AD7091R_LOW_LIMIT 0x0 + struct device; struct ad7091r_state; @@ -17,6 +21,8 @@ struct ad7091r_chip_info { unsigned int vref_mV; }; +extern const struct iio_event_spec ad7091r_events[3]; + extern const struct regmap_config ad7091r_regmap_config; int ad7091r_probe(struct device *dev, const char *name, diff --git a/drivers/iio/adc/ad7091r5.c b/drivers/iio/adc/ad7091r5.c index 9665679c3ea6..e60511460786 100644 --- a/drivers/iio/adc/ad7091r5.c +++ b/drivers/iio/adc/ad7091r5.c @@ -12,26 +12,6 @@ #include "ad7091r-base.h" -static const struct iio_event_spec ad7091r5_events[] = { - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_RISING, - .mask_separate = BIT(IIO_EV_INFO_VALUE) | - BIT(IIO_EV_INFO_ENABLE), - }, - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_FALLING, - .mask_separate = BIT(IIO_EV_INFO_VALUE) | - BIT(IIO_EV_INFO_ENABLE), - }, - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_EITHER, - .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), - }, -}; - #define AD7091R_CHANNEL(idx, bits, ev, num_ev) { \ .type = IIO_VOLTAGE, \ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \ @@ -44,10 +24,10 @@ static const struct iio_event_spec ad7091r5_events[] = { .scan_type.realbits = bits, \ } static const struct iio_chan_spec ad7091r5_channels_irq[] = { - AD7091R_CHANNEL(0, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(1, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(2, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(3, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), + AD7091R_CHANNEL(0, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(1, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(2, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(3, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), }; static const struct iio_chan_spec ad7091r5_channels_noirq[] = { -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] iio: adc: ad7091r: Allow users to configure device events
by Guo Mengqi 14 May '24

14 May '24

From: Marcelo Schmitt <marcelo.schmitt(a)analog.com> stable inclusion from stable-v5.10.210 commit 1eba6f7ffa295a0eec098c107043074be7cc4ec5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4R Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 020e71c7ffc25dfe29ed9be6c2d39af7bd7f661f ] AD7091R-5 devices are supported by the ad7091r-5 driver together with the ad7091r-base driver. Those drivers declared iio events for notifying user space when ADC readings fall bellow the thresholds of low limit registers or above the values set in high limit registers. However, to configure iio events and their thresholds, a set of callback functions must be implemented and those were not present until now. The consequence of trying to configure ad7091r-5 events without the proper callback functions was a null pointer dereference in the kernel because the pointers to the callback functions were not set. Implement event configuration callbacks allowing users to read/write event thresholds and enable/disable event generation. Since the event spec structs are generic to AD7091R devices, also move those from the ad7091r-5 driver the base driver so they can be reused when support for ad7091r-2/-4/-8 be added. Fixes: ca69300173b6 ("iio: adc: Add support for AD7091R5 ADC") Suggested-by: David Lechner <dlechner(a)baylibre.com> Signed-off-by: Marcelo Schmitt <marcelo.schmitt(a)analog.com> Link: https://lore.kernel.org/r/59552d3548dabd56adc3107b7b4869afee2b0c3c.17030133… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/adc/ad7091r-base.c | 156 +++++++++++++++++++++++++++++++++ drivers/iio/adc/ad7091r-base.h | 6 ++ drivers/iio/adc/ad7091r5.c | 28 +----- 3 files changed, 166 insertions(+), 24 deletions(-) diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c index 63b4d6ea4566..827971d458a5 100644 --- a/drivers/iio/adc/ad7091r-base.c +++ b/drivers/iio/adc/ad7091r-base.c @@ -6,6 +6,7 @@ */ #include <linux/bitops.h> +#include <linux/bitfield.h> #include <linux/iio/events.h> #include <linux/iio/iio.h> #include <linux/interrupt.h> @@ -49,6 +50,27 @@ struct ad7091r_state { struct mutex lock; /*lock to prevent concurent reads */ }; +const struct iio_event_spec ad7091r_events[] = { + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_RISING, + .mask_separate = BIT(IIO_EV_INFO_VALUE) | + BIT(IIO_EV_INFO_ENABLE), + }, + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_FALLING, + .mask_separate = BIT(IIO_EV_INFO_VALUE) | + BIT(IIO_EV_INFO_ENABLE), + }, + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_EITHER, + .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), + }, +}; +EXPORT_SYMBOL_NS_GPL(ad7091r_events, IIO_AD7091R); + static int ad7091r_set_mode(struct ad7091r_state *st, enum ad7091r_mode mode) { int ret, conf; @@ -168,8 +190,142 @@ static int ad7091r_read_raw(struct iio_dev *iio_dev, return ret; } +static int ad7091r_read_event_config(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + int val, ret; + + switch (dir) { + case IIO_EV_DIR_RISING: + ret = regmap_read(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + &val); + if (ret) + return ret; + return val != AD7091R_HIGH_LIMIT; + case IIO_EV_DIR_FALLING: + ret = regmap_read(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + &val); + if (ret) + return ret; + return val != AD7091R_LOW_LIMIT; + default: + return -EINVAL; + } +} + +static int ad7091r_write_event_config(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, int state) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + + if (state) { + return regmap_set_bits(st->map, AD7091R_REG_CONF, + AD7091R_REG_CONF_ALERT_EN); + } else { + /* + * Set thresholds either to 0 or to 2^12 - 1 as appropriate to + * prevent alerts and thus disable event generation. + */ + switch (dir) { + case IIO_EV_DIR_RISING: + return regmap_write(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + AD7091R_HIGH_LIMIT); + case IIO_EV_DIR_FALLING: + return regmap_write(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + AD7091R_LOW_LIMIT); + default: + return -EINVAL; + } + } +} + +static int ad7091r_read_event_value(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, + enum iio_event_info info, int *val, int *val2) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + int ret; + + switch (info) { + case IIO_EV_INFO_VALUE: + switch (dir) { + case IIO_EV_DIR_RISING: + ret = regmap_read(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + case IIO_EV_DIR_FALLING: + ret = regmap_read(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + default: + return -EINVAL; + } + case IIO_EV_INFO_HYSTERESIS: + ret = regmap_read(st->map, + AD7091R_REG_CH_HYSTERESIS(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + default: + return -EINVAL; + } +} + +static int ad7091r_write_event_value(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, + enum iio_event_info info, int val, int val2) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + + switch (info) { + case IIO_EV_INFO_VALUE: + switch (dir) { + case IIO_EV_DIR_RISING: + return regmap_write(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + val); + case IIO_EV_DIR_FALLING: + return regmap_write(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + val); + default: + return -EINVAL; + } + case IIO_EV_INFO_HYSTERESIS: + return regmap_write(st->map, + AD7091R_REG_CH_HYSTERESIS(chan->channel), + val); + default: + return -EINVAL; + } +} + static const struct iio_info ad7091r_info = { .read_raw = ad7091r_read_raw, + .read_event_config = &ad7091r_read_event_config, + .write_event_config = &ad7091r_write_event_config, + .read_event_value = &ad7091r_read_event_value, + .write_event_value = &ad7091r_write_event_value, }; static irqreturn_t ad7091r_event_handler(int irq, void *private) diff --git a/drivers/iio/adc/ad7091r-base.h b/drivers/iio/adc/ad7091r-base.h index 509748aef9b1..7a78976a2f80 100644 --- a/drivers/iio/adc/ad7091r-base.h +++ b/drivers/iio/adc/ad7091r-base.h @@ -8,6 +8,10 @@ #ifndef __DRIVERS_IIO_ADC_AD7091R_BASE_H__ #define __DRIVERS_IIO_ADC_AD7091R_BASE_H__ +/* AD7091R_REG_CH_LIMIT */ +#define AD7091R_HIGH_LIMIT 0xFFF +#define AD7091R_LOW_LIMIT 0x0 + struct device; struct ad7091r_state; @@ -17,6 +21,8 @@ struct ad7091r_chip_info { unsigned int vref_mV; }; +extern const struct iio_event_spec ad7091r_events[3]; + extern const struct regmap_config ad7091r_regmap_config; int ad7091r_probe(struct device *dev, const char *name, diff --git a/drivers/iio/adc/ad7091r5.c b/drivers/iio/adc/ad7091r5.c index 9665679c3ea6..e60511460786 100644 --- a/drivers/iio/adc/ad7091r5.c +++ b/drivers/iio/adc/ad7091r5.c @@ -12,26 +12,6 @@ #include "ad7091r-base.h" -static const struct iio_event_spec ad7091r5_events[] = { - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_RISING, - .mask_separate = BIT(IIO_EV_INFO_VALUE) | - BIT(IIO_EV_INFO_ENABLE), - }, - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_FALLING, - .mask_separate = BIT(IIO_EV_INFO_VALUE) | - BIT(IIO_EV_INFO_ENABLE), - }, - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_EITHER, - .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), - }, -}; - #define AD7091R_CHANNEL(idx, bits, ev, num_ev) { \ .type = IIO_VOLTAGE, \ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \ @@ -44,10 +24,10 @@ static const struct iio_event_spec ad7091r5_events[] = { .scan_type.realbits = bits, \ } static const struct iio_chan_spec ad7091r5_channels_irq[] = { - AD7091R_CHANNEL(0, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(1, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(2, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(3, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), + AD7091R_CHANNEL(0, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(1, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(2, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(3, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), }; static const struct iio_chan_spec ad7091r5_channels_noirq[] = { -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] SUNRPC: Fix a suspicious RCU usage warning
by Guo Mengqi 14 May '24

14 May '24

From: Anna Schumaker <Anna.Schumaker(a)Netapp.com> stable inclusion from stable-v5.10.210 commit c430e6bb43955c6bf573665fcebf31694925b9f7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4V Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 31b62908693c90d4d07db597e685d9f25a120073 ] I received the following warning while running cthon against an ontap server running pNFS: [ 57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.202525] ----------------------------- [ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! [ 57.202527] other info that might help us debug this: [ 57.202528] rcu_scheduler_active = 2, debug_locks = 1 [ 57.202529] no locks held by test5/3567. [ 57.202530] stack backtrace: [ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e [ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022 [ 57.202536] Call Trace: [ 57.202537] <TASK> [ 57.202540] dump_stack_lvl+0x77/0xb0 [ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 [ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202671] ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202866] write_cache_pages+0x265/0x450 [ 57.202870] ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202913] do_writepages+0xd2/0x230 [ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80 [ 57.202921] filemap_fdatawrite_wbc+0x67/0x80 [ 57.202924] filemap_write_and_wait_range+0xd9/0x170 [ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202969] __se_sys_close+0x46/0xd0 [ 57.202972] do_syscall_64+0x68/0x100 [ 57.202975] ? do_syscall_64+0x77/0x100 [ 57.202976] ? do_syscall_64+0x77/0x100 [ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 57.202982] RIP: 0033:0x7fe2b12e4a94 [ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3 [ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94 [ 57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003 [ 57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49 [ 57.202993] R10: 00007fe2b11f8300 R11: 0000000000000202 R12: 0000000000000000 [ 57.202994] R13: 00007ffe857dfd80 R14: 00007fe2b1445000 R15: 0000000000000000 [ 57.202999] </TASK> The problem seems to be that two out of three callers aren't taking the rcu_read_lock() before calling the list_for_each_entry_rcu() function in rpc_xprt_switch_has_addr(). I fix this by having rpc_xprt_switch_has_addr() unconditionaly take the rcu_read_lock(), which is okay to do recursively in the case that the lock has already been taken by a caller. Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/sunrpc/xprtmultipath.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c index 78c075a68c04..a11e80d17830 100644 --- a/net/sunrpc/xprtmultipath.c +++ b/net/sunrpc/xprtmultipath.c @@ -253,8 +253,9 @@ struct rpc_xprt *xprt_iter_current_entry(struct rpc_xprt_iter *xpi) return xprt_switch_find_current_entry(head, xpi->xpi_cursor); } -bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, - const struct sockaddr *sap) +static +bool __rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, + const struct sockaddr *sap) { struct list_head *head; struct rpc_xprt *pos; @@ -273,6 +274,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, return false; } +bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, + const struct sockaddr *sap) +{ + bool res; + + rcu_read_lock(); + res = __rpc_xprt_switch_has_addr(xps, sap); + rcu_read_unlock(); + + return res; +} + static struct rpc_xprt *xprt_switch_find_next_entry(struct list_head *head, const struct rpc_xprt *cur) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
by Guo Mengqi 14 May '24

14 May '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.8-rc1 commit 169410eba271afc9f0fb476d996795aa26770c6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4S CVE: CVE-2023-52621 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be reported when a sleepable bpf program manipulates bpf map under interpreter mode (aka bpf_jit_enable=0): WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Call Trace: <TASK> ? __warn+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60 ? report_bug+0x1ba/0x1f0 ? handle_bug+0x40/0x80 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1b/0x20 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0 ? rcu_is_watching+0x23/0x50 ? bpf_map_lookup_elem+0x54/0x60 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> Signed-off-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/20231204140425.1480317-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/helpers.c Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/helpers.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 6cbf82ca33f2..5836d1828ad7 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -15,6 +15,7 @@ #include <linux/pid_namespace.h> #include <linux/proc_ns.h> #include <linux/security.h> +#include <linux/rcupdate_trace.h> #include "../../lib/kstrtox.h" @@ -24,12 +25,12 @@ * * Different map implementations will rely on rcu in map methods * lookup/update/delete, therefore eBPF programs must run under rcu lock - * if program is allowed to access maps, so check rcu_read_lock_held in - * all three functions. + * if program is allowed to access maps, so check rcu_read_lock_held() or + * rcu_read_lock_trace_held() in all three functions. */ BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return (unsigned long) map->ops->map_lookup_elem(map, key); } @@ -45,7 +46,7 @@ const struct bpf_func_proto bpf_map_lookup_elem_proto = { BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key, void *, value, u64, flags) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return map->ops->map_update_elem(map, key, value, flags); } @@ -62,7 +63,7 @@ const struct bpf_func_proto bpf_map_update_elem_proto = { BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return map->ops->map_delete_elem(map, key); } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] SUNRPC: Fix a suspicious RCU usage warning
by Guo Mengqi 14 May '24

14 May '24

From: Anna Schumaker <Anna.Schumaker(a)Netapp.com> stable inclusion from stable-v5.10.210 commit c430e6bb43955c6bf573665fcebf31694925b9f7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4V Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 31b62908693c90d4d07db597e685d9f25a120073 ] I received the following warning while running cthon against an ontap server running pNFS: [ 57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.202525] ----------------------------- [ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! [ 57.202527] other info that might help us debug this: [ 57.202528] rcu_scheduler_active = 2, debug_locks = 1 [ 57.202529] no locks held by test5/3567. [ 57.202530] stack backtrace: [ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e [ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022 [ 57.202536] Call Trace: [ 57.202537] <TASK> [ 57.202540] dump_stack_lvl+0x77/0xb0 [ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 [ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202671] ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202866] write_cache_pages+0x265/0x450 [ 57.202870] ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202913] do_writepages+0xd2/0x230 [ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80 [ 57.202921] filemap_fdatawrite_wbc+0x67/0x80 [ 57.202924] filemap_write_and_wait_range+0xd9/0x170 [ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202969] __se_sys_close+0x46/0xd0 [ 57.202972] do_syscall_64+0x68/0x100 [ 57.202975] ? do_syscall_64+0x77/0x100 [ 57.202976] ? do_syscall_64+0x77/0x100 [ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 57.202982] RIP: 0033:0x7fe2b12e4a94 [ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3 [ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94 [ 57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003 [ 57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49 [ 57.202993] R10: 00007fe2b11f8300 R11: 0000000000000202 R12: 0000000000000000 [ 57.202994] R13: 00007ffe857dfd80 R14: 00007fe2b1445000 R15: 0000000000000000 [ 57.202999] </TASK> The problem seems to be that two out of three callers aren't taking the rcu_read_lock() before calling the list_for_each_entry_rcu() function in rpc_xprt_switch_has_addr(). I fix this by having rpc_xprt_switch_has_addr() unconditionaly take the rcu_read_lock(), which is okay to do recursively in the case that the lock has already been taken by a caller. Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/sunrpc/xprtmultipath.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c index 78c075a68c04..a11e80d17830 100644 --- a/net/sunrpc/xprtmultipath.c +++ b/net/sunrpc/xprtmultipath.c @@ -253,8 +253,9 @@ struct rpc_xprt *xprt_iter_current_entry(struct rpc_xprt_iter *xpi) return xprt_switch_find_current_entry(head, xpi->xpi_cursor); } -bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, - const struct sockaddr *sap) +static +bool __rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, + const struct sockaddr *sap) { struct list_head *head; struct rpc_xprt *pos; @@ -273,6 +274,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, return false; } +bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, + const struct sockaddr *sap) +{ + bool res; + + rcu_read_lock(); + res = __rpc_xprt_switch_has_addr(xps, sap); + rcu_read_unlock(); + + return res; +} + static struct rpc_xprt *xprt_switch_find_next_entry(struct list_head *head, const struct rpc_xprt *cur) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
by Guo Mengqi 14 May '24

14 May '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.8-rc1 commit 169410eba271afc9f0fb476d996795aa26770c6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4S CVE: CVE-2023-52621 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be reported when a sleepable bpf program manipulates bpf map under interpreter mode (aka bpf_jit_enable=0): WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Call Trace: <TASK> ? __warn+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60 ? report_bug+0x1ba/0x1f0 ? handle_bug+0x40/0x80 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1b/0x20 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0 ? rcu_is_watching+0x23/0x50 ? bpf_map_lookup_elem+0x54/0x60 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> Signed-off-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/20231204140425.1480317-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/helpers.c Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/helpers.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 6cbf82ca33f2..5836d1828ad7 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -15,6 +15,7 @@ #include <linux/pid_namespace.h> #include <linux/proc_ns.h> #include <linux/security.h> +#include <linux/rcupdate_trace.h> #include "../../lib/kstrtox.h" @@ -24,12 +25,12 @@ * * Different map implementations will rely on rcu in map methods * lookup/update/delete, therefore eBPF programs must run under rcu lock - * if program is allowed to access maps, so check rcu_read_lock_held in - * all three functions. + * if program is allowed to access maps, so check rcu_read_lock_held() or + * rcu_read_lock_trace_held() in all three functions. */ BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return (unsigned long) map->ops->map_lookup_elem(map, key); } @@ -45,7 +46,7 @@ const struct bpf_func_proto bpf_map_lookup_elem_proto = { BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key, void *, value, u64, flags) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return map->ops->map_update_elem(map, key, value, flags); } @@ -62,7 +63,7 @@ const struct bpf_func_proto bpf_map_update_elem_proto = { BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return map->ops->map_delete_elem(map, key); } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] SUNRPC: Fix a suspicious RCU usage warning
by Guo Mengqi 14 May '24

14 May '24

From: Anna Schumaker <Anna.Schumaker(a)Netapp.com> stable inclusion from stable-v5.10.210 commit c430e6bb43955c6bf573665fcebf31694925b9f7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4V Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 31b62908693c90d4d07db597e685d9f25a120073 ] I received the following warning while running cthon against an ontap server running pNFS: [ 57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.202525] ----------------------------- [ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! [ 57.202527] other info that might help us debug this: [ 57.202528] rcu_scheduler_active = 2, debug_locks = 1 [ 57.202529] no locks held by test5/3567. [ 57.202530] stack backtrace: [ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e [ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022 [ 57.202536] Call Trace: [ 57.202537] <TASK> [ 57.202540] dump_stack_lvl+0x77/0xb0 [ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 [ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202671] ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202866] write_cache_pages+0x265/0x450 [ 57.202870] ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202913] do_writepages+0xd2/0x230 [ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80 [ 57.202921] filemap_fdatawrite_wbc+0x67/0x80 [ 57.202924] filemap_write_and_wait_range+0xd9/0x170 [ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202969] __se_sys_close+0x46/0xd0 [ 57.202972] do_syscall_64+0x68/0x100 [ 57.202975] ? do_syscall_64+0x77/0x100 [ 57.202976] ? do_syscall_64+0x77/0x100 [ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 57.202982] RIP: 0033:0x7fe2b12e4a94 [ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3 [ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94 [ 57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003 [ 57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49 [ 57.202993] R10: 00007fe2b11f8300 R11: 0000000000000202 R12: 0000000000000000 [ 57.202994] R13: 00007ffe857dfd80 R14: 00007fe2b1445000 R15: 0000000000000000 [ 57.202999] </TASK> The problem seems to be that two out of three callers aren't taking the rcu_read_lock() before calling the list_for_each_entry_rcu() function in rpc_xprt_switch_has_addr(). I fix this by having rpc_xprt_switch_has_addr() unconditionaly take the rcu_read_lock(), which is okay to do recursively in the case that the lock has already been taken by a caller. Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/sunrpc/xprtmultipath.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c index 78c075a68c04..a11e80d17830 100644 --- a/net/sunrpc/xprtmultipath.c +++ b/net/sunrpc/xprtmultipath.c @@ -253,8 +253,9 @@ struct rpc_xprt *xprt_iter_current_entry(struct rpc_xprt_iter *xpi) return xprt_switch_find_current_entry(head, xpi->xpi_cursor); } -bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, - const struct sockaddr *sap) +static +bool __rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, + const struct sockaddr *sap) { struct list_head *head; struct rpc_xprt *pos; @@ -273,6 +274,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, return false; } +bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, + const struct sockaddr *sap) +{ + bool res; + + rcu_read_lock(); + res = __rpc_xprt_switch_has_addr(xps, sap); + rcu_read_unlock(); + + return res; +} + static struct rpc_xprt *xprt_switch_find_next_entry(struct list_head *head, const struct rpc_xprt *cur) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] iio: adc: ad7091r: Allow users to configure device events
by Guo Mengqi 14 May '24

14 May '24

From: Marcelo Schmitt <marcelo.schmitt(a)analog.com> stable inclusion from stable-v5.10.210 commit 1eba6f7ffa295a0eec098c107043074be7cc4ec5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4R Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 020e71c7ffc25dfe29ed9be6c2d39af7bd7f661f ] AD7091R-5 devices are supported by the ad7091r-5 driver together with the ad7091r-base driver. Those drivers declared iio events for notifying user space when ADC readings fall bellow the thresholds of low limit registers or above the values set in high limit registers. However, to configure iio events and their thresholds, a set of callback functions must be implemented and those were not present until now. The consequence of trying to configure ad7091r-5 events without the proper callback functions was a null pointer dereference in the kernel because the pointers to the callback functions were not set. Implement event configuration callbacks allowing users to read/write event thresholds and enable/disable event generation. Since the event spec structs are generic to AD7091R devices, also move those from the ad7091r-5 driver the base driver so they can be reused when support for ad7091r-2/-4/-8 be added. Fixes: ca69300173b6 ("iio: adc: Add support for AD7091R5 ADC") Suggested-by: David Lechner <dlechner(a)baylibre.com> Signed-off-by: Marcelo Schmitt <marcelo.schmitt(a)analog.com> Link: https://lore.kernel.org/r/59552d3548dabd56adc3107b7b4869afee2b0c3c.17030133… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/adc/ad7091r-base.c | 156 +++++++++++++++++++++++++++++++++ drivers/iio/adc/ad7091r-base.h | 6 ++ drivers/iio/adc/ad7091r5.c | 28 +----- 3 files changed, 166 insertions(+), 24 deletions(-) diff --git a/drivers/iio/adc/ad7091r-base.c b/drivers/iio/adc/ad7091r-base.c index 63b4d6ea4566..827971d458a5 100644 --- a/drivers/iio/adc/ad7091r-base.c +++ b/drivers/iio/adc/ad7091r-base.c @@ -6,6 +6,7 @@ */ #include <linux/bitops.h> +#include <linux/bitfield.h> #include <linux/iio/events.h> #include <linux/iio/iio.h> #include <linux/interrupt.h> @@ -49,6 +50,27 @@ struct ad7091r_state { struct mutex lock; /*lock to prevent concurent reads */ }; +const struct iio_event_spec ad7091r_events[] = { + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_RISING, + .mask_separate = BIT(IIO_EV_INFO_VALUE) | + BIT(IIO_EV_INFO_ENABLE), + }, + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_FALLING, + .mask_separate = BIT(IIO_EV_INFO_VALUE) | + BIT(IIO_EV_INFO_ENABLE), + }, + { + .type = IIO_EV_TYPE_THRESH, + .dir = IIO_EV_DIR_EITHER, + .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), + }, +}; +EXPORT_SYMBOL_NS_GPL(ad7091r_events, IIO_AD7091R); + static int ad7091r_set_mode(struct ad7091r_state *st, enum ad7091r_mode mode) { int ret, conf; @@ -168,8 +190,142 @@ static int ad7091r_read_raw(struct iio_dev *iio_dev, return ret; } +static int ad7091r_read_event_config(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + int val, ret; + + switch (dir) { + case IIO_EV_DIR_RISING: + ret = regmap_read(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + &val); + if (ret) + return ret; + return val != AD7091R_HIGH_LIMIT; + case IIO_EV_DIR_FALLING: + ret = regmap_read(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + &val); + if (ret) + return ret; + return val != AD7091R_LOW_LIMIT; + default: + return -EINVAL; + } +} + +static int ad7091r_write_event_config(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, int state) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + + if (state) { + return regmap_set_bits(st->map, AD7091R_REG_CONF, + AD7091R_REG_CONF_ALERT_EN); + } else { + /* + * Set thresholds either to 0 or to 2^12 - 1 as appropriate to + * prevent alerts and thus disable event generation. + */ + switch (dir) { + case IIO_EV_DIR_RISING: + return regmap_write(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + AD7091R_HIGH_LIMIT); + case IIO_EV_DIR_FALLING: + return regmap_write(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + AD7091R_LOW_LIMIT); + default: + return -EINVAL; + } + } +} + +static int ad7091r_read_event_value(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, + enum iio_event_info info, int *val, int *val2) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + int ret; + + switch (info) { + case IIO_EV_INFO_VALUE: + switch (dir) { + case IIO_EV_DIR_RISING: + ret = regmap_read(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + case IIO_EV_DIR_FALLING: + ret = regmap_read(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + default: + return -EINVAL; + } + case IIO_EV_INFO_HYSTERESIS: + ret = regmap_read(st->map, + AD7091R_REG_CH_HYSTERESIS(chan->channel), + val); + if (ret) + return ret; + return IIO_VAL_INT; + default: + return -EINVAL; + } +} + +static int ad7091r_write_event_value(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, + enum iio_event_type type, + enum iio_event_direction dir, + enum iio_event_info info, int val, int val2) +{ + struct ad7091r_state *st = iio_priv(indio_dev); + + switch (info) { + case IIO_EV_INFO_VALUE: + switch (dir) { + case IIO_EV_DIR_RISING: + return regmap_write(st->map, + AD7091R_REG_CH_HIGH_LIMIT(chan->channel), + val); + case IIO_EV_DIR_FALLING: + return regmap_write(st->map, + AD7091R_REG_CH_LOW_LIMIT(chan->channel), + val); + default: + return -EINVAL; + } + case IIO_EV_INFO_HYSTERESIS: + return regmap_write(st->map, + AD7091R_REG_CH_HYSTERESIS(chan->channel), + val); + default: + return -EINVAL; + } +} + static const struct iio_info ad7091r_info = { .read_raw = ad7091r_read_raw, + .read_event_config = &ad7091r_read_event_config, + .write_event_config = &ad7091r_write_event_config, + .read_event_value = &ad7091r_read_event_value, + .write_event_value = &ad7091r_write_event_value, }; static irqreturn_t ad7091r_event_handler(int irq, void *private) diff --git a/drivers/iio/adc/ad7091r-base.h b/drivers/iio/adc/ad7091r-base.h index 509748aef9b1..7a78976a2f80 100644 --- a/drivers/iio/adc/ad7091r-base.h +++ b/drivers/iio/adc/ad7091r-base.h @@ -8,6 +8,10 @@ #ifndef __DRIVERS_IIO_ADC_AD7091R_BASE_H__ #define __DRIVERS_IIO_ADC_AD7091R_BASE_H__ +/* AD7091R_REG_CH_LIMIT */ +#define AD7091R_HIGH_LIMIT 0xFFF +#define AD7091R_LOW_LIMIT 0x0 + struct device; struct ad7091r_state; @@ -17,6 +21,8 @@ struct ad7091r_chip_info { unsigned int vref_mV; }; +extern const struct iio_event_spec ad7091r_events[3]; + extern const struct regmap_config ad7091r_regmap_config; int ad7091r_probe(struct device *dev, const char *name, diff --git a/drivers/iio/adc/ad7091r5.c b/drivers/iio/adc/ad7091r5.c index 9665679c3ea6..e60511460786 100644 --- a/drivers/iio/adc/ad7091r5.c +++ b/drivers/iio/adc/ad7091r5.c @@ -12,26 +12,6 @@ #include "ad7091r-base.h" -static const struct iio_event_spec ad7091r5_events[] = { - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_RISING, - .mask_separate = BIT(IIO_EV_INFO_VALUE) | - BIT(IIO_EV_INFO_ENABLE), - }, - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_FALLING, - .mask_separate = BIT(IIO_EV_INFO_VALUE) | - BIT(IIO_EV_INFO_ENABLE), - }, - { - .type = IIO_EV_TYPE_THRESH, - .dir = IIO_EV_DIR_EITHER, - .mask_separate = BIT(IIO_EV_INFO_HYSTERESIS), - }, -}; - #define AD7091R_CHANNEL(idx, bits, ev, num_ev) { \ .type = IIO_VOLTAGE, \ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), \ @@ -44,10 +24,10 @@ static const struct iio_event_spec ad7091r5_events[] = { .scan_type.realbits = bits, \ } static const struct iio_chan_spec ad7091r5_channels_irq[] = { - AD7091R_CHANNEL(0, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(1, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(2, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), - AD7091R_CHANNEL(3, 12, ad7091r5_events, ARRAY_SIZE(ad7091r5_events)), + AD7091R_CHANNEL(0, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(1, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(2, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), + AD7091R_CHANNEL(3, 12, ad7091r_events, ARRAY_SIZE(ad7091r_events)), }; static const struct iio_chan_spec ad7091r5_channels_noirq[] = { -- 2.17.1

2 1

[PATCH OLK-5.10] bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
by Guo Mengqi 14 May '24

14 May '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.8-rc1 commit 169410eba271afc9f0fb476d996795aa26770c6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4S CVE: CVE-2023-52621 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be reported when a sleepable bpf program manipulates bpf map under interpreter mode (aka bpf_jit_enable=0): WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Call Trace: <TASK> ? __warn+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60 ? report_bug+0x1ba/0x1f0 ? handle_bug+0x40/0x80 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1b/0x20 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0 ? rcu_is_watching+0x23/0x50 ? bpf_map_lookup_elem+0x54/0x60 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> Signed-off-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/20231204140425.1480317-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/helpers.c Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/helpers.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 6cbf82ca33f2..5836d1828ad7 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -15,6 +15,7 @@ #include <linux/pid_namespace.h> #include <linux/proc_ns.h> #include <linux/security.h> +#include <linux/rcupdate_trace.h> #include "../../lib/kstrtox.h" @@ -24,12 +25,12 @@ * * Different map implementations will rely on rcu in map methods * lookup/update/delete, therefore eBPF programs must run under rcu lock - * if program is allowed to access maps, so check rcu_read_lock_held in - * all three functions. + * if program is allowed to access maps, so check rcu_read_lock_held() or + * rcu_read_lock_trace_held() in all three functions. */ BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return (unsigned long) map->ops->map_lookup_elem(map, key); } @@ -45,7 +46,7 @@ const struct bpf_func_proto bpf_map_lookup_elem_proto = { BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key, void *, value, u64, flags) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return map->ops->map_update_elem(map, key, value, flags); } @@ -62,7 +63,7 @@ const struct bpf_func_proto bpf_map_update_elem_proto = { BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return map->ops->map_delete_elem(map, key); } -- 2.17.1

2 1

[PATCH OLK-5.10] SUNRPC: Fix a suspicious RCU usage warning
by Guo Mengqi 14 May '24

14 May '24

From: Anna Schumaker <Anna.Schumaker(a)Netapp.com> stable inclusion from stable-v5.10.210 commit c430e6bb43955c6bf573665fcebf31694925b9f7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4V Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 31b62908693c90d4d07db597e685d9f25a120073 ] I received the following warning while running cthon against an ontap server running pNFS: [ 57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.202525] ----------------------------- [ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! [ 57.202527] other info that might help us debug this: [ 57.202528] rcu_scheduler_active = 2, debug_locks = 1 [ 57.202529] no locks held by test5/3567. [ 57.202530] stack backtrace: [ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e [ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022 [ 57.202536] Call Trace: [ 57.202537] <TASK> [ 57.202540] dump_stack_lvl+0x77/0xb0 [ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 [ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202671] ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202866] write_cache_pages+0x265/0x450 [ 57.202870] ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202913] do_writepages+0xd2/0x230 [ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80 [ 57.202921] filemap_fdatawrite_wbc+0x67/0x80 [ 57.202924] filemap_write_and_wait_range+0xd9/0x170 [ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202969] __se_sys_close+0x46/0xd0 [ 57.202972] do_syscall_64+0x68/0x100 [ 57.202975] ? do_syscall_64+0x77/0x100 [ 57.202976] ? do_syscall_64+0x77/0x100 [ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 57.202982] RIP: 0033:0x7fe2b12e4a94 [ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3 [ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94 [ 57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003 [ 57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49 [ 57.202993] R10: 00007fe2b11f8300 R11: 0000000000000202 R12: 0000000000000000 [ 57.202994] R13: 00007ffe857dfd80 R14: 00007fe2b1445000 R15: 0000000000000000 [ 57.202999] </TASK> The problem seems to be that two out of three callers aren't taking the rcu_read_lock() before calling the list_for_each_entry_rcu() function in rpc_xprt_switch_has_addr(). I fix this by having rpc_xprt_switch_has_addr() unconditionaly take the rcu_read_lock(), which is okay to do recursively in the case that the lock has already been taken by a caller. Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/sunrpc/xprtmultipath.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c index 78c075a68c04..a11e80d17830 100644 --- a/net/sunrpc/xprtmultipath.c +++ b/net/sunrpc/xprtmultipath.c @@ -253,8 +253,9 @@ struct rpc_xprt *xprt_iter_current_entry(struct rpc_xprt_iter *xpi) return xprt_switch_find_current_entry(head, xpi->xpi_cursor); } -bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, - const struct sockaddr *sap) +static +bool __rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, + const struct sockaddr *sap) { struct list_head *head; struct rpc_xprt *pos; @@ -273,6 +274,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, return false; } +bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps, + const struct sockaddr *sap) +{ + bool res; + + rcu_read_lock(); + res = __rpc_xprt_switch_has_addr(xps, sap); + rcu_read_unlock(); + + return res; +} + static struct rpc_xprt *xprt_switch_find_next_entry(struct list_head *head, const struct rpc_xprt *cur) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
by Guo Mengqi 14 May '24

14 May '24

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.8-rc1 commit 169410eba271afc9f0fb476d996795aa26770c6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4S CVE: CVE-2023-52621 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be reported when a sleepable bpf program manipulates bpf map under interpreter mode (aka bpf_jit_enable=0): WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Call Trace: <TASK> ? __warn+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60 ? report_bug+0x1ba/0x1f0 ? handle_bug+0x40/0x80 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1b/0x20 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0 ? rcu_is_watching+0x23/0x50 ? bpf_map_lookup_elem+0x54/0x60 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> Signed-off-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/20231204140425.1480317-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/helpers.c Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/helpers.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 26f1a526321a..02ef4dee2611 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -15,6 +15,7 @@ #include <linux/pid_namespace.h> #include <linux/proc_ns.h> #include <linux/security.h> +#include <linux/rcupdate_trace.h> #include "../../lib/kstrtox.h" @@ -24,12 +25,12 @@ * * Different map implementations will rely on rcu in map methods * lookup/update/delete, therefore eBPF programs must run under rcu lock - * if program is allowed to access maps, so check rcu_read_lock_held in - * all three functions. + * if program is allowed to access maps, so check rcu_read_lock_held() or + * rcu_read_lock_trace_held() in all three functions. */ BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return (unsigned long) map->ops->map_lookup_elem(map, key); } @@ -45,7 +46,7 @@ const struct bpf_func_proto bpf_map_lookup_elem_proto = { BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key, void *, value, u64, flags) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return map->ops->map_update_elem(map, key, value, flags); } @@ -62,7 +63,7 @@ const struct bpf_func_proto bpf_map_update_elem_proto = { BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key) { - WARN_ON_ONCE(!rcu_read_lock_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held()); return map->ops->map_delete_elem(map, key); } -- 2.17.1

2 1

[PATCH OLK-5.10] s390/zcrypt: fix reference counting on zcrypt card objects
by felix 14 May '24

14 May '24

From: Harald Freudenberger <freude(a)linux.ibm.com> stable inclusion from stable-v5.10.215 commit 6470078ab3d8f222115e11c4ec67351f3031b3dd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4T8 CVE: CVE-2024-26957 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 50ed48c80fecbe17218afed4f8bed005c802976c ] Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object which could lead to a free of the zcrypt card object while it was still in use. This is an example of the slab message: kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43 kernel: kmalloc_trace+0x3f2/0x470 kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt] kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4] kernel: ap_device_probe+0x15c/0x290 kernel: really_probe+0xd2/0x468 kernel: driver_probe_device+0x40/0xf0 kernel: __device_attach_driver+0xc0/0x140 kernel: bus_for_each_drv+0x8c/0xd0 kernel: __device_attach+0x114/0x198 kernel: bus_probe_device+0xb4/0xc8 kernel: device_add+0x4d2/0x6e0 kernel: ap_scan_adapter+0x3d0/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43 kernel: kfree+0x37e/0x418 kernel: zcrypt_card_put+0x54/0x80 [zcrypt] kernel: ap_device_remove+0x4c/0xe0 kernel: device_release_driver_internal+0x1c4/0x270 kernel: bus_remove_device+0x100/0x188 kernel: device_del+0x164/0x3c0 kernel: device_unregister+0x30/0x90 kernel: ap_scan_adapter+0xc8/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: kthread+0x150/0x168 kernel: __ret_from_fork+0x3c/0x58 kernel: ret_from_fork+0xa/0x30 kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff) kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88 kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........ kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk. kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........ kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2 kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux) kernel: Call Trace: kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120 kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140 kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8 kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8 kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0 kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8 kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8 kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590 kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0 kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0 kernel: [<00000000c9b919dc>] ext4_htree_fill_tree+0x134/0x400 kernel: [<00000000c9b4b3d0>] ext4_dx_readdir+0x160/0x2f0 kernel: [<00000000c9b4bedc>] ext4_readdir+0x5f4/0x760 kernel: [<00000000c9a7efc4>] iterate_dir+0xb4/0x280 kernel: [<00000000c9a7f1ea>] __do_sys_getdents64+0x5a/0x120 kernel: [<00000000ca5d6946>] __do_syscall+0x256/0x310 kernel: [<00000000ca5eea10>] system_call+0x70/0x98 kernel: INFO: lockdep is turned off. kernel: FIX kmalloc-96: Restoring Poison 0x00000000885a7512-0x00000000885a7513=0x6b kernel: FIX kmalloc-96: Marking all objects used The fix is simple: Before use of the queue not only the queue object but also the card object needs to increase it's reference count with a call to zcrypt_card_get(). Similar after use of the queue not only the queue but also the card object's reference count is decreased with zcrypt_card_put(). Signed-off-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Holger Dengler <dengler(a)linux.ibm.com> Cc: stable(a)vger.kernel.org Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/s390/crypto/zcrypt_api.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c index b518009715ee..dde10a5c7d50 100644 --- a/drivers/s390/crypto/zcrypt_api.c +++ b/drivers/s390/crypto/zcrypt_api.c @@ -576,6 +576,7 @@ static inline struct zcrypt_queue *zcrypt_pick_queue(struct zcrypt_card *zc, { if (!zq || !try_module_get(zq->queue->ap_dev.drv->driver.owner)) return NULL; + zcrypt_card_get(zc); zcrypt_queue_get(zq); get_device(&zq->queue->ap_dev.device); atomic_add(weight, &zc->load); @@ -595,6 +596,7 @@ static inline void zcrypt_drop_queue(struct zcrypt_card *zc, atomic_sub(weight, &zq->load); put_device(&zq->queue->ap_dev.device); zcrypt_queue_put(zq); + zcrypt_card_put(zc); module_put(mod); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] s390/zcrypt: fix reference counting on zcrypt card objects
by felix 14 May '24

14 May '24

From: Harald Freudenberger <freude(a)linux.ibm.com> stable inclusion from stable-v4.19.312 commit 7e500849fa558879a1cde43f80c7c048c2437058 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4T8 CVE: CVE-2024-26957 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 50ed48c80fecbe17218afed4f8bed005c802976c ] Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object which could lead to a free of the zcrypt card object while it was still in use. This is an example of the slab message: kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43 kernel: kmalloc_trace+0x3f2/0x470 kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt] kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4] kernel: ap_device_probe+0x15c/0x290 kernel: really_probe+0xd2/0x468 kernel: driver_probe_device+0x40/0xf0 kernel: __device_attach_driver+0xc0/0x140 kernel: bus_for_each_drv+0x8c/0xd0 kernel: __device_attach+0x114/0x198 kernel: bus_probe_device+0xb4/0xc8 kernel: device_add+0x4d2/0x6e0 kernel: ap_scan_adapter+0x3d0/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43 kernel: kfree+0x37e/0x418 kernel: zcrypt_card_put+0x54/0x80 [zcrypt] kernel: ap_device_remove+0x4c/0xe0 kernel: device_release_driver_internal+0x1c4/0x270 kernel: bus_remove_device+0x100/0x188 kernel: device_del+0x164/0x3c0 kernel: device_unregister+0x30/0x90 kernel: ap_scan_adapter+0xc8/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: kthread+0x150/0x168 kernel: __ret_from_fork+0x3c/0x58 kernel: ret_from_fork+0xa/0x30 kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff) kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88 kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........ kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk. kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........ kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2 kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux) kernel: Call Trace: kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120 kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140 kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8 kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8 kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0 kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8 kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8 kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590 kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0 kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0 kernel: [<00000000c9b919dc>] ext4_htree_fill_tree+0x134/0x400 kernel: [<00000000c9b4b3d0>] ext4_dx_readdir+0x160/0x2f0 kernel: [<00000000c9b4bedc>] ext4_readdir+0x5f4/0x760 kernel: [<00000000c9a7efc4>] iterate_dir+0xb4/0x280 kernel: [<00000000c9a7f1ea>] __do_sys_getdents64+0x5a/0x120 kernel: [<00000000ca5d6946>] __do_syscall+0x256/0x310 kernel: [<00000000ca5eea10>] system_call+0x70/0x98 kernel: INFO: lockdep is turned off. kernel: FIX kmalloc-96: Restoring Poison 0x00000000885a7512-0x00000000885a7513=0x6b kernel: FIX kmalloc-96: Marking all objects used The fix is simple: Before use of the queue not only the queue object but also the card object needs to increase it's reference count with a call to zcrypt_card_get(). Similar after use of the queue not only the queue but also the card object's reference count is decreased with zcrypt_card_put(). Signed-off-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Holger Dengler <dengler(a)linux.ibm.com> Cc: stable(a)vger.kernel.org Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/s390/crypto/zcrypt_api.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c index b2737bfeb8bb..4881ee2053f9 100644 --- a/drivers/s390/crypto/zcrypt_api.c +++ b/drivers/s390/crypto/zcrypt_api.c @@ -158,6 +158,7 @@ static inline struct zcrypt_queue *zcrypt_pick_queue(struct zcrypt_card *zc, { if (!zq || !try_module_get(zq->queue->ap_dev.drv->driver.owner)) return NULL; + zcrypt_card_get(zc); zcrypt_queue_get(zq); get_device(&zq->queue->ap_dev.device); atomic_add(weight, &zc->load); @@ -177,6 +178,7 @@ static inline void zcrypt_drop_queue(struct zcrypt_card *zc, atomic_sub(weight, &zq->load); put_device(&zq->queue->ap_dev.device); zcrypt_queue_put(zq); + zcrypt_card_put(zc); module_put(mod); } -- 2.34.1

2 1

[PATCH OLK-6.6] arm64: arm_pmuv3: Correctly extract and check the PMUVer
by Junhao He 14 May '24

14 May '24

From: Yicong Yang <yangyicong(a)hisilicon.com> maillist inclusion category: bugifx bugzilla: https://gitee.com/openeuler/kernel/issues/I9J01A CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/will/linux.git/commit/?h=fo… ---------------------------------------------------------------------- Currently we're using "sbfx" to extract the PMUVer from ID_AA64DFR0_EL1 and skip the init/reset if no PMU present when the extracted PMUVer is negative or is zero. However for PMUv3p8 the PMUVer will be 0b1000 and PMUVer extracted by "sbfx" will always be negative and we'll skip the init/reset in __init_el2_debug/reset_pmuserenr_el0 unexpectedly. So this patch use "ubfx" instead of "sbfx" to extract the PMUVer. If the PMUVer is implementation defined (0b1111) or not implemented(0b0000) then skip the reset/init. Previously we'll also skip the init/reset if the PMUVer is higher than the version we known (currently PMUv3p9), with this patch we'll only skip if the PMU is not implemented or implementation defined. This keeps consistence with how we probe the PMU in the driver with pmuv3_implemented(). Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Link: https://lore.kernel.org/r/20240411123030.7201-1-yangyicong@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- arch/arm64/include/asm/assembler.h | 7 ++++--- arch/arm64/include/asm/el2_setup.h | 9 +++++---- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h index c738877b8c72..38b23786aeb4 100644 --- a/arch/arm64/include/asm/assembler.h +++ b/arch/arm64/include/asm/assembler.h @@ -516,9 +516,10 @@ alternative_endif */ .macro reset_pmuserenr_el0, tmpreg mrs \tmpreg, id_aa64dfr0_el1 - sbfx \tmpreg, \tmpreg, #ID_AA64DFR0_EL1_PMUVer_SHIFT, #4 - cmp \tmpreg, #1 // Skip if no PMU present - b.lt 9000f + ubfx \tmpreg, \tmpreg, #ID_AA64DFR0_EL1_PMUVer_SHIFT, #4 + cmp \tmpreg, #ID_AA64DFR0_EL1_PMUVer_NI + ccmp \tmpreg, #ID_AA64DFR0_EL1_PMUVer_IMP_DEF, #4, ne + b.eq 9000f // Skip if no PMU present or IMP_DEF msr pmuserenr_el0, xzr // Disable PMU access from EL0 9000: .endm diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h index 1e2181820a0a..3dc7c58d55b6 100644 --- a/arch/arm64/include/asm/el2_setup.h +++ b/arch/arm64/include/asm/el2_setup.h @@ -59,13 +59,14 @@ .macro __init_el2_debug mrs x1, id_aa64dfr0_el1 - sbfx x0, x1, #ID_AA64DFR0_EL1_PMUVer_SHIFT, #4 - cmp x0, #1 - b.lt .Lskip_pmu_\@ // Skip if no PMU present + ubfx x0, x1, #ID_AA64DFR0_EL1_PMUVer_SHIFT, #4 + cmp x0, #ID_AA64DFR0_EL1_PMUVer_NI + ccmp x0, #ID_AA64DFR0_EL1_PMUVer_IMP_DEF, #4, ne + b.eq .Lskip_pmu_\@ // Skip if no PMU present or IMP_DEF mrs x0, pmcr_el0 // Disable debug access traps ubfx x0, x0, #11, #5 // to EL2 and allow access to .Lskip_pmu_\@: - csel x2, xzr, x0, lt // all PMU counters from EL1 + csel x2, xzr, x0, eq // all PMU counters from EL1 /* Statistical profiling */ ubfx x0, x1, #ID_AA64DFR0_EL1_PMSVer_SHIFT, #4 -- 2.33.0

2 1

[PATCH OLK-5.10] x86/fpu: Invalidate FPU state correctly on exec()
by Yang Yingliang 14 May '24

14 May '24

From: Rick Edgecombe <rick.p.edgecombe(a)intel.com> mainline inclusion from mainline-v6.5-rc7 commit 1f69383b203e28cf8a4ca9570e572da1699f76cd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NZ3E Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The thread flag TIF_NEED_FPU_LOAD indicates that the FPU saved state is valid and should be reloaded when returning to userspace. However, the kernel will skip doing this if the FPU registers are already valid as determined by fpregs_state_valid(). The logic embedded there considers the state valid if two cases are both true: 1: fpu_fpregs_owner_ctx points to the current tasks FPU state 2: the last CPU the registers were live in was the current CPU. This is usually correct logic. A CPU’s fpu_fpregs_owner_ctx is set to the current FPU during the fpregs_restore_userregs() operation, so it indicates that the registers have been restored on this CPU. But this alone doesn’t preclude that the task hasn’t been rescheduled to a different CPU, where the registers were modified, and then back to the current CPU. To verify that this was not the case the logic relies on the second condition. So the assumption is that if the registers have been restored, AND they haven’t had the chance to be modified (by being loaded on another CPU), then they MUST be valid on the current CPU. Besides the lazy FPU optimizations, the other cases where the FPU registers might not be valid are when the kernel modifies the FPU register state or the FPU saved buffer. In this case the operation modifying the FPU state needs to let the kernel know the correspondence has been broken. The comment in “arch/x86/kernel/fpu/context.h” has: /* ... * If the FPU register state is valid, the kernel can skip restoring the * FPU state from memory. * * Any code that clobbers the FPU registers or updates the in-memory * FPU state for a task MUST let the rest of the kernel know that the * FPU registers are no longer valid for this task. * * Either one of these invalidation functions is enough. Invalidate * a resource you control: CPU if using the CPU for something else * (with preemption disabled), FPU for the current task, or a task that * is prevented from running by the current task. */ However, this is not completely true. When the kernel modifies the registers or saved FPU state, it can only rely on __fpu_invalidate_fpregs_state(), which wipes the FPU’s last_cpu tracking. The exec path instead relies on fpregs_deactivate(), which sets the CPU’s FPU context to NULL. This was observed to fail to restore the reset FPU state to the registers when returning to userspace in the following scenario: 1. A task is executing in userspace on CPU0 - CPU0’s FPU context points to tasks - fpu->last_cpu=CPU0 2. The task exec()’s 3. While in the kernel the task is preempted - CPU0 gets a thread executing in the kernel (such that no other FPU context is activated) - Scheduler sets task’s fpu->last_cpu=CPU0 when scheduling out 4. Task is migrated to CPU1 5. Continuing the exec(), the task gets to fpu_flush_thread()->fpu_reset_fpregs() - Sets CPU1’s fpu context to NULL - Copies the init state to the task’s FPU buffer - Sets TIF_NEED_FPU_LOAD on the task 6. The task reschedules back to CPU0 before completing the exec() and returning to userspace - During the reschedule, scheduler finds TIF_NEED_FPU_LOAD is set - Skips saving the registers and updating task’s fpu→last_cpu, because TIF_NEED_FPU_LOAD is the canonical source. 7. Now CPU0’s FPU context is still pointing to the task’s, and fpu->last_cpu is still CPU0. So fpregs_state_valid() returns true even though the reset FPU state has not been restored. So the root cause is that exec() is doing the wrong kind of invalidate. It should reset fpu->last_cpu via __fpu_invalidate_fpregs_state(). Further, fpu__drop() doesn't really seem appropriate as the task (and FPU) are not going away, they are just getting reset as part of an exec. So switch to __fpu_invalidate_fpregs_state(). Also, delete the misleading comment that says that either kind of invalidate will be enough, because it’s not always the case. Fixes: 33344368cb08 ("x86/fpu: Clean up the fpu__clear() variants") Reported-by: Lei Wang <lei4.wang(a)intel.com> Signed-off-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: Lijun Pan <lijun.pan(a)intel.com> Reviewed-by: Sohil Mehta <sohil.mehta(a)intel.com> Acked-by: Lijun Pan <lijun.pan(a)intel.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20230818170305.502891-1-rick.p.edgecombe@intel.com Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kernel/fpu/context.h | 3 +-- arch/x86/kernel/fpu/core.c | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/fpu/context.h b/arch/x86/kernel/fpu/context.h index 958accf2ccf0..0adef4bb0859 100644 --- a/arch/x86/kernel/fpu/context.h +++ b/arch/x86/kernel/fpu/context.h @@ -19,8 +19,7 @@ * FPU state for a task MUST let the rest of the kernel know that the * FPU registers are no longer valid for this task. * - * Either one of these invalidation functions is enough. Invalidate - * a resource you control: CPU if using the CPU for something else + * Invalidate a resource you control: CPU if using the CPU for something else * (with preemption disabled), FPU for the current task, or a task that * is prevented from running by the current task. */ diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c index 114e87e8de86..49a56bac0d16 100644 --- a/arch/x86/kernel/fpu/core.c +++ b/arch/x86/kernel/fpu/core.c @@ -659,7 +659,7 @@ static void fpu_reset_fpregs(void) struct fpu *fpu = &current->thread.fpu; fpregs_lock(); - fpu__drop(fpu); + __fpu_invalidate_fpregs_state(fpu); /* * This does not change the actual hardware registers. It just * resets the memory image and sets TIF_NEED_FPU_LOAD so a -- 2.25.1

2 1

[PATCH OLK-6.6 0/5] ext4: iomap performance optimize
by Yang Erkun 14 May '24

14 May '24

Yang Erkun (5): iomap: add iomap_is_fully_dirty iomap: export __iomap_write_{begin|end} ext4: fallback to generic_perform_write once iov_iter_count <= PAGE_SIZE iomap: export iomap_clear_range_dirty ext4: add ext4_iomap_invalidate_folio fs/ext4/file.c | 3 +- fs/ext4/inode.c | 140 +++++++++++++++++++++++++++++++++++- fs/iomap/buffered-io.c | 44 +++++++++++- include/linux/iomap.h | 6 ++ include/trace/events/ext4.h | 15 ++++ 5 files changed, 203 insertions(+), 5 deletions(-) -- 2.39.2

2 6

[openeuler:OLK-5.10] BUILD SUCCESS 719747ca72f3d6b0187faeef6b525d76aa404fe8
by kernel test robot 14 May '24

14 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 719747ca72f3d6b0187faeef6b525d76aa404fe8 !7204 udma: fix bugs of DCA and record db Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-arm-cpu.yaml:properties:capacity-dmips-mhz:ref-should-not-be-valid-under-const:ref | |-- Documentation-devicetree-bindings-arm-cpu.yaml:title:ARM-CPUs-bindings-should-not-be-valid-under-pattern:(-Bb-inding-Ss-chema) | |-- Documentation-devicetree-bindings-arm-cpus.yaml:examples:cpus-arm-pbha-performance-only-bits-arm-pbha-no-aliases-bits-ncpu-device_type-cpu-compatible-arm-cortex-a57-...-n-is-not-of-type-array | `-- Documentation-devicetree-bindings-arm-cpus.yaml:maintainers-is-a-required-property `-- x86_64-allnoconfig `-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst elapsed time: 730m configs tested: 35 configs skipped: 149 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240513 gcc arm64 randconfig-002-20240513 gcc arm64 randconfig-003-20240513 clang arm64 randconfig-004-20240513 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240513 gcc x86_64 buildonly-randconfig-002-20240513 gcc x86_64 buildonly-randconfig-003-20240513 gcc x86_64 buildonly-randconfig-004-20240513 clang x86_64 buildonly-randconfig-005-20240513 clang x86_64 buildonly-randconfig-006-20240513 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240513 clang x86_64 randconfig-002-20240513 clang x86_64 randconfig-003-20240513 clang x86_64 randconfig-004-20240513 gcc x86_64 randconfig-005-20240513 clang x86_64 randconfig-006-20240513 clang x86_64 randconfig-011-20240513 clang x86_64 randconfig-012-20240513 gcc x86_64 randconfig-013-20240513 clang x86_64 randconfig-014-20240513 clang x86_64 randconfig-015-20240513 gcc x86_64 randconfig-016-20240513 clang x86_64 randconfig-071-20240513 clang x86_64 randconfig-072-20240513 clang x86_64 randconfig-073-20240513 clang x86_64 randconfig-074-20240513 gcc x86_64 randconfig-075-20240513 gcc x86_64 randconfig-076-20240513 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 27467fc28b6168ab8f4e8136d6ff76612e1e1b54
by kernel test robot 14 May '24

14 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 27467fc28b6168ab8f4e8136d6ff76612e1e1b54 !7206 v2 sched: programmable: Allow set tag for pid 1. Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allnoconfig | `-- arch-arm64-kernel-cpufeature.c:error:enable_pseudo_nmi-undeclared-(first-use-in-this-function) |-- arm64-defconfig | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-001-20240513 | `-- shadow.c:(.text):undefined-reference-to-__memcpy_mc `-- arm64-randconfig-002-20240513 `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used clang_recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_before_active_check | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_destroy | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_init_slave | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_netdev_event | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_service_proc | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_tracker_get | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_deatch_bond | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_detach_nic_bond_work | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev_by_name | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_queue_bond_work | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq_destroy.c:warning:no-previous-prototype-for-function-roce3_cq_hw2sw | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_cleanup_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_init_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_alloc | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_disable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_enable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_res.c:warning:no-previous-prototype-for-function-hmm_rdma_mpt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_alloc_mr | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_free_tpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_umem_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_context_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_ext_ctx_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_dif_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_verbs_cmd.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-mr-roce_mr.c:warning:no-previous-prototype-for-function-roce3_check_mr_status | |-- drivers-infiniband-hw-hiroce3-rdma-rdma_comp.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_bond_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_link_event | |-- drivers-infiniband-hw-hiroce3-roce_sysfs.c:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_io_flush.c:warning:no-previous-prototype-for-function-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_error.c:warning:no-previous-prototype-for-function-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_shutdown.c:warning:no-previous-prototype-for-function-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-bat_table-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_fill_cla | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_numb-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_type-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_fill_cla()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_lock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_unlock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_xyz()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-free_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-malloc_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-bloomfilter_init_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-k_flag-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-op-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-bloomfilter_init_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_dec()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_inc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd_buf-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box_async()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_imm()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_record-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-direct_wqe-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-object-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-pagenum-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_get_db_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_direct_wqe_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_fc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_update_pri()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_software_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_get_hardware_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-data-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-event-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_capability_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_template-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_aeq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_capability_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ecq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nocq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_scq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_register()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_unregister()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-bh-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-common-not-described-in-cqm_object_share_recv_queue_add_container | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_number-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_gid_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_timer_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-function_id-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-global_funcid-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_base-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_number-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-init_rq_num-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_funcid | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_old | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-room_header_alloc-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-xid-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_hash_buf_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_timer_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_gid_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_fc_srq_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_funcid()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_alloc_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_old()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_add_container()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_timer_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_free_srq_bitmap_index | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-common-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-container_addr-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link_mode-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_container_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_used_rq_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_head_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_tail_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-tail-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_per_buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_linkwqe_fill()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_bitmap_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_container_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_used_rq_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hw_cfg.c:warning:expecting-prototype-for-hinic_set_vf_dev_cap().-Prototype-was-for-hinic3_init_vf_dev_cap()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_get | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_hw | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__mbox_to_host | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-comm_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-get_slave_func_netdev_state | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hilink_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_get_master_host_mbox_enable | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_nic_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_register_slave_ppf | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-set_slave_func_nic_state | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-sw_func_ppf_mbox_handler |-- arm64-randconfig-003-20240513 | `-- ld.lld:error:undefined-symbol:__memcpy_mc |-- arm64-randconfig-r051-20240514 | `-- mm-page_alloc.c:error:call-to-undeclared-function-dynamic_pool_should_alloc-ISO-C99-and-later-do-not-support-implicit-function-declarations `-- x86_64-allnoconfig |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:linux-version.h-not-needed. |-- drivers-infiniband-hw-hiroce3-roce.h:linux-version.h-not-needed. |-- drivers-net-ethernet-huawei-hinic3-bond-hinic3_bond.c:linux-version.h-not-needed. `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:hinic3_hwif.h-is-included-more-than-once. elapsed time: 725m configs tested: 40 configs skipped: 142 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240513 gcc arm64 randconfig-002-20240513 gcc arm64 randconfig-003-20240513 clang arm64 randconfig-004-20240513 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240513 gcc loongarch randconfig-002-20240513 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240513 gcc x86_64 buildonly-randconfig-002-20240513 gcc x86_64 buildonly-randconfig-003-20240513 gcc x86_64 buildonly-randconfig-004-20240513 clang x86_64 buildonly-randconfig-005-20240513 clang x86_64 buildonly-randconfig-006-20240513 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240513 clang x86_64 randconfig-002-20240513 clang x86_64 randconfig-003-20240513 clang x86_64 randconfig-004-20240513 gcc x86_64 randconfig-005-20240513 clang x86_64 randconfig-006-20240513 clang x86_64 randconfig-011-20240513 clang x86_64 randconfig-012-20240513 gcc x86_64 randconfig-013-20240513 clang x86_64 randconfig-014-20240513 clang x86_64 randconfig-015-20240513 gcc x86_64 randconfig-016-20240513 clang x86_64 randconfig-071-20240513 clang x86_64 randconfig-072-20240513 clang x86_64 randconfig-073-20240513 clang x86_64 randconfig-074-20240513 gcc x86_64 randconfig-075-20240513 gcc x86_64 randconfig-076-20240513 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 819e21d7b3e4610b4f9d6531b4fcd61ad2e9770a
by kernel test robot 14 May '24

14 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 819e21d7b3e4610b4f9d6531b4fcd61ad2e9770a !7059 nilfs2: prevent kernel bug at submit_bh_wbc() Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405140308.WGE9RFya-lkp@intel.com Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-004-20240513 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-r051-20240514 | |-- drivers-gpio-gpio-phytium-platform.c:Unneeded-semicolon | `-- drivers-media-platform-phytium-jpeg-phytium_jpeg_core.c:inconsistent-IS_ERR-and-PTR_ERR-on-line-. |-- x86_64-buildonly-randconfig-001-20240513 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code | |-- fs-proc-array.c:warning:gtime-may-be-used-uninitialized | |-- fs-proc-array.c:warning:maj_flt-may-be-used-uninitialized | `-- fs-proc-array.c:warning:min_flt-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-002-20240513 | |-- fs-proc-array.c:warning:gtime-may-be-used-uninitialized-in-this-function | |-- fs-proc-array.c:warning:maj_flt-may-be-used-uninitialized-in-this-function | `-- fs-proc-array.c:warning:min_flt-may-be-used-uninitialized-in-this-function |-- x86_64-buildonly-randconfig-006-20240513 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code | `-- drivers-infiniband-ulp-iser-iser_initiator.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-defconfig | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-004-20240513 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int |-- x86_64-randconfig-012-20240513 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-randconfig-076-20240513 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int |-- x86_64-randconfig-101-20240514 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-randconfig-103-20240514 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int `-- x86_64-randconfig-r052-20240514 `-- drivers-gpio-gpio-phytium-core.c:warning:CONFIG_SMP-is-not-defined-evaluates-to clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-buildonly-randconfig-005-20240513 | |-- drivers-cpuidle-cpuidle-haltpoll.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | |-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) | `-- net-netfilter-xt_TEE.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-randconfig-001-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-002-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-003-20240513 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-005-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-006-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-011-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-013-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-014-20240513 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-016-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-071-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-072-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-073-20240513 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-102-20240514 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-104-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) `-- x86_64-rhel-8.3-rust `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) elapsed time: 724m configs tested: 35 configs skipped: 147 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240513 gcc arm64 randconfig-002-20240513 gcc arm64 randconfig-003-20240513 gcc arm64 randconfig-004-20240513 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240513 gcc x86_64 buildonly-randconfig-002-20240513 gcc x86_64 buildonly-randconfig-003-20240513 gcc x86_64 buildonly-randconfig-004-20240513 clang x86_64 buildonly-randconfig-005-20240513 clang x86_64 buildonly-randconfig-006-20240513 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240513 clang x86_64 randconfig-002-20240513 clang x86_64 randconfig-003-20240513 clang x86_64 randconfig-004-20240513 gcc x86_64 randconfig-005-20240513 clang x86_64 randconfig-006-20240513 clang x86_64 randconfig-011-20240513 clang x86_64 randconfig-012-20240513 gcc x86_64 randconfig-013-20240513 clang x86_64 randconfig-014-20240513 clang x86_64 randconfig-015-20240513 gcc x86_64 randconfig-016-20240513 clang x86_64 randconfig-071-20240513 clang x86_64 randconfig-072-20240513 clang x86_64 randconfig-073-20240513 clang x86_64 randconfig-074-20240513 gcc x86_64 randconfig-075-20240513 gcc x86_64 randconfig-076-20240513 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21365/22424] drivers/media/platform/phytium-jpeg/phytium_jpeg_core.c:1301:5-11: inconsistent IS_ERR and PTR_ERR on line 1303.
by kernel test robot 14 May '24

14 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 819e21d7b3e4610b4f9d6531b4fcd61ad2e9770a commit: a773f33429ed6187436dd27117f3cc74a65a5344 [21365/22424] jpeg: Add a Phytium JPEG Engine driver config: arm64-randconfig-r051-20240514 (https://download.01.org/0day-ci/archive/20240514/202405140308.WGE9RFya-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405140308.WGE9RFya-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/media/platform/phytium-jpeg/phytium_jpeg_core.c:1301:5-11: inconsistent IS_ERR and PTR_ERR on line 1303. drivers/media/platform/phytium-jpeg/phytium_jpeg_core.c:1308:5-11: inconsistent IS_ERR and PTR_ERR on line 1310. vim +1301 drivers/media/platform/phytium-jpeg/phytium_jpeg_core.c 1279 1280 static int phytium_jpeg_probe(struct platform_device *pdev) 1281 { 1282 struct phytium_jpeg_dev *jpeg_dev; 1283 const struct of_device_id *match; 1284 const struct phytium_jpeg_config *config; 1285 struct resource *res; 1286 int ret; 1287 1288 jpeg_dev = devm_kzalloc(&pdev->dev, sizeof(*jpeg_dev), GFP_KERNEL); 1289 if (jpeg_dev == NULL) 1290 return -ENOMEM; 1291 1292 res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 1293 jpeg_dev->base_addr = devm_ioremap_resource(&pdev->dev, res); 1294 if (IS_ERR(jpeg_dev->base_addr)) { 1295 dev_err(jpeg_dev->dev, "Failed to ioremap.\n"); 1296 return PTR_ERR(jpeg_dev->base_addr); 1297 } 1298 1299 res = platform_get_resource(pdev, IORESOURCE_MEM, 1); 1300 jpeg_dev->timer30_addr = devm_ioremap_resource(&pdev->dev, res); > 1301 if (IS_ERR(jpeg_dev->base_addr)) { 1302 dev_err(jpeg_dev->dev, "Failed to parse timer30.\n"); > 1303 return PTR_ERR(jpeg_dev->timer30_addr); 1304 } 1305 1306 res = platform_get_resource(pdev, IORESOURCE_MEM, 2); 1307 jpeg_dev->timer31_addr = devm_ioremap_resource(&pdev->dev, res); 1308 if (IS_ERR(jpeg_dev->base_addr)) { 1309 dev_err(jpeg_dev->dev, "Failed to parse timer30.\n"); 1310 return PTR_ERR(jpeg_dev->timer31_addr); 1311 } 1312 match = of_match_node(phytium_jpeg_match, pdev->dev.of_node); 1313 if (match == NULL) { 1314 dev_err(jpeg_dev->dev, "Failed to match.\n"); 1315 return -EINVAL; 1316 } 1317 1318 config = match->data; 1319 jpeg_dev->comp_size_read = config->comp_size_read; 1320 1321 jpeg_dev->frame_rate = 30; 1322 jpeg_dev->dev = &pdev->dev; 1323 spin_lock_init(&jpeg_dev->hw_lock); 1324 mutex_init(&jpeg_dev->video_lock); 1325 init_waitqueue_head(&jpeg_dev->wait); 1326 INIT_DELAYED_WORK(&jpeg_dev->res_work, phytium_jpeg_resolution_work); 1327 INIT_LIST_HEAD(&jpeg_dev->buffers); 1328 1329 ret = phytium_jpeg_init(jpeg_dev); 1330 if (ret != 0) { 1331 dev_err(jpeg_dev->dev, "Failed to initialize the JPEG engine.\n"); 1332 return ret; 1333 } 1334 1335 ret = phytium_jpeg_setup_video(jpeg_dev); 1336 1337 return ret; 1338 } 1339 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/3] major bugfix before 2023
by Liao Chen 13 May '24

13 May '24

major bugfix before 2023 Li Huafei (1): [Backport] powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() Mark Rutland (1): [Backport] irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling Sergey Shtylyov (1): [Backport] genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() arch/powerpc/kernel/kprobes.c | 7 ++++++- drivers/irqchip/irq-gic-v3.c | 3 +++ kernel/irq/ipi.c | 8 ++++++-- 3 files changed, 15 insertions(+), 3 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/3] CVE-2024-26807
by Guo Mengqi 13 May '24

13 May '24

CVE-2024-26807 Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks Vaishnav Achath (2): spi: cadence-quadspi: Handle spi_unregister_master() in remove() spi: cadence-quadspi: Remove spi_master_put() in probe failure path drivers/spi/spi-cadence-quadspi.c | 35 +++++++++++++------------------ 1 file changed, 14 insertions(+), 21 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-22.03-LTS-SP2 0/3] CVE-2024-26807
by Guo Mengqi 13 May '24

13 May '24

CVE-2024-26807 Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks Vaishnav Achath (2): spi: cadence-quadspi: Handle spi_unregister_master() in remove() spi: cadence-quadspi: Remove spi_master_put() in probe failure path drivers/spi/spi-cadence-quadspi.c | 35 +++++++++++++------------------ 1 file changed, 14 insertions(+), 21 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-1.0-LTS 0/2] major bugfix before 2023
by Liao Chen 13 May '24

13 May '24

irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() Mark Rutland (1): irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling Sergey Shtylyov (1): genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() drivers/irqchip/irq-gic-v3.c | 3 +++ kernel/irq/ipi.c | 8 ++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2024-27017
by Wang Hai 13 May '24

13 May '24

CVE-2024-27017 Pablo Neira Ayuso (2): netfilter: nft_set_pipapo: walk over current view on netlink dump netfilter: nf_tables: missing iterator type in lookup walk include/net/netfilter/nf_tables.h | 13 +++++++++++++ net/netfilter/nf_tables_api.c | 6 ++++++ net/netfilter/nft_lookup.c | 1 + net/netfilter/nft_set_pipapo.c | 6 ++++-- 4 files changed, 24 insertions(+), 2 deletions(-) -- 2.17.1

2 3

[PATCH OLK-5.10 0/3] CVE-2024-26807
by g30012805 13 May '24

13 May '24

CVE-2024-26807 Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks Vaishnav Achath (2): spi: cadence-quadspi: Handle spi_unregister_master() in remove() spi: cadence-quadspi: Remove spi_master_put() in probe failure path drivers/spi/spi-cadence-quadspi.c | 35 +++++++++++++------------------ 1 file changed, 14 insertions(+), 21 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-22.03-LTS-SP2 0/3] CVE-2024-26807
by Guo Mengqi 13 May '24

13 May '24

CVE-2024-26807 Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks Vaishnav Achath (2): spi: cadence-quadspi: Handle spi_unregister_master() in remove() spi: cadence-quadspi: Remove spi_master_put() in probe failure path drivers/spi/spi-cadence-quadspi.c | 35 +++++++++++++------------------ 1 file changed, 14 insertions(+), 21 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-22.03-LTS-SP2] net: ip_tunnel: prevent perpetual headroom growth
by Guo Mengqi 13 May '24

13 May '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.212 commit 2e95350fe9db9d53c701075060ac8ac883b68aee category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f ] syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read of size 1 at addr ffff88812fb4000e by task syz-executor183/5191 [..] kasan_report+0xda/0x110 mm/kasan/report.c:588 __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline] ___skb_get_hash net/core/flow_dissector.c:1791 [inline] __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856 skb_get_hash include/linux/skbuff.h:1556 [inline] ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748 ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592 ... ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 .. iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831 ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 ... The splat occurs because skb->data points past skb->head allocated area. This is because neigh layer does: __skb_pull(skb, skb_network_offset(skb)); ... but skb_network_offset() returns a negative offset and __skb_pull() arg is unsigned. IOW, we skb->data gets "adjusted" by a huge value. The negative value is returned because skb->head and skb->data distance is more than 64k and skb->network_header (u16) has wrapped around. The bug is in the ip_tunnel infrastructure, which can cause dev->needed_headroom to increment ad infinitum. The syzkaller reproducer consists of packets getting routed via a gre tunnel, and route of gre encapsulated packets pointing at another (ipip) tunnel. The ipip encapsulation finds gre0 as next output device. This results in the following pattern: 1). First packet is to be sent out via gre0. Route lookup found an output device, ipip0. 2). ip_tunnel_xmit for gre0 bumps gre0->needed_headroom based on the future output device, rt.dev->needed_headroom (ipip0). 3). ip output / start_xmit moves skb on to ipip0. which runs the same code path again (xmit recursion). 4). Routing step for the post-gre0-encap packet finds gre0 as output device to use for ipip0 encapsulated packet. tunl0->needed_headroom is then incremented based on the (already bumped) gre0 device headroom. This repeats for every future packet: gre0->needed_headroom gets inflated because previous packets' ipip0 step incremented rt->dev (gre0) headroom, and ipip0 incremented because gre0 needed_headroom was increased. For each subsequent packet, gre/ipip0->needed_headroom grows until post-expand-head reallocations result in a skb->head/data distance of more than 64k. Once that happens, skb->network_header (u16) wraps around when pskb_expand_head tries to make sure that skb_network_offset() is unchanged after the headroom expansion/reallocation. After this skb_network_offset(skb) returns a different (and negative) result post headroom expansion. The next trip to neigh layer (or anything else that would __skb_pull the network header) makes skb->data point to a memory location outside skb->head area. v2: Cap the needed_headroom update to an arbitarily chosen upperlimit to prevent perpetual increase instead of dropping the headroom increment completely. Reported-and-tested-by: syzbot+bfde3bef047a81b8fde6(a)syzkaller.appspotmail.com Closes: https://groups.google.com/g/syzkaller-bugs/c/fL9G6GtWskY/m/VKk_PR5FBAAJ Fixes: 243aad830e8a ("ip_gre: include route header_len in max_headroom calculation") Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240220135606.4939-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv4/ip_tunnel.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c index 99f70b990eb1..50f8231e9dae 100644 --- a/net/ipv4/ip_tunnel.c +++ b/net/ipv4/ip_tunnel.c @@ -540,6 +540,20 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, return 0; } +static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +{ + /* we must cap headroom to some upperlimit, else pskb_expand_head + * will overflow header offsets in skb_headers_offset_update(). + */ + static const unsigned int max_allowed = 512; + + if (headroom > max_allowed) + headroom = max_allowed; + + if (headroom > READ_ONCE(dev->needed_headroom)) + WRITE_ONCE(dev->needed_headroom, headroom); +} + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto, int tunnel_hlen) { @@ -613,13 +627,13 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, } headroom += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len; - if (headroom > READ_ONCE(dev->needed_headroom)) - WRITE_ONCE(dev->needed_headroom, headroom); - - if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + if (skb_cow_head(skb, headroom)) { ip_rt_put(rt); goto tx_dropped; } + + ip_tunnel_adj_headroom(dev, headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, proto, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; @@ -797,16 +811,16 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr) + rt->dst.header_len + ip_encap_hlen(&tunnel->encap); - if (max_headroom > READ_ONCE(dev->needed_headroom)) - WRITE_ONCE(dev->needed_headroom, max_headroom); - if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + if (skb_cow_head(skb, max_headroom)) { ip_rt_put(rt); dev->stats.tx_dropped++; kfree_skb(skb); return; } + ip_tunnel_adj_headroom(dev, max_headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, protocol, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/3] CVE-2024-26807
by Guo Mengqi 13 May '24

13 May '24

CVE-2024-26807 Cristian Marussi (1): firmware: arm_scmi: Harden accesses to the reset domains Florian Westphal (1): net: ip_tunnel: prevent perpetual headroom growth Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks drivers/firmware/arm_scmi/reset.c | 6 +++++- drivers/spi/spi-cadence-quadspi.c | 6 ++---- net/ipv4/ip_tunnel.c | 28 +++++++++++++++++++++------- 3 files changed, 28 insertions(+), 12 deletions(-) -- 2.17.1

2 4

[PATCH OLK-5.10 0/3] CVE-2024-26807
by g30012805 13 May '24

13 May '24

CVE-2024-26807 Cristian Marussi (1): firmware: arm_scmi: Harden accesses to the reset domains Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks Toke Høiland-Jørgensen (1): bpf: Fix stackmap overflow check on 32-bit arches drivers/firmware/arm_scmi/reset.c | 6 +++++- drivers/spi/spi-cadence-quadspi.c | 6 ++---- kernel/bpf/stackmap.c | 9 ++++++--- 3 files changed, 13 insertions(+), 8 deletions(-) -- 2.17.1

2 4

[PATCH OLK-6.6] sched/eevdf: Revert "Skip eligibility check for current entity during wakeup preemption"
by Zhang Qiao 13 May '24

13 May '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I9EHKI CVE: NA -------------------------------- This reverts commit 0d46b757739655ce3f324fd25e67b667b928eb67. Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/fair.c | 24 ++++-------------------- kernel/sched/features.h | 1 - 2 files changed, 4 insertions(+), 21 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8de28b182763..c19ba84af8e4 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -1038,7 +1038,7 @@ struct sched_entity *__pick_first_entity(struct cfs_rq *cfs_rq) * * Which allows tree pruning through eligibility. */ -static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq, bool wakeup_preempt) +static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq) { struct rb_node *node = cfs_rq->tasks_timeline.rb_root.rb_node; struct sched_entity *se = __pick_first_entity(cfs_rq); @@ -1052,23 +1052,7 @@ static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq, bool wakeup_preemp if (cfs_rq->nr_running == 1) return curr && curr->on_rq ? curr : se; - if (curr && !curr->on_rq) - curr = NULL; - - /* - * When an entity with positive lag wakes up, it pushes the - * avg_vruntime of the runqueue backwards. This may causes the - * current entity to be ineligible soon into its run leading to - * wakeup preemption. - * - * To prevent such aggressive preemption of the current running - * entity during task wakeups, skip the eligibility check if the - * slice promised to the entity since its selection has not yet - * elapsed. - */ - if (curr && - !(sched_feat(RUN_TO_PARITY_WAKEUP) && wakeup_preempt && curr->vlag == curr->deadline) && - !entity_eligible(cfs_rq, curr)) + if (curr && (!curr->on_rq || !entity_eligible(cfs_rq, curr))) curr = NULL; /* @@ -5598,7 +5582,7 @@ pick_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *curr) cfs_rq->next && entity_eligible(cfs_rq, cfs_rq->next)) return cfs_rq->next; - return pick_eevdf(cfs_rq, false); + return pick_eevdf(cfs_rq); } static bool check_cfs_rq_runtime(struct cfs_rq *cfs_rq); @@ -9267,7 +9251,7 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ /* * XXX pick_eevdf(cfs_rq) != se ? */ - if (pick_eevdf(cfs_rq, true) == pse) + if (pick_eevdf(cfs_rq) == pse) goto preempt; return; diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 26b1a03bd3d2..e4789d09f58e 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -7,7 +7,6 @@ SCHED_FEAT(PLACE_LAG, true) SCHED_FEAT(PLACE_DEADLINE_INITIAL, true) SCHED_FEAT(RUN_TO_PARITY, true) -SCHED_FEAT(RUN_TO_PARITY_WAKEUP, true) /* * Prefer to schedule the task we woke last (assuming it failed -- 2.18.0.huawei.25

1 0

[PATCH v2 OLK-5.10] cpufreq/cppc: fix perf_to_khz/khz_to_perf conversion
by liwei 13 May '24

13 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I99VPY CVE: NA -------------------------------- When the nominal_freq recorded by the kernel is equal to the lowest_freq, and the frequency adjustment operation is triggered externally, there is a logic error in cppc_perf_to_khz()/cppc_khz_to_perf(), resulting in perf and khz conversion errors. Fix this by adding the branch processing logic when nominal_freq is equal to lowest_freq. Fixes: ec1c7ad47664 ("cpufreq: CPPC: Fix performance/frequency conversion") Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/cpufreq/cppc_cpufreq.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c index 156ef2c40464..5ceededf514c 100644 --- a/drivers/cpufreq/cppc_cpufreq.c +++ b/drivers/cpufreq/cppc_cpufreq.c @@ -98,7 +98,7 @@ static u64 cppc_get_dmi_max_khz(void) * use them to convert perf to freq and vice versa. The conversion is * extrapolated as an affine function passing by the 2 points: * - (Low perf, Low freq) - * - (Nominal perf, Nominal perf) + * - (Nominal perf, Nominal freq) */ static unsigned int cppc_cpufreq_perf_to_khz(struct cppc_cpudata *cpu_data, unsigned int perf) @@ -109,8 +109,14 @@ static unsigned int cppc_cpufreq_perf_to_khz(struct cppc_cpudata *cpu_data, u64 mul, div; if (caps->lowest_freq && caps->nominal_freq) { - mul = caps->nominal_freq - caps->lowest_freq; - div = caps->nominal_perf - caps->lowest_perf; + /* Avoid the special case when nominal_freq is equal to lowest_freq */ + if (caps->nominal_freq == caps->lowest_freq) { + mul = caps->nominal_freq; + div = caps->nominal_perf; + } else { + mul = caps->nominal_freq - caps->lowest_freq; + div = caps->nominal_perf - caps->lowest_perf; + } offset = caps->nominal_freq - div64_u64(caps->nominal_perf * mul, div); } else { if (!max_khz) @@ -134,8 +140,14 @@ static unsigned int cppc_cpufreq_khz_to_perf(struct cppc_cpudata *cpu_data, u64 mul, div; if (caps->lowest_freq && caps->nominal_freq) { - mul = caps->nominal_perf - caps->lowest_perf; - div = caps->nominal_freq - caps->lowest_freq; + /* Avoid special case when nominal_freq is equal to lowest_freq */ + if (caps->nominal_freq == caps->lowest_freq) { + mul = caps->nominal_perf; + div = caps->nominal_freq; + } else { + mul = caps->nominal_perf - caps->lowest_perf; + div = caps->nominal_freq - caps->lowest_freq; + } offset = caps->nominal_perf - div64_u64(caps->nominal_freq * mul, div); } else { if (!max_khz) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 5421/22422] drivers/infiniband/ulp/iser/iser_initiator.o: warning: objtool: missing symbol for section .text
by kernel test robot 13 May '24

13 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a54e5de9c3b87415db1fe656918e1c6d50706b5f commit: 71e217e85c3dff8a9151707ed3afc7b4b054a2d4 [5421/22422] selinux: use kernel linux/socket.h for genheaders and mdp config: x86_64-buildonly-randconfig-006-20240513 (https://download.01.org/0day-ci/archive/20240513/202405131614.cwAhXvTF-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240513/202405131614.cwAhXvTF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405131614.cwAhXvTF-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/infiniband/ulp/iser/iser_initiator.c: In function 'iser_alloc_rx_descriptors': drivers/infiniband/ulp/iser/iser_initiator.c:277:25: warning: taking address of packed member of 'struct iser_rx_desc' may result in an unaligned pointer value [-Waddress-of-packed-member] 277 | rx_sg = &rx_desc->rx_sg; | ^~~~~~~~~~~~~~~ drivers/infiniband/ulp/iser/iser_initiator.c: In function 'iser_task_rsp': drivers/infiniband/ulp/iser/iser_initiator.c:661:15: warning: taking address of packed member of 'struct iser_rx_desc' may result in an unaligned pointer value [-Waddress-of-packed-member] 661 | hdr = &desc->iscsi_header; | ^~~~~~~~~~~~~~~~~~~ drivers/infiniband/ulp/iser/iser_initiator.c:364: warning: Function parameter or member 'conn' not described in 'iser_send_command' drivers/infiniband/ulp/iser/iser_initiator.c:364: warning: Function parameter or member 'task' not described in 'iser_send_command' drivers/infiniband/ulp/iser/iser_initiator.c:436: warning: Function parameter or member 'conn' not described in 'iser_send_data_out' drivers/infiniband/ulp/iser/iser_initiator.c:436: warning: Function parameter or member 'task' not described in 'iser_send_data_out' drivers/infiniband/ulp/iser/iser_initiator.c:436: warning: Function parameter or member 'hdr' not described in 'iser_send_data_out' >> drivers/infiniband/ulp/iser/iser_initiator.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] sched/eevdf: Revert "Skip eligibility check for current entity during wakeup preemption"
by Zhang Qiao 13 May '24

13 May '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I9EHKI CVE: NA This reverts commit 0d46b757739655ce3f324fd25e67b667b928eb67. Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/fair.c | 24 ++++-------------------- kernel/sched/features.h | 1 - 2 files changed, 4 insertions(+), 21 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8de28b182763..c19ba84af8e4 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -1038,7 +1038,7 @@ struct sched_entity *__pick_first_entity(struct cfs_rq *cfs_rq) * * Which allows tree pruning through eligibility. */ -static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq, bool wakeup_preempt) +static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq) { struct rb_node *node = cfs_rq->tasks_timeline.rb_root.rb_node; struct sched_entity *se = __pick_first_entity(cfs_rq); @@ -1052,23 +1052,7 @@ static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq, bool wakeup_preemp if (cfs_rq->nr_running == 1) return curr && curr->on_rq ? curr : se; - if (curr && !curr->on_rq) - curr = NULL; - - /* - * When an entity with positive lag wakes up, it pushes the - * avg_vruntime of the runqueue backwards. This may causes the - * current entity to be ineligible soon into its run leading to - * wakeup preemption. - * - * To prevent such aggressive preemption of the current running - * entity during task wakeups, skip the eligibility check if the - * slice promised to the entity since its selection has not yet - * elapsed. - */ - if (curr && - !(sched_feat(RUN_TO_PARITY_WAKEUP) && wakeup_preempt && curr->vlag == curr->deadline) && - !entity_eligible(cfs_rq, curr)) + if (curr && (!curr->on_rq || !entity_eligible(cfs_rq, curr))) curr = NULL; /* @@ -5598,7 +5582,7 @@ pick_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *curr) cfs_rq->next && entity_eligible(cfs_rq, cfs_rq->next)) return cfs_rq->next; - return pick_eevdf(cfs_rq, false); + return pick_eevdf(cfs_rq); } static bool check_cfs_rq_runtime(struct cfs_rq *cfs_rq); @@ -9267,7 +9251,7 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ /* * XXX pick_eevdf(cfs_rq) != se ? */ - if (pick_eevdf(cfs_rq, true) == pse) + if (pick_eevdf(cfs_rq) == pse) goto preempt; return; diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 26b1a03bd3d2..e4789d09f58e 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -7,7 +7,6 @@ SCHED_FEAT(PLACE_LAG, true) SCHED_FEAT(PLACE_DEADLINE_INITIAL, true) SCHED_FEAT(RUN_TO_PARITY, true) -SCHED_FEAT(RUN_TO_PARITY_WAKEUP, true) /* * Prefer to schedule the task we woke last (assuming it failed -- 2.18.0.huawei.25

1 0

[PATCH OLK-5.10] cpufreq/cppc: fix perf_to_khz/khz_to_perf conversion
by liwei 13 May '24

13 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I99VPY CVE: NA -------------------------------- When the nominal_freq recorded by the kernel is equal to the lowest_freq, and the frequency adjustment operation is triggered externally, there is a logic error in cppc_perf_to_khz()/cppc_khz_to_perf(), resulting in perf and khz conversion errors. Fix this by adding the branch processing logic when nominal_freq is equal to lowest_freq. Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/cpufreq/cppc_cpufreq.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c index 156ef2c40464..5ceededf514c 100644 --- a/drivers/cpufreq/cppc_cpufreq.c +++ b/drivers/cpufreq/cppc_cpufreq.c @@ -98,7 +98,7 @@ static u64 cppc_get_dmi_max_khz(void) * use them to convert perf to freq and vice versa. The conversion is * extrapolated as an affine function passing by the 2 points: * - (Low perf, Low freq) - * - (Nominal perf, Nominal perf) + * - (Nominal perf, Nominal freq) */ static unsigned int cppc_cpufreq_perf_to_khz(struct cppc_cpudata *cpu_data, unsigned int perf) @@ -109,8 +109,14 @@ static unsigned int cppc_cpufreq_perf_to_khz(struct cppc_cpudata *cpu_data, u64 mul, div; if (caps->lowest_freq && caps->nominal_freq) { - mul = caps->nominal_freq - caps->lowest_freq; - div = caps->nominal_perf - caps->lowest_perf; + /* Avoid the special case when nominal_freq is equal to lowest_freq */ + if (caps->nominal_freq == caps->lowest_freq) { + mul = caps->nominal_freq; + div = caps->nominal_perf; + } else { + mul = caps->nominal_freq - caps->lowest_freq; + div = caps->nominal_perf - caps->lowest_perf; + } offset = caps->nominal_freq - div64_u64(caps->nominal_perf * mul, div); } else { if (!max_khz) @@ -134,8 +140,14 @@ static unsigned int cppc_cpufreq_khz_to_perf(struct cppc_cpudata *cpu_data, u64 mul, div; if (caps->lowest_freq && caps->nominal_freq) { - mul = caps->nominal_perf - caps->lowest_perf; - div = caps->nominal_freq - caps->lowest_freq; + /* Avoid special case when nominal_freq is equal to lowest_freq */ + if (caps->nominal_freq == caps->lowest_freq) { + mul = caps->nominal_perf; + div = caps->nominal_freq; + } else { + mul = caps->nominal_perf - caps->lowest_perf; + div = caps->nominal_freq - caps->lowest_freq; + } offset = caps->nominal_perf - div64_u64(caps->nominal_freq * mul, div); } else { if (!max_khz) -- 2.25.1

2 1

[PATCH OLK-6.6 v2] sched: programmable: Allow set tag for pid 1.
by Hui Tang 13 May '24

13 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NQM5 CVE: NA -------------------------------- There is no reason to prevent user from setting tag for pid 1, which should be up to the user to decide it. So removing the check for pid 1. Fixes: 34239429b125 ("sched: programmable: Add user interface of task tag") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- v1 -> v2 - Add commit message --- fs/proc/base.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 78f41a207767..d6d3b9f55f46 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3773,11 +3773,6 @@ static ssize_t pid_tag_write(struct file *file, const char __user *buf, if (!tsk) return -ESRCH; - if (unlikely(tsk->pid == 1)) { - err = -EPERM; - goto out; - } - err = kstrtol_from_user(buf, count, 0, &tag); if (err) goto out; -- 2.34.1

2 1

[PATCH OLK-5.10] mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations
by Cai Xinchen 13 May '24

13 May '24

From: Roman Gushchin <roman.gushchin(a)linux.dev> mainline inclusion from mainline-v6.0-rc1 commit d6e103a757fa7876e7ded76128d5dffe12402ab9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9ORR4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Yafang Shao reported an issue related to the accounting of bpf memory: if a bpf map is charged indirectly for memory consumed from an interrupt context and allocations are enforced, MEMCG_MAX events are not raised. It's not/less of an issue in a generic case because consequent allocations from a process context will trigger the direct reclaim and MEMCG_MAX events will be raised. However a bpf map can belong to a dying/abandoned memory cgroup, so there will be no allocations from a process context and no MEMCG_MAX events will be triggered. Link: https://lkml.kernel.org/r/20220702033521.64630-1-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin <roman.gushchin(a)linux.dev> Reported-by: Yafang Shao <laoar.shao(a)gmail.com> Acked-by: Shakeel Butt <shakeelb(a)google.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Muchun Song <songmuchun(a)bytedance.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/memcontrol.c [There are context conflicts bacause commit c5c8b16b596e1("mm: memcontrol: fix root_mem_cgroup charging") is not merged. And we merge commit 789303aecf270("mm: vmpressure: don't count proactive reclaim in vmpressure")] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- mm/memcontrol.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index db44ade93455..88656ed2ad5c 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2674,6 +2674,7 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask, bool passed_oom = false; unsigned int reclaim_options = MEMCG_RECLAIM_MAY_SWAP; bool drained = false; + bool raised_max_event = false; unsigned long pflags; if (mem_cgroup_is_root(memcg)) @@ -2724,6 +2725,7 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask, goto nomem; memcg_memory_event(mem_over_limit, MEMCG_MAX); + raised_max_event = true; #ifdef CONFIG_PSI_FINE_GRAINED pflags = PSI_MEMCG_RECLAIM; #endif @@ -2787,6 +2789,13 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask, if (!(gfp_mask & __GFP_NOFAIL)) return -ENOMEM; force: + /* + * If the allocation has to be enforced, don't forget to raise + * a MEMCG_MAX event. + */ + if (!raised_max_event) + memcg_memory_event(mem_over_limit, MEMCG_MAX); + /* * The allocation either can't fail or will lead to more memory * being freed very soon. Allow memory usage go over the limit -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] NTB: fix possible name leak in ntb_register_device()
by Zeng Heng 13 May '24

13 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IV CVE: CVE-2023-52652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweiclou… [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/ntb/core.c drivers/pci/endpoint/functions/pci-epf-vntb.c [The version does not include the pci-epf-vntb.c source file, and ntb_register_device() function is located in drivers/ntb/ntb.c.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/ntb/ntb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/ntb/ntb.c b/drivers/ntb/ntb.c index 2581ab724c34..3305a2fbea4e 100644 --- a/drivers/ntb/ntb.c +++ b/drivers/ntb/ntb.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); -- 2.25.1

2 1

[PATCH OLK-6.6 v2 0/3] erofs: fix WARNING in ida_free
by Baokun Li 13 May '24

13 May '24

V1->V2: Delete a patch that has been merged in. Baokun Li (1): erofs: get rid of erofs_fs_context Christian Brauner (1): erofs: reliably distinguish block based and fscache mode Gao Xiang (1): erofs: drop experimental warning for FSDAX fs/erofs/internal.h | 7 --- fs/erofs/super.c | 125 +++++++++++++++++++------------------------- 2 files changed, 55 insertions(+), 77 deletions(-) -- 2.31.1

2 4

[openeuler:OLK-6.6 9545/9601] include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 12 May '24

12 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 15bef328224e70041aba4aaa6b23977efba191a9 commit: d9ed39df777afd38fcbd4f4ca670cceb2f168124 [9545/9601] entry: Move exit to usermode functions to header file config: loongarch-randconfig-r111-20240512 (https://download.01.org/0day-ci/archive/20240512/202405122055.cg12BYVn-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240512/202405122055.cg12BYVn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405122055.cg12BYVn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c: note: in included file: >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * vim +285 include/linux/entry-common.h 264 265 /** 266 * exit_to_user_mode_loop - do any pending work before leaving to user space 267 */ 268 unsigned long exit_to_user_mode_loop(struct pt_regs *regs, 269 unsigned long ti_work); 270 271 /** 272 * exit_to_user_mode_prepare - call exit_to_user_mode_loop() if required 273 * @regs: Pointer to pt_regs on entry stack 274 * 275 * 1) check that interrupts are disabled 276 * 2) call tick_nohz_user_enter_prepare() 277 * 3) call exit_to_user_mode_loop() if any flags from 278 * EXIT_TO_USER_MODE_WORK are set 279 * 4) check that interrupts are still disabled 280 */ 281 static __always_inline void exit_to_user_mode_prepare(struct pt_regs *regs) 282 { 283 unsigned long ti_work; 284 > 285 lockdep_assert_irqs_disabled(); 286 287 /* Flush pending rcuog wakeup before the last need_resched() check */ 288 tick_nohz_user_enter_prepare(); 289 290 ti_work = read_thread_flags(); 291 if (unlikely(ti_work & EXIT_TO_USER_MODE_WORK)) 292 ti_work = exit_to_user_mode_loop(regs, ti_work); 293 294 arch_exit_to_user_mode_prepare(regs, ti_work); 295 296 /* Ensure that kernel state is sane for a return to userspace */ 297 kmap_assert_nomap(); 298 lockdep_assert_irqs_disabled(); 299 lockdep_sys_exit(); 300 } 301 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 22374/22416] drivers/gpu/drm/nouveau/nvkm/core/object.c:37:19: warning: mixing declarations and code is a C99 extension
by kernel test robot 12 May '24

12 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8d055501b2f0dc4e29197de45eabdd21f73fa507 commit: 901dbb48d8a4f60af427f1ec67ac1247ff219f39 [22374/22416] nouveau: lock the client object tree. config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240512/202405121008.xQ4qtfYQ-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240512/202405121008.xQ4qtfYQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405121008.xQ4qtfYQ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/gpu/drm/nouveau/nvkm/core/object.c:37:19: warning: mixing declarations and code is a C99 extension [-Wdeclaration-after-statement] 37 | struct rb_node *node = client->objroot.rb_node; | ^ 1 warning generated. vim +37 drivers/gpu/drm/nouveau/nvkm/core/object.c 9274f4a9ba7e70 drivers/gpu/drm/nouveau/core/core/object.c Ben Skeggs 2012-07-06 27 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 28 struct nvkm_object * 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 29 nvkm_object_search(struct nvkm_client *client, u64 handle, 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 30 const struct nvkm_object_func *func) 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 31 { 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 32 struct nvkm_object *object; 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 33 unsigned long flags; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 34 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 35 if (handle) { 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 36 spin_lock_irqsave(&client->obj_lock, flags); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 @37 struct rb_node *node = client->objroot.rb_node; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 38 while (node) { 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 39 object = rb_entry(node, typeof(*object), node); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 40 if (handle < object->object) 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 41 node = node->rb_left; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 42 else 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 43 if (handle > object->object) 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 44 node = node->rb_right; 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 45 else { 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 46 spin_unlock_irqrestore(&client->obj_lock, flags); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 47 goto done; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 48 } 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 49 } 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 50 spin_unlock_irqrestore(&client->obj_lock, flags); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 51 return ERR_PTR(-ENOENT); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 52 } else { 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 53 object = &client->object; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 54 } 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 55 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 56 done: 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 57 if (unlikely(func && object->func != func)) 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 58 return ERR_PTR(-EINVAL); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 59 return object; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 60 } 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 61 :::::: The code at line 37 was first introduced by commit :::::: 110cccff955313c66dccd2817f62368f106d9bf2 drm/nouveau/core/object: support lookup of specific object types :::::: TO: Ben Skeggs <bskeggs(a)redhat.com> :::::: CC: Ben Skeggs <bskeggs(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS WITH WARNING 8d055501b2f0dc4e29197de45eabdd21f73fa507
by kernel test robot 12 May '24

12 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 8d055501b2f0dc4e29197de45eabdd21f73fa507 !7158 v2 Squashfs: check the inode number is not the invalid value of zero Warning reports: https://lore.kernel.org/oe-kbuild-all/202405120429.wVDB0LUK-lkp@intel.com Warning: (recently discovered and may have been fixed) drivers/gpu/drm/nouveau/nvkm/core/object.c:37:17: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement] Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-001-20240512 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-004-20240512 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-buildonly-randconfig-004-20240512 | |-- fs-proc-array.c:warning:gtime-may-be-used-uninitialized-in-this-function | |-- fs-proc-array.c:warning:maj_flt-may-be-used-uninitialized-in-this-function | `-- fs-proc-array.c:warning:min_flt-may-be-used-uninitialized-in-this-function |-- x86_64-buildonly-randconfig-006-20240512 | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-defconfig | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-002-20240512 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int |-- x86_64-randconfig-006-20240512 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int |-- x86_64-randconfig-011-20240512 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-072-20240512 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int `-- x86_64-randconfig-073-20240512 |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-buildonly-randconfig-003-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-003-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-013-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-015-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-016-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-071-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-074-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-075-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-076-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-102-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-103-20240512 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) `-- x86_64-rhel-8.3-rust `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) elapsed time: 726m configs tested: 35 configs skipped: 148 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240512 gcc arm64 randconfig-002-20240512 gcc arm64 randconfig-003-20240512 gcc arm64 randconfig-004-20240512 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240512 clang x86_64 buildonly-randconfig-002-20240512 clang x86_64 buildonly-randconfig-003-20240512 clang x86_64 buildonly-randconfig-004-20240512 gcc x86_64 buildonly-randconfig-005-20240512 clang x86_64 buildonly-randconfig-006-20240512 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240512 gcc x86_64 randconfig-002-20240512 gcc x86_64 randconfig-003-20240512 clang x86_64 randconfig-004-20240512 gcc x86_64 randconfig-005-20240512 gcc x86_64 randconfig-006-20240512 gcc x86_64 randconfig-011-20240512 gcc x86_64 randconfig-012-20240512 gcc x86_64 randconfig-013-20240512 clang x86_64 randconfig-014-20240512 gcc x86_64 randconfig-015-20240512 clang x86_64 randconfig-016-20240512 clang x86_64 randconfig-071-20240512 clang x86_64 randconfig-072-20240512 gcc x86_64 randconfig-073-20240512 gcc x86_64 randconfig-074-20240512 clang x86_64 randconfig-075-20240512 clang x86_64 randconfig-076-20240512 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 15bef328224e70041aba4aaa6b23977efba191a9
by kernel test robot 12 May '24

12 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 15bef328224e70041aba4aaa6b23977efba191a9 !7198 v2 mm: prepare more high-order pages on pcplist Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405120422.ZROC7rNv-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) arch/arm64/kvm/vgic/vgic-mmio.c:266:38: warning: variable 'is_pending' set but not used [-Wunused-but-set-variable] Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allnoconfig | `-- arch-arm64-kernel-cpufeature.c:error:enable_pseudo_nmi-undeclared-(first-use-in-this-function) |-- arm64-defconfig | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used `-- arm64-randconfig-r052-20240512 `-- shadow.c:(.text):undefined-reference-to-__memcpy_mc clang_recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_before_active_check | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_destroy | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_init_slave | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_netdev_event | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_service_proc | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_tracker_get | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_deatch_bond | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_detach_nic_bond_work | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev_by_name | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_queue_bond_work | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq_destroy.c:warning:no-previous-prototype-for-function-roce3_cq_hw2sw | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_cleanup_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_init_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_alloc | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_disable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_enable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_res.c:warning:no-previous-prototype-for-function-hmm_rdma_mpt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_alloc_mr | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_free_tpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_umem_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_context_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_ext_ctx_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_dif_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_verbs_cmd.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-mr-roce_mr.c:warning:no-previous-prototype-for-function-roce3_check_mr_status | |-- drivers-infiniband-hw-hiroce3-rdma-rdma_comp.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_bond_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_link_event | |-- drivers-infiniband-hw-hiroce3-roce_sysfs.c:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_io_flush.c:warning:no-previous-prototype-for-function-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_error.c:warning:no-previous-prototype-for-function-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_shutdown.c:warning:no-previous-prototype-for-function-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-bat_table-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_fill_cla | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_numb-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_type-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_fill_cla()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_lock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_unlock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_xyz()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-free_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-malloc_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-bloomfilter_init_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-k_flag-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-op-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-bloomfilter_init_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_dec()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_inc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd_buf-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box_async()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_imm()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_record-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-direct_wqe-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-object-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-pagenum-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_get_db_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_direct_wqe_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_fc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_update_pri()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_software_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_get_hardware_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-data-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-event-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_capability_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_template-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_aeq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_capability_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ecq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nocq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_scq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_register()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_unregister()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-bh-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-common-not-described-in-cqm_object_share_recv_queue_add_container | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_number-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_gid_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_timer_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-function_id-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-global_funcid-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_base-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_number-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-init_rq_num-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_funcid | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_old | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-room_header_alloc-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-xid-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_hash_buf_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_timer_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_gid_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_fc_srq_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_funcid()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_alloc_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_old()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_add_container()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_timer_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_free_srq_bitmap_index | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-common-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-container_addr-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link_mode-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_container_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_used_rq_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_head_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_tail_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-tail-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_per_buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_linkwqe_fill()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_bitmap_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_container_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_used_rq_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hw_cfg.c:warning:expecting-prototype-for-hinic_set_vf_dev_cap().-Prototype-was-for-hinic3_init_vf_dev_cap()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_get | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_hw | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__mbox_to_host | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-comm_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-get_slave_func_netdev_state | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hilink_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_get_master_host_mbox_enable | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_nic_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_register_slave_ppf | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-set_slave_func_nic_state | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-sw_func_ppf_mbox_handler `-- x86_64-allnoconfig |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:linux-version.h-not-needed. |-- drivers-infiniband-hw-hiroce3-roce.h:linux-version.h-not-needed. |-- drivers-net-ethernet-huawei-hinic3-bond-hinic3_bond.c:linux-version.h-not-needed. `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:hinic3_hwif.h-is-included-more-than-once. elapsed time: 724m configs tested: 16 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240512 clang arm64 randconfig-002-20240512 clang arm64 randconfig-003-20240512 clang arm64 randconfig-004-20240512 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240512 gcc loongarch randconfig-002-20240512 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9538/9601] arch/arm64/kvm/vgic/vgic-mmio.c:266:38: warning: variable 'is_pending' set but not used
by kernel test robot 12 May '24

12 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 15bef328224e70041aba4aaa6b23977efba191a9 commit: cb0003ae0500bb69eefa2275722d08bc39a0f157 [9538/9601] irqchip: gicv3: Add workaround for hip09 erratum 162200806 config: arm64-defconfig (https://download.01.org/0day-ci/archive/20240512/202405120422.ZROC7rNv-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240512/202405120422.ZROC7rNv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405120422.ZROC7rNv-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kvm/vgic/vgic-mmio.c: In function '__read_pending': >> arch/arm64/kvm/vgic/vgic-mmio.c:266:38: warning: variable 'is_pending' set but not used [-Wunused-but-set-variable] 266 | bool is_pending; | ^~~~~~~~~~ vim +/is_pending +266 arch/arm64/kvm/vgic/vgic-mmio.c 230 231 #define VIRTUAL_SGI_PENDING_OFFSET 0x3F0 232 static unsigned long __read_pending(struct kvm_vcpu *vcpu, 233 gpa_t addr, unsigned int len, 234 bool is_user) 235 { 236 u32 intid = VGIC_ADDR_TO_INTID(addr, 1); 237 u32 value = 0; 238 int i; 239 struct its_vpe *vpe = &vcpu->arch.vgic_cpu.vgic_v3.its_vpe; 240 241 /* Loop over all IRQs affected by this read */ 242 for (i = 0; i < len * 8; i++) { 243 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i); 244 unsigned long flags; 245 bool val; 246 247 /* 248 * When used from userspace with a GICv3 model: 249 * 250 * Pending state of interrupt is latched in pending_latch 251 * variable. Userspace will save and restore pending state 252 * and line_level separately. 253 * Refer to Documentation/virt/kvm/devices/arm-vgic-v3.rst 254 * for handling of ISPENDR and ICPENDR. 255 */ 256 raw_spin_lock_irqsave(&irq->irq_lock, flags); 257 if (vgic_direct_sgi_or_ppi(irq)) { 258 int err; 259 260 if (irq->hw && vgic_irq_is_sgi(irq->intid) && 261 (kvm_vgic_global_state.flags & 262 FLAGS_WORKAROUND_HIP09_ERRATUM_162200806)) { 263 void *va; 264 u8 *ptr; 265 int mask; > 266 bool is_pending; 267 268 mask = BIT(irq->intid % BITS_PER_BYTE); 269 va = page_address(vpe->vpt_page); 270 ptr = va + VIRTUAL_SGI_PENDING_OFFSET + 271 irq->intid / BITS_PER_BYTE; 272 is_pending = *ptr & mask; 273 } 274 275 val = false; 276 err = irq_get_irqchip_state(irq->host_irq, 277 IRQCHIP_STATE_PENDING, 278 &val); 279 WARN_RATELIMIT(err, "IRQ %d", irq->host_irq); 280 } else if (!is_user && vgic_irq_is_mapped_level(irq)) { 281 val = vgic_get_phys_line_level(irq); 282 } else { 283 switch (vcpu->kvm->arch.vgic.vgic_model) { 284 case KVM_DEV_TYPE_ARM_VGIC_V3: 285 if (is_user) { 286 val = irq->pending_latch; 287 break; 288 } 289 fallthrough; 290 default: 291 val = irq_is_pending(irq); 292 break; 293 } 294 } 295 296 value |= ((u32)val << i); 297 raw_spin_unlock_irqrestore(&irq->irq_lock, flags); 298 299 vgic_put_irq(vcpu->kvm, irq); 300 } 301 302 return value; 303 } 304 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 22374/22416] drivers/gpu/drm/nouveau/nvkm/core/object.c:37:17: warning: ISO C90 forbids mixed declarations and code
by kernel test robot 12 May '24

12 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8d055501b2f0dc4e29197de45eabdd21f73fa507 commit: 901dbb48d8a4f60af427f1ec67ac1247ff219f39 [22374/22416] nouveau: lock the client object tree. config: arm64-defconfig (https://download.01.org/0day-ci/archive/20240512/202405120429.wVDB0LUK-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240512/202405120429.wVDB0LUK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405120429.wVDB0LUK-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/nouveau/nvkm/core/object.c: In function 'nvkm_object_search': >> drivers/gpu/drm/nouveau/nvkm/core/object.c:37:17: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement] 37 | struct rb_node *node = client->objroot.rb_node; | ^~~~~~ In file included from drivers/gpu/drm/nouveau/nvkm/core/object.c:25: drivers/gpu/drm/nouveau/nvkm/core/object.c: In function 'nvkm_object_fini': drivers/gpu/drm/nouveau/include/nvkm/core/client.h:41:28: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 41 | if (_client->debug >= NV_DBG_##l) \ | ^~ drivers/gpu/drm/nouveau/include/nvkm/core/client.h:45:30: note: in expansion of macro 'nvif_printk' 45 | #define nvif_fatal(o,f,a...) nvif_printk((o), FATAL, CRIT, f, ##a) | ^~~~~~~~~~~ drivers/gpu/drm/nouveau/nvkm/core/object.c:226:25: note: in expansion of macro 'nvif_fatal' 226 | nvif_fatal(object, "failed to restart, %d\n", rret); | ^~~~~~~~~~ vim +37 drivers/gpu/drm/nouveau/nvkm/core/object.c 9274f4a9ba7e70 drivers/gpu/drm/nouveau/core/core/object.c Ben Skeggs 2012-07-06 27 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 28 struct nvkm_object * 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 29 nvkm_object_search(struct nvkm_client *client, u64 handle, 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 30 const struct nvkm_object_func *func) 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 31 { 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 32 struct nvkm_object *object; 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 33 unsigned long flags; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 34 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 35 if (handle) { 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 36 spin_lock_irqsave(&client->obj_lock, flags); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 @37 struct rb_node *node = client->objroot.rb_node; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 38 while (node) { 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 39 object = rb_entry(node, typeof(*object), node); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 40 if (handle < object->object) 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 41 node = node->rb_left; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 42 else 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 43 if (handle > object->object) 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 44 node = node->rb_right; 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 45 else { 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 46 spin_unlock_irqrestore(&client->obj_lock, flags); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 47 goto done; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 48 } 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 49 } 901dbb48d8a4f6 drivers/gpu/drm/nouveau/nvkm/core/object.c Dave Airlie 2024-05-09 50 spin_unlock_irqrestore(&client->obj_lock, flags); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 51 return ERR_PTR(-ENOENT); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 52 } else { 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 53 object = &client->object; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 54 } 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 55 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 56 done: 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 57 if (unlikely(func && object->func != func)) 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 58 return ERR_PTR(-EINVAL); 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 59 return object; 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 60 } 110cccff955313 drivers/gpu/drm/nouveau/nvkm/core/object.c Ben Skeggs 2016-12-22 61 :::::: The code at line 37 was first introduced by commit :::::: 110cccff955313c66dccd2817f62368f106d9bf2 drm/nouveau/core/object: support lookup of specific object types :::::: TO: Ben Skeggs <bskeggs(a)redhat.com> :::::: CC: Ben Skeggs <bskeggs(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 0982dad01dc0557bcd40496d87ee9ec5818de858
by kernel test robot 12 May '24

12 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0982dad01dc0557bcd40496d87ee9ec5818de858 !7177 ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-arm-cpu.yaml:properties:capacity-dmips-mhz:ref-should-not-be-valid-under-const:ref | |-- Documentation-devicetree-bindings-arm-cpu.yaml:title:ARM-CPUs-bindings-should-not-be-valid-under-pattern:(-Bb-inding-Ss-chema) | |-- Documentation-devicetree-bindings-arm-cpus.yaml:examples:cpus-arm-pbha-performance-only-bits-arm-pbha-no-aliases-bits-ncpu-device_type-cpu-compatible-arm-cortex-a57-...-n-is-not-of-type-array | `-- Documentation-devicetree-bindings-arm-cpus.yaml:maintainers-is-a-required-property `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst `-- drivers-net-ethernet-mucse-rnpm-rnpm_common.h:linux-version.h-not-needed. elapsed time: 731m configs tested: 35 configs skipped: 133 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240511 gcc arm64 randconfig-002-20240511 clang arm64 randconfig-003-20240511 gcc arm64 randconfig-004-20240511 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240511 gcc x86_64 buildonly-randconfig-002-20240511 gcc x86_64 buildonly-randconfig-003-20240511 gcc x86_64 buildonly-randconfig-004-20240511 gcc x86_64 buildonly-randconfig-005-20240511 clang x86_64 buildonly-randconfig-006-20240511 clang x86_64 defconfig gcc x86_64 randconfig-001-20240511 clang x86_64 randconfig-002-20240511 clang x86_64 randconfig-003-20240511 clang x86_64 randconfig-004-20240511 gcc x86_64 randconfig-005-20240511 gcc x86_64 randconfig-006-20240511 clang x86_64 randconfig-011-20240511 clang x86_64 randconfig-012-20240511 gcc x86_64 randconfig-013-20240511 gcc x86_64 randconfig-014-20240511 gcc x86_64 randconfig-015-20240511 gcc x86_64 randconfig-016-20240511 gcc x86_64 randconfig-071-20240511 gcc x86_64 randconfig-072-20240511 gcc x86_64 randconfig-073-20240511 clang x86_64 randconfig-074-20240511 gcc x86_64 randconfig-075-20240511 gcc x86_64 randconfig-076-20240511 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v2] Backport some memory policy feature and bugfix in mm from mainline
by Ze Zuo 11 May '24

11 May '24

Backport feature(mm/mempolicy: weighted interleave mempolicy and sysfs extension) and some mempolicy bugfix and cleanup. v1 -> v2 - fix conlict in patch [1]. Gregory Price (3): mm/mempolicy: refactor a read-once mechanism into a function for re-use mm/mempolicy: introduce MPOL_WEIGHTED_INTERLEAVE for weighted interleaving mm/mempolicy: protect task interleave functions with tsk->mems_allowed_seq Hugh Dickins (10): mempolicy: fix migrate_pages(2) syscall return nr_failed mempolicy trivia: delete those ancient pr_debug()s mempolicy trivia: slightly more consistent naming mempolicy trivia: use pgoff_t in shared mempolicy tree mempolicy: mpol_shared_policy_init() without pseudo-vma mempolicy: remove confusing MPOL_MF_LAZY dead code kernfs: drop shared NUMA mempolicy hooks mempolicy: alloc_pages_mpol() for NUMA policy without vma mempolicy: mmap_lock is not needed while migrating folios mempolicy: migration attempt to match interleave nodes Rakie Kim (1): mm/mempolicy: implement the sysfs-based weighted_interleave interface .../ABI/testing/sysfs-kernel-mm-mempolicy | 4 + ...fs-kernel-mm-mempolicy-weighted-interleave | 25 + .../admin-guide/mm/numa_memory_policy.rst | 9 + fs/kernfs/file.c | 49 - fs/proc/task_mmu.c | 5 +- include/linux/gfp.h | 10 +- include/linux/hugetlb.h | 9 - include/linux/mempolicy.h | 51 +- include/linux/mm.h | 2 +- include/linux/sched.h | 1 + include/uapi/linux/mempolicy.h | 3 +- ipc/shm.c | 21 +- mm/hugetlb.c | 38 +- mm/mempolicy.c | 1450 +++++++++++------ mm/shmem.c | 95 +- mm/swap.h | 9 +- mm/swap_state.c | 86 +- mm/zswap.c | 7 +- 18 files changed, 1138 insertions(+), 736 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy-weighted-interleave -- 2.33.0

2 28

[PATCH OLK-6.6 v2 0/2] mm: prepare more high-order pages on pcplist
by Liu Shixin 11 May '24

11 May '24

Baolin Wang (1): mm: page_alloc: use the correct THP order for THP PCP Liu Shixin (1): mm: prepare more high-order pages to be stored on the per-cpu lists include/linux/mmzone.h | 4 +++- mm/page_alloc.c | 6 +++--- 2 files changed, 6 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/3] mm: allow more high-order pages stored on PCP lists
by Liu Shixin 11 May '24

11 May '24

The first patch is a bugfix from next branch. The last two patch is feature to allow more high-order pages stored on PCP lists. Baolin Wang (1): mm: page_alloc: use the correct THP order for THP PCP Kefeng Wang (2): mm: prepare more high-order pages to be stored on the per-cpu lists mm: add control to allow specified high-order pages stored on PCP list Documentation/admin-guide/mm/transhuge.rst | 11 +++++ include/linux/gfp.h | 1 + include/linux/huge_mm.h | 1 + include/linux/mmzone.h | 4 +- mm/huge_memory.c | 47 ++++++++++++++++++++++ mm/page_alloc.c | 26 +++++++++--- 6 files changed, 84 insertions(+), 6 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 v3 00/45] Backport folio feature and bugfix
by Liu Shixin 11 May '24

11 May '24

Folio feature: 1. Patch series "Split a folio to any lower order folios", v5. 2. arm64: mm: swap: support THP_SWAP on hardware with MTE 3. Patch series "support multi-size THP numa balancing", v2. 4. Patch series "Swap-out mTHP without splitting", v7. Other improve and bugfix: 1. mm: fix draining remote pageset 2. Patch series "Address some contpte nits". 3. Patch series "mm: page_alloc: fixes for high atomic reserve caluculations", v3. 4. Patch series "Fix I/O high when memory almost met memcg limit", v2. 5. mm, oom:dump_tasks add rss detailed information printing 6. mm: ratelimit stat flush from workingset shrinker 7. mm: madvise: pageout: ignore references rather than clearing young 8. mm: use memalloc_nofs_save() in page_cache_ra_order() 9. mm/vmalloc: fix return value of vb_alloc if size is 0 10. mm: remove struct page from get_shadow_from_swap_cache Baolin Wang (2): mm: factor out the numa mapping rebuilding into a new helper mm: support multi-size THP numa balancing Barry Song (5): mm: madvise: pageout: ignore references rather than clearing young arm64: mm: swap: support THP_SWAP on hardware with MTE madvise:madvise_cold_or_pageout_pte_range(): allow split while folio_estimated_sharers = 0 mm: hold PTL from the first PTE while reclaiming a large folio mm: alloc_anon_folio: avoid doing vma_thp_gfp_mask in fallback cases Charan Teja Kalla (2): mm: page_alloc: correct high atomic reserve calculations mm: page_alloc: enforce minimum zone size to do high atomic reserves David Hildenbrand (1): mm: convert folio_estimated_sharers() to folio_likely_mapped_shared() Hailong.Liu (1): mm/vmalloc: fix return value of vb_alloc if size is 0 Huang Ying (1): mm: fix draining remote pageset Jiexun Wang (1): mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() John Hubbard (1): huge_memory.c: document huge page splitting rules more thoroughly Kefeng Wang (2): mm: use memalloc_nofs_save() in page_cache_ra_order() mm: huge_memory: use more folio api in __split_huge_page_tail() Liu Shixin (2): mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM mm/filemap: don't decrease mmap_miss when folio has workingset flag Matthew Wilcox (Oracle) (4): mm: support order-1 folios in the page cache XArray: set the marks correctly when splitting an entry mm: remove struct page from get_shadow_from_swap_cache mm: remove PageAnonExclusive assertions in unuse_pte() Muhammad Usama Anjum (2): selftests/mm: split_huge_page_test: conform test to TAP format output selftests: mm: fix unused and uninitialized variable warning Ryan Roberts (9): arm64/mm: export contpte symbols only to GPL users arm64/mm: improve comment in contpte_ptep_get_lockless() mm: swap: remove CLUSTER_FLAG_HUGE from swap_cluster_info:flags mm: swap: free_swap_and_cache_nr() as batched free_swap_and_cache() mm: swap: simplify struct percpu_cluster mm: swap: update get_swap_pages() to take folio order mm: swap: allow storage of all mTHP orders mm: vmscan: avoid split during shrink_folio_list() mm: madvise: avoid split during MADV_PAGEOUT and MADV_COLD Sergey Senozhatsky (1): mm/madvise: don't forget to leave lazy MMU mode in madvise_cold_or_pageout_pte_range() Shakeel Butt (1): mm: ratelimit stat flush from workingset shrinker Yong Wang (1): mm, oom:dump_tasks add rss detailed information printing Zi Yan (9): mm/huge_memory: only split PMD mapping when necessary in unmap_folio() mm/memcg: use order instead of nr in split_page_memcg() mm/page_owner: use order instead of nr in split_page_owner() mm: memcg: make memcg huge page split support any order split mm: page_owner: add support for splitting to any order in split page_owner mm: thp: split huge page to any lower order pages mm: huge_memory: enable debugfs to split huge pages to any order mm/huge_memory: check new folio order when split a folio mm/migrate: split source folio if it is on deferred split list arch/arm64/include/asm/pgtable.h | 19 +- arch/arm64/mm/contpte.c | 46 +-- arch/arm64/mm/mteswap.c | 45 +++ fs/proc/etmem_swap.c | 2 +- include/linux/huge_mm.h | 31 +- include/linux/memcontrol.h | 4 +- include/linux/mm.h | 48 ++- include/linux/page_owner.h | 14 +- include/linux/pgtable.h | 61 +++- include/linux/swap.h | 40 ++- lib/test_xarray.c | 14 +- lib/xarray.c | 23 +- mm/damon/paddr.c | 2 +- mm/etmem.c | 2 +- mm/filemap.c | 16 +- mm/huge_memory.c | 206 ++++++++--- mm/internal.h | 93 ++++- mm/madvise.c | 123 ++++--- mm/memcontrol.c | 10 +- mm/memory.c | 100 ++++-- mm/mempolicy.c | 14 +- mm/migrate.c | 31 +- mm/mprotect.c | 3 +- mm/oom_kill.c | 7 +- mm/page_alloc.c | 16 +- mm/page_io.c | 2 +- mm/page_owner.c | 6 +- mm/readahead.c | 15 +- mm/shmem.c | 2 +- mm/swap_slots.c | 8 +- mm/swap_state.c | 8 +- mm/swapfile.c | 331 ++++++++++-------- mm/vmalloc.c | 2 +- mm/vmscan.c | 46 ++- mm/vmstat.c | 4 +- mm/workingset.c | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 22 +- .../selftests/mm/split_huge_page_test.c | 323 ++++++++++++----- 38 files changed, 1207 insertions(+), 534 deletions(-) -- 2.25.1

2 46

[PATCH OLK-6.6 v2 00/45] Backport folio feature and bugfix
by Liu Shixin 11 May '24

11 May '24

Folio feature: 1. Patch series "Split a folio to any lower order folios", v5. 2. arm64: mm: swap: support THP_SWAP on hardware with MTE 3. Patch series "support multi-size THP numa balancing", v2. 4. Patch series "Swap-out mTHP without splitting", v7. Other improve and bugfix: 1. mm: fix draining remote pageset 2. Patch series "Address some contpte nits". 3. Patch series "mm: page_alloc: fixes for high atomic reserve caluculations", v3. 4. Patch series "Fix I/O high when memory almost met memcg limit", v2. 5. mm, oom:dump_tasks add rss detailed information printing 6. mm: ratelimit stat flush from workingset shrinker 7. mm: madvise: pageout: ignore references rather than clearing young 8. mm: use memalloc_nofs_save() in page_cache_ra_order() 9. mm/vmalloc: fix return value of vb_alloc if size is 0 10. mm: remove struct page from get_shadow_from_swap_cache Baolin Wang (2): mm: factor out the numa mapping rebuilding into a new helper mm: support multi-size THP numa balancing Barry Song (5): mm: madvise: pageout: ignore references rather than clearing young arm64: mm: swap: support THP_SWAP on hardware with MTE madvise:madvise_cold_or_pageout_pte_range(): allow split while folio_estimated_sharers = 0 mm: hold PTL from the first PTE while reclaiming a large folio mm: alloc_anon_folio: avoid doing vma_thp_gfp_mask in fallback cases Charan Teja Kalla (2): mm: page_alloc: correct high atomic reserve calculations mm: page_alloc: enforce minimum zone size to do high atomic reserves David Hildenbrand (1): mm: convert folio_estimated_sharers() to folio_likely_mapped_shared() Hailong.Liu (1): mm/vmalloc: fix return value of vb_alloc if size is 0 Huang Ying (1): mm: fix draining remote pageset Jiexun Wang (1): mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() John Hubbard (1): huge_memory.c: document huge page splitting rules more thoroughly Kefeng Wang (2): mm: use memalloc_nofs_save() in page_cache_ra_order() mm: huge_memory: use more folio api in __split_huge_page_tail() Liu Shixin (2): mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM mm/filemap: don't decrease mmap_miss when folio has workingset flag Matthew Wilcox (Oracle) (4): mm: support order-1 folios in the page cache XArray: set the marks correctly when splitting an entry mm: remove struct page from get_shadow_from_swap_cache mm: remove PageAnonExclusive assertions in unuse_pte() Muhammad Usama Anjum (2): selftests/mm: split_huge_page_test: conform test to TAP format output selftests: mm: fix unused and uninitialized variable warning Ryan Roberts (9): arm64/mm: export contpte symbols only to GPL users arm64/mm: improve comment in contpte_ptep_get_lockless() mm: swap: remove CLUSTER_FLAG_HUGE from swap_cluster_info:flags mm: swap: free_swap_and_cache_nr() as batched free_swap_and_cache() mm: swap: simplify struct percpu_cluster mm: swap: update get_swap_pages() to take folio order mm: swap: allow storage of all mTHP orders mm: vmscan: avoid split during shrink_folio_list() mm: madvise: avoid split during MADV_PAGEOUT and MADV_COLD Sergey Senozhatsky (1): mm/madvise: don't forget to leave lazy MMU mode in madvise_cold_or_pageout_pte_range() Shakeel Butt (1): mm: ratelimit stat flush from workingset shrinker Yong Wang (1): mm, oom:dump_tasks add rss detailed information printing Zi Yan (9): mm/huge_memory: only split PMD mapping when necessary in unmap_folio() mm/memcg: use order instead of nr in split_page_memcg() mm/page_owner: use order instead of nr in split_page_owner() mm: memcg: make memcg huge page split support any order split mm: page_owner: add support for splitting to any order in split page_owner mm: thp: split huge page to any lower order pages mm: huge_memory: enable debugfs to split huge pages to any order mm/huge_memory: check new folio order when split a folio mm/migrate: split source folio if it is on deferred split list arch/arm64/include/asm/pgtable.h | 19 +- arch/arm64/mm/contpte.c | 46 +-- arch/arm64/mm/mteswap.c | 45 +++ fs/proc/etmem_swap.c | 2 +- include/linux/huge_mm.h | 31 +- include/linux/memcontrol.h | 4 +- include/linux/mm.h | 48 ++- include/linux/page_owner.h | 14 +- include/linux/pgtable.h | 61 +++- include/linux/swap.h | 40 ++- lib/test_xarray.c | 14 +- lib/xarray.c | 23 +- mm/damon/paddr.c | 2 +- mm/etmem.c | 2 +- mm/filemap.c | 16 +- mm/huge_memory.c | 206 ++++++++--- mm/internal.h | 93 ++++- mm/madvise.c | 123 ++++--- mm/memcontrol.c | 10 +- mm/memory.c | 100 ++++-- mm/mempolicy.c | 14 +- mm/migrate.c | 31 +- mm/mprotect.c | 3 +- mm/oom_kill.c | 7 +- mm/page_alloc.c | 16 +- mm/page_io.c | 2 +- mm/page_owner.c | 6 +- mm/readahead.c | 15 +- mm/shmem.c | 2 +- mm/swap_slots.c | 8 +- mm/swap_state.c | 8 +- mm/swapfile.c | 331 ++++++++++-------- mm/vmalloc.c | 2 +- mm/vmscan.c | 46 ++- mm/vmstat.c | 4 +- mm/workingset.c | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 22 +- .../selftests/mm/split_huge_page_test.c | 323 ++++++++++++----- 38 files changed, 1207 insertions(+), 534 deletions(-) -- 2.25.1

2 46

[PATCH openEuler-1.0-LTS] s390/dasd: fix double module refcount decrement
by Chen Zhongjin 11 May '24

11 May '24

From: Miroslav Franc <mfranc(a)suse.cz> mainline inclusion from mainline-v6.9-rc1 commit c3116e62ddeff79cae342147753ce596f01fcf06 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9NF CVE: CVE-2024-27054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on this error path causes refcount to artificially decrease on each error while it should just stay the same. Fixes: c020d722b110 ("s390/dasd: fix panic during offline processing") Signed-off-by: Miroslav Franc <mfranc(a)suse.cz> Signed-off-by: Jan Höppner <hoeppner(a)linux.ibm.com> Signed-off-by: Stefan Haberland <sth(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240209124522.3697827-3-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/s390/block/dasd.c [fix context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/s390/block/dasd.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c index a23e7d394a0ad..433651225fca6 100644 --- a/drivers/s390/block/dasd.c +++ b/drivers/s390/block/dasd.c @@ -3501,12 +3501,11 @@ int dasd_generic_set_online(struct ccw_device *cdev, dasd_delete_device(device); return -EINVAL; } + device->base_discipline = base_discipline; if (!try_module_get(discipline->owner)) { - module_put(base_discipline->owner); dasd_delete_device(device); return -EINVAL; } - device->base_discipline = base_discipline; device->discipline = discipline; /* check_device will allocate block device if necessary */ @@ -3514,8 +3513,6 @@ int dasd_generic_set_online(struct ccw_device *cdev, if (rc) { pr_warn("%s Setting the DASD online with discipline %s failed with rc=%i\n", dev_name(&cdev->dev), discipline->name, rc); - module_put(discipline->owner); - module_put(base_discipline->owner); dasd_delete_device(device); return rc; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/6] CVE-2024-26921
by Ziyang Xuan 11 May '24

11 May '24

Patchset of CVE-2024-26921. Florian Westphal (1): inet: inet_defrag: prevent sk release while still in use Guillaume Nault (1): inet: frags: re-introduce skb coalescing for local delivery Vasily Averin (2): skbuff: introduce skb_expand_head() skb_expand_head() adjust skb->truesize incorrectly Ziyang Xuan (2): net: Fix KABI break for introducing is_skb_wmem() sk_buff: Fix KABI break for the modification of struct sk_buff include/linux/skbuff.h | 1 + include/net/inet_frag.h | 2 +- include/net/tcp.h | 2 +- include/net/tcp_ext.h | 14 +++ net/core/skbuff.c | 52 +++++++++++ net/ipv4/inet_fragment.c | 109 ++++++++++++++++++------ net/ipv4/ip_fragment.c | 10 ++- net/ipv6/netfilter/nf_conntrack_reasm.c | 4 +- net/ipv6/reassembly.c | 2 +- 9 files changed, 165 insertions(+), 31 deletions(-) create mode 100644 include/net/tcp_ext.h -- 2.25.1

2 7

[PATCH OLK-6.6 00/45] Backport folio feature and bugfix
by Liu Shixin 11 May '24

11 May '24

folio feature: 1. Patch series "Split a folio to any lower order folios", v5. 2. arm64: mm: swap: support THP_SWAP on hardware with MTE 3. Patch series "support multi-size THP numa balancing", v2. 4. Patch series "Swap-out mTHP without splitting", v7. Some bugfix: 1. mm: fix draining remote pageset 2. Patch series "Address some contpte nits". 3. Patch series "mm: page_alloc: fixes for high atomic reserve caluculations", v3. 4. Patch series "Fix I/O high when memory almost met memcg limit", v2. 5. mm, oom:dump_tasks add rss detailed information printing 6. mm: ratelimit stat flush from workingset shrinker 7. mm: madvise: pageout: ignore references rather than clearing young 8. mm: use memalloc_nofs_save() in page_cache_ra_order() 9. mm/vmalloc: fix return value of vb_alloc if size is 0 10. mm: remove struct page from get_shadow_from_swap_cache Baolin Wang (2): [Backport] mm: factor out the numa mapping rebuilding into a new helper [Backport] mm: support multi-size THP numa balancing Barry Song (5): [Backport] mm: madvise: pageout: ignore references rather than clearing young [Backport] arm64: mm: swap: support THP_SWAP on hardware with MTE [Backport] madvise:madvise_cold_or_pageout_pte_range(): allow split while folio_estimated_sharers = 0 [Backport] mm: hold PTL from the first PTE while reclaiming a large folio [Backport] mm: alloc_anon_folio: avoid doing vma_thp_gfp_mask in fallback cases Charan Teja Kalla (2): [Backport] mm: page_alloc: correct high atomic reserve calculations [Backport] mm: page_alloc: enforce minimum zone size to do high atomic reserves David Hildenbrand (1): [Backport] mm: convert folio_estimated_sharers() to folio_likely_mapped_shared() Hailong.Liu (1): [Backport] mm/vmalloc: fix return value of vb_alloc if size is 0 Huang Ying (1): [Backport] mm: fix draining remote pageset Jiexun Wang (1): [Backport] mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() John Hubbard (1): [Backport] huge_memory.c: document huge page splitting rules more thoroughly Kefeng Wang (2): [Backport] mm: use memalloc_nofs_save() in page_cache_ra_order() [Backport] mm: huge_memory: use more folio api in __split_huge_page_tail() Liu Shixin (2): [Backport] mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM [Backport] mm/filemap: don't decrease mmap_miss when folio has workingset flag Matthew Wilcox (Oracle) (4): [Backport] mm: support order-1 folios in the page cache [Backport] XArray: set the marks correctly when splitting an entry [Backport] mm: remove struct page from get_shadow_from_swap_cache [Backport] mm: remove PageAnonExclusive assertions in unuse_pte() Muhammad Usama Anjum (2): [Backport] selftests/mm: split_huge_page_test: conform test to TAP format output [Backport] selftests: mm: fix unused and uninitialized variable warning Ryan Roberts (9): [Backport] arm64/mm: export contpte symbols only to GPL users [Backport] arm64/mm: improve comment in contpte_ptep_get_lockless() [Backport] mm: swap: remove CLUSTER_FLAG_HUGE from swap_cluster_info:flags [Backport] mm: swap: free_swap_and_cache_nr() as batched free_swap_and_cache() [Backport] mm: swap: simplify struct percpu_cluster [Backport] mm: swap: update get_swap_pages() to take folio order [Backport] mm: swap: allow storage of all mTHP orders [Backport] mm: vmscan: avoid split during shrink_folio_list() [Backport] mm: madvise: avoid split during MADV_PAGEOUT and MADV_COLD Sergey Senozhatsky (1): [Backport] mm/madvise: don't forget to leave lazy MMU mode in madvise_cold_or_pageout_pte_range() Shakeel Butt (1): [Backport] mm: ratelimit stat flush from workingset shrinker Yong Wang (1): [Backport] mm, oom:dump_tasks add rss detailed information printing Zi Yan (9): [Backport] mm/huge_memory: only split PMD mapping when necessary in unmap_folio() [Backport] mm/memcg: use order instead of nr in split_page_memcg() [Backport] mm/page_owner: use order instead of nr in split_page_owner() [Backport] mm: memcg: make memcg huge page split support any order split [Backport] mm: page_owner: add support for splitting to any order in split page_owner [Backport] mm: thp: split huge page to any lower order pages [Backport] mm: huge_memory: enable debugfs to split huge pages to any order [Backport] mm/huge_memory: check new folio order when split a folio [Backport] mm/migrate: split source folio if it is on deferred split list arch/arm64/include/asm/pgtable.h | 19 +- arch/arm64/mm/contpte.c | 46 +-- arch/arm64/mm/mteswap.c | 45 +++ fs/proc/etmem_swap.c | 2 +- include/linux/huge_mm.h | 31 +- include/linux/memcontrol.h | 4 +- include/linux/mm.h | 48 ++- include/linux/page_owner.h | 14 +- include/linux/pgtable.h | 61 +++- include/linux/swap.h | 40 ++- lib/test_xarray.c | 14 +- lib/xarray.c | 23 +- mm/damon/paddr.c | 2 +- mm/etmem.c | 2 +- mm/filemap.c | 16 +- mm/huge_memory.c | 206 ++++++++--- mm/internal.h | 93 ++++- mm/madvise.c | 123 ++++--- mm/memcontrol.c | 10 +- mm/memory.c | 100 ++++-- mm/mempolicy.c | 14 +- mm/migrate.c | 31 +- mm/mprotect.c | 3 +- mm/oom_kill.c | 7 +- mm/page_alloc.c | 16 +- mm/page_io.c | 2 +- mm/page_owner.c | 6 +- mm/readahead.c | 15 +- mm/shmem.c | 2 +- mm/swap_slots.c | 8 +- mm/swap_state.c | 8 +- mm/swapfile.c | 331 ++++++++++-------- mm/vmalloc.c | 2 +- mm/vmscan.c | 46 ++- mm/vmstat.c | 4 +- mm/workingset.c | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 22 +- .../selftests/mm/split_huge_page_test.c | 323 ++++++++++++----- 38 files changed, 1207 insertions(+), 534 deletions(-) -- 2.25.1

2 46

[PATCH openEuler-20.03-LTS-SP3] Revert "arm64: head.S: always initialize PSTATE"
by Li Zetao 11 May '24

11 May '24

This reverts commit 7f5917da48dd9f50ca7170356efbdb4cadf3c47c. --- arch/arm64/include/asm/ptrace.h | 5 ----- arch/arm64/kernel/head.S | 25 +++++++++---------------- 2 files changed, 9 insertions(+), 21 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 408bc4719f3b2..f1662df255caf 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -27,11 +27,6 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) -#define INIT_PSTATE_EL1 \ - (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) -#define INIT_PSTATE_EL2 \ - (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) - /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index 04dc533ea8b60..9f083b11efe25 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -465,24 +465,19 @@ ENTRY(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * - * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if - * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. - * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ ENTRY(el2_setup) + msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 b.eq 1f mov_q x0, (SCTLR_EL1_RES1 | ENDIAN_SET_EL1) msr sctlr_el1, x0 + mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - mov_q x0, INIT_PSTATE_EL1 - msr spsr_el1, x0 - msr elr_el1, lr - mov w0, #BOOT_CPU_MODE_EL1 - eret + ret 1: mov_q x0, (SCTLR_EL2_RES1 | ENDIAN_SET_EL2) msr sctlr_el2, x0 @@ -593,12 +588,9 @@ set_hcr: cbz x2, install_el2_stub + mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - mov_q x0, INIT_PSTATE_EL2 - msr spsr_el2, x0 - msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 - eret + ret install_el2_stub: /* @@ -630,11 +622,12 @@ install_el2_stub: 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - isb - mov x0, #INIT_PSTATE_EL1 + /* spsr */ + mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ + PSR_MODE_EL1h) msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 + mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 eret ENDPROC(el2_setup) -- 2.34.1

3 2

[PATCH openEuler-1.0-LTS] NTB: fix possible name leak in ntb_register_device()
by Zeng Heng 11 May '24

11 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IV CVE: CVE-2023-52652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweiclou… [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/ntb/core.c drivers/pci/endpoint/functions/pci-epf-vntb.c [The version does not include the pci-epf-vntb.c source file, and ntb_register_device() function is located in drivers/ntb/ntb.c.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/ntb/ntb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/ntb/ntb.c b/drivers/ntb/ntb.c index 2581ab724c34..3305a2fbea4e 100644 --- a/drivers/ntb/ntb.c +++ b/drivers/ntb/ntb.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] entry: inline syscall enter/exit functions
by liwei 11 May '24

11 May '24

This patchset moves the entry and exit function to entry-common.h, so non inlined code gets only called when there is some work pending. Reference: https://lore.kernel.org/all/20231218074520.1998026-1-svens@linux.ibm.com/ Sven Schnelle (3): entry: Move exit to usermode functions to header file entry: Move enter_from_user_mode() to header file entry: Move syscall_enter_from_user_mode() to header file include/linux/entry-common.h | 95 ++++++++++++++++++++++++++++-- kernel/entry/common.c | 108 ++++------------------------------- 2 files changed, 103 insertions(+), 100 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] NTB: fix possible name leak in ntb_register_device()
by Zeng Heng 11 May '24

11 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IV CVE: CVE-2023-52652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweiclou… [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-vntb.c [The version does not include the pci-epf-vntb.c source file.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/ntb/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/ntb/core.c b/drivers/ntb/core.c index f8f75a504a58..c423c91a617e 100644 --- a/drivers/ntb/core.c +++ b/drivers/ntb/core.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NTB: fix possible name leak in ntb_register_device()
by Zeng Heng 11 May '24

11 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IV CVE: CVE-2023-52652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweiclou… [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-vntb.c [The version does not include the pci-epf-vntb.c source file.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/ntb/ntb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/ntb/ntb.c b/drivers/ntb/ntb.c index 2581ab724c34..3305a2fbea4e 100644 --- a/drivers/ntb/ntb.c +++ b/drivers/ntb/ntb.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); -- 2.25.1

2 1

[rdma-core v3] libhns: Fix missing flag when creating qp by hnsdv_create_qp()
by Chengchang Tang 11 May '24

11 May '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/rdma-core/issues/I9NZME -------------------------------------------------------------------------- This flag will be used when the DCA mode is enabled. Without this flag, the QP fails to be created in DCA mode. Fixes: c7bf0dbf472d ("libhns: Introduce DCA for RC QP") Signed-off-by: Juan Zhou <zhoujuan51(a)h-partners.com> --- providers/hns/hns_roce_u_verbs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index a680339..e30880c 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -1049,7 +1049,8 @@ int hns_roce_u_destroy_srq(struct ibv_srq *ibv_srq) } enum { - HNSDV_QP_SUP_COMP_MASK = HNSDV_QP_INIT_ATTR_MASK_QP_CONGEST_TYPE, + HNSDV_QP_SUP_COMP_MASK = HNSDV_QP_INIT_ATTR_MASK_QP_CREATE_FLAGS | + HNSDV_QP_INIT_ATTR_MASK_QP_CONGEST_TYPE, }; static int check_hnsdv_qp_attr(struct hns_roce_context *ctx, -- 2.33.0

1 0

[PATCH OLK-6.6 00/14] Backport some memory policy feature and bugfix in mm from mainline
by Ze Zuo 11 May '24

11 May '24

Backport feature(mm/mempolicy: weighted interleave mempolicy and sysfs extension) and some mempolicy bugfix and cleanup. Gregory Price (3): mm/mempolicy: refactor a read-once mechanism into a function for re-use mm/mempolicy: introduce MPOL_WEIGHTED_INTERLEAVE for weighted interleaving mm/mempolicy: protect task interleave functions with tsk->mems_allowed_seq Hugh Dickins (10): mempolicy: fix migrate_pages(2) syscall return nr_failed mempolicy trivia: delete those ancient pr_debug()s mempolicy trivia: slightly more consistent naming mempolicy trivia: use pgoff_t in shared mempolicy tree mempolicy: mpol_shared_policy_init() without pseudo-vma mempolicy: remove confusing MPOL_MF_LAZY dead code kernfs: drop shared NUMA mempolicy hooks mempolicy: alloc_pages_mpol() for NUMA policy without vma mempolicy: mmap_lock is not needed while migrating folios mempolicy: migration attempt to match interleave nodes Rakie Kim (1): mm/mempolicy: implement the sysfs-based weighted_interleave interface .../ABI/testing/sysfs-kernel-mm-mempolicy | 4 + ...fs-kernel-mm-mempolicy-weighted-interleave | 25 + .../admin-guide/mm/numa_memory_policy.rst | 9 + fs/kernfs/file.c | 49 - fs/proc/task_mmu.c | 5 +- include/linux/gfp.h | 10 +- include/linux/hugetlb.h | 9 - include/linux/mempolicy.h | 51 +- include/linux/mm.h | 2 +- include/linux/sched.h | 1 + include/uapi/linux/mempolicy.h | 3 +- ipc/shm.c | 21 +- mm/hugetlb.c | 38 +- mm/mempolicy.c | 1449 +++++++++++------ mm/shmem.c | 95 +- mm/swap.h | 9 +- mm/swap_state.c | 86 +- mm/zswap.c | 7 +- 18 files changed, 1137 insertions(+), 736 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy-weighted-interleave -- 2.25.1

2 15

[PATCH openEuler-1.0-LTS] s390/dasd: fix double module refcount decrement
by Chen Zhongjin 11 May '24

11 May '24

From: Miroslav Franc <mfranc(a)suse.cz> mainline inclusion from mainline-v6.9-rc1 commit c3116e62ddeff79cae342147753ce596f01fcf06 category: bugfix bugzilla: 189916 CVE: CVE-2024-27054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on this error path causes refcount to artificially decrease on each error while it should just stay the same. Fixes: c020d722b110 ("s390/dasd: fix panic during offline processing") Signed-off-by: Miroslav Franc <mfranc(a)suse.cz> Signed-off-by: Jan Höppner <hoeppner(a)linux.ibm.com> Signed-off-by: Stefan Haberland <sth(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240209124522.3697827-3-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/s390/block/dasd.c [fix context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/s390/block/dasd.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c index a23e7d394a0ad..433651225fca6 100644 --- a/drivers/s390/block/dasd.c +++ b/drivers/s390/block/dasd.c @@ -3501,12 +3501,11 @@ int dasd_generic_set_online(struct ccw_device *cdev, dasd_delete_device(device); return -EINVAL; } + device->base_discipline = base_discipline; if (!try_module_get(discipline->owner)) { - module_put(base_discipline->owner); dasd_delete_device(device); return -EINVAL; } - device->base_discipline = base_discipline; device->discipline = discipline; /* check_device will allocate block device if necessary */ @@ -3514,8 +3513,6 @@ int dasd_generic_set_online(struct ccw_device *cdev, if (rc) { pr_warn("%s Setting the DASD online with discipline %s failed with rc=%i\n", dev_name(&cdev->dev), discipline->name, rc); - module_put(discipline->owner); - module_put(base_discipline->owner); dasd_delete_device(device); return rc; } -- 2.25.1

2 1

[PATCH OLK-6.6 v3] md: do not delete safemode_timer in mddev_suspend
by Li Nan 11 May '24

11 May '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JMCR Reference: https://lore.kernel.org/all/20240508092053.1447930-1-linan666@huaweicloud.c… -------------------------------- The deletion of safemode_timer in mddev_suspend() is redundant and potentially harmful now. If timer is about to be woken up but gets deleted, 'in_sync' will remain 0 until the next write, causing array to stay in the 'active' state instead of transitioning to 'clean'. Commit 0d9f4f135eb6 ("MD: Add del_timer_sync to mddev_suspend (fix nasty panic))" introduced this deletion for dm, because if timer fired after dm is destroyed, the resource which the timer depends on might have been freed. However, commit 0dd84b319352 ("md: call __md_stop_writes in md_stop") added __md_stop_writes() to md_stop(), which is called before freeing resource. Timer is deleted in __md_stop_writes(), and the origin issue is resolved. Therefore, delete safemode_timer can be removed safely now. Fixes: 0dd84b319352 ("md: call __md_stop_writes in md_stop") Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80cb0120394f..dee49543c2ca 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -490,7 +490,6 @@ int mddev_suspend(struct mddev *mddev, bool interruptible) */ WRITE_ONCE(mddev->suspended, mddev->suspended + 1); - del_timer_sync(&mddev->safemode_timer); /* restrict memory reclaim I/O during raid array is suspend */ mddev->noio_flag = memalloc_noio_save(); -- 2.39.2

2 1

[PATCH v2 OLK-6.6 0/3] mm: mglru: reuse some legacy trace
by Zhao Mengmeng 11 May '24

11 May '24

From: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> Backport upstream mglru patch to reuse some trace events, along with trace-vmscan-postprocess parsing and output fixes. Jaewon Kim (1): mm: multi-gen LRU: reuse some legacy trace events Vlastimil Babka (2): trace-vmscan-postprocess: sync with tracepoints updates mm, vmscan: remove ISOLATE_UNMAPPED .../postprocess/trace-vmscan-postprocess.pl | 42 ++++++++----------- include/linux/mmzone.h | 2 - include/trace/events/vmscan.h | 8 +--- mm/vmscan.c | 21 ++++++---- 4 files changed, 34 insertions(+), 39 deletions(-) -- 2.33.0

3 9

[PATCH OLK-6.6 v2] md: do not delete safemode_timer in mddev_suspend
by Li Nan 11 May '24

11 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JMCR -------------------------------- The deletion of safemode_timer in mddev_suspend() is redundant and potentially harmful now. If timer is about to be woken up but gets deleted, 'in_sync' will remain 0 until the next write, causing array to stay in the 'active' state instead of transitioning to 'clean'. Commit 0d9f4f135eb6 ("MD: Add del_timer_sync to mddev_suspend (fix nasty panic))" introduced this deletion for dm, because if timer fired after dm is destroyed, the resource which the timer depends on might have been freed. However, commit 0dd84b319352 ("md: call __md_stop_writes in md_stop") added __md_stop_writes() to md_stop(), which is called before freeing resource. Timer is deleted in __md_stop_writes(), and the origin issue is resolved. Therefore, delete safemode_timer can be removed safely now. Fixes: 0dd84b319352 ("md: call __md_stop_writes in md_stop") Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80cb0120394f..dee49543c2ca 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -490,7 +490,6 @@ int mddev_suspend(struct mddev *mddev, bool interruptible) */ WRITE_ONCE(mddev->suspended, mddev->suspended + 1); - del_timer_sync(&mddev->safemode_timer); /* restrict memory reclaim I/O during raid array is suspend */ mddev->noio_flag = memalloc_noio_save(); -- 2.39.2

2 1

[PATCH v3 OLK-6.6 0/3] mm: mglru: reuse some legacy trace
by Zhao Mengmeng 11 May '24

11 May '24

Backport upstream mglru patch to reuse some trace events, along with trace-vmscan-postprocess parsing and output fixes. Jaewon Kim (1): mm: multi-gen LRU: reuse some legacy trace events Vlastimil Babka (2): trace-vmscan-postprocess: sync with tracepoints updates mm, vmscan: remove ISOLATE_UNMAPPED .../postprocess/trace-vmscan-postprocess.pl | 42 ++++++++----------- include/linux/mmzone.h | 2 - include/trace/events/vmscan.h | 8 +--- mm/vmscan.c | 21 ++++++---- 4 files changed, 34 insertions(+), 39 deletions(-) -- 2.33.0

2 4

[openeuler:OLK-6.6 7640/9508] kernel/livepatch/core.c:216:13: warning: no previous prototype for 'arch_klp_skip_resolve'
by kernel test robot 11 May '24

11 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0238904492b29dfc7715e7783eff8011b916ddac commit: b8f3220637be1736c165c289c634f27841ac4e01 [7640/9508] livepatch: add arch hook before doing klp_resolve_symbols config: x86_64-randconfig-013-20240511 (https://download.01.org/0day-ci/archive/20240511/202405111327.wFY69R0L-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240511/202405111327.wFY69R0L-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405111327.wFY69R0L-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/livepatch/core.c:97:12: warning: no previous prototype for 'arch_klp_init_func' [-Wmissing-prototypes] 97 | int __weak arch_klp_init_func(struct klp_object *obj, struct klp_func *func) | ^~~~~~~~~~~~~~~~~~ >> kernel/livepatch/core.c:216:13: warning: no previous prototype for 'arch_klp_skip_resolve' [-Wmissing-prototypes] 216 | bool __weak arch_klp_skip_resolve(unsigned int type) | ^~~~~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:1767:12: warning: no previous prototype for 'arch_klp_check_activeness_func' [-Wmissing-prototypes] 1767 | int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:2022:14: warning: no previous prototype for 'arch_klp_mem_alloc' [-Wmissing-prototypes] 2022 | void __weak *arch_klp_mem_alloc(size_t size) | ^~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:2027:13: warning: no previous prototype for 'arch_klp_mem_free' [-Wmissing-prototypes] 2027 | void __weak arch_klp_mem_free(void *mem) | ^~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:2063:13: warning: no previous prototype for 'arch_klp_set_brk_func' [-Wmissing-prototypes] 2063 | void __weak arch_klp_set_brk_func(struct klp_func_node *func_node, void *new_func) | ^~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for DRM_I915_DEBUG_GEM Depends on [n]: HAS_IOMEM [=y] && DRM_I915 [=m] && EXPERT [=y] && DRM_I915_WERROR [=n] Selected by [m]: - DRM_I915_DEBUG [=y] && HAS_IOMEM [=y] && DRM_I915 [=m] && EXPERT [=y] && !COMPILE_TEST [=n] vim +/arch_klp_skip_resolve +216 kernel/livepatch/core.c 96 > 97 int __weak arch_klp_init_func(struct klp_object *obj, struct klp_func *func) 98 { 99 return 0; 100 } 101 #endif /* CONFIG_LIVEPATCH_FTRACE */ 102 103 static bool klp_initialized(void) 104 { 105 return !!klp_root_kobj; 106 } 107 108 #ifdef CONFIG_LIVEPATCH_FTRACE 109 static struct klp_func *klp_find_func(struct klp_object *obj, 110 struct klp_func *old_func) 111 { 112 struct klp_func *func; 113 114 klp_for_each_func(obj, func) { 115 if ((strcmp(old_func->old_name, func->old_name) == 0) && 116 (old_func->old_sympos == func->old_sympos)) { 117 return func; 118 } 119 } 120 121 return NULL; 122 } 123 124 static struct klp_object *klp_find_object(struct klp_patch *patch, 125 struct klp_object *old_obj) 126 { 127 struct klp_object *obj; 128 129 klp_for_each_object(patch, obj) { 130 if (klp_is_module(old_obj)) { 131 if (klp_is_module(obj) && 132 strcmp(old_obj->name, obj->name) == 0) { 133 return obj; 134 } 135 } else if (!klp_is_module(obj)) { 136 return obj; 137 } 138 } 139 140 return NULL; 141 } 142 #endif /* CONFIG_LIVEPATCH_FTRACE */ 143 144 struct klp_find_arg { 145 const char *name; 146 unsigned long addr; 147 unsigned long count; 148 unsigned long pos; 149 }; 150 151 static int klp_match_callback(void *data, unsigned long addr) 152 { 153 struct klp_find_arg *args = data; 154 155 args->addr = addr; 156 args->count++; 157 158 /* 159 * Finish the search when the symbol is found for the desired position 160 * or the position is not defined for a non-unique symbol. 161 */ 162 if ((args->pos && (args->count == args->pos)) || 163 (!args->pos && (args->count > 1))) 164 return 1; 165 166 return 0; 167 } 168 169 static int klp_find_callback(void *data, const char *name, unsigned long addr) 170 { 171 struct klp_find_arg *args = data; 172 173 if (strcmp(args->name, name)) 174 return 0; 175 176 return klp_match_callback(data, addr); 177 } 178 179 static int klp_find_object_symbol(const char *objname, const char *name, 180 unsigned long sympos, unsigned long *addr) 181 { 182 struct klp_find_arg args = { 183 .name = name, 184 .addr = 0, 185 .count = 0, 186 .pos = sympos, 187 }; 188 189 if (objname) 190 module_kallsyms_on_each_symbol(objname, klp_find_callback, &args); 191 else 192 kallsyms_on_each_match_symbol(klp_match_callback, name, &args); 193 194 /* 195 * Ensure an address was found. If sympos is 0, ensure symbol is unique; 196 * otherwise ensure the symbol position count matches sympos. 197 */ 198 if (args.addr == 0) 199 pr_err("symbol '%s' not found in symbol table\n", name); 200 else if (args.count > 1 && sympos == 0) { 201 pr_err("unresolvable ambiguity for symbol '%s' in object '%s'\n", 202 name, objname); 203 } else if (sympos != args.count && sympos > 0) { 204 pr_err("symbol position %lu for symbol '%s' in object '%s' not found\n", 205 sympos, name, objname ? objname : "vmlinux"); 206 } else { 207 *addr = args.addr; 208 return 0; 209 } 210 211 *addr = 0; 212 return -EINVAL; 213 } 214 215 #ifdef CONFIG_LIVEPATCH_WO_FTRACE > 216 bool __weak arch_klp_skip_resolve(unsigned int type) 217 { 218 return false; 219 } 220 #endif 221 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] nfs: fix UAF in direct writes
by Long Li 11 May '24

11 May '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.214 commit 4595d90b5d2ea5fa4d318d13f59055aa4bf3e7f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5GC CVE: CVE-2024-26958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 17f46b803d4f23c66cacce81db35fef3adb8f2af ] In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nfs/write.c include/linux/nfs_fs.h [make nfs_commit_end() have return value of bool and declared in header file] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/nfs/direct.c | 11 +++++++++-- fs/nfs/write.c | 10 +++++++--- include/linux/nfs_fs.h | 2 ++ 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 6a4083d550c6..c0de56ed8364 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -760,10 +760,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq) LIST_HEAD(mds_list); nfs_init_cinfo_from_dreq(&cinfo, dreq); + nfs_commit_begin(cinfo.mds); nfs_scan_commit(dreq->inode, &mds_list, &cinfo); res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo); - if (res < 0) /* res == -ENOMEM */ - nfs_direct_write_reschedule(dreq); + if (res < 0) { /* res == -ENOMEM */ + spin_lock(&dreq->lock); + if (dreq->flags == 0) + dreq->flags = NFS_ODIRECT_RESCHED_WRITES; + spin_unlock(&dreq->lock); + } + if (nfs_commit_end(cinfo.mds)) + nfs_direct_write_complete(dreq); } static void nfs_direct_write_schedule_work(struct work_struct *work) diff --git a/fs/nfs/write.c b/fs/nfs/write.c index e383d265e65b..e4b1ce488637 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1643,15 +1643,19 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) !atomic_read(&cinfo->rpcs_out)); } -static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) { atomic_inc(&cinfo->rpcs_out); } -static void nfs_commit_end(struct nfs_mds_commit_info *cinfo) +bool nfs_commit_end(struct nfs_mds_commit_info *cinfo) { - if (atomic_dec_and_test(&cinfo->rpcs_out)) + + if (atomic_dec_and_test(&cinfo->rpcs_out)) { wake_up_var(&cinfo->rpcs_out); + return true; + } + return false; } void nfs_commitdata_release(struct nfs_commit_data *data) diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 22e4ce63917d..beb26241fe57 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -545,6 +545,8 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); extern int nfs_commit_inode(struct inode *, int); extern struct nfs_commit_data *nfs_commitdata_alloc(bool never_fail); extern void nfs_commit_free(struct nfs_commit_data *data); +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo); +bool nfs_commit_end(struct nfs_mds_commit_info *cinfo); static inline int nfs_have_writebacks(struct inode *inode) -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 33f2da805c97..6e87964c5c0a 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1223,6 +1223,8 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP2] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 33f2da805c97..6e87964c5c0a 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1223,6 +1223,8 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH OLK-5.10] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 33f2da805c97..6e87964c5c0a 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1223,6 +1223,8 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 1686e7aea823..b7b08b6492d0 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1225,6 +1225,8 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH OLK-5.10] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 33f2da805c97..6e87964c5c0a 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1223,6 +1223,8 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH OLK-5.10 0/4] CVE-2022-48689
by Ziyang Xuan 11 May '24

11 May '24

Patchset of CVE-2022-48689. Eric Dumazet (1): tcp: TX zerocopy should not sense pfmemalloc status Paolo Abeni (1): tcp: factor out tcp_build_frag() Pavel Begunkov (1): net: introduce __skb_fill_page_desc_noacc Yunsheng Lin (1): net: skbuff: update comment about pfmemalloc propagating include/linux/skbuff.h | 41 +++++++++++--- include/net/tcp.h | 3 ++ net/core/datagram.c | 2 +- net/ipv4/tcp.c | 119 +++++++++++++++++++++++------------------ 4 files changed, 105 insertions(+), 60 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS-SP2] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 33f2da805c97..f3e30cb52883 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1124,6 +1124,8 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 1686e7aea823..9bfa0b6b3771 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1126,6 +1126,8 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 33f2da805c97..f3e30cb52883 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1124,6 +1124,8 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH OLK-5.10] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 33f2da805c97..f3e30cb52883 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1124,6 +1124,8 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH OLK-5.10] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 6e87964c5c0a..bf65aec6bfc0 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1124,6 +1124,8 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH OLK-5.10] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 6e87964c5c0a..bf65aec6bfc0 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1124,6 +1124,8 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH OLK-5.10] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 33f2da805c97..6e87964c5c0a 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1223,6 +1223,8 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH OLK-5.10] ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
by ZhaoLong Wang 11 May '24

11 May '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v5.10.210 commit d132010e6d5c0cb2e28ce9e91ab3ad0ad4cd1063 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5M6 CVE: CVE-2024-26972 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream. For error handling path in ubifs_symlink(), inode will be marked as bad first, then iput() is invoked. If inode->i_link is initialized by fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error handling path, because make_bad_inode() has changed 'inode->i_mode' as 'S_IFREG'. Following kmemleak is easy to be reproduced by injecting error in ubifs_jnl_update() when doing symlink in encryption scenario: unreferenced object 0xffff888103da3d98 (size 8): comm "ln", pid 1692, jiffies 4294914701 (age 12.045s) backtrace: kmemdup+0x32/0x70 __fscrypt_encrypt_symlink+0xed/0x1c0 ubifs_symlink+0x210/0x300 [ubifs] vfs_symlink+0x216/0x360 do_symlinkat+0x11a/0x190 do_syscall_64+0x3b/0xe0 There are two ways fixing it: 1. Remove make_bad_inode() in error handling path. We can do that because ubifs_evict_inode() will do same processes for good symlink inode and bad symlink inode, for inode->i_nlink checking is before is_bad_inode(). 2. Free inode->i_link before marking inode bad. Method 2 is picked, it has less influence, personally, I think. Cc: stable(a)vger.kernel.org Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Suggested-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 6e87964c5c0a..bf65aec6bfc0 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -1124,6 +1124,8 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry, dir_ui->ui_size = dir->i_size; mutex_unlock(&dir_ui->ui_mutex); out_inode: + /* Free inode->i_link before inode is marked as bad. */ + fscrypt_free_inode(inode); make_bad_inode(inode); iput(inode); out_fname: -- 2.34.3

2 1

[PATCH OLK-6.6 v2] tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled
by Yu Liao 11 May '24

11 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8PL17 CVE: NA ---------------------------------------- It was found that running the LTP hotplug stress test on a aarch64 system could produce rcu_sched stall warnings. The issue is the following: CPU1 (owns the broadcast hrtimer) CPU2 tick_broadcast_enter() //shut down local timer device ... tick_broadcast_exit() //exits with tick_broadcast_force_mask set, timer device remains disabled initiates offlining of CPU1 take_cpu_down() //CPU1 shuts down and does not send broadcast IPI anymore takedown_cpu() hotplug_cpu__broadcast_tick_pull() //move broadcast hrtimer to this CPU clockevents_program_event() bc_set_next() hrtimer_start() //does not call hrtimer_reprogram() to program timer device if expires equals dev->next_event, so the timer device remains disabled. CPU2 takes over the broadcast duty but local timer device is disabled, causing many CPUs to become stuck. Fix this by calling tick_program_event() to reprogram the local timer device in this scenario. Fixes: 5d1638acb9f6 ("tick: Introduce hrtimer based broadcast") Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- kernel/time/tick-broadcast-hrtimer.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c index e28f9210f8a1..0dc78744fce6 100644 --- a/kernel/time/tick-broadcast-hrtimer.c +++ b/kernel/time/tick-broadcast-hrtimer.c @@ -42,6 +42,19 @@ static int bc_shutdown(struct clock_event_device *evt) */ static int bc_set_next(ktime_t expires, struct clock_event_device *bc) { + struct clock_event_device *dev = __this_cpu_read(tick_cpu_device.evtdev); + + /* + * This can be called from CPU offline operation to move broadcast + * assignment. If tick_broadcast_force_mask is set, the CPU local + * timer device may be disabled. And hrtimer_reprogram() will not + * called if the timer is not the first expiring timer. Reprogram + * the cpu local timer device to ensure we can take over the + * broadcast duty. + */ + if (tick_check_broadcast_expired() && expires >= dev->next_event) + clockevents_program_event(dev, dev->next_event, 1); + /* * This is called either from enter/exit idle code or from the * broadcast handler. In all cases tick_broadcast_lock is held. -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2] usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
by Wei Li 11 May '24

11 May '24

From: Norihiko Hama <Norihiko.Hama(a)alpsalpine.com> mainline inclusion from mainline-v6.9-rc5 commit 6334b8e4553cc69f51e383c9de545082213d785e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5KV CVE: CVE-2024-26996 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- When ncm function is working and then stop usb0 interface for link down, eth_stop() is called. At this piont, accidentally if usb transport error should happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled. After that, ncm_disable() is called to disable for ncm unbind but gether_disconnect() is never called since 'in_ep' is not enabled. As the result, ncm object is released in ncm unbind but 'dev->port_usb' associated to 'ncm->port' is not NULL. And when ncm bind again to recover netdev, ncm object is reallocated but usb0 interface is already associated to previous released ncm object. Therefore, once usb0 interface is up and eth_start_xmit() is called, released ncm object is dereferrenced and it might cause use-after-free memory. [function unlink via configfs] usb0: eth_stop dev->port_usb=ffffff9b179c3200 --> error happens in usb_ep_enable(). NCM: ncm_disable: ncm=ffffff9b179c3200 --> no gether_disconnect() since ncm->port.in_ep->enabled is false. NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200 NCM: ncm_free: ncm free ncm=ffffff9b179c3200 <-- released ncm [function link via configfs] NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000 NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000 NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0 usb0: eth_open dev->port_usb=ffffff9b179c3200 <-- previous released ncm usb0: eth_start dev->port_usb=ffffff9b179c3200 <-- eth_start_xmit() --> dev->wrap() Unable to handle kernel paging request at virtual address dead00000000014f This patch addresses the issue by checking if 'ncm->netdev' is not NULL at ncm_disable() to call gether_disconnect() to deassociate 'dev->port_usb'. It's more reasonable to check 'ncm->netdev' to call gether_connect/disconnect rather than check 'ncm->port.in_ep->enabled' since it might not be enabled but the gether connection might be established. Signed-off-by: Norihiko Hama <Norihiko.Hama(a)alpsalpine.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240327023550.51214-1-Norihiko.Hama@alpsalpine.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/gadget/function/f_ncm.c [lw: fix context conflict only] Signed-off-by: Wei Li <liwei391(a)huawei.com> --- drivers/usb/gadget/function/f_ncm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index 5780fba620ab..3da7e6511fc6 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -885,7 +885,7 @@ static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) if (alt > 1) goto fail; - if (ncm->port.in_ep->enabled) { + if (ncm->netdev) { DBG(cdev, "reset ncm\n"); ncm->timer_stopping = true; ncm->netdev = NULL; @@ -1322,7 +1322,7 @@ static void ncm_disable(struct usb_function *f) DBG(cdev, "ncm deactivated\n"); - if (ncm->port.in_ep->enabled) { + if (ncm->netdev) { ncm->timer_stopping = true; ncm->netdev = NULL; gether_disconnect(&ncm->port); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2] Squashfs: check the inode number is not the invalid value of zero
by Long Li 11 May '24

11 May '24

From: Phillip Lougher <phillip(a)squashfs.org.uk> mainline inclusion from mainline-v6.9-rc4 commit 9253c54e01b6505d348afbc02abaa4d9f8a01395 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5DF CVE: CVE-2024-26982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because the inode has an inode number with the invalid value of zero, which was not checked. The reason this causes the out of bounds access is due to following sequence of events: 1. Fill_meta_index() is called to allocate (via empty_meta_index()) and fill a metadata index. It however suffers a data read error and aborts, invalidating the newly returned empty metadata index. It does this by setting the inode number of the index to zero, which means unused (zero is not a valid inode number). 2. When fill_meta_index() is subsequently called again on another read operation, locate_meta_index() returns the previous index because it matches the inode number of 0. Because this index has been returned it is expected to have been filled, and because it hasn't been, an out of bounds access is performed. This patch adds a sanity check which checks that the inode number is not zero when the inode is created and returns -EINVAL if it is. [phillip(a)squashfs.org.uk: whitespace fix] Link: https://lkml.kernel.org/r/20240409204723.446925-1-phillip@squashfs.org.uk Link: https://lkml.kernel.org/r/20240408220206.435788-1-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Reported-by: "Ubisectech Sirius" <bugreport(a)ubisectech.com> Closes: https://lore.kernel.org/lkml/87f5c007-b8a5-41ae-8b57-431e924c5915.bugreport… Cc: Christian Brauner <brauner(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/squashfs/inode.c [since commit a1f13ed8c748 ("squashfs: convert to new timestamp accessors") merged, function squashfs_new_inode() has changed and result conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/squashfs/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index e9793b1e49a5..98825d8a03eb 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -61,6 +61,10 @@ static int squashfs_new_inode(struct super_block *sb, struct inode *inode, gid_t i_gid; int err; + inode->i_ino = le32_to_cpu(sqsh_ino->inode_number); + if (inode->i_ino == 0) + return -EINVAL; + err = squashfs_get_id(sb, le16_to_cpu(sqsh_ino->uid), &i_uid); if (err) return err; @@ -71,7 +75,6 @@ static int squashfs_new_inode(struct super_block *sb, struct inode *inode, i_uid_write(inode, i_uid); i_gid_write(inode, i_gid); - inode->i_ino = le32_to_cpu(sqsh_ino->inode_number); inode->i_mtime.tv_sec = le32_to_cpu(sqsh_ino->mtime); inode->i_atime.tv_sec = inode->i_mtime.tv_sec; inode->i_ctime.tv_sec = inode->i_mtime.tv_sec; -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION a786a35ec1aeb84a5ff258956854c2eaebec12b7
by kernel test robot 11 May '24

11 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: a786a35ec1aeb84a5ff258956854c2eaebec12b7 !7137 v2 SUNRPC: fix a memleak in gss_import_v2_context Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405102258.1OIgsP3m-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405110005.f8e8EhFW-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405110244.yz4AxkCm-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) net/netfilter/xt_TEE.o: warning: objtool: missing symbol for section .exit.text Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- x86_64-buildonly-randconfig-003-20240509 | `-- net-rxrpc-.tmp_input.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-004-20240509 | `-- net-netfilter-xt_TEE.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-buildonly-randconfig-004-20240511 | |-- fs-proc-array.c:warning:gtime-may-be-used-uninitialized-in-this-function | |-- fs-proc-array.c:warning:maj_flt-may-be-used-uninitialized-in-this-function | `-- fs-proc-array.c:warning:min_flt-may-be-used-uninitialized-in-this-function |-- x86_64-defconfig | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-004-20240511 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int `-- x86_64-randconfig-161-20240511 |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int clang_recent_errors |-- x86_64-allyesconfig | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-buildonly-randconfig-004-20240510 | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-scsi-huawei-hifc-hifc_cmdq.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-scsi-huawei-hifc-hifc_portmng.o:warning:objtool:missing-symbol-for-section-.text | `-- drivers-scsi-huawei-hifc-unf_event.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-randconfig-001-20240511 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-002-20240511 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-003-20240511 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-006-20240511 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-011-20240511 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-101-20240511 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) `-- x86_64-rhel-8.3-rust `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) elapsed time: 727m configs tested: 30 configs skipped: 131 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240511 gcc arm64 randconfig-002-20240511 gcc arm64 randconfig-003-20240511 gcc arm64 randconfig-004-20240511 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240511 gcc x86_64 buildonly-randconfig-002-20240511 gcc x86_64 buildonly-randconfig-003-20240511 gcc x86_64 buildonly-randconfig-004-20240511 gcc x86_64 buildonly-randconfig-005-20240511 clang x86_64 buildonly-randconfig-006-20240511 clang x86_64 defconfig gcc x86_64 randconfig-001-20240511 clang x86_64 randconfig-002-20240511 clang x86_64 randconfig-003-20240511 clang x86_64 randconfig-004-20240511 gcc x86_64 randconfig-005-20240511 gcc x86_64 randconfig-006-20240511 clang x86_64 randconfig-011-20240511 clang x86_64 randconfig-012-20240511 gcc x86_64 randconfig-013-20240511 gcc x86_64 randconfig-014-20240511 gcc x86_64 randconfig-015-20240511 gcc x86_64 randconfig-016-20240511 gcc x86_64 randconfig-072-20240511 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] md: do not delete safemode_timer in mddev_suspend
by Li Nan 11 May '24

11 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9JMCR -------------------------------- The deletion of safemode_timer in mddev_suspend() is redundant and potentially harmful now. If timer is about to be woken up but gets deleted, 'in_sync' will remain 0 until the next write, causing array to stay in the 'active' state instead of transitioning to 'clean'. Commit 0d9f4f135eb6 ("MD: Add del_timer_sync to mddev_suspend (fix nasty panic))" introduced this deletion for dm, because if timer fired after dm is destroyed, the resource which the timer depends on might have been freed. However, commit 0dd84b319352 ("md: call __md_stop_writes in md_stop") added __md_stop_writes() to md_stop(), which is called before freeing resource. Timer is deleted in __md_stop_writes(), and the origin issue is resolved. Therefore, delete safemode_timer can be removed safely now. Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80cb0120394f..dee49543c2ca 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -490,7 +490,6 @@ int mddev_suspend(struct mddev *mddev, bool interruptible) */ WRITE_ONCE(mddev->suspended, mddev->suspended + 1); - del_timer_sync(&mddev->safemode_timer); /* restrict memory reclaim I/O during raid array is suspend */ mddev->noio_flag = memalloc_noio_save(); -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 5395/22398] net/rxrpc/.tmp_input.o: warning: objtool: missing symbol for section .text
by kernel test robot 11 May '24

11 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a786a35ec1aeb84a5ff258956854c2eaebec12b7 commit: ef48248d933d2602d3c9d30e9d85c6807e0ac46e [5395/22398] rxrpc: fix race condition in rxrpc_input_packet() config: x86_64-buildonly-randconfig-003-20240509 (https://download.01.org/0day-ci/archive/20240511/202405110912.db5AcH6D-lkp@…) compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240511/202405110912.db5AcH6D-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405110912.db5AcH6D-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/rxrpc/.tmp_input.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] Backports for OLK-6.6
by Ziyang Xuan 11 May '24

11 May '24

Backports for OLK-6.6. Florian Westphal (1): netfilter: bridge: confirm multicast packets before passing them up the stack Pablo Neira Ayuso (1): netfilter: br_netfilter: skip conntrack input hook for promisc packets include/linux/netfilter.h | 1 + net/bridge/br_input.c | 15 ++- net/bridge/br_netfilter_hooks.c | 102 +++++++++++++++++++++ net/bridge/br_private.h | 1 + net/bridge/netfilter/nf_conntrack_bridge.c | 36 ++++++++ net/netfilter/nf_conntrack_core.c | 1 + 6 files changed, 152 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[openeuler:OLK-6.6 2850/9501] kernel/sched/isolation.c:244:19: error: invalid storage class for function 'enhanced_isolcpus_setup'
by kernel test robot 11 May '24

11 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a00ba8b54d9123a4242dc589aee8122a3adf0d4a commit: 5f20541757730418065c3ae77dfdbcde3f523394 [2850/9501] blk-mq: avoid housekeeping CPUs scheduling a worker on a non-housekeeping CPU config: x86_64-randconfig-012-20240511 (https://download.01.org/0day-ci/archive/20240511/202405110520.AdmHWk19-lkp@…) compiler: gcc-12 (Ubuntu 12.3.0-9ubuntu2) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240511/202405110520.AdmHWk19-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405110520.AdmHWk19-lkp@intel.com/ All errors (new ones prefixed by >>): 54 | EXPORT_SYMBOL_GPL(housekeeping_any_cpu); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:39:5: note: previous definition of 'housekeeping_any_cpu' with type 'int(enum hk_type)' 39 | int housekeeping_any_cpu(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:63:19: error: non-static declaration of 'housekeeping_cpumask' follows static declaration 63 | EXPORT_SYMBOL_GPL(housekeeping_cpumask); | ^~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:63:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 63 | EXPORT_SYMBOL_GPL(housekeeping_cpumask); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:56:23: note: previous definition of 'housekeeping_cpumask' with type 'const struct cpumask *(enum hk_type)' 56 | const struct cpumask *housekeeping_cpumask(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:71:19: error: non-static declaration of 'housekeeping_affine' follows static declaration 71 | EXPORT_SYMBOL_GPL(housekeeping_affine); | ^~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:71:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 71 | EXPORT_SYMBOL_GPL(housekeeping_affine); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:65:6: note: previous definition of 'housekeeping_affine' with type 'void(struct task_struct *, enum hk_type)' 65 | void housekeeping_affine(struct task_struct *t, enum hk_type type) | ^~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:80:19: error: non-static declaration of 'housekeeping_test_cpu' follows static declaration 80 | EXPORT_SYMBOL_GPL(housekeeping_test_cpu); | ^~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:80:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 80 | EXPORT_SYMBOL_GPL(housekeeping_test_cpu); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:73:6: note: previous definition of 'housekeeping_test_cpu' with type 'bool(int, enum hk_type)' {aka '_Bool(int, enum hk_type)'} 73 | bool housekeeping_test_cpu(int cpu, enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:100:20: error: invalid storage class for function 'housekeeping_setup_type' 100 | static void __init housekeeping_setup_type(enum hk_type type, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:109:19: error: invalid storage class for function 'housekeeping_setup' 109 | static int __init housekeeping_setup(char *str, unsigned long flags) | ^~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:180:19: error: invalid storage class for function 'housekeeping_nohz_full_setup' 180 | static int __init housekeeping_nohz_full_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/printk.h:6, from include/linux/kernel.h:30: kernel/sched/isolation.c:189:23: error: initializer element is not constant 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:189:1: note: in expansion of macro '__setup' 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~ kernel/sched/isolation.c:189:23: note: (near initialization for '__setup_housekeeping_nohz_full_setup.setup_func') 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:189:1: note: in expansion of macro '__setup' 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~ kernel/sched/isolation.c:191:19: error: invalid storage class for function 'housekeeping_isolcpus_setup' 191 | static int __init housekeeping_isolcpus_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:241:22: error: initializer element is not constant 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup' 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~ kernel/sched/isolation.c:241:22: note: (near initialization for '__setup_housekeeping_isolcpus_setup.setup_func') 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup' 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~ >> kernel/sched/isolation.c:244:19: error: invalid storage class for function 'enhanced_isolcpus_setup' 244 | static int __init enhanced_isolcpus_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:249:30: error: initializer element is not constant 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:249:1: note: in expansion of macro '__setup' 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~ kernel/sched/isolation.c:249:30: note: (near initialization for '__setup_enhanced_isolcpus_setup.setup_func') 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:249:1: note: in expansion of macro '__setup' 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~ In file included from kernel/sched/build_utility.c:109: kernel/sched/autogroup.c:7:28: error: section attribute cannot be specified for local variables 7 | unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:15:35: error: initializer element is not constant 15 | .data = &sysctl_sched_autogroup_enabled, | ^ kernel/sched/autogroup.c:15:35: note: (near initialization for 'sched_autogroup_sysctls[0].data') kernel/sched/autogroup.c:25:20: error: invalid storage class for function 'sched_autogroup_sysctl_init' 25 | static void __init sched_autogroup_sysctl_init(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:47:20: error: invalid storage class for function 'autogroup_destroy' 47 | static inline void autogroup_destroy(struct kref *kref) | ^~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:60:20: error: invalid storage class for function 'autogroup_kref_put' 60 | static inline void autogroup_kref_put(struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:65:33: error: invalid storage class for function 'autogroup_kref_get' 65 | static inline struct autogroup *autogroup_kref_get(struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:71:33: error: invalid storage class for function 'autogroup_task_get' 71 | static inline struct autogroup *autogroup_task_get(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:85:33: error: invalid storage class for function 'autogroup_create' 85 | static inline struct autogroup *autogroup_create(void) | ^~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:158:1: error: invalid storage class for function 'autogroup_move_group' 158 | autogroup_move_group(struct task_struct *p, struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:202:15: error: non-static declaration of 'sched_autogroup_create_attach' follows static declaration 202 | EXPORT_SYMBOL(sched_autogroup_create_attach); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL' 86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "") | ^~~~~~~~~~~~~~ kernel/sched/autogroup.c:202:1: note: in expansion of macro 'EXPORT_SYMBOL' 202 | EXPORT_SYMBOL(sched_autogroup_create_attach); | ^~~~~~~~~~~~~ kernel/sched/autogroup.c:193:6: note: previous definition of 'sched_autogroup_create_attach' with type 'void(struct task_struct *)' 193 | void sched_autogroup_create_attach(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:209:15: error: non-static declaration of 'sched_autogroup_detach' follows static declaration 209 | EXPORT_SYMBOL(sched_autogroup_detach); | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL' 86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "") | ^~~~~~~~~~~~~~ kernel/sched/autogroup.c:209:1: note: in expansion of macro 'EXPORT_SYMBOL' 209 | EXPORT_SYMBOL(sched_autogroup_detach); | ^~~~~~~~~~~~~ kernel/sched/autogroup.c:205:6: note: previous definition of 'sched_autogroup_detach' with type 'void(struct task_struct *)' 205 | void sched_autogroup_detach(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:221:19: error: invalid storage class for function 'setup_autogroup' 221 | static int __init setup_autogroup(char *str) | ^~~~~~~~~~~~~~~ kernel/sched/autogroup.c:227:24: error: initializer element is not constant 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup' 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~ kernel/sched/autogroup.c:227:24: note: (near initialization for '__setup_setup_autogroup.setup_func') 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup' 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~ vim +/enhanced_isolcpus_setup +244 kernel/sched/isolation.c 242 243 bool enhanced_isolcpus; > 244 static int __init enhanced_isolcpus_setup(char *str) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION a00ba8b54d9123a4242dc589aee8122a3adf0d4a
by kernel test robot 11 May '24

11 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: a00ba8b54d9123a4242dc589aee8122a3adf0d4a !3184 [OLK-6.6] add support for Zhaoxin ZXPAUSE instruction Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allnoconfig | `-- arch-arm64-kernel-cpufeature.c:error:enable_pseudo_nmi-undeclared-(first-use-in-this-function) |-- x86_64-randconfig-005-20240511 | `-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:error:struct-pci_dev-has-no-member-named-physfn |-- x86_64-randconfig-012-20240511 | |-- arch-x86-include-asm-syscall_wrapper.h:error:implicit-declaration-of-function-__do_sys_membarrier | |-- arch-x86-include-asm-syscall_wrapper.h:error:implicit-declaration-of-function-__se_sys_membarrier | |-- arch-x86-include-asm-syscall_wrapper.h:error:invalid-storage-class-for-function-__do_sys_membarrier | |-- arch-x86-include-asm-syscall_wrapper.h:error:invalid-storage-class-for-function-__se_sys_membarrier | |-- arch-x86-include-asm-syscall_wrapper.h:error:static-declaration-of-__ia32_sys_membarrier-follows-non-static-declaration | |-- arch-x86-include-asm-syscall_wrapper.h:error:static-declaration-of-__x64_sys_membarrier-follows-non-static-declaration | `-- include-linux-compiler.h:error:initializer-element-is-not-constant |-- x86_64-randconfig-074-20240511 | `-- ld:drivers-video-fbdev-ls2k500sfb.c:(.text):undefined-reference-to-fg_console `-- x86_64-randconfig-075-20240511 |-- arch-x86-include-asm-syscall_wrapper.h:error:implicit-declaration-of-function-__do_sys_membarrier |-- arch-x86-include-asm-syscall_wrapper.h:error:implicit-declaration-of-function-__se_sys_membarrier |-- arch-x86-include-asm-syscall_wrapper.h:error:invalid-storage-class-for-function-__do_sys_membarrier |-- arch-x86-include-asm-syscall_wrapper.h:error:invalid-storage-class-for-function-__se_sys_membarrier |-- arch-x86-include-asm-syscall_wrapper.h:error:static-declaration-of-__ia32_sys_membarrier-follows-non-static-declaration |-- arch-x86-include-asm-syscall_wrapper.h:error:static-declaration-of-__x64_sys_membarrier-follows-non-static-declaration `-- include-linux-compiler.h:error:initializer-element-is-not-constant clang_recent_errors |-- arm64-allmodconfig | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_before_active_check | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_destroy | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_init_slave | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_netdev_event | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_service_proc | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_tracker_get | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_deatch_bond | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_detach_nic_bond_work | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev_by_name | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_queue_bond_work | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq_destroy.c:warning:no-previous-prototype-for-function-roce3_cq_hw2sw | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_cleanup_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_init_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_alloc | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_disable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_enable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_res.c:warning:no-previous-prototype-for-function-hmm_rdma_mpt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_alloc_mr | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_free_tpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_umem_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_context_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_ext_ctx_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_dif_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_verbs_cmd.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-mr-roce_mr.c:warning:no-previous-prototype-for-function-roce3_check_mr_status | |-- drivers-infiniband-hw-hiroce3-rdma-rdma_comp.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_bond_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_link_event | |-- drivers-infiniband-hw-hiroce3-roce_sysfs.c:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_io_flush.c:warning:no-previous-prototype-for-function-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_error.c:warning:no-previous-prototype-for-function-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_shutdown.c:warning:no-previous-prototype-for-function-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-bat_table-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_fill_cla | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_numb-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_type-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_fill_cla()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_lock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_unlock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_xyz()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-free_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-malloc_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-bloomfilter_init_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-k_flag-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-op-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-bloomfilter_init_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_dec()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_inc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd_buf-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box_async()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_imm()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_record-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-direct_wqe-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-object-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-pagenum-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_get_db_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_direct_wqe_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_fc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_update_pri()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_software_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_get_hardware_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-data-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-event-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_capability_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_template-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_aeq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_capability_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ecq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nocq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_scq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_register()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_unregister()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-bh-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-common-not-described-in-cqm_object_share_recv_queue_add_container | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_number-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_gid_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_timer_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-function_id-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-global_funcid-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_base-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_number-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-init_rq_num-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_funcid | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_old | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-room_header_alloc-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-xid-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_hash_buf_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_timer_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_gid_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_fc_srq_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_funcid()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_alloc_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_old()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_add_container()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_timer_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_free_srq_bitmap_index | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-common-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-container_addr-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link_mode-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_container_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_used_rq_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_head_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_tail_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-tail-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_per_buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_linkwqe_fill()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_bitmap_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_container_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_used_rq_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hw_cfg.c:warning:expecting-prototype-for-hinic_set_vf_dev_cap().-Prototype-was-for-hinic3_init_vf_dev_cap()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_get | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_hw | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__mbox_to_host | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-comm_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-get_slave_func_netdev_state | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hilink_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_get_master_host_mbox_enable | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_nic_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_register_slave_ppf | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-set_slave_func_nic_state | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-sw_func_ppf_mbox_handler |-- x86_64-allnoconfig | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:linux-version.h-not-needed. | |-- drivers-infiniband-hw-hiroce3-roce.h:linux-version.h-not-needed. | |-- drivers-net-ethernet-huawei-hinic3-bond-hinic3_bond.c:linux-version.h-not-needed. | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:hinic3_hwif.h-is-included-more-than-once. `-- x86_64-buildonly-randconfig-006-20240511 |-- ld.lld:error:undefined-symbol:public_key_free `-- ld.lld:error:undefined-symbol:public_key_subtype elapsed time: 732m configs tested: 40 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240510 clang arm64 randconfig-002-20240510 gcc arm64 randconfig-003-20240510 clang arm64 randconfig-004-20240510 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240510 gcc loongarch randconfig-002-20240510 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240511 gcc x86_64 buildonly-randconfig-002-20240511 gcc x86_64 buildonly-randconfig-003-20240511 gcc x86_64 buildonly-randconfig-004-20240511 gcc x86_64 buildonly-randconfig-005-20240511 clang x86_64 buildonly-randconfig-006-20240511 clang x86_64 defconfig gcc x86_64 randconfig-001-20240511 clang x86_64 randconfig-002-20240511 clang x86_64 randconfig-003-20240511 clang x86_64 randconfig-004-20240511 gcc x86_64 randconfig-005-20240511 gcc x86_64 randconfig-006-20240511 clang x86_64 randconfig-011-20240511 clang x86_64 randconfig-012-20240511 gcc x86_64 randconfig-013-20240511 gcc x86_64 randconfig-014-20240511 gcc x86_64 randconfig-015-20240511 gcc x86_64 randconfig-016-20240511 gcc x86_64 randconfig-071-20240511 gcc x86_64 randconfig-072-20240511 gcc x86_64 randconfig-073-20240511 clang x86_64 randconfig-074-20240511 gcc x86_64 randconfig-075-20240511 gcc x86_64 randconfig-076-20240511 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 8caff8afe5a7c894f7a71a8a6cfb990a05f04cfb
by kernel test robot 11 May '24

11 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 8caff8afe5a7c894f7a71a8a6cfb990a05f04cfb !7044 v2 nfs: fix UAF in direct writes Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-arm-cpu.yaml:properties:capacity-dmips-mhz:ref-should-not-be-valid-under-const:ref | |-- Documentation-devicetree-bindings-arm-cpu.yaml:title:ARM-CPUs-bindings-should-not-be-valid-under-pattern:(-Bb-inding-Ss-chema) | |-- Documentation-devicetree-bindings-arm-cpus.yaml:examples:cpus-arm-pbha-performance-only-bits-arm-pbha-no-aliases-bits-ncpu-device_type-cpu-compatible-arm-cortex-a57-...-n-is-not-of-type-array | |-- Documentation-devicetree-bindings-arm-cpus.yaml:maintainers-is-a-required-property | |-- description:Display-controller-reference-clock-source-is-not-of-type-object-boolean | |-- description:Display-controller-reference-clock-source-is-too-short | |-- description:Offset-and-length-of-the-memory-mapped-registers-is-too-short | |-- items-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneOf-r | `-- minItems-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneO `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst `-- drivers-net-ethernet-mucse-rnpm-rnpm_common.h:linux-version.h-not-needed. elapsed time: 729m configs tested: 35 configs skipped: 133 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240510 clang arm64 randconfig-002-20240510 gcc arm64 randconfig-003-20240510 clang arm64 randconfig-004-20240510 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240511 gcc x86_64 buildonly-randconfig-002-20240511 gcc x86_64 buildonly-randconfig-003-20240511 gcc x86_64 buildonly-randconfig-004-20240511 gcc x86_64 buildonly-randconfig-005-20240511 clang x86_64 buildonly-randconfig-006-20240511 clang x86_64 defconfig gcc x86_64 randconfig-001-20240511 clang x86_64 randconfig-002-20240511 clang x86_64 randconfig-003-20240511 clang x86_64 randconfig-004-20240511 gcc x86_64 randconfig-005-20240511 gcc x86_64 randconfig-006-20240511 clang x86_64 randconfig-011-20240511 clang x86_64 randconfig-012-20240511 gcc x86_64 randconfig-013-20240511 gcc x86_64 randconfig-014-20240511 gcc x86_64 randconfig-015-20240511 gcc x86_64 randconfig-016-20240511 gcc x86_64 randconfig-071-20240511 gcc x86_64 randconfig-072-20240511 gcc x86_64 randconfig-073-20240511 clang x86_64 randconfig-074-20240511 gcc x86_64 randconfig-075-20240511 gcc x86_64 randconfig-076-20240511 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18554/22398] drivers/net/ethernet/netswift/ngbe/ngbe_main.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 11 May '24

11 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a786a35ec1aeb84a5ff258956854c2eaebec12b7 commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [18554/22398] net: ngbe: Add Netswift Giga NIC driver config: x86_64-buildonly-randconfig-004-20240510 (https://download.01.org/0day-ci/archive/20240511/202405110244.yz4AxkCm-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240511/202405110244.yz4AxkCm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405110244.yz4AxkCm-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/netswift/ngbe/ngbe_main.c:38: drivers/net/ethernet/netswift/ngbe/ngbe.h:764:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:170:6: warning: no previous prototype for function 'ngbe_service_event_schedule' [-Wmissing-prototypes] 170 | void ngbe_service_event_schedule(struct ngbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:170:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 170 | void ngbe_service_event_schedule(struct ngbe_adapter *adapter) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:433:7: warning: variable 'real_tx_hang' set but not used [-Wunused-but-set-variable] 433 | bool real_tx_hang = false; | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3223:6: warning: no previous prototype for function 'ngbe_configure_isb' [-Wmissing-prototypes] 3223 | void ngbe_configure_isb(struct ngbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3223:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3223 | void ngbe_configure_isb(struct ngbe_adapter *adapter) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3233:6: warning: no previous prototype for function 'ngbe_configure_port' [-Wmissing-prototypes] 3233 | void ngbe_configure_port(struct ngbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3233:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3233 | void ngbe_configure_port(struct ngbe_adapter *adapter) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3592:6: warning: no previous prototype for function 'ngbe_disable_device' [-Wmissing-prototypes] 3592 | void ngbe_disable_device(struct ngbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3592:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3592 | void ngbe_disable_device(struct ngbe_adapter *adapter) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3693:5: warning: no previous prototype for function 'ngbe_init_shared_code' [-Wmissing-prototypes] 3693 | s32 ngbe_init_shared_code(struct ngbe_hw *hw) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3693:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3693 | s32 ngbe_init_shared_code(struct ngbe_hw *hw) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5810:5: warning: no previous prototype for function 'ngbe_skb_pad_nonzero' [-Wmissing-prototypes] 5810 | int ngbe_skb_pad_nonzero(struct sk_buff *skb, int pad) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5810:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5810 | int ngbe_skb_pad_nonzero(struct sk_buff *skb, int pad) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6010:6: warning: variable 'prtad' set but not used [-Wunused-but-set-variable] 6010 | int prtad, devad, ret = 0; | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6010:13: warning: variable 'devad' set but not used [-Wunused-but-set-variable] 6010 | int prtad, devad, ret = 0; | ^ 10 warnings generated. drivers/net/ethernet/netswift/ngbe/ngbe_main.c:257: warning: Function parameter or member 'quiet' not described in 'ngbe_read_reg' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:1644: warning: Function parameter or member 'queues' not described in 'ngbe_irq_enable' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:1644: warning: Function parameter or member 'flush' not described in 'ngbe_irq_enable' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2035: warning: Function parameter or member 'adapter' not described in 'ngbe_configure_msi_and_legacy' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2449: warning: Function parameter or member 'adapter' not described in 'ngbe_configure_bridge_mode' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2913: warning: Function parameter or member 'pool' not described in 'ngbe_write_uc_addr_list' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3722: warning: cannot understand function prototype: 'const u32 def_rss_key[10] = ' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4583: warning: Function parameter or member 'adapter' not described in 'ngbe_check_hang_subtask' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4648: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_update_link_status' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4744: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_link_is_up' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4789: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_link_is_down' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4856: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_flush_tx' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4928: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_subtask' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4957: warning: Function parameter or member 't' not described in 'ngbe_service_timer' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4957: warning: Excess function parameter 'data' description in 'ngbe_service_timer' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6043: warning: Function parameter or member 'dev' not described in 'ngbe_setup_tc' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6043: warning: Excess function parameter 'netdev' description in 'ngbe_setup_tc' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6297: warning: Excess function parameter 'device_id' description in 'ngbe_wol_supported' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6297: warning: Excess function parameter 'subdev_id' description in 'ngbe_wol_supported' >> drivers/net/ethernet/netswift/ngbe/ngbe_main.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 2935/22394] net/netfilter/xt_TEE.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 11 May '24

11 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a786a35ec1aeb84a5ff258956854c2eaebec12b7 commit: 4868e78c935a8da49eb80e1af8710d2a1ad27624 [2935/22394] netfilter: xt_TEE: fix wrong interface selection config: x86_64-buildonly-randconfig-004-20240509 (https://download.01.org/0day-ci/archive/20240511/202405110005.f8e8EhFW-lkp@…) compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240511/202405110005.f8e8EhFW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405110005.f8e8EhFW-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/netfilter/xt_TEE.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 14777/22394] drivers/scsi/huawei/hifc/hifc_portmng.o: warning: objtool: missing symbol for section .text
by kernel test robot 10 May '24

10 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a786a35ec1aeb84a5ff258956854c2eaebec12b7 commit: 7fc993d55d1b54ae40e29dfac825a18d04d644c6 [14777/22394] scsi/hifc: add hifc driver FC service module config: x86_64-buildonly-randconfig-004-20240510 (https://download.01.org/0day-ci/archive/20240510/202405102258.1OIgsP3m-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240510/202405102258.1OIgsP3m-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405102258.1OIgsP3m-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/scsi/huawei/hifc/hifc_portmng.c:6: In file included from drivers/scsi/huawei/hifc/hifc_module.h:10: In file included from drivers/scsi/huawei/hifc/unf_common.h:9: In file included from drivers/scsi/huawei/hifc/unf_scsi_common.h:10: In file included from drivers/scsi/huawei/hifc/hifc_knl_adp.h:30: In file included from include/scsi/scsi_host.h:12: In file included from include/linux/blk-mq.h:5: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/huawei/hifc/hifc_portmng.c:570:5: warning: no previous prototype for function 'hifc_dfx_get_rxtx_error_state' [-Wmissing-prototypes] 570 | int hifc_dfx_get_rxtx_error_state(void *v_hba, void *v_buff_out) | ^ drivers/scsi/huawei/hifc/hifc_portmng.c:570:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 570 | int hifc_dfx_get_rxtx_error_state(void *v_hba, void *v_buff_out) | ^ | static drivers/scsi/huawei/hifc/hifc_portmng.c:1118:14: warning: no previous prototype for function 'hifc_port_info' [-Wmissing-prototypes] 1118 | unsigned int hifc_port_info(struct unf_hinicam_pkg *v_input) | ^ drivers/scsi/huawei/hifc/hifc_portmng.c:1118:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1118 | unsigned int hifc_port_info(struct unf_hinicam_pkg *v_input) | ^ | static 3 warnings generated. >> drivers/scsi/huawei/hifc/hifc_portmng.o: warning: objtool: missing symbol for section .text -- In file included from drivers/scsi/huawei/hifc/hifc_cmdq.c:21: In file included from drivers/scsi/huawei/hifc/hifc_knl_adp.h:30: In file included from include/scsi/scsi_host.h:12: In file included from include/linux/blk-mq.h:5: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/huawei/hifc/hifc_cmdq.c:1316:5: warning: no previous prototype for function 'hifc_set_cmdq_ctxts' [-Wmissing-prototypes] 1316 | int hifc_set_cmdq_ctxts(struct hifc_hwdev *hwdev) | ^ drivers/scsi/huawei/hifc/hifc_cmdq.c:1316:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1316 | int hifc_set_cmdq_ctxts(struct hifc_hwdev *hwdev) | ^ | static 2 warnings generated. >> drivers/scsi/huawei/hifc/hifc_cmdq.o: warning: objtool: missing symbol for section .text -- In file included from drivers/scsi/huawei/hifc/unf_event.c:8: In file included from drivers/scsi/huawei/hifc/unf_common.h:9: In file included from drivers/scsi/huawei/hifc/unf_scsi_common.h:10: In file included from drivers/scsi/huawei/hifc/hifc_knl_adp.h:30: In file included from include/scsi/scsi_host.h:12: In file included from include/linux/blk-mq.h:5: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/huawei/hifc/unf_event.c:18:14: warning: no previous prototype for function 'unf_init_event_msg' [-Wmissing-prototypes] 18 | unsigned int unf_init_event_msg(struct unf_lport_s *v_lport) | ^ drivers/scsi/huawei/hifc/unf_event.c:18:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 18 | unsigned int unf_init_event_msg(struct unf_lport_s *v_lport) | ^ | static drivers/scsi/huawei/hifc/unf_event.c:69:6: warning: no previous prototype for function 'unf_init_event_node' [-Wmissing-prototypes] 69 | void unf_init_event_node(struct unf_cm_event_report *v_event_node) | ^ drivers/scsi/huawei/hifc/unf_event.c:69:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 69 | void unf_init_event_node(struct unf_cm_event_report *v_event_node) | ^ | static drivers/scsi/huawei/hifc/unf_event.c:85:29: warning: no previous prototype for function 'unf_get_free_event_node' [-Wmissing-prototypes] 85 | struct unf_cm_event_report *unf_get_free_event_node(void *v_lport) | ^ drivers/scsi/huawei/hifc/unf_event.c:85:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 85 | struct unf_cm_event_report *unf_get_free_event_node(void *v_lport) | ^ | static drivers/scsi/huawei/hifc/unf_event.c:128:6: warning: no previous prototype for function 'unf_check_event_mgr_status' [-Wmissing-prototypes] 128 | void unf_check_event_mgr_status(struct unf_event_mgr *v_event_mgr) | ^ drivers/scsi/huawei/hifc/unf_event.c:128:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 128 | void unf_check_event_mgr_status(struct unf_event_mgr *v_event_mgr) | ^ | static drivers/scsi/huawei/hifc/unf_event.c:142:6: warning: no previous prototype for function 'unf_release_event' [-Wmissing-prototypes] 142 | void unf_release_event(void *v_lport, void *v_event_node) | ^ drivers/scsi/huawei/hifc/unf_event.c:142:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 142 | void unf_release_event(void *v_lport, void *v_event_node) | ^ | static drivers/scsi/huawei/hifc/unf_event.c:166:6: warning: no previous prototype for function 'unf_post_event' [-Wmissing-prototypes] 166 | void unf_post_event(void *v_lport, void *v_event_node) | ^ drivers/scsi/huawei/hifc/unf_event.c:166:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 166 | void unf_post_event(void *v_lport, void *v_event_node) | ^ | static drivers/scsi/huawei/hifc/unf_event.c:249:6: warning: no previous prototype for function 'unf_wait_event_mgr_complete' [-Wmissing-prototypes] 249 | void unf_wait_event_mgr_complete(struct unf_event_mgr *v_event_mgr) | ^ drivers/scsi/huawei/hifc/unf_event.c:249:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 249 | void unf_wait_event_mgr_complete(struct unf_event_mgr *v_event_mgr) | ^ | static drivers/scsi/huawei/hifc/unf_event.c:355:6: warning: no previous prototype for function 'unf_release_global_event' [-Wmissing-prototypes] 355 | void unf_release_global_event(void *v_event_node) | ^ drivers/scsi/huawei/hifc/unf_event.c:355:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 355 | void unf_release_global_event(void *v_event_node) | ^ | static 9 warnings generated. >> drivers/scsi/huawei/hifc/unf_event.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18554/22394] drivers/net/ethernet/netswift/ngbe/.tmp_ngbe_phy.o: warning: objtool: missing symbol for section .text
by kernel test robot 10 May '24

10 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f35cd2565c44b31298a14d8e033e94bfed1b0e1c commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [18554/22394] net: ngbe: Add Netswift Giga NIC driver config: x86_64-buildonly-randconfig-001-20240510 (https://download.01.org/0day-ci/archive/20240510/202405102228.PBZNkwU1-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240510/202405102228.PBZNkwU1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405102228.PBZNkwU1-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/sctp.h:57, from drivers/net/ethernet/netswift/ngbe/ngbe.h:28, from drivers/net/ethernet/netswift/ngbe/ngbe_phy.h:22, from drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:19: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe.h: In function 'ngbe_misc_isb': drivers/net/ethernet/netswift/ngbe/ngbe.h:764:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c: At top level: drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:30:6: warning: no previous prototype for 'ngbe_check_reset_blocked' [-Wmissing-prototypes] 30 | bool ngbe_check_reset_blocked(struct ngbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:47:5: warning: no previous prototype for 'ngbe_phy_read_reg' [-Wmissing-prototypes] 47 | s32 ngbe_phy_read_reg(struct ngbe_hw *hw, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:70:5: warning: no previous prototype for 'ngbe_phy_write_reg' [-Wmissing-prototypes] 70 | s32 ngbe_phy_write_reg(struct ngbe_hw *hw, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:89:5: warning: no previous prototype for 'ngbe_check_internal_phy_id' [-Wmissing-prototypes] 89 | s32 ngbe_check_internal_phy_id(struct ngbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:269:5: warning: no previous prototype for 'ngbe_check_mdi_phy_id' [-Wmissing-prototypes] 269 | s32 ngbe_check_mdi_phy_id(struct ngbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:300:6: warning: no previous prototype for 'ngbe_validate_phy_addr' [-Wmissing-prototypes] 300 | bool ngbe_validate_phy_addr(struct ngbe_hw *hw, u32 phy_addr) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:316:5: warning: no previous prototype for 'ngbe_check_yt_phy_id' [-Wmissing-prototypes] 316 | s32 ngbe_check_yt_phy_id(struct ngbe_hw *hw) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1037:5: warning: no previous prototype for 'ngbe_phy_get_advertised_pause' [-Wmissing-prototypes] 1037 | s32 ngbe_phy_get_advertised_pause(struct ngbe_hw *hw, u8 *pause_bit) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1074:5: warning: no previous prototype for 'ngbe_phy_get_lp_advertised_pause' [-Wmissing-prototypes] 1074 | s32 ngbe_phy_get_lp_advertised_pause(struct ngbe_hw *hw, u8 *pause_bit) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1119:5: warning: no previous prototype for 'ngbe_phy_set_pause_advertisement' [-Wmissing-prototypes] 1119 | s32 ngbe_phy_set_pause_advertisement(struct ngbe_hw *hw, u16 pause_bit) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1167:5: warning: no previous prototype for 'ngbe_phy_setup' [-Wmissing-prototypes] 1167 | s32 ngbe_phy_setup(struct ngbe_hw *hw) | ^~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c: In function 'ngbe_phy_get_lp_advertised_pause': drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1082:30: warning: 'value' may be used uninitialized [-Wmaybe-uninitialized] 1082 | value = (value >> 5) & 0x1; | ~~~~~~~~~~~~~^~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1076:13: note: 'value' declared here 1076 | u16 value; | ^~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:123: warning: Function parameter or member 'device_type' not described in 'ngbe_phy_read_reg_mdi' >> drivers/net/ethernet/netswift/ngbe/.tmp_ngbe_phy.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v2] scsi: sd: Fix sd_do_mode_sense() buffer length handling
by Li Nan 10 May '24

10 May '24

From: Damien Le Moal <damien.lemoal(a)wdc.com> mainline inclusion from mainline-v5.16-rc1 commit c749301ebee82eb5e97dec14b6ab31a4aabe37a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFK CVE: CVE-2021-47182 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For devices that explicitly asked for MODE SENSE(10) use, make sure that scsi_mode_sense() is called with a buffer of at least 8 bytes so that the sense header fits. Link: https://lore.kernel.org/r/20210820070255.682775-4-damien.lemoal@wdc.com Signed-off-by: Damien Le Moal <damien.lemoal(a)wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Fixes: 907ea672e30b ("scsi: core: Fix scsi_mode_sense() buffer length handling") Conflicts: drivers/scsi/sd.c [ Mianline commit 0610959fbbca ("scsi: sd: Allow user to configure command retries") use 'sdkp->device' intead of 'sdp'. ] Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/scsi/sd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 45d6174d3458..f618726bbe70 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -2612,6 +2612,13 @@ sd_do_mode_sense(struct scsi_device *sdp, int dbd, int modepage, unsigned char *buffer, int len, struct scsi_mode_data *data, struct scsi_sense_hdr *sshdr) { + /* + * If we must use MODE SENSE(10), make sure that the buffer length + * is at least 8 bytes so that the mode sense header fits. + */ + if (sdp->use_10_for_ms && len < 8) + len = 8; + return scsi_mode_sense(sdp, dbd, modepage, buffer, len, SD_TIMEOUT, SD_MAX_RETRIES, data, sshdr); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: sd: Fix sd_do_mode_sense() buffer length handling
by Li Nan 10 May '24

10 May '24

From: Damien Le Moal <damien.lemoal(a)wdc.com> mainline inclusion from mainline-v5.16-rc1 commit c749301ebee82eb5e97dec14b6ab31a4aabe37a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFK CVE: CVE-2021-47182 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For devices that explicitly asked for MODE SENSE(10) use, make sure that scsi_mode_sense() is called with a buffer of at least 8 bytes so that the sense header fits. Link: https://lore.kernel.org/r/20210820070255.682775-4-damien.lemoal@wdc.com Signed-off-by: Damien Le Moal <damien.lemoal(a)wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Fixes: 907ea672e30b ("scsi: core: Fix scsi_mode_sense() buffer length handling") Conflicts: drivers/scsi/sd.c [ Mianline commit 0610959fbbca ("scsi: sd: Allow user to configure command retries") changed context. ] Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/scsi/sd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 45d6174d3458..8d3f8ac2d1ce 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -2612,6 +2612,13 @@ sd_do_mode_sense(struct scsi_device *sdp, int dbd, int modepage, unsigned char *buffer, int len, struct scsi_mode_data *data, struct scsi_sense_hdr *sshdr) { + /* + * If we must use MODE SENSE(10), make sure that the buffer length + * is at least 8 bytes so that the mode sense header fits. + */ + if (sdkp->device->use_10_for_ms && len < 8) + len = 8; + return scsi_mode_sense(sdp, dbd, modepage, buffer, len, SD_TIMEOUT, SD_MAX_RETRIES, data, sshdr); -- 2.39.2

2 1

[PATCH OLK-5.10] scsi: sd: Fix sd_do_mode_sense() buffer length handling
by Li Nan 10 May '24

10 May '24

From: Damien Le Moal <damien.lemoal(a)wdc.com> mainline inclusion from mainline-v5.16-rc1 commit c749301ebee82eb5e97dec14b6ab31a4aabe37a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFK CVE: CVE-2021-47182 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For devices that explicitly asked for MODE SENSE(10) use, make sure that scsi_mode_sense() is called with a buffer of at least 8 bytes so that the sense header fits. Link: https://lore.kernel.org/r/20210820070255.682775-4-damien.lemoal@wdc.com Signed-off-by: Damien Le Moal <damien.lemoal(a)wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Fixes: 46708639bcd8 ("[Backport] scsi: core: Fix scsi_mode_sense() buffer length handling") Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/scsi/sd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 5385805e06a8..595891482986 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -2657,6 +2657,13 @@ sd_do_mode_sense(struct scsi_disk *sdkp, int dbd, int modepage, unsigned char *buffer, int len, struct scsi_mode_data *data, struct scsi_sense_hdr *sshdr) { + /* + * If we must use MODE SENSE(10), make sure that the buffer length + * is at least 8 bytes so that the mode sense header fits. + */ + if (sdkp->device->use_10_for_ms && len < 8) + len = 8; + return scsi_mode_sense(sdkp->device, dbd, modepage, buffer, len, SD_TIMEOUT, sdkp->max_retries, data, sshdr); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: sd: Fix sd_do_mode_sense() buffer length handling
by Li Nan 10 May '24

10 May '24

From: Damien Le Moal <damien.lemoal(a)wdc.com> mainline inclusion from mainline-v5.16-rc1 commit c749301ebee82eb5e97dec14b6ab31a4aabe37a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFK CVE: CVE-2021-47182 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For devices that explicitly asked for MODE SENSE(10) use, make sure that scsi_mode_sense() is called with a buffer of at least 8 bytes so that the sense header fits. Link: https://lore.kernel.org/r/20210820070255.682775-4-damien.lemoal@wdc.com Signed-off-by: Damien Le Moal <damien.lemoal(a)wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Fixes: 907ea672e30b ("scsi: core: Fix scsi_mode_sense() buffer length handling") Conflicts: drivers/scsi/sd.c [ Mianline commit 0610959fbbca ("scsi: sd: Allow user to configure command retries") changed context. ] Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/scsi/sd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 45d6174d3458..8d3f8ac2d1ce 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -2612,6 +2612,13 @@ sd_do_mode_sense(struct scsi_device *sdp, int dbd, int modepage, unsigned char *buffer, int len, struct scsi_mode_data *data, struct scsi_sense_hdr *sshdr) { + /* + * If we must use MODE SENSE(10), make sure that the buffer length + * is at least 8 bytes so that the mode sense header fits. + */ + if (sdkp->device->use_10_for_ms && len < 8) + len = 8; + return scsi_mode_sense(sdp, dbd, modepage, buffer, len, SD_TIMEOUT, SD_MAX_RETRIES, data, sshdr); -- 2.39.2

2 1

[PATCH OLK-6.6 1/2] netfilter: bridge: confirm multicast packets before passing them up the stack
by Ziyang Xuan 10 May '24

10 May '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v6.6.21 commit 80cd0487f630b5382734997c3e5e3003a77db315 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9MPZ8 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 62e7151ae3eb465e0ab52a20c941ff33bb6332e9 ] conntrack nf_confirm logic cannot handle cloned skbs referencing the same nf_conn entry, which will happen for multicast (broadcast) frames on bridges. Example: macvlan0 | br0 / \ ethX ethY ethX (or Y) receives a L2 multicast or broadcast packet containing an IP packet, flow is not yet in conntrack table. 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting. -> skb->_nfct now references a unconfirmed entry 2. skb is broad/mcast packet. bridge now passes clones out on each bridge interface. 3. skb gets passed up the stack. 4. In macvlan case, macvlan driver retains clone(s) of the mcast skb and schedules a work queue to send them out on the lower devices. The clone skb->_nfct is not a copy, it is the same entry as the original skb. The macvlan rx handler then returns RX_HANDLER_PASS. 5. Normal conntrack hooks (in NF_INET_LOCAL_IN) confirm the orig skb. The Macvlan broadcast worker and normal confirm path will race. This race will not happen if step 2 already confirmed a clone. In that case later steps perform skb_clone() with skb->_nfct already confirmed (in hash table). This works fine. But such confirmation won't happen when eb/ip/nftables rules dropped the packets before they reached the nf_confirm step in postrouting. Pablo points out that nf_conntrack_bridge doesn't allow use of stateful nat, so we can safely discard the nf_conn entry and let inet call conntrack again. This doesn't work for bridge netfilter: skb could have a nat transformation. Also bridge nf prevents re-invocation of inet prerouting via 'sabotage_in' hook. Work around this problem by explicit confirmation of the entry at LOCAL_IN time, before upper layer has a chance to clone the unconfirmed entry. The downside is that this disables NAT and conntrack helpers. Alternative fix would be to add locking to all code parts that deal with unconfirmed packets, but even if that could be done in a sane way this opens up other problems, for example: -m physdev --physdev-out eth0 -j SNAT --snat-to 1.2.3.4 -m physdev --physdev-out eth1 -j SNAT --snat-to 1.2.3.5 For multicast case, only one of such conflicting mappings will be created, conntrack only handles 1:1 NAT mappings. Users should set create a setup that explicitly marks such traffic NOTRACK (conntrack bypass) to avoid this, but we cannot auto-bypass them, ruleset might have accept rules for untracked traffic already, so user-visible behaviour would change. Suggested-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217777 Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- include/linux/netfilter.h | 1 + net/bridge/br_netfilter_hooks.c | 96 ++++++++++++++++++++++ net/bridge/netfilter/nf_conntrack_bridge.c | 30 +++++++ net/netfilter/nf_conntrack_core.c | 1 + 4 files changed, 128 insertions(+) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 94fac194a7b1..f3658dd0d28d 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -471,6 +471,7 @@ struct nf_ct_hook { const struct sk_buff *); void (*attach)(struct sk_buff *nskb, const struct sk_buff *skb); void (*set_closing)(struct nf_conntrack *nfct); + int (*confirm)(struct sk_buff *skb); KABI_RESERVE(1) KABI_RESERVE(2) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c index 92dae4c4922c..6ef67030b4db 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -43,6 +43,10 @@ #include <linux/sysctl.h> #endif +#if IS_ENABLED(CONFIG_NF_CONNTRACK) +#include <net/netfilter/nf_conntrack_core.h> +#endif + static unsigned int brnf_net_id __read_mostly; struct brnf_net { @@ -553,6 +557,90 @@ static unsigned int br_nf_pre_routing(void *priv, return NF_STOLEN; } +#if IS_ENABLED(CONFIG_NF_CONNTRACK) +/* conntracks' nf_confirm logic cannot handle cloned skbs referencing + * the same nf_conn entry, which will happen for multicast (broadcast) + * Frames on bridges. + * + * Example: + * macvlan0 + * br0 + * ethX ethY + * + * ethX (or Y) receives multicast or broadcast packet containing + * an IP packet, not yet in conntrack table. + * + * 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting. + * -> skb->_nfct now references a unconfirmed entry + * 2. skb is broad/mcast packet. bridge now passes clones out on each bridge + * interface. + * 3. skb gets passed up the stack. + * 4. In macvlan case, macvlan driver retains clone(s) of the mcast skb + * and schedules a work queue to send them out on the lower devices. + * + * The clone skb->_nfct is not a copy, it is the same entry as the + * original skb. The macvlan rx handler then returns RX_HANDLER_PASS. + * 5. Normal conntrack hooks (in NF_INET_LOCAL_IN) confirm the orig skb. + * + * The Macvlan broadcast worker and normal confirm path will race. + * + * This race will not happen if step 2 already confirmed a clone. In that + * case later steps perform skb_clone() with skb->_nfct already confirmed (in + * hash table). This works fine. + * + * But such confirmation won't happen when eb/ip/nftables rules dropped the + * packets before they reached the nf_confirm step in postrouting. + * + * Work around this problem by explicit confirmation of the entry at + * LOCAL_IN time, before upper layer has a chance to clone the unconfirmed + * entry. + * + */ +static unsigned int br_nf_local_in(void *priv, + struct sk_buff *skb, + const struct nf_hook_state *state) +{ + struct nf_conntrack *nfct = skb_nfct(skb); + const struct nf_ct_hook *ct_hook; + struct nf_conn *ct; + int ret; + + if (!nfct || skb->pkt_type == PACKET_HOST) + return NF_ACCEPT; + + ct = container_of(nfct, struct nf_conn, ct_general); + if (likely(nf_ct_is_confirmed(ct))) + return NF_ACCEPT; + + WARN_ON_ONCE(skb_shared(skb)); + WARN_ON_ONCE(refcount_read(&nfct->use) != 1); + + /* We can't call nf_confirm here, it would create a dependency + * on nf_conntrack module. + */ + ct_hook = rcu_dereference(nf_ct_hook); + if (!ct_hook) { + skb->_nfct = 0ul; + nf_conntrack_put(nfct); + return NF_ACCEPT; + } + + nf_bridge_pull_encap_header(skb); + ret = ct_hook->confirm(skb); + switch (ret & NF_VERDICT_MASK) { + case NF_STOLEN: + return NF_STOLEN; + default: + nf_bridge_push_encap_header(skb); + break; + } + + ct = container_of(nfct, struct nf_conn, ct_general); + WARN_ON_ONCE(!nf_ct_is_confirmed(ct)); + + return ret; +} +#endif /* PF_BRIDGE/FORWARD *************************************************/ static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb) @@ -962,6 +1050,14 @@ static const struct nf_hook_ops br_nf_ops[] = { .hooknum = NF_BR_PRE_ROUTING, .priority = NF_BR_PRI_BRNF, }, +#if IS_ENABLED(CONFIG_NF_CONNTRACK) + { + .hook = br_nf_local_in, + .pf = NFPROTO_BRIDGE, + .hooknum = NF_BR_LOCAL_IN, + .priority = NF_BR_PRI_LAST, + }, +#endif { .hook = br_nf_forward_ip, .pf = NFPROTO_BRIDGE, diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c index 0fcf357ea7ad..d32fce70d797 100644 --- a/net/bridge/netfilter/nf_conntrack_bridge.c +++ b/net/bridge/netfilter/nf_conntrack_bridge.c @@ -291,6 +291,30 @@ static unsigned int nf_ct_bridge_pre(void *priv, struct sk_buff *skb, return nf_conntrack_in(skb, &bridge_state); } +static unsigned int nf_ct_bridge_in(void *priv, struct sk_buff *skb, + const struct nf_hook_state *state) +{ + enum ip_conntrack_info ctinfo; + struct nf_conn *ct; + + if (skb->pkt_type == PACKET_HOST) + return NF_ACCEPT; + + /* nf_conntrack_confirm() cannot handle concurrent clones, + * this happens for broad/multicast frames with e.g. macvlan on top + * of the bridge device. + */ + ct = nf_ct_get(skb, &ctinfo); + if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) + return NF_ACCEPT; + + /* let inet prerouting call conntrack again */ + skb->_nfct = 0; + nf_ct_put(ct); + + return NF_ACCEPT; +} + static void nf_ct_bridge_frag_save(struct sk_buff *skb, struct nf_bridge_frag_data *data) { @@ -385,6 +409,12 @@ static struct nf_hook_ops nf_ct_bridge_hook_ops[] __read_mostly = { .hooknum = NF_BR_PRE_ROUTING, .priority = NF_IP_PRI_CONNTRACK, }, + { + .hook = nf_ct_bridge_in, + .pf = NFPROTO_BRIDGE, + .hooknum = NF_BR_LOCAL_IN, + .priority = NF_IP_PRI_CONNTRACK_CONFIRM, + }, { .hook = nf_ct_bridge_post, .pf = NFPROTO_BRIDGE, diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 9f6f2e643575..e4ae2a08da6a 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -2766,6 +2766,7 @@ static const struct nf_ct_hook nf_conntrack_hook = { .get_tuple_skb = nf_conntrack_get_tuple_skb, .attach = nf_conntrack_attach, .set_closing = nf_conntrack_set_closing, + .confirm = __nf_conntrack_confirm, }; void nf_conntrack_init_end(void) -- 2.25.1

1 1

[PATCH OLK-6.6 0/3] Revert syscall performance degradation patches
by liwei 10 May '24

10 May '24

This patch group has about 30% impact on syscall performance. liwei (3): Revert "x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI" Revert "x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto" Revert "x86: set SPECTRE_BHI_ON as default" Documentation/admin-guide/hw-vuln/spectre.rst | 4 ++++ .../admin-guide/kernel-parameters.txt | 3 +++ arch/x86/Kconfig | 21 ++++++++++++++++--- arch/x86/kernel/cpu/bugs.c | 10 ++++++++- 4 files changed, 34 insertions(+), 4 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] media: usbtv: Remove useless locks in usbtv_video_free()
by Zeng Heng 10 May '24

10 May '24

From: Benjamin Gaignard <benjamin.gaignard(a)collabora.com> mainline inclusion from mainline-v6.9-rc1 commit 65e6a2773d655172143cc0b927cdc89549842895 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9JS CVE: CVE-2024-27072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Remove locks calls in usbtv_video_free() because are useless and may led to a deadlock as reported here: https://syzkaller.appspot.com/x/bisect.txt?x=166dc872180000 Also remove usbtv_stop() call since it will be called when unregistering the device. Before 'c838530d230b' this issue would only be noticed if you disconnect while streaming and now it is noticeable even when disconnecting while not streaming. Fixes: c838530d230b ("media: media videobuf2: Be more flexible on the number of queue stored buffers") Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber") Signed-off-by: Benjamin Gaignard <benjamin.gaignard(a)collabora.com> Reviewed-by: Tomasz Figa <tfiga(a)chromium.org> Tested-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> [hverkuil: fix minor spelling mistake in log message] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/media/usb/usbtv/usbtv-video.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c index 3b4a2e769230..f2aaec0f77c8 100644 --- a/drivers/media/usb/usbtv/usbtv-video.c +++ b/drivers/media/usb/usbtv/usbtv-video.c @@ -959,15 +959,8 @@ int usbtv_video_init(struct usbtv *usbtv) void usbtv_video_free(struct usbtv *usbtv) { - mutex_lock(&usbtv->vb2q_lock); - mutex_lock(&usbtv->v4l2_lock); - - usbtv_stop(usbtv); vb2_video_unregister_device(&usbtv->vdev); v4l2_device_disconnect(&usbtv->v4l2_dev); - mutex_unlock(&usbtv->v4l2_lock); - mutex_unlock(&usbtv->vb2q_lock); - v4l2_device_put(&usbtv->v4l2_dev); } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] media: usbtv: Remove useless locks in usbtv_video_free()
by Zeng Heng 10 May '24

10 May '24

From: Benjamin Gaignard <benjamin.gaignard(a)collabora.com> mainline inclusion from mainline-v6.9-rc1 commit 65e6a2773d655172143cc0b927cdc89549842895 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9JS CVE: CVE-2024-27072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Remove locks calls in usbtv_video_free() because are useless and may led to a deadlock as reported here: https://syzkaller.appspot.com/x/bisect.txt?x=166dc872180000 Also remove usbtv_stop() call since it will be called when unregistering the device. Before 'c838530d230b' this issue would only be noticed if you disconnect while streaming and now it is noticeable even when disconnecting while not streaming. Fixes: c838530d230b ("media: media videobuf2: Be more flexible on the number of queue stored buffers") Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber") Signed-off-by: Benjamin Gaignard <benjamin.gaignard(a)collabora.com> Reviewed-by: Tomasz Figa <tfiga(a)chromium.org> Tested-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> [hverkuil: fix minor spelling mistake in log message] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/media/usb/usbtv/usbtv-video.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c index 3b4a2e769230..f2aaec0f77c8 100644 --- a/drivers/media/usb/usbtv/usbtv-video.c +++ b/drivers/media/usb/usbtv/usbtv-video.c @@ -959,15 +959,8 @@ int usbtv_video_init(struct usbtv *usbtv) void usbtv_video_free(struct usbtv *usbtv) { - mutex_lock(&usbtv->vb2q_lock); - mutex_lock(&usbtv->v4l2_lock); - - usbtv_stop(usbtv); vb2_video_unregister_device(&usbtv->vdev); v4l2_device_disconnect(&usbtv->v4l2_dev); - mutex_unlock(&usbtv->v4l2_lock); - mutex_unlock(&usbtv->vb2q_lock); - v4l2_device_put(&usbtv->v4l2_dev); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: usbtv: Remove useless locks in usbtv_video_free()
by Zeng Heng 10 May '24

10 May '24

From: Benjamin Gaignard <benjamin.gaignard(a)collabora.com> mainline inclusion from mainline-v6.9-rc1 commit 65e6a2773d655172143cc0b927cdc89549842895 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9JS CVE: CVE-2024-27072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Remove locks calls in usbtv_video_free() because are useless and may led to a deadlock as reported here: https://syzkaller.appspot.com/x/bisect.txt?x=166dc872180000 Also remove usbtv_stop() call since it will be called when unregistering the device. Before 'c838530d230b' this issue would only be noticed if you disconnect while streaming and now it is noticeable even when disconnecting while not streaming. Fixes: c838530d230b ("media: media videobuf2: Be more flexible on the number of queue stored buffers") Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber") Signed-off-by: Benjamin Gaignard <benjamin.gaignard(a)collabora.com> Reviewed-by: Tomasz Figa <tfiga(a)chromium.org> Tested-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> [hverkuil: fix minor spelling mistake in log message] Conflicts: drivers/media/usb/usbtv/usbtv-video.c [The version does not include commit 24b5836dbd45.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/media/usb/usbtv/usbtv-video.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c index 36a9a4017185..096fca028d1f 100644 --- a/drivers/media/usb/usbtv/usbtv-video.c +++ b/drivers/media/usb/usbtv/usbtv-video.c @@ -963,15 +963,8 @@ int usbtv_video_init(struct usbtv *usbtv) void usbtv_video_free(struct usbtv *usbtv) { - mutex_lock(&usbtv->vb2q_lock); - mutex_lock(&usbtv->v4l2_lock); - - usbtv_stop(usbtv); video_unregister_device(&usbtv->vdev); v4l2_device_disconnect(&usbtv->v4l2_dev); - mutex_unlock(&usbtv->v4l2_lock); - mutex_unlock(&usbtv->vb2q_lock); - v4l2_device_put(&usbtv->v4l2_dev); } -- 2.25.1

2 1

[PATCH OLK-5.10] SUNRPC: fix some memleaks in gssx_dec_option_array
by Dong Chenchen 10 May '24

10 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit 3cfcfc102a5e57b021b786a755a38935e357797d category: bugfix bugzilla: 189901, https://gitee.com/src-openeuler/kernel/issues/I9L9J1 CVE: CVE-2024-27388 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the corresponding paths. Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sunrpc/auth_gss/gss_rpc_xdr.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c index 2ff7b7083eba..e265b8d38aa1 100644 --- a/net/sunrpc/auth_gss/gss_rpc_xdr.c +++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c @@ -250,8 +250,8 @@ static int gssx_dec_option_array(struct xdr_stream *xdr, creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL); if (!creds) { - kfree(oa->data); - return -ENOMEM; + err = -ENOMEM; + goto free_oa; } oa->data[0].option.data = CREDS_VALUE; @@ -265,29 +265,40 @@ static int gssx_dec_option_array(struct xdr_stream *xdr, /* option buffer */ p = xdr_inline_decode(xdr, 4); - if (unlikely(p == NULL)) - return -ENOSPC; + if (unlikely(p == NULL)) { + err = -ENOSPC; + goto free_creds; + } length = be32_to_cpup(p); p = xdr_inline_decode(xdr, length); - if (unlikely(p == NULL)) - return -ENOSPC; + if (unlikely(p == NULL)) { + err = -ENOSPC; + goto free_creds; + } if (length == sizeof(CREDS_VALUE) && memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) { /* We have creds here. parse them */ err = gssx_dec_linux_creds(xdr, creds); if (err) - return err; + goto free_creds; oa->data[0].value.len = 1; /* presence */ } else { /* consume uninteresting buffer */ err = gssx_dec_buffer(xdr, &dummy); if (err) - return err; + goto free_creds; } } return 0; + +free_creds: + kfree(creds); +free_oa: + kfree(oa->data); + oa->data = NULL; + return err; } static int gssx_dec_status(struct xdr_stream *xdr, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] SUNRPC: fix some memleaks in gssx_dec_option_array
by Dong Chenchen 10 May '24

10 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit 3cfcfc102a5e57b021b786a755a38935e357797d category: bugfix bugzilla: 189901, https://gitee.com/src-openeuler/kernel/issues/I9L9J1 CVE: CVE-2024-27388 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the corresponding paths. Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sunrpc/auth_gss/gss_rpc_xdr.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c index 444380f968f1..730a9c4dc993 100644 --- a/net/sunrpc/auth_gss/gss_rpc_xdr.c +++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c @@ -263,8 +263,8 @@ static int gssx_dec_option_array(struct xdr_stream *xdr, creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL); if (!creds) { - kfree(oa->data); - return -ENOMEM; + err = -ENOMEM; + goto free_oa; } oa->data[0].option.data = CREDS_VALUE; @@ -278,29 +278,40 @@ static int gssx_dec_option_array(struct xdr_stream *xdr, /* option buffer */ p = xdr_inline_decode(xdr, 4); - if (unlikely(p == NULL)) - return -ENOSPC; + if (unlikely(p == NULL)) { + err = -ENOSPC; + goto free_creds; + } length = be32_to_cpup(p); p = xdr_inline_decode(xdr, length); - if (unlikely(p == NULL)) - return -ENOSPC; + if (unlikely(p == NULL)) { + err = -ENOSPC; + goto free_creds; + } if (length == sizeof(CREDS_VALUE) && memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) { /* We have creds here. parse them */ err = gssx_dec_linux_creds(xdr, creds); if (err) - return err; + goto free_creds; oa->data[0].value.len = 1; /* presence */ } else { /* consume uninteresting buffer */ err = gssx_dec_buffer(xdr, &dummy); if (err) - return err; + goto free_creds; } } return 0; + +free_creds: + kfree(creds); +free_oa: + kfree(oa->data); + oa->data = NULL; + return err; } static int gssx_dec_status(struct xdr_stream *xdr, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2] SUNRPC: fix a memleak in gss_import_v2_context
by Dong Chenchen 10 May '24

10 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit e67b652d8e8591d3b1e569dbcdfcee15993e91fa category: bugfix bugzilla: 189914, https://gitee.com/src-openeuler/kernel/issues/I9L9IF CVE: CVE-2023-52653 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ctx->mech_used.data allocated by kmemdup is not freed in neither gss_import_v2_context nor it only caller gss_krb5_import_sec_context, which frees ctx on error. Thus, this patch reform the last call of gss_import_v2_context to the gss_krb5_import_ctx_v2, preventing the memleak while keepping the return formation. Fixes: 47d848077629 ("gss_krb5: handle new context format from gssd") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: net/sunrpc/auth_gss/gss_krb5_mech.c [commit 279a67cdd491 was not merged] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sunrpc/auth_gss/gss_krb5_mech.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c index 893d8a480592..f4f3ca817068 100644 --- a/net/sunrpc/auth_gss/gss_krb5_mech.c +++ b/net/sunrpc/auth_gss/gss_krb5_mech.c @@ -588,6 +588,7 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx, { int keylen; u32 time32; + int ret; p = simple_get_bytes(p, end, &ctx->flags, sizeof(ctx->flags)); if (IS_ERR(p)) @@ -644,16 +645,28 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx, switch (ctx->enctype) { case ENCTYPE_DES3_CBC_RAW: - return context_derive_keys_des3(ctx, gfp_mask); + ret = context_derive_keys_des3(ctx, gfp_mask); + break; case ENCTYPE_ARCFOUR_HMAC: - return context_derive_keys_rc4(ctx); + ret = context_derive_keys_rc4(ctx); + break; case ENCTYPE_AES128_CTS_HMAC_SHA1_96: case ENCTYPE_AES256_CTS_HMAC_SHA1_96: - return context_derive_keys_new(ctx, gfp_mask); + ret = context_derive_keys_new(ctx, gfp_mask); + break; default: - return -EINVAL; + ret = -EINVAL; } + if (ret) { + p = ERR_PTR(ret); + goto out_free; + } + + return 0; + +out_free: + kfree(ctx->mech_used.data); out_err: return PTR_ERR(p); } -- 2.25.1

2 1

[PATCH OLK-6.6 v2] openeuler_defconfig: update oedefconfig for the minimum set
by Peng Zhang 10 May '24

10 May '24

From: YGN-NDWD-Official <liuyanze1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9NSB7 ---------------------------------------------- The minimum set of kconfig configuration items is different from that defined by the openEuler community. For details about the modification and reason, see the issue. Signed-off-by: YGN-NDWD-Official <liuyanze1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 138 ++++++++++++++----------- arch/x86/configs/openeuler_defconfig | 17 ++- 2 files changed, 94 insertions(+), 61 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index baf9159c9826..4932a6be9d6f 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2,6 +2,7 @@ # Automatically generated file; DO NOT EDIT. # Linux/arm64 6.6.0 Kernel Configuration # +CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y @@ -96,7 +97,6 @@ CONFIG_PREEMPT_NONE=y # CONFIG_PREEMPT_VOLUNTARY is not set # CONFIG_PREEMPT is not set # CONFIG_PREEMPT_DYNAMIC is not set -# CONFIG_SCHED_CORE is not set # # CPU/Task time and stats accounting @@ -153,7 +153,8 @@ CONFIG_GENERIC_SCHED_CLOCK=y CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" -CONFIG_GCC11_NO_ARRAY_BOUNDS=y +CONFIG_GCC10_NO_ARRAY_BOUNDS=y +CONFIG_CC_NO_ARRAY_BOUNDS=y CONFIG_ARCH_SUPPORTS_INT128=y CONFIG_NUMA_BALANCING=y CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y @@ -171,14 +172,14 @@ CONFIG_CGROUP_WRITEBACK=y CONFIG_CGROUP_V1_WRITEBACK=y CONFIG_CGROUP_SCHED=y CONFIG_QOS_SCHED=y -CONFIG_QOS_SCHED_MULTILEVEL=y +CONFIG_QOS_SCHED_SMT_EXPELLER=y CONFIG_QOS_SCHED_PRIO_LB=y +CONFIG_QOS_SCHED_MULTILEVEL=y CONFIG_FAIR_GROUP_SCHED=y -CONFIG_QOS_SCHED_SMT_EXPELLER=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y -CONFIG_SCHED_MM_CID=y CONFIG_QOS_SCHED_DYNAMIC_AFFINITY=y +CONFIG_SCHED_MM_CID=y CONFIG_QOS_SCHED_SMART_GRID=y CONFIG_CGROUP_PIDS=y CONFIG_CGROUP_RDMA=y @@ -274,6 +275,8 @@ CONFIG_DEBUG_PERF_USE_VMALLOC=y CONFIG_SYSTEM_DATA_VERIFICATION=y CONFIG_PROFILING=y CONFIG_TRACEPOINTS=y +CONFIG_KABI_RESERVE=y +CONFIG_KABI_SIZE_ALIGN_CHECKS=y # # Kexec and crash features @@ -419,6 +422,7 @@ CONFIG_ARM64_ERRATUM_2038923=y CONFIG_ARM64_ERRATUM_1902691=y CONFIG_ARM64_ERRATUM_2457168=y CONFIG_ARM64_ERRATUM_2645198=y +CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD=y CONFIG_ARM64_ERRATUM_2966298=y CONFIG_ARM64_ERRATUM_3117295=y CONFIG_CAVIUM_ERRATUM_22375=y @@ -430,10 +434,10 @@ CONFIG_CAVIUM_TX2_ERRATUM_219=y CONFIG_FUJITSU_ERRATUM_010001=y CONFIG_HISILICON_ERRATUM_161600802=y CONFIG_HISILICON_ERRATUM_162100125=y -CONFIG_HISILICON_ERRATUM_162102203=y # CONFIG_HISILICON_ERRATUM_1980005 is not set CONFIG_HISILICON_ERRATUM_162100801=y CONFIG_HISILICON_ERRATUM_162100602=y +CONFIG_HISILICON_ERRATUM_162102203=y CONFIG_QCOM_FALKOR_ERRATUM_1003=y CONFIG_QCOM_FALKOR_ERRATUM_1009=y CONFIG_QCOM_QDF2400_ERRATUM_0065=y @@ -473,6 +477,7 @@ CONFIG_HZ=250 CONFIG_SCHED_HRTICK=y CONFIG_ARCH_SPARSEMEM_ENABLE=y CONFIG_HW_PERF_EVENTS=y +CONFIG_CC_HAVE_SHADOW_CALL_STACK=y CONFIG_PARAVIRT=y CONFIG_PARAVIRT_SCHED=y CONFIG_PARAVIRT_TIME_ACCOUNTING=y @@ -528,8 +533,8 @@ CONFIG_ARM64_PTR_AUTH_KERNEL=y # ARMv8.4 architectural features # CONFIG_ARM64_AMU_EXTN=y -CONFIG_ARM64_MPAM=y CONFIG_ARM64_TLB_RANGE=y +CONFIG_ARM64_MPAM=y # end of ARMv8.4 architectural features # @@ -567,8 +572,8 @@ CONFIG_IPI_AS_NMI=y CONFIG_NON_NMI_IPI_BACKTRACE=y CONFIG_RELOCATABLE=y CONFIG_RANDOMIZE_BASE=y -CONFIG_KASLR_SKIP_MEM_RANGE=y CONFIG_RANDOMIZE_MODULE_REGION_FULL=y +CONFIG_KASLR_SKIP_MEM_RANGE=y CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y CONFIG_STACKPROTECTOR_PER_TASK=y CONFIG_ARM64_CONTPTE=y @@ -580,7 +585,7 @@ CONFIG_CLEAR_USER_WORKAROUND=y # CONFIG_ARM64_ACPI_PARKING_PROTOCOL=y CONFIG_CMDLINE="console=ttyAMA0" -# CONFIG_CMDLINE_FROM_BOOTLOADER is not set +CONFIG_CMDLINE_FROM_BOOTLOADER=y # CONFIG_CMDLINE_FORCE is not set CONFIG_EFI_STUB=y CONFIG_EFI=y @@ -666,7 +671,7 @@ CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y # # CONFIG_CPUFREQ_DT is not set # CONFIG_CPUFREQ_DT_PLATDEV is not set -CONFIG_ACPI_CPPC_CPUFREQ=y +CONFIG_ACPI_CPPC_CPUFREQ=m CONFIG_ACPI_CPPC_CPUFREQ_FIE=y CONFIG_ARM_SCPI_CPUFREQ=m # CONFIG_ARM_QCOM_CPUFREQ_HW is not set @@ -694,7 +699,6 @@ CONFIG_ACPI_MCFG=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=m -CONFIG_ACPI_HOTPLUG_CPU=y CONFIG_ACPI_THERMAL=y CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y CONFIG_ACPI_TABLE_UPGRADE=y @@ -725,6 +729,7 @@ CONFIG_ACPI_IORT=y CONFIG_ACPI_GTDT=y CONFIG_ACPI_AGDI=y CONFIG_ACPI_APMT=y +CONFIG_ACPI_MPAM=y CONFIG_ACPI_PPTT=y CONFIG_ACPI_PCC=y CONFIG_ACPI_FFH=y @@ -746,13 +751,16 @@ CONFIG_KVM_VFIO=y CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y CONFIG_HAVE_KVM_IRQ_BYPASS=y CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE=y -CONFIG_KVM_HISI_VIRT=y CONFIG_KVM_XFER_TO_GUEST_WORK=y CONFIG_KVM_GENERIC_HARDWARE_ENABLING=y +CONFIG_KVM_HISI_VIRT=y CONFIG_VIRTUALIZATION=y CONFIG_KVM=y -CONFIG_KVM_ARM_MULTI_LPI_TRANSLATE_CACHE=y # CONFIG_NVHE_EL2_DEBUG is not set +CONFIG_KVM_ARM_MULTI_LPI_TRANSLATE_CACHE=y +CONFIG_ARCH_VCPU_STAT=y +CONFIG_VIRT_VTIMER_IRQ_BYPASS=y +CONFIG_CPU_MITIGATIONS=y # # General architecture-dependent options @@ -813,6 +821,8 @@ CONFIG_HAVE_ARCH_STACKLEAK=y CONFIG_HAVE_STACKPROTECTOR=y CONFIG_STACKPROTECTOR=y CONFIG_STACKPROTECTOR_STRONG=y +CONFIG_ARCH_SUPPORTS_SHADOW_CALL_STACK=y +# CONFIG_SHADOW_CALL_STACK is not set CONFIG_ARCH_SUPPORTS_LTO_CLANG=y CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y CONFIG_LTO_NONE=y @@ -852,6 +862,7 @@ CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y CONFIG_STRICT_KERNEL_RWX=y CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y CONFIG_STRICT_MODULE_RWX=y +CONFIG_ARCH_HAS_CPU_RESCTRL=y CONFIG_HAVE_ARCH_COMPILER_H=y CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y CONFIG_ARCH_USE_MEMREMAP_PROT=y @@ -917,6 +928,7 @@ CONFIG_BLK_ICQ=y CONFIG_BLK_DEV_BSGLIB=y CONFIG_BLK_DEV_INTEGRITY=y CONFIG_BLK_DEV_INTEGRITY_T10=m +CONFIG_BLK_DEV_WRITE_MOUNTED=y CONFIG_BLK_DEV_ZONED=y CONFIG_BLK_DEV_THROTTLING=y # CONFIG_BLK_DEV_THROTTLING_LOW is not set @@ -932,7 +944,6 @@ CONFIG_BLK_DEBUG_FS=y CONFIG_BLK_DEBUG_FS_ZONED=y # CONFIG_BLK_SED_OPAL is not set # CONFIG_BLK_INLINE_ENCRYPTION is not set -CONFIG_BLK_DEV_WRITE_MOUNTED=y CONFIG_BLK_DEV_DETECT_WRITING_PART0=y CONFIG_BLK_DEV_WRITE_MOUNTED_DUMP=y @@ -1043,7 +1054,6 @@ CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y CONFIG_PID_MAX_PER_NAMESPACE=y CONFIG_FREEZER=y -CONFIG_KWORKER_NUMA_AFFINITY=y # # Executable file formats @@ -1185,8 +1195,8 @@ CONFIG_LRU_GEN=y CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y +CONFIG_IOMMU_MM_DATA=y # CONFIG_ASCEND_FEATURES is not set -# CONFIG_ASCEND_OOM is not set CONFIG_PAGE_CACHE_LIMIT=y # CONFIG_CLEAR_FREELIST_PAGE is not set CONFIG_MEMORY_RELIABLE=y @@ -1336,6 +1346,7 @@ CONFIG_IPV6_PIMSM_V2=y # CONFIG_IPV6_IOAM6_LWTUNNEL is not set CONFIG_NETLABEL=y CONFIG_MPTCP=y +CONFIG_INET_MPTCP_DIAG=m CONFIG_MPTCP_IPV6=y CONFIG_NETWORK_SECMARK=y CONFIG_NET_PTP_CLASSIFY=y @@ -1772,7 +1783,7 @@ CONFIG_NET_SCH_MQPRIO=m CONFIG_NET_SCH_CHOKE=m CONFIG_NET_SCH_QFQ=m CONFIG_NET_SCH_CODEL=m -CONFIG_NET_SCH_FQ_CODEL=m +CONFIG_NET_SCH_FQ_CODEL=y # CONFIG_NET_SCH_CAKE is not set CONFIG_NET_SCH_FQ=m CONFIG_NET_SCH_HHF=m @@ -2100,6 +2111,7 @@ CONFIG_WANT_DEV_COREDUMP=y # CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set CONFIG_HMEM_REPORTING=y # CONFIG_TEST_ASYNC_DRIVER_PROBE is not set +CONFIG_GENERIC_CPU_DEVICES=y CONFIG_GENERIC_CPU_AUTOPROBE=y CONFIG_GENERIC_CPU_VULNERABILITIES=y CONFIG_SOC_BUS=y @@ -2431,9 +2443,9 @@ CONFIG_SENSORS_APDS990X=m # CONFIG_XILINX_SDFEC is not set CONFIG_MISC_RTSX=m # CONFIG_HISI_HIKEY_USB is not set +CONFIG_VIRT_PLAT_DEV=y # CONFIG_OPEN_DICE is not set # CONFIG_VCPU_STALL_DETECTOR is not set -CONFIG_VIRT_PLAT_DEV=y # CONFIG_C2PORT is not set # @@ -2927,12 +2939,6 @@ CONFIG_ICE=m CONFIG_ICE_SWITCHDEV=y CONFIG_FM10K=m # CONFIG_IGC is not set -# CONFIG_JME is not set -CONFIG_NET_VENDOR_ADI=y -# CONFIG_ADIN1110 is not set -CONFIG_NET_VENDOR_LITEX=y -# CONFIG_LITEX_LITEETH is not set -# CONFIG_NET_VENDOR_MARVELL is not set CONFIG_NET_VENDOR_MUCSE=y CONFIG_MXGBE=m CONFIG_MXGBE_FIX_VF_QUEUE=y @@ -2952,6 +2958,15 @@ CONFIG_MGBE=m CONFIG_MGBE_MSIX_COUNT=26 CONFIG_MGBEVF=m # CONFIG_MGBEVF_OPTM_WITH_LARGE is not set +CONFIG_NET_VENDOR_YUNSILICON=y +CONFIG_YUNSILICON_XSC_ETH=m +CONFIG_YUNSILICON_XSC_PCI=m +# CONFIG_JME is not set +CONFIG_NET_VENDOR_ADI=y +# CONFIG_ADIN1110 is not set +CONFIG_NET_VENDOR_LITEX=y +# CONFIG_LITEX_LITEETH is not set +# CONFIG_NET_VENDOR_MARVELL is not set CONFIG_NET_VENDOR_MELLANOX=y CONFIG_MLX4_EN=m CONFIG_MLX4_EN_DCB=y @@ -3057,9 +3072,6 @@ CONFIG_SMSC9420=m # CONFIG_NET_VENDOR_SYNOPSYS is not set # CONFIG_NET_VENDOR_TEHUTI is not set # CONFIG_NET_VENDOR_TI is not set -CONFIG_NET_VENDOR_YUNSILICON=y -CONFIG_YUNSILICON_XSC_ETH=m -CONFIG_YUNSILICON_XSC_PCI=m CONFIG_NET_VENDOR_VERTEXCOM=y # CONFIG_MSE102X is not set # CONFIG_NET_VENDOR_VIA is not set @@ -3885,8 +3897,8 @@ CONFIG_PTP_1588_CLOCK_KVM=y # CONFIG_PTP_1588_CLOCK_IDTCM is not set # CONFIG_PTP_1588_CLOCK_MOCK is not set # CONFIG_PTP_1588_CLOCK_OCP is not set -# end of PTP clock support CONFIG_PTP_HISI=m +# end of PTP clock support CONFIG_PINCTRL=y CONFIG_PINMUX=y @@ -4339,7 +4351,7 @@ CONFIG_CPU_THERMAL=y CONFIG_CPU_FREQ_THERMAL=y CONFIG_THERMAL_EMULATION=y # CONFIG_THERMAL_MMIO is not set -CONFIG_HISI_THERMAL=y +CONFIG_HISI_THERMAL=m # # Qualcomm thermal drivers @@ -4483,7 +4495,6 @@ CONFIG_MFD_CORE=m # CONFIG_MFD_SKY81452 is not set # CONFIG_MFD_STMPE is not set CONFIG_MFD_SYSCON=y -# CONFIG_MFD_TI_AM335X_TSCADC is not set # CONFIG_MFD_LP3943 is not set # CONFIG_MFD_LP8788 is not set # CONFIG_MFD_TI_LMU is not set @@ -5287,9 +5298,8 @@ CONFIG_AUXDISPLAY=y # CONFIG_CHARLCD_BL_OFF is not set # CONFIG_CHARLCD_BL_ON is not set CONFIG_CHARLCD_BL_FLASH=y -CONFIG_DRM=y -# CONFIG_DRM_DEBUG_MM is not set -CONFIG_DRM_KMS_HELPER=y +CONFIG_DRM=m +CONFIG_DRM_KMS_HELPER=m # CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set # CONFIG_DRM_DEBUG_MODESET_LOCK is not set CONFIG_DRM_FBDEV_EMULATION=y @@ -6045,8 +6055,6 @@ CONFIG_MMC_CQHCI=m CONFIG_MMC_TOSHIBA_PCI=m CONFIG_MMC_MTK=m CONFIG_MMC_SDHCI_XENON=m -# CONFIG_MMC_SDHCI_OMAP is not set -# CONFIG_MMC_SDHCI_AM654 is not set # CONFIG_SCSI_UFSHCD is not set CONFIG_MEMSTICK=m # CONFIG_MEMSTICK_DEBUG is not set @@ -6207,7 +6215,8 @@ CONFIG_RTC_LIB=y CONFIG_RTC_CLASS=y CONFIG_RTC_HCTOSYS=y CONFIG_RTC_HCTOSYS_DEVICE="rtc0" -# CONFIG_RTC_SYSTOHC is not set +CONFIG_RTC_SYSTOHC=y +CONFIG_RTC_SYSTOHC_DEVICE="rtc0" # CONFIG_RTC_DEBUG is not set CONFIG_RTC_NVMEM=y @@ -6434,7 +6443,7 @@ CONFIG_VIRTIO_PCI_LEGACY=y # CONFIG_VIRTIO_VDPA is not set # CONFIG_VIRTIO_PMEM is not set CONFIG_VIRTIO_BALLOON=m -# CONFIG_VIRTIO_MEM is not set +CONFIG_VIRTIO_MEM=m CONFIG_VIRTIO_INPUT=m CONFIG_VIRTIO_MMIO=m # CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set @@ -6475,6 +6484,7 @@ CONFIG_CHROME_PLATFORMS=y # CONFIG_CROS_HPS_I2C is not set # CONFIG_CHROMEOS_PRIVACY_SCREEN is not set # CONFIG_MELLANOX_PLATFORM is not set +CONFIG_ARM_CPU_RESCTRL=y CONFIG_SURFACE_PLATFORMS=y # CONFIG_SURFACE_3_POWER_OPREGION is not set # CONFIG_SURFACE_GPE is not set @@ -6578,6 +6588,7 @@ CONFIG_IOMMU_DEFAULT_DMA_STRICT=y CONFIG_OF_IOMMU=y CONFIG_IOMMU_DMA=y CONFIG_IOMMU_SVA=y +CONFIG_IOMMU_IOPF=y CONFIG_IOMMUFD=m CONFIG_ARM_SMMU=y # CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set @@ -6702,7 +6713,15 @@ CONFIG_EXTCON_GPIO=m # CONFIG_EXTCON_USBC_TUSB320 is not set # CONFIG_MEMORY is not set # CONFIG_IIO is not set -# CONFIG_NTB is not set +CONFIG_NTB=m +# CONFIG_NTB_MSI is not set +# CONFIG_NTB_IDT is not set +# CONFIG_NTB_EPF is not set +# CONFIG_NTB_SWITCHTEC is not set +# CONFIG_NTB_PINGPONG is not set +# CONFIG_NTB_TOOL is not set +# CONFIG_NTB_PERF is not set +# CONFIG_NTB_TRANSPORT is not set CONFIG_PWM=y CONFIG_PWM_SYSFS=y # CONFIG_PWM_DEBUG is not set @@ -6728,7 +6747,6 @@ CONFIG_ARM_GIC_PHYTIUM_2500=y # CONFIG_AL_FIC is not set CONFIG_HISILICON_IRQ_MBIGEN=y CONFIG_IRQ_MBIGEN_ENABLE_SPI=y -CONFIG_VIRT_VTIMER_IRQ_BYPASS=y # CONFIG_XILINX_INTC is not set CONFIG_PARTITION_PERCPU=y CONFIG_QCOM_IRQ_COMBINER=y @@ -6806,14 +6824,14 @@ CONFIG_ARM_CCN=y # CONFIG_ARM_CMN is not set CONFIG_ARM_PMU=y CONFIG_ARM_PMU_ACPI=y -CONFIG_ARM_SMMU_V3_PMU=y +CONFIG_ARM_SMMU_V3_PMU=m CONFIG_ARM_PMUV3=y # CONFIG_ARM_DSU_PMU is not set CONFIG_QCOM_L2_PMU=y CONFIG_QCOM_L3_PMU=y CONFIG_THUNDERX2_PMU=m CONFIG_XGENE_PMU=y -CONFIG_ARM_SPE_PMU=y +CONFIG_ARM_SPE_PMU=m # CONFIG_ARM_DMC620_PMU is not set # CONFIG_MARVELL_CN10K_TAD_PMU is not set # CONFIG_ALIBABA_UNCORE_DRW_PMU is not set @@ -6925,8 +6943,8 @@ CONFIG_EXT4_FS=m CONFIG_EXT4_USE_FOR_EXT2=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y -CONFIG_EXT4_ERROR_REPORT=y # CONFIG_EXT4_DEBUG is not set +CONFIG_EXT4_ERROR_REPORT=y CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m @@ -7044,6 +7062,7 @@ CONFIG_PROC_VMCORE=y CONFIG_PROC_SYSCTL=y CONFIG_PROC_PAGE_MONITOR=y CONFIG_PROC_CHILDREN=y +CONFIG_PROC_CPU_RESCTRL=y CONFIG_KERNFS=y CONFIG_SYSFS=y CONFIG_DIRTY_PAGES=y @@ -7101,6 +7120,8 @@ CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3 # CONFIG_HPFS_FS is not set # CONFIG_QNX4FS_FS is not set # CONFIG_QNX6FS_FS is not set +CONFIG_RESCTRL_FS=y +CONFIG_RESCTRL_RMID_DEPENDS_ON_CLOSID=y # CONFIG_ROMFS_FS is not set CONFIG_PSTORE=y CONFIG_PSTORE_DEFAULT_KMSG_BYTES=10240 @@ -7328,6 +7349,10 @@ CONFIG_IMA_APPRAISE_MODSIG=y CONFIG_IMA_LOAD_X509=y CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der" # CONFIG_IMA_APPRAISE_SIGNED_INIT is not set +CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y +CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y +# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set +# CONFIG_IMA_DISABLE_HTABLE is not set CONFIG_IMA_DIGEST_LIST=y CONFIG_IMA_DIGEST_LISTS_DIR="/etc/ima/digest_lists" CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y @@ -7335,14 +7360,11 @@ CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y # CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set CONFIG_IMA_DIGEST_DB_MEGABYTES=16 CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists" -CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y -CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y -# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set -# CONFIG_IMA_DISABLE_HTABLE is not set CONFIG_EVM=y -CONFIG_EVM_DEFAULT_HASH_SHA1=n +# CONFIG_EVM_DEFAULT_HASH_SHA1 is not set CONFIG_EVM_DEFAULT_HASH_SHA256=y -CONFIG_EVM_DEFAULT_HASH_SHA512=n +# CONFIG_EVM_DEFAULT_HASH_SHA512 is not set +CONFIG_EVM_DEFAULT_HASH="sha256" CONFIG_EVM_ATTR_FSUUID=y # CONFIG_EVM_ADD_XATTRS is not set CONFIG_EVM_LOAD_X509=y @@ -7360,8 +7382,11 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,appar # Memory initialization # CONFIG_INIT_STACK_NONE=y +# CONFIG_INIT_STACK_ALL_PATTERN is not set +# CONFIG_INIT_STACK_ALL_ZERO is not set # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set +# CONFIG_ZERO_CALL_USED_REGS is not set # end of Memory initialization # @@ -7617,7 +7642,6 @@ CONFIG_CAVIUM_CPT=m # CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set -# CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION is not set CONFIG_CRYPTO_DEV_CAVIUM_ZIP=m # CONFIG_CRYPTO_DEV_QCE is not set # CONFIG_CRYPTO_DEV_QCOM_RNG is not set @@ -7769,7 +7793,6 @@ CONFIG_BTREE=y CONFIG_INTERVAL_TREE=y CONFIG_INTERVAL_TREE_SPAN_ITER=y CONFIG_XARRAY_MULTI=y -CONFIG_ARCH_VCPU_STAT=y CONFIG_ASSOCIATIVE_ARRAY=y CONFIG_HAS_IOMEM=y CONFIG_HAS_IOPORT=y @@ -7836,6 +7859,7 @@ CONFIG_SG_POOL=y CONFIG_ARCH_HAS_PMEM_API=y CONFIG_MEMREGION=y CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE=y +CONFIG_ARCH_HAS_COPY_MC=y CONFIG_ARCH_STACKWALK=y CONFIG_STACKDEPOT=y CONFIG_SBITMAP=y @@ -7882,9 +7906,6 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y -CONFIG_PAHOLE_HAS_SPLIT_BTF=y -CONFIG_DEBUG_INFO_BTF_MODULES=y -# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y @@ -7924,6 +7945,8 @@ CONFIG_KDB_CONTINUE_CATASTROPHIC=0 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y # CONFIG_UBSAN is not set CONFIG_HAVE_ARCH_KCSAN=y +CONFIG_HAVE_KCSAN_COMPILER=y +# CONFIG_KCSAN is not set # end of Generic Kernel Debugging Instruments # @@ -7984,6 +8007,7 @@ CONFIG_LOCKUP_DETECTOR=y CONFIG_SOFTLOCKUP_DETECTOR=y # CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set CONFIG_HAVE_HARDLOCKUP_DETECTOR_BUDDY=y +CONFIG_SDEI_WATCHDOG=y CONFIG_HARDLOCKUP_DETECTOR=y # CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY is not set CONFIG_HARDLOCKUP_DETECTOR_PERF=y @@ -7991,7 +8015,6 @@ CONFIG_HARDLOCKUP_DETECTOR_PERF=y # CONFIG_HARDLOCKUP_DETECTOR_ARCH is not set CONFIG_HARDLOCKUP_DETECTOR_COUNTS_HRTIMER=y CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y -CONFIG_SDEI_WATCHDOG=y CONFIG_DETECT_HUNG_TASK=y CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 # CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set @@ -8045,8 +8068,6 @@ CONFIG_DEBUG_LIST=y # CONFIG_DEBUG_MAPLE_TREE is not set # end of Debug kernel data structures -# CONFIG_DEBUG_CREDENTIALS is not set - # # RCU Debugging # @@ -8170,6 +8191,7 @@ CONFIG_ULTRASOC_SMB=m CONFIG_FUNCTION_ERROR_INJECTION=y # CONFIG_FAULT_INJECTION is not set CONFIG_ARCH_HAS_KCOV=y +# CONFIG_KCOV is not set # CONFIG_RUNTIME_TESTING_MENU is not set CONFIG_ARCH_USE_MEMTEST=y # CONFIG_MEMTEST is not set @@ -8180,5 +8202,5 @@ CONFIG_ARCH_USE_MEMTEST=y # # end of Rust hacking # end of Kernel hacking -CONFIG_KABI_SIZE_ALIGN_CHECKS=y -CONFIG_KABI_RESERVE=y + +CONFIG_KWORKER_NUMA_AFFINITY=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index e68707028ddd..9b5df8585310 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2,6 +2,8 @@ # Automatically generated file; DO NOT EDIT. # Linux/x86 6.6.0 Kernel Configuration # +CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y +CONFIG_TOOLS_SUPPORT_RELR=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y @@ -170,6 +172,7 @@ CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" CONFIG_GCC10_NO_ARRAY_BOUNDS=y +CONFIG_CC_NO_ARRAY_BOUNDS=y CONFIG_ARCH_SUPPORTS_INT128=y CONFIG_NUMA_BALANCING=y CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y @@ -546,6 +549,7 @@ CONFIG_CALL_DEPTH_TRACKING=y CONFIG_CPU_IBPB_ENTRY=y CONFIG_CPU_IBRS_ENTRY=y CONFIG_CPU_SRSO=y +# CONFIG_SLS is not set # CONFIG_GDS_FORCE_MITIGATION is not set CONFIG_MITIGATION_RFDS=y CONFIG_MITIGATION_SPECTRE_BHI=y @@ -2005,7 +2009,7 @@ CONFIG_PCIEASPM_DEFAULT=y CONFIG_PCIE_PME=y CONFIG_PCIE_DPC=y # CONFIG_PCIE_PTM is not set -# CONFIG_PCIE_EDR is not set +CONFIG_PCIE_EDR=y CONFIG_PCI_MSI=y CONFIG_PCI_QUIRKS=y # CONFIG_PCI_DEBUG is not set @@ -6905,7 +6909,8 @@ CONFIG_RTC_MC146818_LIB=y CONFIG_RTC_CLASS=y CONFIG_RTC_HCTOSYS=y CONFIG_RTC_HCTOSYS_DEVICE="rtc0" -# CONFIG_RTC_SYSTOHC is not set +CONFIG_RTC_SYSTOHC=y +CONFIG_RTC_SYSTOHC_DEVICE="rtc0" # CONFIG_RTC_DEBUG is not set CONFIG_RTC_NVMEM=y @@ -7106,7 +7111,8 @@ CONFIG_VIRTIO_PCI_LEGACY=y CONFIG_VIRTIO_BALLOON=m CONFIG_VIRTIO_MEM=m CONFIG_VIRTIO_INPUT=m -# CONFIG_VIRTIO_MMIO is not set +CONFIG_VIRTIO_MMIO=m +# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set CONFIG_VIRTIO_DMA_SHARED_BUFFER=m # CONFIG_VDPA is not set CONFIG_VHOST_IOTLB=m @@ -8530,8 +8536,11 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,appar # Memory initialization # CONFIG_INIT_STACK_NONE=y +# CONFIG_INIT_STACK_ALL_PATTERN is not set +# CONFIG_INIT_STACK_ALL_ZERO is not set # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set +# CONFIG_ZERO_CALL_USED_REGS is not set # end of Memory initialization # @@ -9068,6 +9077,8 @@ CONFIG_ARCH_HAS_EARLY_DEBUG=y CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y # CONFIG_UBSAN is not set CONFIG_HAVE_ARCH_KCSAN=y +CONFIG_HAVE_KCSAN_COMPILER=y +# CONFIG_KCSAN is not set # end of Generic Kernel Debugging Instruments # -- 2.25.1

2 1

[PATCH OLK-5.10] SUNRPC: fix a memleak in gss_import_v2_context
by Dong Chenchen 10 May '24

10 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit e67b652d8e8591d3b1e569dbcdfcee15993e91fa category: bugfix bugzilla: 189914, https://gitee.com/src-openeuler/kernel/issues/I9L9IF CVE: CVE-2023-52653 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ctx->mech_used.data allocated by kmemdup is not freed in neither gss_import_v2_context nor it only caller gss_krb5_import_sec_context, which frees ctx on error. Thus, this patch reform the last call of gss_import_v2_context to the gss_krb5_import_ctx_v2, preventing the memleak while keepping the return formation. Fixes: 47d848077629 ("gss_krb5: handle new context format from gssd") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: net/sunrpc/auth_gss/gss_krb5_mech.c [commit 279a67cdd491 was not merged] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sunrpc/auth_gss/gss_krb5_mech.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c index 1c092b05c2bb..232d31111e4f 100644 --- a/net/sunrpc/auth_gss/gss_krb5_mech.c +++ b/net/sunrpc/auth_gss/gss_krb5_mech.c @@ -471,6 +471,7 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx, u64 seq_send64; int keylen; u32 time32; + int ret; p = simple_get_bytes(p, end, &ctx->flags, sizeof(ctx->flags)); if (IS_ERR(p)) @@ -528,14 +529,25 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx, switch (ctx->enctype) { case ENCTYPE_DES3_CBC_RAW: - return context_derive_keys_des3(ctx, gfp_mask); + ret = context_derive_keys_des3(ctx, gfp_mask); + break; case ENCTYPE_AES128_CTS_HMAC_SHA1_96: case ENCTYPE_AES256_CTS_HMAC_SHA1_96: - return context_derive_keys_new(ctx, gfp_mask); + ret = context_derive_keys_new(ctx, gfp_mask); + break; default: - return -EINVAL; + ret = -EINVAL; + } + + if (ret) { + p = ERR_PTR(ret); + goto out_free; } + return 0; + +out_free: + kfree(ctx->mech_used.data); out_err: return PTR_ERR(p); } -- 2.25.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: update oedefconfig for the minimum set
by Peng Zhang 10 May '24

10 May '24

From: YGN-NDWD-Official <liuyanze1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9NSB7 ---------------------------------------------- The minimum set of kconfig configuration items is different from that defined by the openEuler community. For details about the modification and reason, see the issue. Signed-off-by: YGN-NDWD-Official <liuyanze1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 138 ++++++++++++++----------- arch/x86/configs/openeuler_defconfig | 17 ++- 2 files changed, 94 insertions(+), 61 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index baf9159c9826..4932a6be9d6f 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2,6 +2,7 @@ # Automatically generated file; DO NOT EDIT. # Linux/arm64 6.6.0 Kernel Configuration # +CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y @@ -96,7 +97,6 @@ CONFIG_PREEMPT_NONE=y # CONFIG_PREEMPT_VOLUNTARY is not set # CONFIG_PREEMPT is not set # CONFIG_PREEMPT_DYNAMIC is not set -# CONFIG_SCHED_CORE is not set # # CPU/Task time and stats accounting @@ -153,7 +153,8 @@ CONFIG_GENERIC_SCHED_CLOCK=y CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" -CONFIG_GCC11_NO_ARRAY_BOUNDS=y +CONFIG_GCC10_NO_ARRAY_BOUNDS=y +CONFIG_CC_NO_ARRAY_BOUNDS=y CONFIG_ARCH_SUPPORTS_INT128=y CONFIG_NUMA_BALANCING=y CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y @@ -171,14 +172,14 @@ CONFIG_CGROUP_WRITEBACK=y CONFIG_CGROUP_V1_WRITEBACK=y CONFIG_CGROUP_SCHED=y CONFIG_QOS_SCHED=y -CONFIG_QOS_SCHED_MULTILEVEL=y +CONFIG_QOS_SCHED_SMT_EXPELLER=y CONFIG_QOS_SCHED_PRIO_LB=y +CONFIG_QOS_SCHED_MULTILEVEL=y CONFIG_FAIR_GROUP_SCHED=y -CONFIG_QOS_SCHED_SMT_EXPELLER=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y -CONFIG_SCHED_MM_CID=y CONFIG_QOS_SCHED_DYNAMIC_AFFINITY=y +CONFIG_SCHED_MM_CID=y CONFIG_QOS_SCHED_SMART_GRID=y CONFIG_CGROUP_PIDS=y CONFIG_CGROUP_RDMA=y @@ -274,6 +275,8 @@ CONFIG_DEBUG_PERF_USE_VMALLOC=y CONFIG_SYSTEM_DATA_VERIFICATION=y CONFIG_PROFILING=y CONFIG_TRACEPOINTS=y +CONFIG_KABI_RESERVE=y +CONFIG_KABI_SIZE_ALIGN_CHECKS=y # # Kexec and crash features @@ -419,6 +422,7 @@ CONFIG_ARM64_ERRATUM_2038923=y CONFIG_ARM64_ERRATUM_1902691=y CONFIG_ARM64_ERRATUM_2457168=y CONFIG_ARM64_ERRATUM_2645198=y +CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD=y CONFIG_ARM64_ERRATUM_2966298=y CONFIG_ARM64_ERRATUM_3117295=y CONFIG_CAVIUM_ERRATUM_22375=y @@ -430,10 +434,10 @@ CONFIG_CAVIUM_TX2_ERRATUM_219=y CONFIG_FUJITSU_ERRATUM_010001=y CONFIG_HISILICON_ERRATUM_161600802=y CONFIG_HISILICON_ERRATUM_162100125=y -CONFIG_HISILICON_ERRATUM_162102203=y # CONFIG_HISILICON_ERRATUM_1980005 is not set CONFIG_HISILICON_ERRATUM_162100801=y CONFIG_HISILICON_ERRATUM_162100602=y +CONFIG_HISILICON_ERRATUM_162102203=y CONFIG_QCOM_FALKOR_ERRATUM_1003=y CONFIG_QCOM_FALKOR_ERRATUM_1009=y CONFIG_QCOM_QDF2400_ERRATUM_0065=y @@ -473,6 +477,7 @@ CONFIG_HZ=250 CONFIG_SCHED_HRTICK=y CONFIG_ARCH_SPARSEMEM_ENABLE=y CONFIG_HW_PERF_EVENTS=y +CONFIG_CC_HAVE_SHADOW_CALL_STACK=y CONFIG_PARAVIRT=y CONFIG_PARAVIRT_SCHED=y CONFIG_PARAVIRT_TIME_ACCOUNTING=y @@ -528,8 +533,8 @@ CONFIG_ARM64_PTR_AUTH_KERNEL=y # ARMv8.4 architectural features # CONFIG_ARM64_AMU_EXTN=y -CONFIG_ARM64_MPAM=y CONFIG_ARM64_TLB_RANGE=y +CONFIG_ARM64_MPAM=y # end of ARMv8.4 architectural features # @@ -567,8 +572,8 @@ CONFIG_IPI_AS_NMI=y CONFIG_NON_NMI_IPI_BACKTRACE=y CONFIG_RELOCATABLE=y CONFIG_RANDOMIZE_BASE=y -CONFIG_KASLR_SKIP_MEM_RANGE=y CONFIG_RANDOMIZE_MODULE_REGION_FULL=y +CONFIG_KASLR_SKIP_MEM_RANGE=y CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y CONFIG_STACKPROTECTOR_PER_TASK=y CONFIG_ARM64_CONTPTE=y @@ -580,7 +585,7 @@ CONFIG_CLEAR_USER_WORKAROUND=y # CONFIG_ARM64_ACPI_PARKING_PROTOCOL=y CONFIG_CMDLINE="console=ttyAMA0" -# CONFIG_CMDLINE_FROM_BOOTLOADER is not set +CONFIG_CMDLINE_FROM_BOOTLOADER=y # CONFIG_CMDLINE_FORCE is not set CONFIG_EFI_STUB=y CONFIG_EFI=y @@ -666,7 +671,7 @@ CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y # # CONFIG_CPUFREQ_DT is not set # CONFIG_CPUFREQ_DT_PLATDEV is not set -CONFIG_ACPI_CPPC_CPUFREQ=y +CONFIG_ACPI_CPPC_CPUFREQ=m CONFIG_ACPI_CPPC_CPUFREQ_FIE=y CONFIG_ARM_SCPI_CPUFREQ=m # CONFIG_ARM_QCOM_CPUFREQ_HW is not set @@ -694,7 +699,6 @@ CONFIG_ACPI_MCFG=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=m -CONFIG_ACPI_HOTPLUG_CPU=y CONFIG_ACPI_THERMAL=y CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y CONFIG_ACPI_TABLE_UPGRADE=y @@ -725,6 +729,7 @@ CONFIG_ACPI_IORT=y CONFIG_ACPI_GTDT=y CONFIG_ACPI_AGDI=y CONFIG_ACPI_APMT=y +CONFIG_ACPI_MPAM=y CONFIG_ACPI_PPTT=y CONFIG_ACPI_PCC=y CONFIG_ACPI_FFH=y @@ -746,13 +751,16 @@ CONFIG_KVM_VFIO=y CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y CONFIG_HAVE_KVM_IRQ_BYPASS=y CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE=y -CONFIG_KVM_HISI_VIRT=y CONFIG_KVM_XFER_TO_GUEST_WORK=y CONFIG_KVM_GENERIC_HARDWARE_ENABLING=y +CONFIG_KVM_HISI_VIRT=y CONFIG_VIRTUALIZATION=y CONFIG_KVM=y -CONFIG_KVM_ARM_MULTI_LPI_TRANSLATE_CACHE=y # CONFIG_NVHE_EL2_DEBUG is not set +CONFIG_KVM_ARM_MULTI_LPI_TRANSLATE_CACHE=y +CONFIG_ARCH_VCPU_STAT=y +CONFIG_VIRT_VTIMER_IRQ_BYPASS=y +CONFIG_CPU_MITIGATIONS=y # # General architecture-dependent options @@ -813,6 +821,8 @@ CONFIG_HAVE_ARCH_STACKLEAK=y CONFIG_HAVE_STACKPROTECTOR=y CONFIG_STACKPROTECTOR=y CONFIG_STACKPROTECTOR_STRONG=y +CONFIG_ARCH_SUPPORTS_SHADOW_CALL_STACK=y +# CONFIG_SHADOW_CALL_STACK is not set CONFIG_ARCH_SUPPORTS_LTO_CLANG=y CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y CONFIG_LTO_NONE=y @@ -852,6 +862,7 @@ CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y CONFIG_STRICT_KERNEL_RWX=y CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y CONFIG_STRICT_MODULE_RWX=y +CONFIG_ARCH_HAS_CPU_RESCTRL=y CONFIG_HAVE_ARCH_COMPILER_H=y CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y CONFIG_ARCH_USE_MEMREMAP_PROT=y @@ -917,6 +928,7 @@ CONFIG_BLK_ICQ=y CONFIG_BLK_DEV_BSGLIB=y CONFIG_BLK_DEV_INTEGRITY=y CONFIG_BLK_DEV_INTEGRITY_T10=m +CONFIG_BLK_DEV_WRITE_MOUNTED=y CONFIG_BLK_DEV_ZONED=y CONFIG_BLK_DEV_THROTTLING=y # CONFIG_BLK_DEV_THROTTLING_LOW is not set @@ -932,7 +944,6 @@ CONFIG_BLK_DEBUG_FS=y CONFIG_BLK_DEBUG_FS_ZONED=y # CONFIG_BLK_SED_OPAL is not set # CONFIG_BLK_INLINE_ENCRYPTION is not set -CONFIG_BLK_DEV_WRITE_MOUNTED=y CONFIG_BLK_DEV_DETECT_WRITING_PART0=y CONFIG_BLK_DEV_WRITE_MOUNTED_DUMP=y @@ -1043,7 +1054,6 @@ CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y CONFIG_PID_MAX_PER_NAMESPACE=y CONFIG_FREEZER=y -CONFIG_KWORKER_NUMA_AFFINITY=y # # Executable file formats @@ -1185,8 +1195,8 @@ CONFIG_LRU_GEN=y CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y +CONFIG_IOMMU_MM_DATA=y # CONFIG_ASCEND_FEATURES is not set -# CONFIG_ASCEND_OOM is not set CONFIG_PAGE_CACHE_LIMIT=y # CONFIG_CLEAR_FREELIST_PAGE is not set CONFIG_MEMORY_RELIABLE=y @@ -1336,6 +1346,7 @@ CONFIG_IPV6_PIMSM_V2=y # CONFIG_IPV6_IOAM6_LWTUNNEL is not set CONFIG_NETLABEL=y CONFIG_MPTCP=y +CONFIG_INET_MPTCP_DIAG=m CONFIG_MPTCP_IPV6=y CONFIG_NETWORK_SECMARK=y CONFIG_NET_PTP_CLASSIFY=y @@ -1772,7 +1783,7 @@ CONFIG_NET_SCH_MQPRIO=m CONFIG_NET_SCH_CHOKE=m CONFIG_NET_SCH_QFQ=m CONFIG_NET_SCH_CODEL=m -CONFIG_NET_SCH_FQ_CODEL=m +CONFIG_NET_SCH_FQ_CODEL=y # CONFIG_NET_SCH_CAKE is not set CONFIG_NET_SCH_FQ=m CONFIG_NET_SCH_HHF=m @@ -2100,6 +2111,7 @@ CONFIG_WANT_DEV_COREDUMP=y # CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set CONFIG_HMEM_REPORTING=y # CONFIG_TEST_ASYNC_DRIVER_PROBE is not set +CONFIG_GENERIC_CPU_DEVICES=y CONFIG_GENERIC_CPU_AUTOPROBE=y CONFIG_GENERIC_CPU_VULNERABILITIES=y CONFIG_SOC_BUS=y @@ -2431,9 +2443,9 @@ CONFIG_SENSORS_APDS990X=m # CONFIG_XILINX_SDFEC is not set CONFIG_MISC_RTSX=m # CONFIG_HISI_HIKEY_USB is not set +CONFIG_VIRT_PLAT_DEV=y # CONFIG_OPEN_DICE is not set # CONFIG_VCPU_STALL_DETECTOR is not set -CONFIG_VIRT_PLAT_DEV=y # CONFIG_C2PORT is not set # @@ -2927,12 +2939,6 @@ CONFIG_ICE=m CONFIG_ICE_SWITCHDEV=y CONFIG_FM10K=m # CONFIG_IGC is not set -# CONFIG_JME is not set -CONFIG_NET_VENDOR_ADI=y -# CONFIG_ADIN1110 is not set -CONFIG_NET_VENDOR_LITEX=y -# CONFIG_LITEX_LITEETH is not set -# CONFIG_NET_VENDOR_MARVELL is not set CONFIG_NET_VENDOR_MUCSE=y CONFIG_MXGBE=m CONFIG_MXGBE_FIX_VF_QUEUE=y @@ -2952,6 +2958,15 @@ CONFIG_MGBE=m CONFIG_MGBE_MSIX_COUNT=26 CONFIG_MGBEVF=m # CONFIG_MGBEVF_OPTM_WITH_LARGE is not set +CONFIG_NET_VENDOR_YUNSILICON=y +CONFIG_YUNSILICON_XSC_ETH=m +CONFIG_YUNSILICON_XSC_PCI=m +# CONFIG_JME is not set +CONFIG_NET_VENDOR_ADI=y +# CONFIG_ADIN1110 is not set +CONFIG_NET_VENDOR_LITEX=y +# CONFIG_LITEX_LITEETH is not set +# CONFIG_NET_VENDOR_MARVELL is not set CONFIG_NET_VENDOR_MELLANOX=y CONFIG_MLX4_EN=m CONFIG_MLX4_EN_DCB=y @@ -3057,9 +3072,6 @@ CONFIG_SMSC9420=m # CONFIG_NET_VENDOR_SYNOPSYS is not set # CONFIG_NET_VENDOR_TEHUTI is not set # CONFIG_NET_VENDOR_TI is not set -CONFIG_NET_VENDOR_YUNSILICON=y -CONFIG_YUNSILICON_XSC_ETH=m -CONFIG_YUNSILICON_XSC_PCI=m CONFIG_NET_VENDOR_VERTEXCOM=y # CONFIG_MSE102X is not set # CONFIG_NET_VENDOR_VIA is not set @@ -3885,8 +3897,8 @@ CONFIG_PTP_1588_CLOCK_KVM=y # CONFIG_PTP_1588_CLOCK_IDTCM is not set # CONFIG_PTP_1588_CLOCK_MOCK is not set # CONFIG_PTP_1588_CLOCK_OCP is not set -# end of PTP clock support CONFIG_PTP_HISI=m +# end of PTP clock support CONFIG_PINCTRL=y CONFIG_PINMUX=y @@ -4339,7 +4351,7 @@ CONFIG_CPU_THERMAL=y CONFIG_CPU_FREQ_THERMAL=y CONFIG_THERMAL_EMULATION=y # CONFIG_THERMAL_MMIO is not set -CONFIG_HISI_THERMAL=y +CONFIG_HISI_THERMAL=m # # Qualcomm thermal drivers @@ -4483,7 +4495,6 @@ CONFIG_MFD_CORE=m # CONFIG_MFD_SKY81452 is not set # CONFIG_MFD_STMPE is not set CONFIG_MFD_SYSCON=y -# CONFIG_MFD_TI_AM335X_TSCADC is not set # CONFIG_MFD_LP3943 is not set # CONFIG_MFD_LP8788 is not set # CONFIG_MFD_TI_LMU is not set @@ -5287,9 +5298,8 @@ CONFIG_AUXDISPLAY=y # CONFIG_CHARLCD_BL_OFF is not set # CONFIG_CHARLCD_BL_ON is not set CONFIG_CHARLCD_BL_FLASH=y -CONFIG_DRM=y -# CONFIG_DRM_DEBUG_MM is not set -CONFIG_DRM_KMS_HELPER=y +CONFIG_DRM=m +CONFIG_DRM_KMS_HELPER=m # CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set # CONFIG_DRM_DEBUG_MODESET_LOCK is not set CONFIG_DRM_FBDEV_EMULATION=y @@ -6045,8 +6055,6 @@ CONFIG_MMC_CQHCI=m CONFIG_MMC_TOSHIBA_PCI=m CONFIG_MMC_MTK=m CONFIG_MMC_SDHCI_XENON=m -# CONFIG_MMC_SDHCI_OMAP is not set -# CONFIG_MMC_SDHCI_AM654 is not set # CONFIG_SCSI_UFSHCD is not set CONFIG_MEMSTICK=m # CONFIG_MEMSTICK_DEBUG is not set @@ -6207,7 +6215,8 @@ CONFIG_RTC_LIB=y CONFIG_RTC_CLASS=y CONFIG_RTC_HCTOSYS=y CONFIG_RTC_HCTOSYS_DEVICE="rtc0" -# CONFIG_RTC_SYSTOHC is not set +CONFIG_RTC_SYSTOHC=y +CONFIG_RTC_SYSTOHC_DEVICE="rtc0" # CONFIG_RTC_DEBUG is not set CONFIG_RTC_NVMEM=y @@ -6434,7 +6443,7 @@ CONFIG_VIRTIO_PCI_LEGACY=y # CONFIG_VIRTIO_VDPA is not set # CONFIG_VIRTIO_PMEM is not set CONFIG_VIRTIO_BALLOON=m -# CONFIG_VIRTIO_MEM is not set +CONFIG_VIRTIO_MEM=m CONFIG_VIRTIO_INPUT=m CONFIG_VIRTIO_MMIO=m # CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set @@ -6475,6 +6484,7 @@ CONFIG_CHROME_PLATFORMS=y # CONFIG_CROS_HPS_I2C is not set # CONFIG_CHROMEOS_PRIVACY_SCREEN is not set # CONFIG_MELLANOX_PLATFORM is not set +CONFIG_ARM_CPU_RESCTRL=y CONFIG_SURFACE_PLATFORMS=y # CONFIG_SURFACE_3_POWER_OPREGION is not set # CONFIG_SURFACE_GPE is not set @@ -6578,6 +6588,7 @@ CONFIG_IOMMU_DEFAULT_DMA_STRICT=y CONFIG_OF_IOMMU=y CONFIG_IOMMU_DMA=y CONFIG_IOMMU_SVA=y +CONFIG_IOMMU_IOPF=y CONFIG_IOMMUFD=m CONFIG_ARM_SMMU=y # CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set @@ -6702,7 +6713,15 @@ CONFIG_EXTCON_GPIO=m # CONFIG_EXTCON_USBC_TUSB320 is not set # CONFIG_MEMORY is not set # CONFIG_IIO is not set -# CONFIG_NTB is not set +CONFIG_NTB=m +# CONFIG_NTB_MSI is not set +# CONFIG_NTB_IDT is not set +# CONFIG_NTB_EPF is not set +# CONFIG_NTB_SWITCHTEC is not set +# CONFIG_NTB_PINGPONG is not set +# CONFIG_NTB_TOOL is not set +# CONFIG_NTB_PERF is not set +# CONFIG_NTB_TRANSPORT is not set CONFIG_PWM=y CONFIG_PWM_SYSFS=y # CONFIG_PWM_DEBUG is not set @@ -6728,7 +6747,6 @@ CONFIG_ARM_GIC_PHYTIUM_2500=y # CONFIG_AL_FIC is not set CONFIG_HISILICON_IRQ_MBIGEN=y CONFIG_IRQ_MBIGEN_ENABLE_SPI=y -CONFIG_VIRT_VTIMER_IRQ_BYPASS=y # CONFIG_XILINX_INTC is not set CONFIG_PARTITION_PERCPU=y CONFIG_QCOM_IRQ_COMBINER=y @@ -6806,14 +6824,14 @@ CONFIG_ARM_CCN=y # CONFIG_ARM_CMN is not set CONFIG_ARM_PMU=y CONFIG_ARM_PMU_ACPI=y -CONFIG_ARM_SMMU_V3_PMU=y +CONFIG_ARM_SMMU_V3_PMU=m CONFIG_ARM_PMUV3=y # CONFIG_ARM_DSU_PMU is not set CONFIG_QCOM_L2_PMU=y CONFIG_QCOM_L3_PMU=y CONFIG_THUNDERX2_PMU=m CONFIG_XGENE_PMU=y -CONFIG_ARM_SPE_PMU=y +CONFIG_ARM_SPE_PMU=m # CONFIG_ARM_DMC620_PMU is not set # CONFIG_MARVELL_CN10K_TAD_PMU is not set # CONFIG_ALIBABA_UNCORE_DRW_PMU is not set @@ -6925,8 +6943,8 @@ CONFIG_EXT4_FS=m CONFIG_EXT4_USE_FOR_EXT2=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y -CONFIG_EXT4_ERROR_REPORT=y # CONFIG_EXT4_DEBUG is not set +CONFIG_EXT4_ERROR_REPORT=y CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m @@ -7044,6 +7062,7 @@ CONFIG_PROC_VMCORE=y CONFIG_PROC_SYSCTL=y CONFIG_PROC_PAGE_MONITOR=y CONFIG_PROC_CHILDREN=y +CONFIG_PROC_CPU_RESCTRL=y CONFIG_KERNFS=y CONFIG_SYSFS=y CONFIG_DIRTY_PAGES=y @@ -7101,6 +7120,8 @@ CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3 # CONFIG_HPFS_FS is not set # CONFIG_QNX4FS_FS is not set # CONFIG_QNX6FS_FS is not set +CONFIG_RESCTRL_FS=y +CONFIG_RESCTRL_RMID_DEPENDS_ON_CLOSID=y # CONFIG_ROMFS_FS is not set CONFIG_PSTORE=y CONFIG_PSTORE_DEFAULT_KMSG_BYTES=10240 @@ -7328,6 +7349,10 @@ CONFIG_IMA_APPRAISE_MODSIG=y CONFIG_IMA_LOAD_X509=y CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der" # CONFIG_IMA_APPRAISE_SIGNED_INIT is not set +CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y +CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y +# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set +# CONFIG_IMA_DISABLE_HTABLE is not set CONFIG_IMA_DIGEST_LIST=y CONFIG_IMA_DIGEST_LISTS_DIR="/etc/ima/digest_lists" CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y @@ -7335,14 +7360,11 @@ CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y # CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set CONFIG_IMA_DIGEST_DB_MEGABYTES=16 CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists" -CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y -CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y -# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set -# CONFIG_IMA_DISABLE_HTABLE is not set CONFIG_EVM=y -CONFIG_EVM_DEFAULT_HASH_SHA1=n +# CONFIG_EVM_DEFAULT_HASH_SHA1 is not set CONFIG_EVM_DEFAULT_HASH_SHA256=y -CONFIG_EVM_DEFAULT_HASH_SHA512=n +# CONFIG_EVM_DEFAULT_HASH_SHA512 is not set +CONFIG_EVM_DEFAULT_HASH="sha256" CONFIG_EVM_ATTR_FSUUID=y # CONFIG_EVM_ADD_XATTRS is not set CONFIG_EVM_LOAD_X509=y @@ -7360,8 +7382,11 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,appar # Memory initialization # CONFIG_INIT_STACK_NONE=y +# CONFIG_INIT_STACK_ALL_PATTERN is not set +# CONFIG_INIT_STACK_ALL_ZERO is not set # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set +# CONFIG_ZERO_CALL_USED_REGS is not set # end of Memory initialization # @@ -7617,7 +7642,6 @@ CONFIG_CAVIUM_CPT=m # CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set -# CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION is not set CONFIG_CRYPTO_DEV_CAVIUM_ZIP=m # CONFIG_CRYPTO_DEV_QCE is not set # CONFIG_CRYPTO_DEV_QCOM_RNG is not set @@ -7769,7 +7793,6 @@ CONFIG_BTREE=y CONFIG_INTERVAL_TREE=y CONFIG_INTERVAL_TREE_SPAN_ITER=y CONFIG_XARRAY_MULTI=y -CONFIG_ARCH_VCPU_STAT=y CONFIG_ASSOCIATIVE_ARRAY=y CONFIG_HAS_IOMEM=y CONFIG_HAS_IOPORT=y @@ -7836,6 +7859,7 @@ CONFIG_SG_POOL=y CONFIG_ARCH_HAS_PMEM_API=y CONFIG_MEMREGION=y CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE=y +CONFIG_ARCH_HAS_COPY_MC=y CONFIG_ARCH_STACKWALK=y CONFIG_STACKDEPOT=y CONFIG_SBITMAP=y @@ -7882,9 +7906,6 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y -CONFIG_PAHOLE_HAS_SPLIT_BTF=y -CONFIG_DEBUG_INFO_BTF_MODULES=y -# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y @@ -7924,6 +7945,8 @@ CONFIG_KDB_CONTINUE_CATASTROPHIC=0 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y # CONFIG_UBSAN is not set CONFIG_HAVE_ARCH_KCSAN=y +CONFIG_HAVE_KCSAN_COMPILER=y +# CONFIG_KCSAN is not set # end of Generic Kernel Debugging Instruments # @@ -7984,6 +8007,7 @@ CONFIG_LOCKUP_DETECTOR=y CONFIG_SOFTLOCKUP_DETECTOR=y # CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set CONFIG_HAVE_HARDLOCKUP_DETECTOR_BUDDY=y +CONFIG_SDEI_WATCHDOG=y CONFIG_HARDLOCKUP_DETECTOR=y # CONFIG_HARDLOCKUP_DETECTOR_PREFER_BUDDY is not set CONFIG_HARDLOCKUP_DETECTOR_PERF=y @@ -7991,7 +8015,6 @@ CONFIG_HARDLOCKUP_DETECTOR_PERF=y # CONFIG_HARDLOCKUP_DETECTOR_ARCH is not set CONFIG_HARDLOCKUP_DETECTOR_COUNTS_HRTIMER=y CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y -CONFIG_SDEI_WATCHDOG=y CONFIG_DETECT_HUNG_TASK=y CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 # CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set @@ -8045,8 +8068,6 @@ CONFIG_DEBUG_LIST=y # CONFIG_DEBUG_MAPLE_TREE is not set # end of Debug kernel data structures -# CONFIG_DEBUG_CREDENTIALS is not set - # # RCU Debugging # @@ -8170,6 +8191,7 @@ CONFIG_ULTRASOC_SMB=m CONFIG_FUNCTION_ERROR_INJECTION=y # CONFIG_FAULT_INJECTION is not set CONFIG_ARCH_HAS_KCOV=y +# CONFIG_KCOV is not set # CONFIG_RUNTIME_TESTING_MENU is not set CONFIG_ARCH_USE_MEMTEST=y # CONFIG_MEMTEST is not set @@ -8180,5 +8202,5 @@ CONFIG_ARCH_USE_MEMTEST=y # # end of Rust hacking # end of Kernel hacking -CONFIG_KABI_SIZE_ALIGN_CHECKS=y -CONFIG_KABI_RESERVE=y + +CONFIG_KWORKER_NUMA_AFFINITY=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index e68707028ddd..9b5df8585310 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2,6 +2,8 @@ # Automatically generated file; DO NOT EDIT. # Linux/x86 6.6.0 Kernel Configuration # +CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y +CONFIG_TOOLS_SUPPORT_RELR=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y @@ -170,6 +172,7 @@ CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" CONFIG_GCC10_NO_ARRAY_BOUNDS=y +CONFIG_CC_NO_ARRAY_BOUNDS=y CONFIG_ARCH_SUPPORTS_INT128=y CONFIG_NUMA_BALANCING=y CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y @@ -546,6 +549,7 @@ CONFIG_CALL_DEPTH_TRACKING=y CONFIG_CPU_IBPB_ENTRY=y CONFIG_CPU_IBRS_ENTRY=y CONFIG_CPU_SRSO=y +# CONFIG_SLS is not set # CONFIG_GDS_FORCE_MITIGATION is not set CONFIG_MITIGATION_RFDS=y CONFIG_MITIGATION_SPECTRE_BHI=y @@ -2005,7 +2009,7 @@ CONFIG_PCIEASPM_DEFAULT=y CONFIG_PCIE_PME=y CONFIG_PCIE_DPC=y # CONFIG_PCIE_PTM is not set -# CONFIG_PCIE_EDR is not set +CONFIG_PCIE_EDR=y CONFIG_PCI_MSI=y CONFIG_PCI_QUIRKS=y # CONFIG_PCI_DEBUG is not set @@ -6905,7 +6909,8 @@ CONFIG_RTC_MC146818_LIB=y CONFIG_RTC_CLASS=y CONFIG_RTC_HCTOSYS=y CONFIG_RTC_HCTOSYS_DEVICE="rtc0" -# CONFIG_RTC_SYSTOHC is not set +CONFIG_RTC_SYSTOHC=y +CONFIG_RTC_SYSTOHC_DEVICE="rtc0" # CONFIG_RTC_DEBUG is not set CONFIG_RTC_NVMEM=y @@ -7106,7 +7111,8 @@ CONFIG_VIRTIO_PCI_LEGACY=y CONFIG_VIRTIO_BALLOON=m CONFIG_VIRTIO_MEM=m CONFIG_VIRTIO_INPUT=m -# CONFIG_VIRTIO_MMIO is not set +CONFIG_VIRTIO_MMIO=m +# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set CONFIG_VIRTIO_DMA_SHARED_BUFFER=m # CONFIG_VDPA is not set CONFIG_VHOST_IOTLB=m @@ -8530,8 +8536,11 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,appar # Memory initialization # CONFIG_INIT_STACK_NONE=y +# CONFIG_INIT_STACK_ALL_PATTERN is not set +# CONFIG_INIT_STACK_ALL_ZERO is not set # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set +# CONFIG_ZERO_CALL_USED_REGS is not set # end of Memory initialization # @@ -9068,6 +9077,8 @@ CONFIG_ARCH_HAS_EARLY_DEBUG=y CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y # CONFIG_UBSAN is not set CONFIG_HAVE_ARCH_KCSAN=y +CONFIG_HAVE_KCSAN_COMPILER=y +# CONFIG_KCSAN is not set # end of Generic Kernel Debugging Instruments # -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] SUNRPC: fix a memleak in gss_import_v2_context
by Dong Chenchen 10 May '24

10 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit e67b652d8e8591d3b1e569dbcdfcee15993e91fa category: bugfix bugzilla: 189914, https://gitee.com/src-openeuler/kernel/issues/I9L9IF CVE: CVE-2023-52653 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ctx->mech_used.data allocated by kmemdup is not freed in neither gss_import_v2_context nor it only caller gss_krb5_import_sec_context, which frees ctx on error. Thus, this patch reform the last call of gss_import_v2_context to the gss_krb5_import_ctx_v2, preventing the memleak while keepping the return formation. Fixes: 47d848077629 ("gss_krb5: handle new context format from gssd") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: net/sunrpc/auth_gss/gss_krb5_mech.c [commit 279a67cdd491 was not merged] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sunrpc/auth_gss/gss_krb5_mech.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c index 893d8a480592..a296690e5947 100644 --- a/net/sunrpc/auth_gss/gss_krb5_mech.c +++ b/net/sunrpc/auth_gss/gss_krb5_mech.c @@ -588,6 +588,7 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx, { int keylen; u32 time32; + int ret; p = simple_get_bytes(p, end, &ctx->flags, sizeof(ctx->flags)); if (IS_ERR(p)) @@ -644,16 +645,28 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx, switch (ctx->enctype) { case ENCTYPE_DES3_CBC_RAW: - return context_derive_keys_des3(ctx, gfp_mask); + ret = context_derive_keys_des3(ctx, gfp_mask); + break; case ENCTYPE_ARCFOUR_HMAC: - return context_derive_keys_rc4(ctx); + ret = context_derive_keys_rc4(ctx); + break; case ENCTYPE_AES128_CTS_HMAC_SHA1_96: case ENCTYPE_AES256_CTS_HMAC_SHA1_96: - return context_derive_keys_new(ctx, gfp_mask); + ret = context_derive_keys_new(ctx, gfp_mask); + break; default: - return -EINVAL; + ret -EINVAL; } + if (ret) { + p = ERR_PTR(ret); + goto out_free; + } + + return 0; + +out_free: + kfree(ctx->mech_used.data); out_err: return PTR_ERR(p); } -- 2.25.1

2 1

[PATCH OLK-6.6] tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled
by Yu Liao 10 May '24

10 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8PL17 CVE: NA ---------------------------------------- It was found that running the LTP hotplug stress test on a aarch64 system could produce rcu_sched stall warnings. The issue is the following: CPU1 (owns the broadcast hrtimer) CPU2 tick_broadcast_enter() //shut down local timer device ... tick_broadcast_exit() //exits with tick_broadcast_force_mask set, timer device remains disabled initiates offlining of CPU1 take_cpu_down() //CPU1 shuts down and does not send broadcast IPI anymore takedown_cpu() hotplug_cpu__broadcast_tick_pull() //move broadcast hrtimer to this CPU clockevents_program_event() bc_set_next() hrtimer_start() //does not call hrtimer_reprogram() to program timer device if expires equals dev->next_event, so the timer device remains disabled. CPU2 takes over the broadcast duty but local timer device is disabled, causing many CPUs to become stuck. Fix this by calling tick_program_event() to reprogram the local timer device in this scenario. Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- kernel/time/tick-broadcast-hrtimer.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c index e28f9210f8a1..0dc78744fce6 100644 --- a/kernel/time/tick-broadcast-hrtimer.c +++ b/kernel/time/tick-broadcast-hrtimer.c @@ -42,6 +42,19 @@ static int bc_shutdown(struct clock_event_device *evt) */ static int bc_set_next(ktime_t expires, struct clock_event_device *bc) { + struct clock_event_device *dev = __this_cpu_read(tick_cpu_device.evtdev); + + /* + * This can be called from CPU offline operation to move broadcast + * assignment. If tick_broadcast_force_mask is set, the CPU local + * timer device may be disabled. And hrtimer_reprogram() will not + * called if the timer is not the first expiring timer. Reprogram + * the cpu local timer device to ensure we can take over the + * broadcast duty. + */ + if (tick_check_broadcast_expired() && expires >= dev->next_event) + clockevents_program_event(dev, dev->next_event, 1); + /* * This is called either from enter/exit idle code or from the * broadcast handler. In all cases tick_broadcast_lock is held. -- 2.25.1

2 1

[PATCH OLK-5.10 v2] clk: zynq: Prevent null pointer dereference caused by kmalloc failure
by Yu Liao 10 May '24

10 May '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit 7938e9ce39d6779d2f85d822cc930f73420e54a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9NB CVE: CVE-2024-27037 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kmalloc() in zynq_clk_setup() will return null if the physical memory has run out. As a result, if we use snprintf() to write data to the null address, the null pointer dereference bug will happen. This patch uses a stack variable to replace the kmalloc(). Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver") Suggested-by: Michal Simek <michal.simek(a)amd.com> Suggested-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Link: https://lore.kernel.org/r/20240301084437.16084-1-duoming@zju.edu.cn Acked-by: Michal Simek <michal.simek(a)amd.com> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Conflicts: drivers/clk/zynq/clkc.c [The conflicts were caused by not merged bf2244ba9d85("clk: zynq: clkc: Remove various instances of an unused variable 'clk'")] Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/clk/zynq/clkc.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c index ffbb9008c1c9..15320945bedc 100644 --- a/drivers/clk/zynq/clkc.c +++ b/drivers/clk/zynq/clkc.c @@ -42,6 +42,7 @@ static void __iomem *zynq_clkc_base; #define SLCR_SWDT_CLK_SEL (zynq_clkc_base + 0x204) #define NUM_MIO_PINS 54 +#define CLK_NAME_LEN 16 #define DBG_CLK_CTRL_CLKACT_TRC BIT(0) #define DBG_CLK_CTRL_CPU_1XCLKACT BIT(1) @@ -218,7 +219,7 @@ static void __init zynq_clk_setup(struct device_node *np) u32 tmp; int ret; struct clk *clk; - char *clk_name; + char clk_name[CLK_NAME_LEN]; unsigned int fclk_enable = 0; const char *clk_output_name[clk_max]; const char *cpu_parents[4]; @@ -428,12 +429,10 @@ static void __init zynq_clk_setup(struct device_node *np) "gem1_emio_mux", CLK_SET_RATE_PARENT, SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock); - tmp = strlen("mio_clk_00x"); - clk_name = kmalloc(tmp, GFP_KERNEL); for (i = 0; i < NUM_MIO_PINS; i++) { int idx; - snprintf(clk_name, tmp, "mio_clk_%2.2d", i); + snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i); idx = of_property_match_string(np, "clock-names", clk_name); if (idx >= 0) can_mio_mux_parents[i] = of_clk_get_parent_name(np, @@ -441,7 +440,6 @@ static void __init zynq_clk_setup(struct device_node *np) else can_mio_mux_parents[i] = dummy_nm; } - kfree(clk_name); clk = clk_register_mux(NULL, "can_mux", periph_parents, 4, CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0, &canclk_lock); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2] clk: zynq: Prevent null pointer dereference caused by kmalloc failure
by Yu Liao 10 May '24

10 May '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit 7938e9ce39d6779d2f85d822cc930f73420e54a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9NB CVE: CVE-2024-27037 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kmalloc() in zynq_clk_setup() will return null if the physical memory has run out. As a result, if we use snprintf() to write data to the null address, the null pointer dereference bug will happen. This patch uses a stack variable to replace the kmalloc(). Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver") Suggested-by: Michal Simek <michal.simek(a)amd.com> Suggested-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Link: https://lore.kernel.org/r/20240301084437.16084-1-duoming@zju.edu.cn Acked-by: Michal Simek <michal.simek(a)amd.com> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Conflicts: drivers/clk/zynq/clkc.c [The conflicts were caused by not merged bf2244ba9d85("clk: zynq: clkc: Remove various instances of an unused variable 'clk'")] Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/clk/zynq/clkc.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c index 88a2cab37f62..35c855708741 100644 --- a/drivers/clk/zynq/clkc.c +++ b/drivers/clk/zynq/clkc.c @@ -53,6 +53,7 @@ static void __iomem *zynq_clkc_base; #define SLCR_SWDT_CLK_SEL (zynq_clkc_base + 0x204) #define NUM_MIO_PINS 54 +#define CLK_NAME_LEN 16 #define DBG_CLK_CTRL_CLKACT_TRC BIT(0) #define DBG_CLK_CTRL_CPU_1XCLKACT BIT(1) @@ -229,7 +230,7 @@ static void __init zynq_clk_setup(struct device_node *np) u32 tmp; int ret; struct clk *clk; - char *clk_name; + char clk_name[CLK_NAME_LEN]; unsigned int fclk_enable = 0; const char *clk_output_name[clk_max]; const char *cpu_parents[4]; @@ -439,12 +440,10 @@ static void __init zynq_clk_setup(struct device_node *np) "gem1_emio_mux", CLK_SET_RATE_PARENT, SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock); - tmp = strlen("mio_clk_00x"); - clk_name = kmalloc(tmp, GFP_KERNEL); for (i = 0; i < NUM_MIO_PINS; i++) { int idx; - snprintf(clk_name, tmp, "mio_clk_%2.2d", i); + snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i); idx = of_property_match_string(np, "clock-names", clk_name); if (idx >= 0) can_mio_mux_parents[i] = of_clk_get_parent_name(np, @@ -452,7 +451,6 @@ static void __init zynq_clk_setup(struct device_node *np) else can_mio_mux_parents[i] = dummy_nm; } - kfree(clk_name); clk = clk_register_mux(NULL, "can_mux", periph_parents, 4, CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0, &canclk_lock); -- 2.25.1

2 1

[PATCH OLK-6.6] mm: multi-gen LRU: reuse some legacy trace events
by Zhao Mengmeng 10 May '24

10 May '24

From: Jaewon Kim <jaewon31.kim(a)samsung.com> mainline inclusion from mainline-v6.7-rc1 commit 8c2214fc9a470aee0c615aeb14d8c7ce98e45a08 catogory: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9O1OT Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As the legacy lru provides, the mglru needs some trace events for debugging. Let's reuse following legacy events for the mglru. trace_mm_vmscan_lru_isolate trace_mm_vmscan_lru_shrink_inactive Here's an example mm_vmscan_lru_isolate: classzone=2 order=0 nr_requested=4096 nr_scanned=64 nr_skipped=0 nr_taken=64 lru=inactive_file mm_vmscan_lru_shrink_inactive: nid=0 nr_scanned=64 nr_reclaimed=63 nr_dirty=0 nr_writeback=0 nr_congested=0 nr_immediate=0 nr_activate_anon=0 nr_activate_file=1 nr_ref_keep=0 nr_unmap_fail=0 priority=2 flags=RECLAIM_WB_FILE|RECLAIM_WB_ASYNC Link: https://lkml.kernel.org/r/20231003114155.21869-1-jaewon31.kim@samsung.com Signed-off-by: Jaewon Kim <jaewon31.kim(a)samsung.com> Acked-by: Yu Zhao <yuzhao(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Kalesh Singh <kaleshsingh(a)google.com> Cc: SeongJae Park <sj(a)kernel.org> Cc: Steven Rostedt (Google) <rostedt(a)goodmis.org> Cc: T.J. Mercier <tjmercier(a)google.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- mm/vmscan.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index 95a845905624..95a3e1e7dbb1 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -5030,6 +5030,7 @@ static int scan_folios(struct lruvec *lruvec, struct scan_control *sc, int sorted = 0; int scanned = 0; int isolated = 0; + int skipped = 0; int remaining = MAX_LRU_BATCH; struct lru_gen_folio *lrugen = &lruvec->lrugen; struct mem_cgroup *memcg = lruvec_memcg(lruvec); @@ -5043,7 +5044,7 @@ static int scan_folios(struct lruvec *lruvec, struct scan_control *sc, for (i = MAX_NR_ZONES; i > 0; i--) { LIST_HEAD(moved); - int skipped = 0; + int skipped_zone = 0; int zone = (sc->reclaim_idx + i) % MAX_NR_ZONES; struct list_head *head = &lrugen->folios[gen][type][zone]; @@ -5065,16 +5066,17 @@ static int scan_folios(struct lruvec *lruvec, struct scan_control *sc, isolated += delta; } else { list_move(&folio->lru, &moved); - skipped += delta; + skipped_zone += delta; } - if (!--remaining || max(isolated, skipped) >= MIN_LRU_BATCH) + if (!--remaining || max(isolated, skipped_zone) >= MIN_LRU_BATCH) break; } - if (skipped) { + if (skipped_zone) { list_splice(&moved, head); - __count_zid_vm_events(PGSCAN_SKIP, zone, skipped); + __count_zid_vm_events(PGSCAN_SKIP, zone, skipped_zone); + skipped += skipped_zone; } if (!remaining || isolated >= MIN_LRU_BATCH) @@ -5089,6 +5091,9 @@ static int scan_folios(struct lruvec *lruvec, struct scan_control *sc, __count_memcg_events(memcg, item, isolated); __count_memcg_events(memcg, PGREFILL, sorted); __count_vm_events(PGSCAN_ANON + type, isolated); + trace_mm_vmscan_lru_isolate(sc->reclaim_idx, sc->order, MAX_LRU_BATCH, + scanned, skipped, isolated, + type ? LRU_INACTIVE_FILE : LRU_INACTIVE_ANON); /* * There might not be eligible folios due to reclaim_idx. Check the @@ -5219,6 +5224,9 @@ static int evict_folios(struct lruvec *lruvec, struct scan_control *sc, int swap retry: reclaimed = shrink_folio_list(&list, pgdat, sc, &stat, false); sc->nr_reclaimed += reclaimed; + trace_mm_vmscan_lru_shrink_inactive(pgdat->node_id, + scanned, reclaimed, &stat, sc->priority, + type ? LRU_INACTIVE_FILE : LRU_INACTIVE_ANON); list_for_each_entry_safe_reverse(folio, next, &list, lru) { if (!folio_evictable(folio)) { -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS] drm/radeon: add a force flush to delay work when radeon
by Zhang Zekun 10 May '24

10 May '24

From: Zhenneng Li <lizhenneng(a)kylinos.cn> stable inclusion from stable-v4.19.258 commit c0a45f41fde4a0f2c900f719817493ee5c4a5aa3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9LKDS CVE: CVE-2022-48704 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f461950fdc374a3ada5a63c669d997de4600dffe ] Although radeon card fence and wait for gpu to finish processing current batch rings, there is still a corner case that radeon lockup work queue may not be fully flushed, and meanwhile the radeon_suspend_kms() function has called pci_set_power_state() to put device in D3hot state. Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. > Configuration and Message requests are the only TLPs accepted by a Function in > the D3hot state. All other received Requests must be handled as Unsupported Requests, > and all received Completions may optionally be handled as Unexpected Completions. This issue will happen in following logs: Unable to handle kernel paging request at virtual address 00008800e0008010 CPU 0 kworker/0:3(131): Oops 0 pc = [<ffffffff811bea5c>] ra = [<ffffffff81240844>] ps = 0000 Tainted: G W pc is at si_gpu_check_soft_reset+0x3c/0x240 ra is at si_dma_is_lockup+0x34/0xd0 v0 = 0000000000000000 t0 = fff08800e0008010 t1 = 0000000000010000 t2 = 0000000000008010 t3 = fff00007e3c00000 t4 = fff00007e3c00258 t5 = 000000000000ffff t6 = 0000000000000001 t7 = fff00007ef078000 s0 = fff00007e3c016e8 s1 = fff00007e3c00000 s2 = fff00007e3c00018 s3 = fff00007e3c00000 s4 = fff00007fff59d80 s5 = 0000000000000000 s6 = fff00007ef07bd98 a0 = fff00007e3c00000 a1 = fff00007e3c016e8 a2 = 0000000000000008 a3 = 0000000000000001 a4 = 8f5c28f5c28f5c29 a5 = ffffffff810f4338 t8 = 0000000000000275 t9 = ffffffff809b66f8 t10 = ff6769c5d964b800 t11= 000000000000b886 pv = ffffffff811bea20 at = 0000000000000000 gp = ffffffff81d89690 sp = 00000000aa814126 Disabling lock debugging due to kernel taint Trace: [<ffffffff81240844>] si_dma_is_lockup+0x34/0xd0 [<ffffffff81119610>] radeon_fence_check_lockup+0xd0/0x290 [<ffffffff80977010>] process_one_work+0x280/0x550 [<ffffffff80977350>] worker_thread+0x70/0x7c0 [<ffffffff80977410>] worker_thread+0x130/0x7c0 [<ffffffff80982040>] kthread+0x200/0x210 [<ffffffff809772e0>] worker_thread+0x0/0x7c0 [<ffffffff80981f8c>] kthread+0x14c/0x210 [<ffffffff80911658>] ret_from_kernel_thread+0x18/0x20 [<ffffffff80981e40>] kthread+0x0/0x210 Code: ad3e0008 43f0074a ad7e0018 ad9e0020 8c3001e8 40230101 <88210000> 4821ed21 So force lockup work queue flush to fix this problem. Acked-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Zhenneng Li <lizhenneng(a)kylinos.cn> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/gpu/drm/radeon/radeon_device.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c index 59c8a6647ff2..cc1c07963116 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -1625,6 +1625,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, if (r) { /* delay GPU reset to resume */ radeon_fence_driver_force_completion(rdev, i); + } else { + /* finish executing delayed work */ + flush_delayed_work(&rdev->fence_drv[i].lockup_work); } } -- 2.17.1

2 1

[PATCH v2 openEuler-1.0-LTS 0/3] backport patch for thp deferred list for 4.19
by Wupeng Ma 10 May '24

10 May '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport patch for thp deferred list for 4.19. changelog since v1: - remove data_race since 4.19 does not have it Jianxing Wang (1): mm/mmu_gather: limit free batch count and add schedule point in tlb_batch_pages_flush Kirill A. Shutemov (1): mm, thp: do not queue fully unmapped pages for deferred split Yin Fengwei (1): THP: avoid lock when check whether THP is in deferred list mm/huge_memory.c | 15 +++++++++++---- mm/mmu_gather.c | 16 ++++++++++++++-- mm/rmap.c | 14 ++++++++++---- 3 files changed, 35 insertions(+), 10 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-1.0-LTS] clk: zynq: Prevent null pointer dereference caused by kmalloc failure
by Yu Liao 10 May '24

10 May '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.9.rc1 commit 7938e9ce39d6779d2f85d822cc930f73420e54a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9NB CVE: CVE-2024-27037 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kmalloc() in zynq_clk_setup() will return null if the physical memory has run out. As a result, if we use snprintf() to write data to the null address, the null pointer dereference bug will happen. This patch uses a stack variable to replace the kmalloc(). Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver") Suggested-by: Michal Simek <michal.simek(a)amd.com> Suggested-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Link: https://lore.kernel.org/r/20240301084437.16084-1-duoming@zju.edu.cn Acked-by: Michal Simek <michal.simek(a)amd.com> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Conflicts: drivers/clk/zynq/clkc.c [The conflicts were caused by not merged bf2244ba9d85("clk: zynq: clkc: Remove various instances of an unused variable 'clk'")] Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/clk/zynq/clkc.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c index 88a2cab37f62..35c855708741 100644 --- a/drivers/clk/zynq/clkc.c +++ b/drivers/clk/zynq/clkc.c @@ -53,6 +53,7 @@ static void __iomem *zynq_clkc_base; #define SLCR_SWDT_CLK_SEL (zynq_clkc_base + 0x204) #define NUM_MIO_PINS 54 +#define CLK_NAME_LEN 16 #define DBG_CLK_CTRL_CLKACT_TRC BIT(0) #define DBG_CLK_CTRL_CPU_1XCLKACT BIT(1) @@ -229,7 +230,7 @@ static void __init zynq_clk_setup(struct device_node *np) u32 tmp; int ret; struct clk *clk; - char *clk_name; + char clk_name[CLK_NAME_LEN]; unsigned int fclk_enable = 0; const char *clk_output_name[clk_max]; const char *cpu_parents[4]; @@ -439,12 +440,10 @@ static void __init zynq_clk_setup(struct device_node *np) "gem1_emio_mux", CLK_SET_RATE_PARENT, SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock); - tmp = strlen("mio_clk_00x"); - clk_name = kmalloc(tmp, GFP_KERNEL); for (i = 0; i < NUM_MIO_PINS; i++) { int idx; - snprintf(clk_name, tmp, "mio_clk_%2.2d", i); + snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i); idx = of_property_match_string(np, "clock-names", clk_name); if (idx >= 0) can_mio_mux_parents[i] = of_clk_get_parent_name(np, @@ -452,7 +451,6 @@ static void __init zynq_clk_setup(struct device_node *np) else can_mio_mux_parents[i] = dummy_nm; } - kfree(clk_name); clk = clk_register_mux(NULL, "can_mux", periph_parents, 4, CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0, &canclk_lock); -- 2.25.1

2 1

[PATCH OLK-5.10] clk: zynq: Prevent null pointer dereference caused by kmalloc failure
by Yu Liao 10 May '24

10 May '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.9.rc1 commit 7938e9ce39d6779d2f85d822cc930f73420e54a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9NB CVE: CVE-2024-27037 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kmalloc() in zynq_clk_setup() will return null if the physical memory has run out. As a result, if we use snprintf() to write data to the null address, the null pointer dereference bug will happen. This patch uses a stack variable to replace the kmalloc(). Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver") Suggested-by: Michal Simek <michal.simek(a)amd.com> Suggested-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Link: https://lore.kernel.org/r/20240301084437.16084-1-duoming@zju.edu.cn Acked-by: Michal Simek <michal.simek(a)amd.com> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Conflicts: drivers/clk/zynq/clkc.c [The conflicts were caused by not merged bf2244ba9d85("clk: zynq: clkc: Remove various instances of an unused variable 'clk'")] Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/clk/zynq/clkc.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c index ffbb9008c1c9..15320945bedc 100644 --- a/drivers/clk/zynq/clkc.c +++ b/drivers/clk/zynq/clkc.c @@ -42,6 +42,7 @@ static void __iomem *zynq_clkc_base; #define SLCR_SWDT_CLK_SEL (zynq_clkc_base + 0x204) #define NUM_MIO_PINS 54 +#define CLK_NAME_LEN 16 #define DBG_CLK_CTRL_CLKACT_TRC BIT(0) #define DBG_CLK_CTRL_CPU_1XCLKACT BIT(1) @@ -218,7 +219,7 @@ static void __init zynq_clk_setup(struct device_node *np) u32 tmp; int ret; struct clk *clk; - char *clk_name; + char clk_name[CLK_NAME_LEN]; unsigned int fclk_enable = 0; const char *clk_output_name[clk_max]; const char *cpu_parents[4]; @@ -428,12 +429,10 @@ static void __init zynq_clk_setup(struct device_node *np) "gem1_emio_mux", CLK_SET_RATE_PARENT, SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock); - tmp = strlen("mio_clk_00x"); - clk_name = kmalloc(tmp, GFP_KERNEL); for (i = 0; i < NUM_MIO_PINS; i++) { int idx; - snprintf(clk_name, tmp, "mio_clk_%2.2d", i); + snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i); idx = of_property_match_string(np, "clock-names", clk_name); if (idx >= 0) can_mio_mux_parents[i] = of_clk_get_parent_name(np, @@ -441,7 +440,6 @@ static void __init zynq_clk_setup(struct device_node *np) else can_mio_mux_parents[i] = dummy_nm; } - kfree(clk_name); clk = clk_register_mux(NULL, "can_mux", periph_parents, 4, CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0, &canclk_lock); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-26960
by Jinjiang Tu 10 May '24

10 May '24

fix CVE-2024-26960 Huang Ying (1): mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() Ryan Roberts (1): mm: swap: fix race between free_swap_and_cache() and swapoff() mm/swapfile.c | 70 +++++++++++++++++++++++++++------------------------ 1 file changed, 37 insertions(+), 33 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
by Wei Li 10 May '24

10 May '24

From: Norihiko Hama <Norihiko.Hama(a)alpsalpine.com> mainline inclusion from mainline-v6.9-rc5 commit 6334b8e4553cc69f51e383c9de545082213d785e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AJ86 CVE: CVE-2024-26996 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- When ncm function is working and then stop usb0 interface for link down, eth_stop() is called. At this piont, accidentally if usb transport error should happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled. After that, ncm_disable() is called to disable for ncm unbind but gether_disconnect() is never called since 'in_ep' is not enabled. As the result, ncm object is released in ncm unbind but 'dev->port_usb' associated to 'ncm->port' is not NULL. And when ncm bind again to recover netdev, ncm object is reallocated but usb0 interface is already associated to previous released ncm object. Therefore, once usb0 interface is up and eth_start_xmit() is called, released ncm object is dereferrenced and it might cause use-after-free memory. [function unlink via configfs] usb0: eth_stop dev->port_usb=ffffff9b179c3200 --> error happens in usb_ep_enable(). NCM: ncm_disable: ncm=ffffff9b179c3200 --> no gether_disconnect() since ncm->port.in_ep->enabled is false. NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200 NCM: ncm_free: ncm free ncm=ffffff9b179c3200 <-- released ncm [function link via configfs] NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000 NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000 NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0 usb0: eth_open dev->port_usb=ffffff9b179c3200 <-- previous released ncm usb0: eth_start dev->port_usb=ffffff9b179c3200 <-- eth_start_xmit() --> dev->wrap() Unable to handle kernel paging request at virtual address dead00000000014f This patch addresses the issue by checking if 'ncm->netdev' is not NULL at ncm_disable() to call gether_disconnect() to deassociate 'dev->port_usb'. It's more reasonable to check 'ncm->netdev' to call gether_connect/disconnect rather than check 'ncm->port.in_ep->enabled' since it might not be enabled but the gether connection might be established. Signed-off-by: Norihiko Hama <Norihiko.Hama(a)alpsalpine.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240327023550.51214-1-Norihiko.Hama@alpsalpine.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/gadget/function/f_ncm.c [lw: fix context conflict only] Signed-off-by: Wei Li <liwei391(a)huawei.com> --- drivers/usb/gadget/function/f_ncm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index 5780fba620ab..3da7e6511fc6 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -885,7 +885,7 @@ static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) if (alt > 1) goto fail; - if (ncm->port.in_ep->enabled) { + if (ncm->netdev) { DBG(cdev, "reset ncm\n"); ncm->timer_stopping = true; ncm->netdev = NULL; @@ -1322,7 +1322,7 @@ static void ncm_disable(struct usb_function *f) DBG(cdev, "ncm deactivated\n"); - if (ncm->port.in_ep->enabled) { + if (ncm->netdev) { ncm->timer_stopping = true; ncm->netdev = NULL; gether_disconnect(&ncm->port); -- 2.25.1

2 1